Comment on page
Concourse CI
Integrate Meterian with Concourse CI pipeline
Assuming you have a working instance of Concourse CI, integrating Meterian only involves a few simple steps. These consist of a secrets pre-configuration to ensure the scan is authenticated and the addition of a task to a pipeline to execute said scan.
Secrets pre-configuration
In a
.yml file set the key METERIAN_API_TOKEN as it follows# secrets.yml
METERIAN_API_TOKEN: your API token
To retrieve a Meterian API Token visit the Meterian Dashboard; in your account select the tab "Tokens" and create a new one, or use an existing one.
Meterian scan pipeline task
Now prepare a pipeline where the codebase you intend to scan is firstly pulled as a resource and then scanned by the Meterian client (to learn more about the pipeline syntax please refer to the official documentation)
# pipeline.yml
resources:
- name: source-code
type: git
source:
uri: your repository uri
branch: the target branch
jobs:
- name: you-job-name
plan:
- get: source-code
trigger: true
- task: meterian-scan
config:
platform: linux
image_resource:
type: registry-image
source:
repository: meterian/cli
inputs:
- name: source-code
path: .
run:
path: /root/concourse.sh
args: [ comma-separated arguments for the client ]
params:
METERIAN_API_TOKEN: ((METERIAN_API_TOKEN))
In case of an on-premise instance of Meterian you also will need to specify the following params
CLIENT_ENV: your site environment (e.g. www.meterian.io -> www )
CLIENT_PROTO: your site protocol
CLIENT_DOMAIN: your site domain (e.g. www.meterian.io -> meterian.io )
$ fly -t <Concourse target name> \
set-pipeline -p <pipeline name> \
-c pipeline.yml \
-l secrets.yml
This example triggers a build whenever your repository is updated on GitHub. The repository is treated as a git-resource resource arbitrary named "source-code". Note there are countless resources developed by the Concourse CI community so consider consulting their catalog for other alternatives.
Adjustments for private repositories
The above example works great with public repositories but in order to use private repositories the pipeline requires some minor tweaks.
If you haven't already, create and set up deploy keys for your private repository following this guide.
Refer to the resource object and update your repository
uri to a git ssh clone uri and add your deploy private key through the private_key attribute as it followsresources:
- name: source-code
type: git
source:
uri: [email protected]:...
branch: main
private_key: ((private-key))
Now apply the changes through the fly client binding your private key to the variable
private-key$ fly -t <Concourse target name> \
set-pipeline -p <pipeline name> \
-c pipeline.yml \
-l secrets.yml \
-v private-key="$(cat /path/to/your/private/key)"
Caveats
As of now the
git-resource always pulls the specified branch in detached mode causing the scan to report a misleading branch name unless the appropriate override is provided. To fix this issue provide the --project-branch arguments with the right branch name to the Meterian scan task - task: meterian-scan
config:
platform: linux
image_resource:
type: registry-image
source:
repository: meterian/cli
inputs:
- name: source-code
path: .
run:
path: /root/entrypoint.sh
args: [ --project-branch=correct-branch-name ]
params:
METERIAN_API_TOKEN: ((METERIAN_API_TOKEN))
A full list of available client arguments can be found here https://docs.meterian.io/the-client/command-line-parameters
Last modified 1mo ago