GitHub Actions

Integrate Prisma Cloud with GitHub Actions to allow dynamic, automated, and context-specific scans within your development workflow. This includes continuous scanning of your workflow whenever changes are pushed or triggered, integrating security checks, and catching issues as soon as they are introduced. Additionally, it automates shift-left actions such as notifying developers or creating tickets, based on scan results.

Before you begin.
1. Generate and copy the Prisma Cloud access key to enable access to Prisma Cloud. The access key includes a key ID and secret.
2. Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud Console.
3. Grant the Prisma user integrating Prisma Cloud with GitHub Actions Administrator user permissions.
On the Prisma Cloud Application Security console.
1. In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.
2. Select GitHub Actions (under CI/CD Runs) in the catalog that is displayed.
  The Add Environment Variable step of the integration wizard is displayed.
Add the Prisma Cloud access key as an environment variable to GitHub Secrets.
1. Copy the Prisma access key name from the Name field.
2. Copy the access key ID and secret from the Value step
3. Add the access key as an environment variable to GitHub Actions.
  For more information on passing secrets as environment variables to GitHub Actions, refer to https://docs.github.com/actions/security-guides/encrypted-secrets.
Click Next.
The Configure Job step of the integration wizard is displayed.

Copy and paste the following code into your GitHub Actions job configuration.

The prisma-api-url value is environment-specific. Therefore, replace the value with the appropriate value for your environment.

steps:
      - name: Checkout repo
        uses: actions/checkout@v2

      - name: Run Prisma Cloud
        id: Prisma Cloud
        uses: bridgecrewio/checkov-action@master
        env:
          PRISMA_API_URL: https://api2.prismacloud.io
        with:
          api-key: ${{ secrets.BC_API_KEY }}
          use_enforcement_rules: true

For more job configuration options, such as use_enforcement_rules and framework, refer to the Checkov Action yml file.

Select Done.
Verify integration: In Application Security, select Home > Settings > CI/CD Runs tab.
Your integrated GitHub Actions repositories will be displayed. You may have to wait for up to three minutes before the status of the integration is updated.
Next step: Monitor and manage scan results.
- The next GitHub Actions scan will automatically include the selected repositories
- To view scan results and resolve issues, in Application Security select Home > Projects.
  Refer to Monitor and Manage Code Build Issues for more information

PreviousCircleCI NextGitLab Runner

Last updated 20 days ago

Was this helpful?