Chainloop Integrations
Operators can extend Chainloop functionality by setting up third-party integrations that operate on your attestation metadata. Integrations can range from sending a Slack message, uploading the attestation to a storage backend or sending a Software Bill Of Materials (SBOMs) to a third-party service for analysis, for example.
Below you can find the list of currently available integrations.
Available Integrations
Integration | Version | Description | Materials supported |
Dependency Track | 1.4 | Send CycloneDX SBOMs to your Dependency-Track instance | SBOMs |
Discord Webhook | 1.1 | Send attestations to Discord | Attestations |
GUAC | 1.0 | Export Attestation and SBOMs metadata to a blob storage backend so guacsec/guac can consume it | SBOMs |
Slack Webhook | 1.0 | Send attestations to Slack | Attestations |
SMTP | 1.0 | Send emails with information about a received attestation | Attestations |
Webook | 1.0 | Generic webhook | Attestations SBOMs |
How to use integrations
First, you need to make sure that the integration that you are looking for is available in your Chainloop instance, go to the "Integrations" section:
Once you find your integration, it's time to configure it. Configuring an integration has two steps:
register it in your organization and
attach the registered integration to your workflows.
Registering an integration
Registration is when a specific instance of the integration is configured on a Chainloop organization. A registered instance is then available to be attached to any workflow.
In our case, we want to register an instance of the webhook integration. To do so, click on the integration. You'll see two sections: Registration inputs, and Attachment inputs.
Registration inputs are a one-time set of fields required to register the integration in your organization. In this case, the URL of the webhook. However, Attachment inputs are properties set at the workflow level, which can vary from one workflow to another within the same organization.
Click "Add Registration" to set the URL value:
After clicking "Register" you'll see your integration in the "Registrations" tab:
The integration is now ready to be used in your different workflows.
Attaching an integration
Once the integration is registered, we can attach it to any workflow. In practice this means that attestations and material information generated in this workflow will be sent to the registered integration.
In the workflow view, click on the integrations tab:
When clicking "Attach" you'll be presented with the list of available integrations for your organization (which were prepared in the previous step).
When an integration is selected, you'll see the list of attachment properties that can be set at the workflow level. In this case, the two Attachment Input properties we saw in the previous section. This particular integration can receive full attestation documents, SBOMs, or both.
CLI FAQ
All the above operations can be done with the CLI as well:
How do I know if an integration is available?
You can use the chainloop integration available list command to list all the available integrations.
How do I know what configuration parameters are required by an integration?
You can use the chainloop integration available describe command to list all the required configuration parameters.
How do I know what registered integrations I have in my organization?
You can use the chainloop integration registered list command to list all the registered integrations.
You can also delete a registered integration by using the chainloop integration registered delete command.
How do I know what attachments I have in my organization?
You can use the chainloop integration attached list command to list all the attachments, and detach them by using the chainloop integration attached delete command.
What If I can't find the integration I am looking for?
If you can't find the integration you are looking for, or run into any issues, feel free to reach to us.