Migrate Cortex CLI - Administrator Guide - Cortex CLOUD

Checkov YAML step

This example shows a typical step using checkov-action.

- name: Run Checkov scan
  uses: bridgecrewio/checkov-action@v12
  with:
    directory: ./terraform
    framework: terraform
    quiet: true # Don't output results to stdout

Cortex CLI YAML step

This new step calls the Cortex CLI directly. It uses GitHub secrets to securely provide API credentials. Note the prerequisites in the YAML (such as Node.js v22). For a list of requirements, refer to both the general requirements (Connect Cortex CLI) and Application Security specific requirements (Cortex CLI for Code Security).

 name: Cortex CLI Code Scan
on:
  push:
    branches:
      - main
  workflow_dispatch:
env:
  CORTEX_API_KEY: ${{secrets.CORTEX_API_KEY}}
  CORTEX_API_KEY_ID: ${{secrets.CORTEX_API_KEY_ID}}
  CORTEX_API_URL: https://api-viso-cq3sdpg7uyd6vqk66ccjyv.xdr-qa2-uat.us.paloaltonetworks.com
  
jobs:
  cortex-code-scan:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repository
      uses: actions/checkout@v2
    
    - name: Set up Node.js
      uses: actions/setup-node@v4
      with:
        node-version: 22
    - name: Verify Node.js Version
      run: node -v
    - name: Download cortexcli
      run: |
        set -x
        crtx_resp=$(curl "${CORTEX_API_URL}/public_api/v1/unified-cli/releases/download-link?os=linux&architecture=amd64" \
          -H "x-xdr-auth-id: ${CORTEX_API_KEY_ID}" \
          -H "Authorization: ${CORTEX_API_KEY}")
        crtx_url=$(echo $crtx_resp | jq -r ".signed_url")
        curl -o cortexcli $crtx_url
        chmod +x cortexcli
        ./cortexcli --version
    - name: Run Cortex CLI Code Scan
      run: |
        ./cortexcli \
          --api-base-url "${CORTEX_API_URL}" \
          --api-key "${CORTEX_API_KEY}" \
          --api-key-id "${CORTEX_API_KEY_ID}" \
          code scan \
          --directory "${{github.workspace}}" \
          --repo-id "${{github.repository}}" \
          --branch "${{github.ref_name}}" \
          --source "GITHUB_ACTIONS" \
          --create-repo-if-missing