A Docker-based Static Application Security Testing (SAST) scanner with SmartAI triage capabilities, powered by Contrast Security's SAST engine and AI-driven vulnerability assessment.
This project provides a containerized solution for running SAST scans on your applications with intelligent triage capabilities. The scanner performs comprehensive code analysis, generates SARIF reports, and uses AI to enhance vulnerability detection and prioritization.
The scanner requires several environment variables to be set - it is probably easier to maintain a dedicated .env file eg ghenv.env:
$ cat ./ghenv.env
REPO_NAME=smartscan-repo # Change this item to create new Repositories in your env.
APPLICATION_NAME=my-application # Change this item to create new Applications in your env.
# GIT information (all can be derived from the GIT Provider's build information for the repository)
REPO_HTTP_URL=https://github.com/Contrast-Security-Inc/sast-smartai-repo-example # GIT repository
DEFAULT_BRANCH=main # GIT default target branch
TAG=refs/heads/main # GIT tag information
COMMIT_HASH=e8205001765f69c3801eabfb74270eae7f840108 # GIT commit hash
COMMITTER=smontgomery # GIT User
RUN_ID=21435407829 # GIT build number
WORKFLOW_ID=local # GIT workflow id
REPO_LANG_INFO=Java,166017|Python,245| # GIT repository language information
# Contrast Organization information
CONTRAST_BASE_URL=https://app.contrastsecurity.com
CONTRAST_API_KEY=ZDjrDxui7...
CONTRAST_AUTHORIZATION=c3RlcG...
CONTRAST_ORG_ID=0add9d43-e9ca...
Then point the image to the target repo eg /Users/user/git/repo and execute:
docker run --env-file ./ghenv.env -e REPO_NAME=repo_name -v /Users/user/git/repo:/var/app -t contrast/sast-smartai:latest
A sample GitHub workflow:
jobs:
scan_repo:
runs-on: ubuntu-latest
steps:
- name: Clone repository
uses: actions/checkout@v6
- name: Get repository languages
id: get_repo_langs
uses: octokit/[email protected]
with:
route: GET /repos/{owner}/{repo}/languages
owner: ${{ GITHUB.REPOSITORY_OWNER }}
repo: ${{ github.event.repository.name }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: echo '${{ steps.get_repo_langs.outputs.data }}' | jq -r 'to_entries[] | [.[]] | join(",")' | tr '\n' '|' | xargs -I '{}' echo "REPO_LANG_INFO={}" >> $GITHUB_ENV
- name: Strip owner from repo eg Contrast-Security-Inc/sast-smartai-repo-example
run: echo "REPO_NAME=${GITHUB_REPOSITORY#*/}" >> $GITHUB_ENV
- name: Determine branch name if PR
if: github.event_name == 'pull_request'
run: echo "BRANCH_NAME=${{ github.head_ref }} " >> $GITHUB_ENV
- name: Determine branch name if direct push
if: github.event_name != 'pull_request'
run: echo "BRANCH_NAME=${{ github.ref_name }} " >> $GITHUB_ENV
- name: List env vars
run: "env | sort"
- name: Run SmartAI container docker image
uses: maus007/docker-run-action-fork@5ddaad0f7eedd03f64e412b1931852bd3031b273
with:
registry: docker.io
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
image: contrast/sast-smartai:latest
options: -v ${{ GITHUB.WORKSPACE }}:/var/app
-e LOGLEVEL=DEBUG
-e REPO_NAME=${{ env.REPO_NAME }}
-e REPO_LANG_INFO=${{ env.REPO_LANG_INFO }}
-e REPO_HTTP_URL=${{ GITHUB.SERVER_URL }}/${{ GITHUB.REPOSITORY }}
-e BRANCH_NAME=${{ env.BRANCH_NAME }}
-e DEFAULT_BRANCH=${{ github.event.repository.default_branch }}
-e APPLICATION_NAME=${{ env.REPO_NAME }}
-e COMMIT_HASH=${{ GITHUB.SHA }}
-e COMMITTER=${{ GITHUB.TRIGGERING_ACTOR }}
-e TAG=${{ GITHUB.REF }}
-e RUN_ID=${{ GITHUB.RUN_ID }}
-e WORKFLOW_ID=${{ GITHUB.WORKFLOW_SHA }}
-e CONTRAST_BASE_URL=https://app.contrastsecurity.com
-e CONTRAST_API_KEY=${{ secrets.SMARTAI_ENABLED_ORG_API_KEY }}
-e CONTRAST_AUTHORIZATION=${{ secrets.SMARTAI_ENABLED_ORG_AUTH }}
-e CONTRAST_ORG_ID=${{ secrets.SMARTAI_ENABLED_ORG_ID }}
-e APPLICATION_DIR=/var/app
# entrypoint script not invoked by docker-run-action
run: /usr/app/smartai.py
Copyright: 2026 Contrast Security, Inc
Contact: [email protected]
License: Commercial
NOTICE: This Software and the patented inventions embodied within may only be used as part of Contrast Security’s commercial offerings. Even though it is made available through public repositories, use of this Software is subject to the applicable End User Licensing Agreement found at https://www.contrastsecurity.com/enduser-terms-0317a or as otherwise agreed between Contrast Security and the End User. The Software may not be reverse engineered, modified, repackaged, sold, redistributed or otherwise used in a way not consistent with the End User License Agreement.
For issues, questions, or contributions, please contact the Contrast Security team or open an issue in the repository.
Content type
Image
Digest
sha256:12f530563…
Size
626 MB
Last updated
about 2 months ago
docker pull contrast/sast-smartai