Connect code repositories
The Core app in Vulkro Cloud scans your code repositories: the same analysis
as the vulkro scanner, run in Vulkro
Cloud on the branches you track.
What you can connect
- GitHub, GitLab and Bitbucket, on github.com, gitlab.com and bitbucket.org.
- Another git host over HTTPS (Other / Self-Hosted), including a self-hosted GitLab or Bitbucket Data Center. Self-hosted git hosts are on the Business plan and up.
The repository address must use https:// and carry no credentials. SSH and
git:// addresses are refused. A self-hosted server must be reachable over
HTTPS from the internet under a public DNS name: private network addresses
and internal names are refused.
How many repositories you can connect, and how many branches you can track in each, is set with your plan.
Connect with an access token
- Open Connect a Repository in the Core app. Pick the host, then the Access Token tab.
- Create an access token on the git host, for that one repository, with the permissions in the table below.
- Check Access: paste the Repository address and the Access token, and Vulkro Cloud checks that it can read the repository.
- Pick Branches and Connect: the default branch is always tracked; pick any others, set a Name in Vulkro, an Environment and a Criticality, and choose whether to scan the default branch now.
The token is stored encrypted, for that repository only, and is never shown again. Vulkro uses it as you created it, so give it access to that one repository and only the permissions you need. You can replace it later in the repository's settings.
Public repositories
A public repository needs no token: leave the token field empty. Without a token, Vulkro Cloud can scan the repository but cannot report back on pull requests.
What the token needs
| Host | Token to create | To scan | For pull-request checks |
|---|---|---|---|
| GitHub | A fine-grained personal access token, with Repository access set to Only select repositories | Contents: Read-only (Metadata: Read-only is added with it) | Commit statuses: Read and write, and Pull requests: Read and write |
| GitLab | A project access token | Reporter role, scopes read_repository and read_api | The api scope with the Developer role |
| Bitbucket | A repository access token | Repositories: Read | Pull requests: Write |
| Other / Self-Hosted | A read-only access token from your git server | Read access to the repository contents | Not used (see below) |
Fix pull requests also need write access to the repository contents (on GitHub: Contents, Read and write). Leave it out if you do not turn fix pull requests on.
Pull-request checks, fix pull requests and scan on push work on GitHub, GitLab and Bitbucket. A repository connected as Other / Self-Hosted is scanned on its schedule and on demand.
What Vulkro Cloud does with the repository
- Reads the code. Each scan clones the branch, read-only and shallow, into its own container. The clone is deleted when the scan ends.
- Reads
CODEOWNERSto set the owner of each issue, matched to members by email. - Writes back only what you turn on: commit statuses, a pull-request summary comment, line comments and check annotations (see Pull requests), and fix pull requests when you ask for one (opt-in per repository).
- Receives webhooks from the git host if you set up scan on push (see Branches and gates).
See Data handling for what is stored and for how long.
What's next
- Branches and gates: track branches, schedule scans, scan on push and set a quality gate.
- Pull requests: status, comments and fix pull requests.