CI/CD Integration

Native CI/CD Integration

The @bytehide/secrets-scanner npm package already provides CI/CD integration by default because:

• It's installed directly in your JavaScript project
• It runs automatically when called from your build process
• It works in any environment or platform where your project is built
• It's independent of the specific CI/CD platform (GitHub Actions, Azure DevOps, AWS, Jenkins, etc.)

As long as the bytehide.secrets.json configuration file is present and the package is installed in your project, the scanner will work on any machine where the project is built, providing continuous protection against secret leaks.

Integration Options

Build-Time Integration (Recommended)

The simplest way to integrate the scanner is to add it to your build process by using a prebuild script in your package.json:

{
  "scripts": {
    "prebuild": "bytehide-secrets scan",
    "build": "your-build-command"
  }
}

With this setup, the scanner runs automatically whenever you build your project:

npm run build

Repository-Level Git Integration

If you prefer deeper integration at the Git repository level, rather than just at the project level, you can use our:

• GitHub Integration

This option provides additional features like pull request scanning and automatic comments.

DevOps-Only Integration

If you exceptionally don't want the package and configuration to be in your project or repository, there are options to integrate the scanner only in your DevOps pipeline:

GitHub Actions

name: Secrets Scanner

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  scan:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
    
    - name: Setup Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '16.x'
        
    - name: Install dependencies
      run: |
        npm install
        npm install @bytehide/secrets-scanner --save-dev
      
    - name: Create scanner config
      run: |
        echo '{
          "token": "${{ secrets.BYTEHIDE_TOKEN }}",
          "appName": "CI Scanner",
          "environment": "ci",
          "sync": true,
          "anonymize": false
        }' > bytehide.secrets.json
      
    - name: Run scanner
      run: npx bytehide-secrets scan

Azure DevOps Pipelines

trigger:
- main
- develop

pool:
  vmImage: 'ubuntu-latest'

steps:
- task: NodeTool@0
  inputs:
    versionSpec: '16.x'
  displayName: 'Install Node.js'

- script: |
    npm install
    npm install @bytehide/secrets-scanner --save-dev
  displayName: 'Install dependencies'

- task: Bash@3
  displayName: 'Create scanner config'
  inputs:
    targetType: 'inline'
    script: |
      echo '{
        "token": "$(BYTEHIDE_TOKEN)",
        "appName": "Azure Pipeline Scanner",
        "environment": "azure-devops",
        "sync": true,
        "anonymize": false
      }' > bytehide.secrets.json

- script: npx bytehide-secrets scan
  displayName: 'Run scanner'

GitLab CI/CD

image: node:16

stages:
  - scan

variables:
  npm_config_cache: "$CI_PROJECT_DIR/.npm"

cache:
  paths:
    - .npm/

scan_secrets:
  stage: scan
  script:
    - npm install @bytehide/secrets-scanner --save-dev
    - |
      echo '{
        "token": "'$BYTEHIDE_TOKEN'",
        "appName": "GitLab CI Scanner",
        "environment": "gitlab-ci",
        "sync": true,
        "anonymize": false
      }' > bytehide.secrets.json
    - npx bytehide-secrets scan

CircleCI

version: 2.1

jobs:
  scan:
    docker:
      - image: cimg/node:16.13
    steps:
      - checkout
      - run:
          name: Install scanner
          command: npm install @bytehide/secrets-scanner --save-dev
      - run:
          name: Configure scanner
          command: |
            echo '{
              "token": "'$BYTEHIDE_TOKEN'",
              "appName": "CircleCI Scanner",
              "environment": "circleci",
              "sync": true,
              "anonymize": false
            }' > bytehide.secrets.json
      - run:
          name: Run scan
          command: npx bytehide-secrets scan

workflows:
  version: 2
  scan_workflow:
    jobs:
      - scan

Environment-Specific Configuration

You can use different scanner configurations for different environments:

Using Environment Variables

In GitHub Actions:

- name: Create development config
  if: ${{ github.ref == 'refs/heads/develop' }}
  run: |
    echo '{
      "token": "${{ secrets.BYTEHIDE_TOKEN }}",
      "environment": "development",
      "appName": "Dev Build",
      "sync": true
    }' > bytehide.secrets.json

- name: Create production config
  if: ${{ github.ref == 'refs/heads/main' }}
  run: |
    echo '{
      "token": "${{ secrets.BYTEHIDE_TOKEN }}",
      "environment": "production",
      "appName": "Prod Build",
      "sync": true
    }' > bytehide.secrets.json

Using Environment Variables

Alternatively, you can use environment variables in your CI/CD system:

BYTEHIDE_SECRETS_TOKEN=your-project-token
BYTEHIDE_SECRETS_ENVIRONMENT=production

Viewing Results

After the CI/CD pipeline runs, you can view the scanning results in your ByteHide dashboard. The results will include:

• Detected secrets by type and location
• The commit and branch where the secret was found
• Confidence level of the detection
• Link to the specific code location

Next Steps

• Set up GitHub repository integration
• Learn about the Secrets Manager
• View detected secrets