Meterian
Search…
CircleCI

How to integrate Meterian with CircleCI pipeline

Adding Meterian to your CI pipeline is very simple, and it does not require much effort:
Simply add this 'job' into the config.yml configuration file:
1
orbs:
2
docker: circleci/[email protected]
3
jobs:
4
meterian:
5
machine: true
6
steps:
7
- checkout
8
- run: |
9
docker run --rm \
10
--volume ${PWD}:/workspace --env METERIAN_API_TOKEN=$METERIAN_API_TOKEN \
11
meterian/cli [Meterian CLI Options]
Copied!
Then on the CircleCI dashboard, open your project and open your project' settings. Here you will be able to set the METERIAN_API_TOKEN as environment variable.
To retrieve a Meterian API Token visit the Meterian Dashboard; in your account select the tab "Tokens" and create a new one, or use an existing one.
API tokens are available only on paid account. To upgrade your subscription, please contact us.
Once the configuration has been committed and pushed on the repository, CircleCI will launch the 'meterian' job.
Learn more about the Meterian Client here.

How does it work

The above example uses the CircleCI machine executor which checks out your project's source code and runs the latest tag of the Meterian Docker image against it through Docker. This image contains the latest version of the Meterian client and the building tools for all the languages we support. Running it ensures that a scan of your project is performed yielding results that will either cause the CircleCI task to pass or fail breaking the workflow.

Docker executor

Should you wish to use the Docker executor here's an adaptation of the above example that does just that
1
jobs:
2
meterian-scan:
3
docker:
4
- image: meterian/cli:latest
5
working_directory: /workspace
6
steps:
7
- checkout
8
- run: /root/circleci_entrypoint.sh
Copied!
Jobs that use the Docker executor run within a container created with the specified image (in this case we are using the Meterian Dockerized Client image), hence why you need to invoke the entry point script yourself as part of your steps to have your project scanned (after the source code checkout on line 7 of the snippet).
The circleci_entrypoint.sh script at line 8 is a tailored script designed for these type of jobs covering aspects such as needing SSH access for the scan. An example of a scan that might need this is the one involving a Golang project. Assuming that the project defines modules that live on private repositories only accessible through a pair of SSH keys teaming the latter script with CircleCI's add_ssh_keys special step will allow you to easily tackle that.
Here's an adapted example suited to scan a Golang project winch will require private modules to be resolved
1
jobs:
2
meterian-scan:
3
docker:
4
- image: meterian/cli:latest
5
working_directory: /workspace
6
steps:
7
- checkout
8
- add_ssh_keys:
9
fingerprints:
10
- "SO:ME:FIN:G:ER:PR:IN:T"
11
- run: |
12
git config --global url.ssh://[email protected]/.insteadOf https://github.com/
13
export GOPRIVATE=PRIVATE_REPOS_GLOB_PATTERNS
14
/root/circleci_entrypoint.sh
Copied!
After adding SSH keys in the job, GIT and GO are configured to download non-public code. The configurations are then appropriately propagated to the Meterian client for the scan that will follow thanks to our tailored script.
Learn more about configuring GO for downloading non-public code here.
Last modified 1mo ago