{match[5]});
} else if (match[6]) {
parts.push({match[7]});
} else if (match[8]) {
parts.push({match[9]});
}
lastIndex = match.index + match[0].length;
}
if (lastIndex < text.length) parts.push(text.slice(lastIndex));
if (parts.length === 0) return text;
const keyRef = {
current: keyIndex
};
return expandHtmlTags(parts, keyRef);
};
const processBadges = text => {
if (!text || typeof text !== 'string') return text;
if (YES_RE.test(text)) return ✓;
if (NO_RE.test(text)) return ✗;
if (LIMITED_RE.test(text)) return ◐;
if (NA_RE.test(text) || NA2_RE.test(text)) return Not applicable;
return processText(text);
};
const cellClassName = text => {
if (!text || typeof text !== 'string') return undefined;
if (NA_RE.test(text)) return 'yt-cell-na';
if (NA2_RE.test(text)) return 'yt-cell-na2';
return undefined;
};
const expandSimpleTags = (str, keyRef) => {
const result = [];
let last = 0;
SIMPLE_TAG_RE.lastIndex = 0;
let m;
while ((m = SIMPLE_TAG_RE.exec(str)) !== null) {
if (m.index > last) result.push(str.slice(last, m.index));
if (m[1]) {
result.push(); } else if (m[2]) { result.push(
,
); } else if (m[3]) { result.push(Note: ); } else if (m[4]) { result.push(Warning: ); } last = m.index + m[0].length; } if (last < str.length) result.push(str.slice(last)); return result; }; const expandHtmlTags = (chunks, keyRef) => { const out = []; for (const chunk of chunks) { if (typeof chunk === 'string') { out.push(...expandSimpleTags(chunk, keyRef)); } else { out.push(chunk); } } return out; }; const extractText = node => { if (node === null || node === undefined) return ''; if (typeof node === 'string') return node; if (typeof node === 'number') return String(node); if (typeof node === 'boolean') return ''; if (Array.isArray(node)) return node.map(extractText).join(''); if (node && typeof node === 'object' && node.type) { const props = node.props || ({}); if (typeof props.children === 'string') return props.children; if (props.children) return extractText(props.children); return ''; } return String(node || ''); }; const [mounted, setMounted] = useState(false); useEffect(() => { setMounted(true); }, []); const data = useMemo(() => { if (propData) return propData; if (content && typeof content === 'string') return parseYamlTableContent(content); if (!children) return []; if (typeof children === 'string') return parseYamlTableContent(children); const childrenArray = Array.isArray(children) ? children : [children]; return parseYamlTableContent(childrenArray.map(extractText).join('').trim()); }, [children, propData, content]); const columns = useMemo(() => { if (!data || data.length === 0) return []; const firstRow = data[0]; if (!firstRow || typeof firstRow !== 'object') return []; return Object.keys(firstRow); }, [data]); if (!mounted) return null; if (!data || data.length === 0) return null; const rowKey = row => columns.map(c => row[c] || '').join('|'); return
| {col.replaceAll('_', ' ')} | )}
|---|
| {processBadges(row[col])} | )}
3. Copy the commit SHA from the URL.
The commit SHA is the 40-character alphanumeric string in the URL after `/commit/`.
## Example GitHub Action Workflow
Endor Labs scanning workflow using GitHub Actions that accomplishes the following tasks in your CI environment:
* Tests PRs to the default branch and monitors the most recent push to the default branch.
* Builds a Java project and sets up the Java build tools. If your project is not on Java, then configure this workflow with your project-specific steps and build tools.
* Authenticates to Endor Labs with GitHub Actions keyless authentication.
* Scan with Endor Labs.
* Comments on PRs if any policy violations occur.
* Generates findings and uploads results to GitHub in SARIF format.
The following example workflow shows how to scan with Endor Labs for a Java application using the recommended keyless authentication for GitHub Actions.
```yaml expandable theme={null}
name: Endor Labs Dependency and Secrets Scan
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
jobs:
scan:
permissions:
security-events: write # Used to upload Sarif artifact to GitHub
contents: read # Used to check out a private repository
actions: read # Required for private repositories to upload Sarif files. GitHub Advanced Security licenses are required.
id-token: write # Used for keyless authentication with Endor Labs
pull-requests: write # Required to automatically comment on PRs for new policy violations
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@v3
- name: Setup Java
uses: actions/setup-java@v3
with:
distribution: 'microsoft'
java-version: '17'
- name: Build Package
run: mvn clean install
- name: Endor Labs Scan Pull Request
if: github.event_name == 'pull_request'
uses: endorlabs/github-action@v1 # Replace v1 with the commit SHA of the latest version of the GitHub Action for enhanced security
with:
namespace: 'example' # Replace with your Endor Labs tenant namespace
scan_dependencies: true
scan_secrets: true
pr: true
enable_pr_comments: true # Required to automatically comment on PRs for new policy violations
github_token: ${{ secrets.GITHUB_TOKEN }} # Required for PR comments on new policy violations
scan-main:
permissions:
id-token: write
repository-projects: read
pull-requests: read
contents: read
name: endorctl-scan
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@v3
- name: Setup Java
uses: actions/setup-java@v3
with:
distribution: 'microsoft'
java-version: '17'
- name: Build Package
run: mvn clean install
- name: 'Endor Labs Scan Push to main'
if: ${{ github.event_name == 'push' }}
uses: endorlabs/github-action@v1 # Replace v1 with the commit SHA of the latest version of the GitHub Action for enhanced security
with:
namespace: 'example' # Replace with your Endor Labs tenant namespace
scan_dependencies: true
scan_secrets: true
pr: false
scan_summary_output_type: 'table'
sarif_file: 'findings.sarif'
- name: Upload findings to github
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'findings.sarif'
```
## Set up branch tracking in GitHub Actions
In Git, a detached HEAD state occurs when the repository checks out a specific commit instead of a branch reference. In this state, Git points the HEAD directly to a commit hash, without associating it with a named branch. As a result, actions performed, such as creating new commits or running automated scans, do not carry branch identity unless explicitly specified.
Proper branch context enables Endor Labs to:
* Associate scans with the correct branch
* Identify scans on the monitored default branch
* Track findings and display metrics accurately across branches
Without proper branch configuration, Endor Labs may create multiple branch entries for the same logical branch, leading to fragmented reporting and inaccurate metrics.
GitHub Actions typically maintains proper branch context automatically. However, to ensure scans are properly tracked, when using the Endor Labs GitHub Action, set `pr: false` to create monitored versions that appear on dashboards. Use `if: github.event_name == 'push'` to trigger only on pushes to the default branch:
```yaml theme={null}
- name: Endor Labs Scan Push to main
if: github.event_name == 'push'
uses: endorlabs/github-action@v1 # Replace v1 with the commit SHA of the latest version of the GitHub Action for enhanced security
with:
namespace: 'example'
scan_dependencies: true
pr: false
```
## Scan containers with OS reachability
You can use the Endor Labs GitHub Action to scan container images with [OS reachability](/scan/containers/container-reachability) enabled. Container reachability identifies which packages inside a container image are actually used at runtime, helping you prioritize the most critical vulnerabilities for remediation. Set `scan_container: true` and `os_reachability: true` to enable container scanning with reachability analysis:
```yaml theme={null}
- name: Scan container with OS reachability
uses: endorlabs/github-action@v1 # Replace v1 with the commit SHA of the latest version of the GitHub Action for enhanced security
with:
namespace: 'example'
enable_github_action_token: 'true'
scan_container: true
scan_dependencies: false
image: "nginx:latest"
os_reachability: true
pr: false
project_name: 'my-project'
```
## Authenticate with Endor Labs
Endor Labs recommends using keyless authentication in CI environments. Keyless authentication is more secure and reduces the cost of secret rotation. To set up keyless authentication see [Keyless Authentication](/setup-deployment/ci-cd/keyless-authentication).
If you choose not to use keyless authentication, you can configure an API key and secret in GitHub for authentication as outlined in [Managing API keys](/platform-administration/api-keys).
### Authentication Without Keyless Authentication for GitHub
If you are not using keyless authentication for GitHub Actions, you must not provide `id-token: write` permissions to your GitHub token unless specifically required by a step in this job. You must also set `enable_github_action_token: false` in your Endor Labs GitHub Action configuration.
The following example configuration uses the Endor Labs API key for authentication:
```yaml theme={null}
- name: Scan with Endor Labs
uses: endorlabs/github-action@v1 # Replace v1 with the commit SHA of the latest version of the GitHub Action for enhanced security
with:
namespace: 'example'
api_key: ${{ secrets.ENDOR_API_CREDENTIALS_KEY }}
api_secret: ${{ secrets.ENDOR_API_CREDENTIALS_SECRET }}
enable_github_action_token: false
```
The following example configuration uses a GCP service account for keyless authentication to Endor Labs:
```yaml theme={null}
- name: Scan with Endor Labs
uses: endorlabs/github-action@v1 # Replace v1 with the commit SHA of the latest version of the GitHub Action for enhanced security
with:
namespace: 'example'
gcp_service_account: '