Skip to main content

Scan a repository

Three jobs for repository scans, each with the call that does it

Scans are in beta and open workspace by workspace. They use purchased or granted credits and need a key with scans:write, which only owners and admins can grant. See Repository scans.

Scan your main branch before a release​

curl -s https://app.makesmores.com/api/v1/scans \
  -H "Authorization: Bearer $SMORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d @- <<JSON | tee scan.json
{
  "repo_url": "https://github.com/your-org/your-repo",
  "ref": "main",
  "idempotency_key": "release-scan-$(date +%Y-%m-%d)",
  "max_credits": 20000
}
JSON

Poll until status is complete or partial:

curl -s "https://app.makesmores.com/api/v1/scans/$(jq -r .id scan.json)" \
  -H "Authorization: Bearer $SMORE_API_KEY" | jq '{status, stage, progress, credits_used, heartbeat_at}'

Scan a private repository​

Add a fine-grained GitHub token with read-only access to contents. S'more uses it once to clone, then deletes it.

curl -s https://app.makesmores.com/api/v1/scans \
  -H "Authorization: Bearer $SMORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d @- <<JSON
{
  "repo_url": "https://github.com/your-org/private-repo",
  "idempotency_key": "private-scan-$(date +%s)",
  "max_credits": 60000,
  "github_token": "$GITHUB_TOKEN"
}
JSON

Download the report for your team​

curl -s -o report.html "https://app.makesmores.com/api/v1/scans/$(jq -r .id scan.json)/report" \
  -H "Authorization: Bearer $SMORE_API_KEY"

To share it without a file, an owner or admin opens the scan in the console and makes a share link. Anyone with the link can read the report without signing in. A link lasts 30 days, or 1 to 90 days if you pick a length, and you can revoke it at any time.