Sign inSign up

contrast/sca-smartai

By contrast

•Updated 17 days ago

Image
0

1.8K

contrast/sca-smartai repository overview

⁠Contrast SCA SmartAI SBOM Generator Docker Image

A Docker-based Software Composition Analysis (SCA) SBOM Generator with SmartAI triage capabilities, powered by Contrast Security's SCA engine and AI-driven library assessment.

⁠Usage

⁠Running the Contrast SCA SBOM Generator

To run the docker image, simply:

  1. Map the target code repository directory eg /Users/user/git/repo to /var/app as a ReadWrite volume
  2. Map an output directory eg /tmp/ as a ReadWrite volume to collect the generated AI-enhanced SBOM for results and/or log file
docker run -v /Users/user/git/repo:/var/app:rw -v /tmp:/tmp:rw -t contrast/sca-smartai:latest scan /var/app --output /tmp/sbom.json --debug /tmp/sbom.debug
  1. The resulting SBOM eg /tmp/sbom.json can then be uploaded to Contrast for reporting.
⁠Additional Configuration

If you need to add a Maven settings file for access to non-public artifacts, you can mount it as a volume to a location where it will be picked up eg -v /Users/user/.m2/settings.xml:/root/.m2/settings.xml:ro.

If you need additional environment variables for the configuration, supply through the usual Docker -e keypairs eg:

docker run -e ARTIFACTORY_USER=${ARTIFACTORY_USER} -e ARTIFACTORY_PASSWORD=${ARTIFACTORY_PASSWORD} \ 
    -v /Users/user/git/repo:/var/app:rw -v /tmp:/tmp:rw \ 
    -v /Users/user/.m2/settings.xml:/root/.m2/settings.xml:ro \
    -t contrast/sca-smartai:latest \ 
    scan \ 
    /var/app \ 
    --output /tmp/sbom.json \ 
    --debug /tmp/sbom.debug
⁠Running the Contrast SCA SBOM Generator from a GitHub Workflow

A sample GitHub workflow:

env:
  CONTRAST_API_KEY: ${{ secrets.CONTRAST_API_KEY }}
  CONTRAST_AUTHORIZATION: ${{ secrets.CONTRAST_AUTHORIZATION }}
  CONTRAST_ORG_ID: ccdcdc68...
  CONTRAST_BASE_URL: https://app.contrastsecurity.com
  
jobs:
  scan_repo:
    runs-on: ubuntu-latest
    steps:
      - name: Clone repository
        uses: actions/checkout@v6

      - name: Run Contrast SCA container
        uses: maus007/docker-run-action-fork@5ddaad0f7eedd03f64e412b1931852bd3031b273
        with:
          registry: docker.io
          username: ${{ secrets.DOCKERHUB_USER }}
          password: ${{ secrets.DOCKERHUB_PASSWORD }}
          image: contrast/sca-smartai:latest
          options: -v ${{ GITHUB.WORKSPACE }}:/var/app:rw -v /tmp:/tmp:rw
          # entrypoint script not invoked by docker-run-action
          run: contrast-sca scan /var/app --output /tmp/sbom.json --debug /tmp/sbom.debug

      - name: Archive SBOM results
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        with:
          name: sbom-output
          path: /tmp/sbom*

      - name: Upload SBOM to Contrast
        run: |
          ls -la /tmp/sbom.json
          curl -v -X POST "${{ env.CONTRAST_BASE_URL }}/api/sca/v1/organizations/${{ env.CONTRAST_ORG_ID }}/sbom" -H "API-Key: ${{ env.CONTRAST_API_KEY }}" -H "Authorization: ${{ env.CONTRAST_AUTHORIZATION }}" -F "file=@/tmp/sbom.json;type=application/json"

⁠License

Copyright: 2026 Contrast Security, Inc
Contact: [email protected]⁠
License: Commercial

NOTICE: This Software and the patented inventions embodied within may only be used as part of Contrast Security’s commercial offerings. Even though it is made available through public repositories, use of this Software is subject to the applicable End User Licensing Agreement found at https://www.contrastsecurity.com/enduser-terms-0317a⁠ or as otherwise agreed between Contrast Security and the End User. The Software may not be reverse engineered, modified, repackaged, sold, redistributed or otherwise used in a way not consistent with the End User License Agreement.

⁠Support

For issues, questions, or contributions, please contact the Contrast Security team or open an issue in the repository.

Tag summary

Content type

Image

Digest

sha256:d5df44962…

Size

1.2 GB

Last updated

17 days ago

docker pull contrast/sca-smartai