Set up a global configuration for Mend for Bitbucket Cloud

overrideConfigAllowList

Array

Optional. Default Value: null. Regulate the ability of repositories that inherit their configuration from the whitesource-config repository to override the parameters locally. There are three options:

• null ("overrideConfigAllowList": null) - All repositories that inherit configuration from this repo-config.json file can override its settings locally in their .whitesource file.

• Empty array ("overrideConfigAllowList": []) - All repositories that inherit configuration from this repo-config.json file cannot override its settings in their .whitesource file.

• Array with values ("overrideConfigAllowList": ["orgName1/repoName1", "orgName2/repoName2"]) - Only the repositories specified in this list that inherit configuration from this repo-config.json file can override its settings locally in their .whitesource file.

settingsInheritedFrom

String

Optional. Default Value: none. When the global configuration is enabled, this parameter will specify the location of the whitesource-config repository from which it will inherit its configuration. It must contain the Bitbucket Server Cloud user name, repository name and branch (optional) of the repo-config.json file location. The default branch is 'master', but can be modified according to the location of the repo-config.json file in the whitesource-config repo. 

NOTE: You can override specific parameters that are relevant only in the specific repository by adding these after this parameter. Parameters with type of array do not override the value from global configuration, but only add new values.

Examples:

Using only values defined in the global configuration:

"settingsInheritedFrom": "whitesource-config/whitesource-config@master"

Using values defined in the global configuration and overriding the scan settings parameters:

"settingsInheritedFrom": "whitesource-config/whitesource-config@master", 
"scanSettings": {
  "projectToken": "12345",
  "baseBranches": ["master","integration"]
}

repoConfigMode

String

Required. Default Value: createOnboardingPR. The configuration mode to be used on all integrated repositories. There are three options:

• createOnboardingPR - Create an onboarding pull request (PR) containing a .whitesource file with inherited configuration.

  • The integrated repositories will inherit the configuration from the repo-config.json file located inside the whitesource-config repository.

  • The .whitesource configuration file generated in each repository will contain a single parameter, settingsInheritedFrom, with a value pointing to the repo name and branch in which the repo-config.json file is located.

• pushwhitesourceFile - A .whitesource configuration file with inherited configuration will immediately be pushed to the default branch of all integrated repositories without creating any onboarding PRs.

  • The .whitesource configuration file generated in each repository will contain a single parameter, settingsInheritedFrom, with a value pointing to the repo name and branch in which the repo-config.json file is located.

• nowhitesourceFile - Integrated repositories will be scanned without creating a .whitesource file or onboarding PR. The integrated repositories will inherit the configuration from the repo-config.json file located inside the whitesource-config repository.

Note: If the nowhitesourceFile parameter is set, the existing repositories that Mend has access to require a valid commit before scanning will continue. Newly created repositories that Mend has access to will automatically start the initial scan (versus waiting for the onboarding PR to be merged when createOnboardingPR is set).

repoConfigFileName

String

Optional. Default Value: .whitesource. Rename the .whitesource configuration file added to an integrated repository.

Note:

• This is currently only supported for newly-integrated repositories. If a repository already includes a .whitesource file, the integration will continue using it.

• This parameter is ignored when repoConfigMode is set to nowhitesourceFile.

CVSSv3

Boolean

Optional. Default Value: false. The available parameter values are:

• true - the CRITICAL severity level will be supported for Issues, Checks, and Pull Requests.

  • CVSS score for CRITICAL is 9.0-10.0

  • CVSS score for HIGH is 7.0-8.9

• false - The highest supported severity level for Issues, Checks, and Pull Requests will be HIGH (with CVSS v2 score 7.0-10.0).

Notes:

• From version 22.12.1 (January 2nd, 2022), you must trigger a new scan on a repository to see the CRITICAL label for vulnerabilities for existing Bitbucket Server and Data Center Issues created by Mend for Bitbucket Server and Data Center.

• From version 23.5.1 (May 21st, 2023), the parameter CVSSv3 is being deprecated and if it is used - the value will not be read. CVSS v3 with Critical severity is now enabled by default.

ignoreSpecificVulnerabilities

Boolean

Optional. Default Value: false. When set to true, all vulnerability IDs listed in a created ignored-vulnerabilities.txt file in the root of whitesource-config repository will be ignored during SCA security scans. The vulnerabilities:

• Will not be mentioned in nor fail the Mend Security Check.

• Will not be mentioned in Mend for Bitbucket Cloud created Bitbucket Cloud Issues.

The format of ignored-vulnerabilities.txt is a list CVEs or WSs IDs separated by a new line:

CVE-2017-1000048
WS-2014-0005
CVE-2014-6394

Note:

• Existing mentions of the ignored vulnerabilities will be removed from the issues with the next valid push after this parameter is enabeled.

• These change affects only Repo Integration and doesn’t change the vulnerability alerts in the Mend SCA Application.

exactNames

Array

Optional. Default Value: N/A. Provide a list of specific repositories to ignore from the integration. For example:

"ignoredRepos": {
  "exactNames": ["myorg/myrepo", "myorg/testrepo"]
}