Onboarding your Project
Last updated
Last updated
Copyright © 2022 The Linux Foundation®. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks.
You can onboard your project from GitHub to use LFX Security services. Onboard your project to start scanning for vulnerabilities, code secrets, and non-inclusive language.
To onboard projects into LFX Security, use the Project Control Center (PCC). During this process, a Security Bot is installed on the project's GitHub organization.
You need to raise a ticket if you do not have access to PCC. Use this link to raise a support ticket to access PCC.
If you want to know more about PCC, please visit the PCC website. You can refer to PCC documentation for more information.
Onboarding projects into LFX Security is done from the PCC (Project Control Center). A Security Bot is installed on the project's GitHub Organizations as part of this onboarding.
To set up the Security service using PCC, perform the following steps:
Log in to PCC.
Search for the required project. The Project dashboard appears. Click Security from the TOOLS STATUS tab.
You can also navigate to Security from the Vertical Sidebar navigation menu. Click Tools and then select Security.
Enter the GitHub organization name in the Organization Name and click Connect.
Make sure that you logged into the GitHub.
5. Install Security Bot on GitHub.org instructions page appears. You can read the instructions on how to install the Security Bot from this page. Click Install Security Bot button.
6. A list of GitHub organization associated with the login account are listed and displayed. Select the required organization for which you want to install the Security bot.
7.The Install & Authorize LFx Security GitHub App page appears. This page provides the following information:
Information on the permission requested for the selected repositories. The LFX Security requests the following permissions from the GitHub:
Read access to administer, code, check commit status, lookup members, and other metadata.
Read and write access to organization hooks, pull requests, and repository hooks.
Installing and authorizing LFX Security GitHub App grants these permissions on your account:
Read access to emails
Access to the repositories. You can either provide access to all the repositories or selected repositories within the GitHub Organization.
Click Install & Authorize to install the LFX Security GitHub App.
For more information on permissions, refer GitHub App Permissions.
8.The LFX Security Service GitHub app is installed successfully. You can see the installation success message.
You will also receive an email after successful installation of the LFX Security GitHub App.
9.In the PCC page, you need to click I'm Done Installing the Security Bot after completing the installation process.
10.You can see the list of GitHub organizations along with the repositories for which the Security bot has been successfully configured.
A green dot present with the GitHub organization name indicates that the Security bot is successfully installed.
GitHub has been authorized with the following permissions:
Administration: read-only (so that we can discover new repositories, identify when repositories are transferred, determine if a repository is archived, deleted, etc.)
Contents: read-only (view details about the repositories)
Metadata: read-only - required
Pull Requests: read-write - allows Snyk to create pull requests based on fixable vulnerabilities (e.g. version bumps)
Webhooks - read-write - required to add callbacks when PRs are created, when updates are pushed to the main branch, etc.
Commit Status - read-only - get commit status details
Webhooks - read-write - required to add callbacks when events occur for the organization
Email addresses - read-only - ability to read public email ID's.
As on 12/02/2021 adjusted permissions to include webhooks. These additional configurations will allow us to monitor changes in user permissions. The plan is to collect the initial list of permissions when the GitHub app is installed and add the details to the datalake. Additionally, we want to register and receive any callbacks which change the permissions model in the future.
You can uninstall the security bot at any point of time from the PCC. When you uninstall the security bot, the security scanning for the GitHub organization is discontinued. You cannot see the vulnerabilities associated with your GitHub organizations.
To uninstall Security service from PCC, perform the following steps:
1.Login into PCC.
3.The Uninstall Security Bot on GitHub.org instructions page appears. You can read the instructions on how to uninstall the Security Bot from this page. Click Uninstall Security Bot button.
4.The LFx Security GitHub App opens in a new tab. Click Uninstall from the Danger Zone.
You can uninstall the Security bot from all the repositories associated with your GitHub organization by selecting All Repositories or select specific repositories for which you want to uninstall the Security bot by selecting Only Select Repositories.
5. A pop message appears informing that the Security bot will be uninstalled for the selected repositories. Click OK to continue with the uninstallation process.
6.In the PCC page, you need to click I'm Done Uninstalling the Security Bot after completing the uninstallation process.
7.The GitHub repositories will be removed from the Security dashboard. But, you can see the GitHub organization name in the Security dashboard.
A red dot present with the GitHub organization name indicates that the Security bot is successfully uninstalled.
8.If you want to remove the GitHub organization completely from the Security dashboard, click Disassociate Organization.
9.A pop message appears informing that the GitHub organization will be disassociated. Click Disassociate to continue with the disassociation process.
You have an option to suspend the Security service scanning without uninstalling the Security bot. When you suspend the Security service, the bot will not be uninstalled. You can revoke the suspension at any point of time by Unsuspending.
To suspend the Security service, perform the following steps:
1.Login into PCC.
3.The LFx Security GitHub App opens in a new tab. Click Suspend from the Danger Zone.
4.A pop message appears informing that the Security bot will be suspended. Click OK to continue with the suspension process.
5.The GitHub repositories are suspended from the Security dashboard.
A orange dot present with the GitHub organization name indicates that the Security bot is suspended.
The Security page appears. From the GitHub Onboarding tab, click the icon available next to Connect.
2. Search for the required project. The Project dashboard appears. Click Security from the TOOLS STATUS tab. The GitHub organizations are listed, select the settings icon and click Disassociate GitHub Org.
2. Search for the required project. The Project dashboard appears. Click Security from the TOOLS STATUS tab. The GitHub organizations are listed, select the settings icon and click Configure Security Bot.
To revoke the suspended Security service, click settings icon and click Configure Security Bot and click Unsuspend from the Danger Zone.
