Overview

About 383 wordsAbout 1 min

CNB provides three SCA pipeline plugins that compare Base and Head dependency changes in a Pull Request and catch dependency risks before they merge: vulnerabilities, licenses, and the component inventory (SBOM).

Difference from configuration-file scanning

Code security scanning is the platform's built-in, repository-level scan. Its scan scope can be adjusted through .scanignore and .cnb/security/code_scan_config.yml; the SCA plugins are scan tasks declared explicitly in the pull_request stage of .cnb.yml, run incrementally per PR, each with its own gate.

Plugin list

Plugin	Image	Description
Open-Source Component Vulnerability Scan	`cnbcool/sca-vulnerability:latest`	Checks new dependency vulnerabilities in a PR; configurable gate
License Scan	`cnbcool/sca-license:latest`	Checks new License risks in a PR; configurable gate
SBOM Generation	`cnbcool/sca-sbom:latest`	Outputs the Base/Head component changes of a PR

Features

Incremental scanning: scans PR Base and Head separately, processing only risks new to the current PR;
Gate: the vulnerability and license plugins can fail the check by severity;
Standard SBOM: the SBOM plugin supports JSON Delta, SPDX, CycloneDX, and SWID.

Usage in CNB

Add the following configuration to the .cnb.yml at the root of your repository:

.cnb.yml
main:
  pull_request:
    - stages:
        - name: Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest
          settings:
            failOnSeverity: high

        - name: License Scan
          image: cnbcool/sca-license:latest
          settings:
            failOnSeverity: high

        - name: Generate SBOM Delta
          image: cnbcool/sca-sbom:latest
          settings:
            output: ${CNB_BUILD_WORKSPACE}/.cnb-sca/sbom-delta.json

Gates

Set failOnSeverity for the vulnerability and License plugins to define the minimum severity that blocks the check:

failOnSeverity: high

With high, newly introduced High or Critical vulnerabilities and High License risks fail the check. Omit this setting to report findings without applying a risk gate.

Exit codes

Exit code	Description
`0`	Scan completed and no newly introduced risk matched the gate
`1`	A newly introduced risk matched the gate
`2`	Configuration error or scan failure

Next steps

Open-Source Component Vulnerability Scan — vulnerability gate and incremental rules
License Scan — License risk gate
SBOM Generation — component change list and standard formats