DigitSec recommends that you prepare for this integration by opening three separate browser windows and following these steps to connect DigitSec and Copado. Keep this page open for instructions while you switch between DigitSec and Salesforce/Copado.
Source Format pipelines using the Quality Gate framework supercharge Copado's commit-based scanning. To work properly, each sandbox/org in your pipeline should have a corresponding connected workspace set up in DigitSec. When making a commit to a User Story, DigitSec will scan the source sandbox/org with the newly committed code. Scans will not be initiated if there is not a connected Workspace on DigitSec corresponding to the Source Sandbox/Org.
- Install the DigitSec Package (Prod, Dev)
https://login.salesforce.com/packaging/installPackage.apexp?p0=04tgL000000Owin - Install the DigitSec Package (Sandbox)
https://test.salesforce.com/packaging/installPackage.apexp?p0=04tgL000000Owin
Note: This extension requires the latest version of Copado Deployer
Part 1: Install the DigitSec Extension Bundle
-
Open the App Launcher. In Copado Release Manager, click the grid icon (App Launcher) in the top-left corner. Search for "Exte" and select Copado Extensions from the options.
Screenshot 1 - App Launcher search for "Extensions"
2. Select DigitSecExtensionBundle. On the Copado Extensions page, click the Select Extension dropdown. Scroll to the bottom of the list and verify DigitSecExtensionBundle is an option. If it does not appear, please try reinstalling the package as indicated in Step 1 above.
Screenshot 2 - Selecting DigitSecExtensionsBundle
Part 2: Add "DigitSec Security Scan" to the Extension Tool Picklist
3. Navigate to the Extension Tool field. Go to Setup --> Object Manager, locate the Extension Configuration object, then click Fields & Relationships --> Extension Tool.
4. Check whether "DigitSec Security Scan" is already listed. If the option appears in the Values list, skip to Step 8. If it is not listed, continue with the next step.
Screenshot 3 - Extension Tool Values (DigitSec Security Scan visible in Values options).
5. Open the Copado Test Tool Value Set. Click View Copado Test Tool Value Set. On the next screen, click New.
Screenshot 4 - Adding DigitSec Security Scan to Picklist Value Options
6. Add the new value. In the text area, type DigitSec Security Scan (one value per line). Click Save.
Part 3: Add "DigitSec Security Scan" to the Quality Gate Rule Tool Picklist
7. Navigate to the Quality Gate Rule Tool field. Go to Setup --> Object Manager --> Quality Gate Rule --> Fields & Relationships -- > Tool (API name: copado__Tool__c)
Screenshot 5 - Quality Gate Rule: Tool picklist values
8. Add the value if missing. If DigitSec Security Scan is not in the list, click View Copado Test Tool Value Set and add it following the same process as indicated in Steps 6-7.
9. Verify the Copado Test Tool Picklist Value Set. Go to Setup --> Picklist Value Sets --> Copado Test Tool and confirm that DigitSec Security Scan is listed as an active value
Screenshot 6 - Picklist Value Sets: Copado Test Tool
Part 4: Generate Extension Records
10. Return to Copado Extensions. From the App Launcher, open Copado Extensions. In the Select Extension dropdown, choose DigitSecExtensionBundle. You will see three records listed with red X status icons.
Screenshot 7 - Copado Extensions indicating 'not generated'
11. Click Generate Extension Records. Click the Generate Extension Records button at the bottom of the page.
12. Confirm success. All three records (DigitSecToolTemplate, DigitSecToolExtensionStep, and DigitSec Security Service) should now show a green checkmark with status 'Created'.
Screenshot 8 - Copado Extensions indicating generated status
Part 5: Create the Quality Gate Rule
13. Open Quality Gate Rules. In Copado Release Manager, navigate to Quality Gates (visible in the top navigation). Click New.Screenshot 9 - Quality Gate Rules list & creating a new one
14. Select DigitSec Security Scan (Step 1 of 2). Next, in the Create Quality Gate 1/2 dialog, select DigitSec Security Scan (Security Scan Test Type) from the list. Click Next
Screenshot 10 - Creating Quality Gate 1/2: DigitSec Security Scan selection
15. Configure the Quality Gate (Step 2 of 2). Set Run DigitSec Security Scan to After Commit - Block. Set the Tests linked to User Story. Select the environments where this gate should run (e.g., Dev1-SFP). Click Save.
Screenshot 11 - Creating Quality Gate 2/2 configuration with Dev1-SFP selected
16. Confirm successful creation. A confirmation dialog will appear as shown below:
Screenshot 12 - Quality Gate creation confirmation dialog
17. Click Close.
Part 6: Configure Named Credentials (digitsecAPI)
18. Open Named Credentials. Go to Setup > Named Credentials. Click digitsec1 (Type: Secured Endpoint, URL: https://s4.digitsec.com).
Screenshot 13 - Named Credentials listing digitsec1
19. Click digitsecAPI under External Credential as shown below:
Screenshot 14 - Named Credentials digitsec1 visible with its details
20. On the new screen, find the Principals header and Edit the Principal. In the Principals section, click the dropdown arrow and select Edit.
Screenshot 15 - digitsecAPI External Credential: editing the Principals section
21. Enter your DigitSec API token (collected from your DigitSec account workspace at s4.digitsec.com shown below)
Screenshot 16 - Fetching the DigitSec API token from s4.digitsec.com
22. Back in the Create Principal dialog: set Parameter Name to any value (e.g., "Security"), set Identity Type to Named Principal. Under Authentication Parameters, click Add. In the Name field, enter ClientId. In the Value field, enter your DigitSec API token collected in the previous step --> Click Save.
Screenshot 17 - Create Principal Dialog: ClientId and API token entry
Part 7: Grant External Credential Access to the Profile
23. Open the Profile. Navigate to Setup > Profiles and open the profile used by the Copado-running user.
24. Open External Credential Principal Access. Click External Credential Principal Access from the profile navigation.
25. Move digitsecAPI to the Enabled list: Find digitsecAPI - Security in the Available list. Click Add (►) to move it to the Enabled column. Click Save.
Screenshot 18 - External Credential Principal Access: moving digitsecAPI to Enabled
Part 8: Configure DigitSec Custom Settings
26. Open Custom Settings. Navigate to Setup > Custom Settings. Find digitsec and click Manage.
27. Create a new custom setting record: Click New. Set Location to Profile and select the profile(s) running Copado (e.g., System Administrator). Enable Save as DigitSec Findings and Scan Commit. Enter your orgId value. Click Save.
Screenshot 19 - digitsec Custom Settings: configuration form
Part 9: Run Your First Commit
30. Configure the Security Scanning Tool workspace: In DigitSec at s4.digitsec.com, configure the workspace. Security scan results will then appear in your User Stories after commits.
31. Commit a change via a User Story: Go to User Stories, open a User Story with a pending change, and run a commit.
32. Check the Test tab: After the commit, open the User Story and click the Test tab.
Your set up is now complete
Screenshots for Reference:
1. A passing quality gate
2. A failing quality gate
3. Result for a passing quality gate
4. Result for a failing quality gate
5. Opening Pull Request for Peer Review
6. Scans are run as a Quality Gate
