Skip to content

Customizing the ZTP Pipeline

Zero Touch Provisioning (ZTP) installs the Boost Security pipeline in your Boost scanner project: the repository or project that runs the scans, such as the .boost repository on GitHub or Bitbucket. You can adapt that pipeline to how jobs run in your CI/CD system, but not to what is scanned.

Warning

The Update Template action overwrites the pipeline in the Boost scanner project with the latest Boost Security pipeline, and any edits you made to it are lost. See ZTP Actions.

Supported Customizations

Customize the pipeline only for how the job runs in your CI/CD system, for example:

  • the runners or agent pools the job runs on;
  • proxies;
  • registry mirrors;
  • caching.

To change what is scanned, or when a scanner runs, use a Scanner Policy instead of editing the pipeline.

Never end the job before the Boost Security CLI runs

Don't add a step that exits the job early, for example to skip commits made by bots or draft pull requests or merge requests. The pull request or merge request check stays pending, and every scan ends as a Timeout.

Connectivity Options

The pipeline reads the following variables to reach the scanner images and the scanner registry through your own infrastructure. Where you define them depends on your SCM:

  • GitLab: define them as CI/CD variables in the settings of the Boost scanner project. They are kept when you update the template. GitLab's own dependency proxy is also supported natively: see Use a Docker Container Proxy.
  • Other SCMs: define them in the pipeline definition itself. Update Template overwrites them, so define them again after each update.
Variable Use it to
CI_DOCKER_PROXY Pull the scanner images through your own Docker registry. Set it to the host of that registry. The job must be logged in to that registry (docker login) before the images are pulled.
BOOST_SCANNER_REGISTRY_REPO Use your own copy of the scanner registry. Set it to the URL of a Git repository publicly accessible over HTTPS. It defaults to the Boost Security scanner registry. To use a specific branch, add it after a #, for example https://github.com/boost-community/scanner-registry#<branch>.

Warning

A copy of the scanner registry doesn't receive the scanner updates published by Boost Security, and it can lead to unsupported configurations. Use a copy with caution.

Azure DevOps: Choosing the Agent Pool

On Azure DevOps, don't edit the stock pipeline to change its agent pool. Instead, create a wrapper pipeline in the Boost scanner project that extends: the stock pipeline (azure-pipelines.yml by default) and sets pool:. Template updates then keep applying to the stock pipeline, and your pool setting is kept.

The wrapper must declare the stock pipeline's parameters and pass them through. In this example, replace Azure Pipelines, the Microsoft-hosted pool, with the name of your agent pool:

pool:
  name: Azure Pipelines

parameters:
  - name: task_name
    type: string
  - name: task_display_name
    type: string
  - name: trigger_id
    type: string

extends:
  template: azure-pipelines.yml
  parameters:
    task_name: ${{ parameters.task_name }}
    task_display_name: ${{ parameters.task_display_name }}
    trigger_id: ${{ parameters.trigger_id }}