GitLab Runner

Configure Cortex CLI code scanning in GitLab Runner.

ARM64

stages:
  - scan

variables:
  CORTEX_API_URL: <your_cortex_api_url>

cortex_code_scan:
  image: node:22-bookworm
  stage: scan
  rules:
    - when: on_success
  before_script:
    - set -euo pipefail
    - apt-get update
    - apt-get install -y --no-install-recommends curl jq ca-certificates tar gzip file
    - export CORTEXCLI_HOME="/root/.cortexcli"; rm -rf "$CORTEXCLI_HOME" || true; mkdir -p "$CORTEXCLI_HOME"
    - |
      # avoid leaking secrets in logs
      set +x
      CRTX_URL=$(curl -fsSL "${CORTEX_API_URL}/public_api/v1/unified-cli/releases/download-link?os=linux&architecture=arm64" \
        -H "x-xdr-auth-id: ${CORTEX_API_KEY_ID}" \
        -H "Authorization: ${CORTEX_API_KEY}" | jq -r '.signed_url')
      set -x
      curl -fsSL -o cortexcli "$CRTX_URL"
      chmod +x cortexcli
      ./cortexcli --version
  script:
    - |
      ./cortexcli \
        --api-base-url "${CORTEX_API_URL}" \
        --api-key "${CORTEX_API_KEY}" \
        --api-key-id "${CORTEX_API_KEY_ID}" \
        code scan \
        --directory "${CI_PROJECT_DIR}" \
        --repo-id "${CI_PROJECT_PATH}" \
        --branch "${CI_COMMIT_REF_NAME}" \
        --source "CORTEX_CLI" \
        --create-repo-if-missing
  artifacts:
    when: always
    paths:
      - cortexcli
    expire_in: 1 day

AMD64

 name: Cortex CLI Code Scan

on:
  push:
    branches:
      - main
  workflow_dispatch:

env:
  CORTEX_API_KEY: ${{secrets.CORTEX_API_KEY}}
  CORTEX_API_KEY_ID: ${{secrets.CORTEX_API_KEY_ID}}
  CORTEX_API_URL: <your_cortex_api_url>

jobs:
  cortex-code-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v2

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Verify Node.js Version
        run: node -v

      - name: Download cortexcli
        run: |
          set -x
          crtx_resp=$(curl "${CORTEX_API_URL}/public_api/v1/unified-cli/releases/download-link?os=linux&architecture=arm64" \
            -H "x-xdr-auth-id: ${CORTEX_API_KEY_ID}" \
            -H "Authorization: ${CORTEX_API_KEY}")
          crtx_url=$(echo $crtx_resp | jq -r ".signed_url")
          curl -o cortexcli $crtx_url
          chmod +x cortexcli
          ./cortexcli --version

      - name: Run Cortex CLI Code Scan
        run: |
          ./cortexcli \
            --api-base-url "${CORTEX_API_URL}" \
            --api-key "${CORTEX_API_KEY}" \
            --api-key-id "${CORTEX_API_KEY_ID}" \
            code scan \
            --directory "${{github.workspace}}" \
            --repo-id "${{github.repository}}" \
            --branch "${{github.ref_name}}" \
            --source "GITHUB_ACTIONS" \
            --create-repo-if-missing