Enable monitoring

Enable CodeQL and software bill of materials (SBOM) analysis to increase visibility into security risks across your repositories and releases.

What are CodeQL and SBOM?

CodeQL is a static analysis engine that scans your source code to identify security vulnerabilities and coding weaknesses. It detects issues such as injection flaws, insecure configurations, and other common weaknesses categorized as CVEs and CWEs.

An SBOM (Software Bill of Materials) is a structured inventory of the third party components and dependencies used in your application. It helps identify vulnerable libraries and track which versions of a release are affected by newly disclosed issues.

When used together, CodeQL and SBOM provide visibility into:

Vulnerabilities in custom code
Risks in third party dependencies
Security impact across current and historical releases

What happens when you enable this?

When enabled: CodeQL analysis runs on your repository as part of your build process. SBOM data is generated and ingested into DigiCert® Software Trust Manager. Findings are refreshed every 24 hours. Both current and previously released versions are re-evaluated for newly disclosed vulnerabilities. Results appear in the Secure release monitoring dashboard with version level visibility.

Enable Monitoring for CodeQL and SBOM

In the Software Trust menu, go to Secure releases.
Select the Repositories tab.
In the row of the disconnected repository, select Manage Monitoring.
Select Monitoring to enable continuous release security monitoring. After enabling monitoring, you can also configure custom on-demand scans as required.

Manage monitoring

In the Software Trust menu, go to Secure releases.
Select Repositories tab.
Locate the required repository and select Manage Monitoring in its row.
To enable GitHub release scans, select Enable GitHub release scans. to configure the workflow automatically.
To set up a GitHub Actions workflow to run on-demand security scans on your schedule or conditions, you must perform the following procedures:
1. Generate API key.
  - Open the admin profile.
  -Select user.
  - Go to API keys section.
  - Create and save your API key.
2. Create GitHub secret.
  In your GitHub organization, add your API key as a GitHub secret:
  -Name: DIGICERT_BACKEND_API_KEY.
  -Value: Your API key.
3. Add release security GitHub action to your pipeline / workflow.
  - Select Enable release scans to automatically scan each new GitHub release by enabling a scanning workflow for the repository.
  - Select Custom workflow to add the scan action to a GitHub Actions workflow and run scans on your own schedule or based on specific conditions.
  Include release metadata (name and tag) in the submission.
```
  name: Run DigiCert Code Scan composite action
  uses: digicert/digicert-code-monitoring-action@master
  with:
    host: https://one.stage.az.digicert.net
    api-key: ${{ secrets.DIGICERT_BACKEND_API_KEY }}
```

이 섹션의 내용: