Managed Scans

Creating an Integration with your SCM

Xygeni provides a quick way to scan your repositories directly from the UI. With this functionality (named Managed Scans) you will be able to scan your repos and Xygeni will manage everything behind the scenes.

First, go to Settings >> Managed Scans

Managed Scans page will open.

Click on New Integration button to create an integration with your SCM. A dialog will open to select your SCM:

For this example, we will use GitHub. So clicking on GitHub will install Xygeni GitHub Application.

As you can see below, the installation procedure will let you specify the scope of the installation (user- or organization-level)

The installation will ask you to grant permission to Xygeni GitHub Application to all or only selected repositories.

After clicking on Install & Authorize button, Managed Scans page will display the new integration.

It also display a table listing the granted repositories (this list depends on previous step).

You can create as many integrations as you wish. Just click on any integration and the list of repos will be refreshed accordingly.

Any integration has some available actions:

• Clicking on the icon of an integration allows you to delete the integration.
• Clicking on the icon of an integration will refresh the list of repos.
• Clicking on the icon of an integration will take you to Xygeni GitHub App configuration page.

Once that you get your list of repositories you can execute scans as follows.

Once that you hace created an integration and you can see the list of repos, you can execute scans in different ways:

1. Scanning a repo on-demand

2. Programming a daily scan of the repo

3. Executing the scan on Pull Requests

Follow below instructions on every method.

On-Demand Scan

Clicking on the Scan Now button of any repo will execute a scan on that repo.

If you go now to GitHub, you will see a workflow running the scan:

Xygeni automatically created a GitHub workflow into the selected repo.

The workflows would be like this:

In the last line you can see that Xygeni has created a secret (XYGENI_TOKEN) in the repo with the Xygeni token (needed to authenticate against Xygeni, to execute the scan and upload the results to Xygeni platform).

After the scan is completed, you can find the results in the Xygeni Dashboard. The name of your project will be the same as your repo name.

You can configure to be notified when the scan is finished. See Notifications.

Daily Scan

Another option is to schedule the scan.

To do it, select any repo and click on Scheduled Scan button.

A dialog will open to select the time to execute the scan:

Please note that the specified time is according to your time zone, but it will be converted to to UTC time zone in the workflow

Once it is done, you will see the scheduling information:

The created workflow will be like this:

In the last line you can see that Xygeni has created a secret (XYGENI_TOKEN) in the repo with the Xygeni token (needed to authenticate against Xygeni, to execute the scan and upload the results to Xygeni platform).

After the scan is completed, you can find the results in the Xygeni Dashboard. The name of your project will be the same as your repo name.

You can configure to be notified when the scan is finished. See Notifications.

If you need to un-schedule the scan, you only need to click on the Stop Automatic Scan button.

Scan on PullRequest / MergeRequest

Another option is to configure the scan to be executed upon a Pull Request against the default branch.

In this case, whenever any branch wants to merge ti the default branch the scan will be executed over the branch code.

To do it, select any repo and click on Scan on PR/MR button.

Once it is done, you will see the following information:

The created workflow will be like this:

In the last line you can see that Xygeni has created a secret (XYGENI_TOKEN) in the repo with the Xygeni token (needed to authenticate against Xygeni, to execute the scan and upload the results to Xygeni platform).

After the scan is completed, you can find the results in the Xygeni Dashboard. The name of your project will be the same as your repo name.

You can configure to be notified when the scan is finished. See Notifications.