Integrating with CircleCI

It’s easy to combine VAddy with CircleCI to set up an environment for continuous security tests. Just run git push to start a CircleCI job, deploy your code to your test server, and then test for web security vulnerabilities with VAddy.

In this article, we will explain the following procedure:

1. git push
2. Run unit tests
3. Deploy code to staging
4. Run VAddy tests
5. Deploy code to production

If the unit tests fail, the following steps in the process are skipped. Likewise, if VAddy’s tests fail, code will not be deployed to production. By regularly running unit tests and scanning your web application for vulnerabilities, you can prevent buggy code from being deployed to production.

 

Prerequisites

Because VAddy sends HTTP requests over the Internet when it scans for vulnerabilities, your test server must allow external connections. (If you have already set up a staging server, you should be able to use that.)

Unfortunately, CircleCI instances do not allow external access and thus do not constitute a complete testing setup—yet. This would be very convenient and will consequently be supported in the future.

 

Step 1

Register the server that you would like VAddy to test. You will be issued a Web API key once VAddy is ready to scan your server. For more details on issuing web API keys, see the VAddy Quickstart Guide.

From CircleCI’s Project Settings screen, register VAddy’s API keys and other environment variables.

You will register different environment variables for v1.0 and v2.0 projects. For more information on the differences between the two, see this support article.

Register the following three environment variables for v2.0 projects:

• VADDY_PROJECT_ID: The value shown under Server settings in the admin console’s left sidebar.
• VADDY_TOKEN: Your web API key (generate one here).
• VADDY_USER: Your VAddy login ID.

Register the following three environment variables for v1.0 projects:

• VADDY_HOST: The fully qualified domain name (FQDN) of the server that you have registered with VAddy for testing.
• VADDY_TOKEN: Your web API key (generate one here).
• VADDY_USER: Your VAddy login ID.

 

Step 2

Prepare a circle.yml file for your project.

test:
  override:
    - ./test.sh
deployment:
  staging:
    branch: master
    commands:
      - ./deploy.sh
      - git clone https://github.com/vaddy/go-vaddy.git && cd ./go-vaddy/bin/ && ./vaddy-linux-64bit
    - ./deploy2.sh

In the sample file above, the test section runs the unit tests. The deployment section—through the staging subsection—first deploys code to staging with deploy.sh, then sets up VAddy’s CLI tool with git clone, and finally starts testing. If none of the tests fail, deploy2.sh will be run.

Define test.sh, deploy.sh, and deploy2.sh as appropriate for your project.

Because VAddy’s client tool targets Ruby 2.0 and above, rvm is used to switch the Ruby environment.

 

Smoke Test

Run git push. If none of VAddy’s tests fail, processing will continue and deploy2.sh will be run.

If VAddy finds even a single vulnerability, processing will stop and deploy2.sh will not be run.

 

Summary

We have released VAddy’s client tool under an open-source license, so you should be able to use it with services other than CircleCI.

We have also published our Web API specifications, allowing you to build your own client tools for your projects.