{match[5]});
} else if (match[6]) {
parts.push({match[7]});
} else if (match[8]) {
parts.push({match[9]});
}
lastIndex = match.index + match[0].length;
}
if (lastIndex < text.length) parts.push(text.slice(lastIndex));
if (parts.length === 0) return text;
const keyRef = {
current: keyIndex
};
return expandHtmlTags(parts, keyRef);
};
const processBadges = text => {
if (!text || typeof text !== 'string') return text;
if (YES_RE.test(text)) return ✓;
if (NO_RE.test(text)) return ✗;
if (LIMITED_RE.test(text)) return ◐;
if (NA_RE.test(text) || NA2_RE.test(text)) return Not applicable;
const statusBadge = STATUS_ICON_DEFS.find(def => def.re.test(text));
if (statusBadge) return renderStatusBadge(statusBadge);
return processText(text);
};
const cellClassName = text => {
if (!text || typeof text !== 'string') return undefined;
if (NA_RE.test(text)) return 'yt-cell-na';
if (NA2_RE.test(text)) return 'yt-cell-na2';
return undefined;
};
const expandSimpleTags = (str, keyRef) => {
const result = [];
let last = 0;
SIMPLE_TAG_RE.lastIndex = 0;
let m;
while ((m = SIMPLE_TAG_RE.exec(str)) !== null) {
if (m.index > last) result.push(str.slice(last, m.index));
if (m[1]) {
result.push(); } else if (m[2]) { result.push(
,
); } else if (m[3]) { result.push(Note: ); } else if (m[4]) { result.push(Warning: ); } last = m.index + m[0].length; } if (last < str.length) result.push(str.slice(last)); return result; }; const expandHtmlTags = (chunks, keyRef) => { const out = []; for (const chunk of chunks) { if (typeof chunk === 'string') { out.push(...expandSimpleTags(chunk, keyRef)); } else { out.push(chunk); } } return out; }; const extractText = node => { if (node === null || node === undefined) return ''; if (typeof node === 'string') return node; if (typeof node === 'number') return String(node); if (typeof node === 'boolean') return ''; if (Array.isArray(node)) return node.map(extractText).join(''); if (node && typeof node === 'object' && node.type) { const props = node.props || ({}); if (typeof props.children === 'string') return props.children; if (props.children) return extractText(props.children); return ''; } return String(node || ''); }; const [mounted, setMounted] = useState(false); const scrollWrapRef = useRef(null); const [isScrollable, setIsScrollable] = useState(false); useEffect(() => { setMounted(true); }, []); const data = useMemo(() => { if (propData) return propData; if (content && typeof content === 'string') return parseYamlTableContent(content); if (!children) return []; if (typeof children === 'string') return parseYamlTableContent(children); const childrenArray = Array.isArray(children) ? children : [children]; return parseYamlTableContent(childrenArray.map(extractText).join('').trim()); }, [children, propData, content]); const columns = useMemo(() => { if (!data || data.length === 0) return []; const firstRow = data[0]; if (!firstRow || typeof firstRow !== 'object') return []; return Object.keys(firstRow); }, [data]); useEffect(() => { const wrap = scrollWrapRef.current; if (!wrap) return undefined; const updateScrollable = () => { setIsScrollable(wrap.scrollWidth > wrap.clientWidth); }; updateScrollable(); const observer = new ResizeObserver(updateScrollable); observer.observe(wrap); return () => observer.disconnect(); }, [mounted, data]); if (!mounted) return null; if (!data || data.length === 0) return null; const rowKey = row => columns.map(c => row[c] || '').join('|'); return
| {col.replaceAll('_', ' ')} | )}
|---|
| {processBadges(row[col])} | )}
3. Copy the commit SHA from the URL.
The commit SHA is the 40-character alphanumeric string in the URL after `/commit/`.
## Example GitHub Action Workflow
Endor Labs scanning workflow using GitHub Actions that accomplishes the following tasks in your CI environment:
* Tests PRs to the default branch and monitors the most recent push to the default branch.
* Builds a Java project and sets up the Java build tools. If your project is not on Java, then configure this workflow with your project-specific steps and build tools.
* Authenticates to Endor Labs with GitHub Actions keyless authentication.
* Scan with Endor Labs.
* Comments on PRs if any policy violations occur.
* Generates findings and uploads results to GitHub in SARIF format.
The following example workflow shows how to scan with Endor Labs for a Java application using the recommended keyless authentication for GitHub Actions.
GitHub Actions typically maintains proper branch context automatically. However, to ensure scans are properly tracked, when using the Endor Labs GitHub Action, set `pr: false` to create monitored versions that appear on dashboards. Use `if: github.event_name == 'push'` to trigger only on pushes to the default branch:
```yaml theme={null}
- name: Endor Labs Scan Push to main
if: github.event_name == 'push'
uses: endorlabs/github-action@b8992820cc4d9c9e7ded5022adf6cabe2dc11946 # v1.1.12
with:
namespace: 'example'
scan_dependencies: true
pr: false
```
## Scan containers with OS reachability
You can use the Endor Labs GitHub Action to scan container images with [OS reachability](/scan/containers/container-reachability) enabled. Container reachability identifies which packages inside a container image are actually used at runtime, helping you prioritize the most critical vulnerabilities for remediation. Set `scan_container: true` and `os_reachability: true` to enable container scanning with reachability analysis:
```yaml theme={null}
- name: Scan container with OS reachability
uses: endorlabs/github-action@b8992820cc4d9c9e7ded5022adf6cabe2dc11946 # v1.1.12
with:
namespace: 'example'
enable_github_action_token: 'true'
scan_container: true
scan_dependencies: false
image: "nginx:latest"
os_reachability: true
pr: false
project_name: 'my-project'
```
## Authenticate with Endor Labs
Endor Labs recommends using keyless authentication in CI environments. Keyless authentication is more secure and reduces the cost of secret rotation. To set up keyless authentication see [Keyless Authentication](/setup-deployment/ci-cd/keyless-authentication).
If you choose not to use keyless authentication, you can configure an API key and secret in GitHub for authentication as outlined in [Managing API keys](/platform-administration/api-keys).
### Authentication Without Keyless Authentication for GitHub
If you are not using keyless authentication for GitHub Actions, you must not provide `id-token: write` permissions to your GitHub token unless specifically required by a step in this job. You must also set `enable_github_action_token: false` in your Endor Labs GitHub Action configuration.
The following example configuration uses the Endor Labs API key for authentication:
```yaml theme={null}
- name: Scan with Endor Labs
uses: endorlabs/github-action@b8992820cc4d9c9e7ded5022adf6cabe2dc11946 # v1.1.12
with:
namespace: 'example'
api_key: ${{ secrets.ENDOR_API_CREDENTIALS_KEY }}
api_secret: ${{ secrets.ENDOR_API_CREDENTIALS_SECRET }}
enable_github_action_token: false
```
The following example configuration uses a GCP service account for keyless authentication to Endor Labs:
```yaml theme={null}
- name: Scan with Endor Labs
uses: endorlabs/github-action@b8992820cc4d9c9e7ded5022adf6cabe2dc11946 # v1.1.12
with:
namespace: 'example'
gcp_service_account: '