GitHub: DevSecOps: Part 3/12: Learn How to use SCA (Software Composition Analysis)
What is Software Composition Analysis (SCA) in GitHub?
Part 3/12: In this video, Padi and I will show you how to find vulnerabilities in dependencies in your code by using Software Composition Analysis (SCA) or Dependency Scanning.
▬▬▬▬▬▬ T I M E S T A M P S ⏰ ▬▬▬▬▬▬
00:00 Welcome
00:17 Intro
00:23 DevSecOps with GitHub
00:58 What is Software Composition Analysis
03:17 SCA with Code Ready Dependency Analytics
04:32 SCA implementation details
05:20 Dependency graph and Dependabot
06:12 Dependabot implementation details
06:59 Enable Dependency Graph in GitHub
07:25 Enable Dependabot
08:33 Dependency Graph Results
09:10 Dependabot alerts
10:04 Enable code scanning for the repository
10:40 Configure code scanning
11:13 Add SCA to Main-Pipeline.yml
12:38 Create sca.yml
15:58 Adding a the SNYK_KEY to the repository secret
16:24 How to get the SNYK_KEY
17:15 Pipeline result
18:00 Critique
19:46 Findings
20:52 Summary
▬▬▬▬▬▬ L I N K S 🔗▬▬▬▬▬▬
Source Code
https://github.com/romanoroth/GitHubD...
Blog-Post
https://www.romanoroth.com/post/gitla...
GitHub
https://github.com/
Patrick Steger
/ patrick-steger-ch
▬▬▬▬▬▬ Want to learn more? 🚀 ▬▬▬▬▬▬
GitHub: DevSecOps: Part 1/12: What is GitHub? The fundamental concepts of a DevSecOps pipeline.
• GitHub: DevSecOps: Part 1/12: What is GitH...
GitHub: DevSecOps: Part 2/12: Introduction to GitHub
• GitHub: DevSecOps: Part 2/12: Introduction...
GitHub: DevSecOps: Part 3/12: Learn How to Use SCA (Software Composition Analysis)
• GitHub: DevSecOps: Part 3/12: Learn How to...
▬▬▬▬▬▬ S U B S C R I B E 🔔 ▬▬▬▬▬▬
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
/ @romanoroth
▬▬▬▬▬▬ Connect with me 👋 ▬▬▬▬▬▬
LINKEDIN ► / romanoroth
TWITTER ► / romanoroth
INSTAGRAM ► / romanoroth
FACEBOOK ► / romanoroth
MEETUP ► https://www.meetup.com/de-DE/DevOps-M...
CONFERNCE ►https://www.devopsdays.ch/
HOMEPAGE ► https://www.romanoroth.com/
▬▬▬▬▬▬ P L A Y L I S T S ▶️ ▬▬▬▬▬▬
Modern Software Engineering
• Modern Software Engineering
DevOps
• DevOps
GitLab: Build a DevSecOps Pipeline
• GitLab: Build a DevSecOps Pipeline
#devsecops #devops #github #romanoroth