Reachability Analysis with Sonatype for GitHub Actions

You can configure Sonatype for GitHub Actions to perform Reachability Analysis, which can detect method signatures in your application code that contain components with potentially exploitable security vulnerabilities. Policy violations occurring due to these vulnerable components are labeled as Reachable and can be viewed on the application report.

By including additional parameters in the workflow actions you can enable the Reachability Analysis feature. The scan process will then analyze application code and dependencies in the scan target for Java (or any JVM language) and JavaScript/TypeScript projects. This allows you to detect reachable vulnerabilities, even in proprietary components within your application.

Permissions Required

Sonatype for GitHub Actions users should have the Evaluate Applications permissions to scan applications with Reachability Analysis.

Using Java Reachability Analysis

Both the Sonatype Evaluate action and the Sonatype Run CLI action expose two parameters to enable Java Reachability Analysis.

Parameter	Description
`enable-reachability`	Enable Reachability Analysis in Java or JVM language binaries to determine the method signatures that trigger a security vulnerability. Default: false.
`reachability-namespaces`	Limit Reachability Analysis to one or more namespaces for faster, more precise results. To specify multiple namespaces, repeat the parameter, e.g., `com.package1 org.package2`. Default: empty. You can use regular expressions when specifying the namespace. Example: For `org.foo.example`, you can use regular expressions with `'/'` at the start and end of the string as `/^org\.+.*\.example\/`.

Usage Example

name: Sonatype Workflow
on: push
jobs:
  sonatype-evaluation:
    runs-on: ubuntu-latest
    steps:
      # some steps are omitted...
      - name: Run evaluate action
        uses: sonatype/actions/evaluate@v1
        with:
          # other input parameters could be provided here
          enable-reachability: true
          reachability-namespaces: 'com.example.library.one com.example.app.two'
          # more input parameters may follow

Entrypoint Strategy

The entrypoint strategy determines which methods are treated as entry points for your Java/JVM application.

The default entrypoint strategy is CONCRETE, which means every non-abstract, non-synthetic method defined in a non-interface, non-annotation class is considered a potential entry point. Use the reachability-namespaces parameter to restrict the method set to specific namespaces and improve the overall results.

Parameter	Description
`reachability-entrypoint-strategy`	Customize the entrypoint strategy for Java reachability analysis. Optional.

Using JavaScript Reachability Analysis

JavaScript Reachability Analysis allows you to determine whether vulnerable JavaScript or TypeScript dependencies are actually reachable from your application source code. This analysis inspects application source files provided in the scan target and does not include dependencies or test files unless explicitly configured.

Usage Example

name: Sonatype Workflow with JS Reachability
on: push
jobs:
  sonatype-evaluation:
    runs-on: ubuntu-latest
    steps:
      # some steps are omitted...
      - name: Run evaluate action
        uses: sonatype/actions/evaluate@v1
        with:
          # other input parameters could be provided here
          enable-reachability-js: true
          reachability-js-sources: 'src/**/*.js src/**/*.ts lib/**/*.js'
          reachability-js-excludes: '**/*.test.js **/*.spec.ts'
          reachability-js-project-root: '.'

Using .NET Reachability Analysis

.NET reachability is supported in Sonatype for GitHub Actions 1.12.0 and later.

.NET Reachability Analysis allows you to determine whether vulnerable .NET dependencies are actually reachable from your application source code.

Usage Example

name: Sonatype Workflow with .NET Reachability
on: push
jobs:
  sonatype-evaluation:
    runs-on: ubuntu-latest
    steps:
      # some steps are omitted...
      - name: Run evaluate action
        uses: sonatype/actions/evaluate@v1
        with:
          # other input parameters could be provided here
          enable-reachability-dotnet: true
          reachability-dotnet-namespaces: MyCompany.App
          reachability-dotnet-entrypoint-strategy: DOTNET_MAIN
          reachability-dotnet-path: /opt/bin/dotnet