Skip to main content

Pipeline and CI/CD Connectors

Connect build pipelines and static analysis tools directly to CVD Portal. Automated connectors attach verifiable testing evidence to product technical files and support Article 14 triage.

SonarQube and SonarCloud Quality Gate webhook​

CVD Portal receives build analysis notifications through the SonarQube webhook endpoint.

AttributeValue
MethodPOST
Path/api/webhooks/sonarqube
Required scopesarif:write
Body size limit5 MB streaming limit
Target productOptional productId query parameter

Security and verification​

Configure a webhook secret on your server using the SONARQUBE_WEBHOOK_SECRET variable. When this secret is configured, the server requires the X-Sonar-Webhook-HMAC-SHA256 header on all incoming requests. The server calculates an HMAC-SHA256 signature and uses timing-safe comparison to verify the payload. The server ignores any secret parameters supplied in URL query strings.

CRA compliance mapping​

Successful Quality Gate executions automatically map to the following CRA controls.

  • Clause 7.5 (C7.5-OUT-05) verifies code changes comply with secure implementation baselines.
  • Clause 7.6 (C7.6-OUT-01) documents automated security testing and quality gate enforcement.
  • Clause 7.6 (C7.6-OUT-02) confirms operating effectiveness of implemented security controls.

Each incoming delivery creates an EvidenceDocument and child Evidence rows in one atomic database transaction.

VEX reachability ingestion​

CVD Portal ingests machine-readable Vulnerability Exploitability eXchange documents from reachability scanners such as Endor Labs and Grype.

AttributeValue
MethodPOST
Path/api/v1/vex
Required scopesbom:write
FormatsOpenVEX v0.2.0 and CycloneDX VEX 1.4 through 1.6
Body size limit5 MB streaming limit

Article 14 reachability assessment​

Article 14 ties mandatory authority reporting to awareness of active exploitation in a product. Commission guidance C(2026) 5252 final Paragraph 218 states that third-party component vulnerabilities that are technically unreachable do not trigger reporting duties.

The ingestion engine evaluates each statement.

  • Unreachable components with valid justifications return not reportable under Paragraph 218.
  • Vulnerabilities marked fixed return a review required status. A later patch does not prove that code was unreachable prior to remediation or remove an earlier reporting duty.
  • Reachable vulnerabilities return potentially reportable and prompt active monitoring.

The parser maps verified reachability statements to Clause 7.5 (C7.5-OUT-03) and Clause 7.11 (C7.11-OUT-01 and C7.11-OUT-02).

SARIF static analysis ingest​

Upload Static Analysis Results Format (SARIF) reports from static analysis security tools and container vulnerability scanners.

AttributeValue
MethodPOST
Path/api/v1/scan/sarif
Required scopesarif:write
FormatStandard SARIF JSON

Findings attach to the product technical file to evidence automated code verification under Clause 7.6.