Quickstart with Minder (< 1 min)
Minder provides a straightforward "quickstart" functionality that will create your first profile in Minder which ensures that GitHub secret scanning is enabled, and lets you select the GitHub repositories that you want this profile to apply to.
The quickstart lets you get started with Minder, ensuring that secret scanning is enabled for your repositories in seconds.
Prerequisites
Before you can run the quickstart
command, you must
log in to Minder using the CLI.
Quickstart
Now that you have installed the Minder CLI and have logged in to your Minder server, you can start using Minder!
Minder's quickstart
command will simplify getting started managing GitHub
repositories. It will perform three steps to help you get started:
- enroll the GitHub provider, so that Minder can access your repositories
- register repositories, which selects which repositories you want to manage
- add a rule type and create a profile, which will detect repositories that don't have secret scanning enabled.
To get started, run:
minder quickstart
Enrolling the GitHub provider
This first step configures GitHub and produces an authentication token that allows Minder to inspect and manage your repository configuration. You will be prompted to grant Minder access.
Registering repositories
This step allows you to select the repositories that you want Minder to manage. Every repository that you select will be scanned according to the profile that quickstart will set up (next). This profile will ensure that secret scanning is enabled for these repositories.
Create the secret_scanning
rule type
This step will upload the secret_scanning
rule type to the server.
A rule type is a definition of an individual security setting and how to
evaluate it; for example, the secret_scanning
rule type contains the logic to
query GitHub and evaluate whether secret scanning is enabled for an individual
repository.
Minder allows you to build custom rule types, or use one of our pre-defined rule types. But in either case, these rules must be uploaded to the Minder server before you can use them.
Create the quickstart
profile
This step will create a profile named quickstart-profile
that contains the
secret_scanning
rule type.
A security profile is a definition of the rule types that you want to apply to
your repositories. The quickstart
command will create a profile with a single
rule type, the secret_scanning
rule type that it uploads. Once this has been
created, Minder will scan all the repositories that you selected in step two to
ensure that secret scanning is enabled for each of them.
Congratulations! 🎉 You've now successfully created your first profile!
See the status of your profile
To see the status of your profile, run:
minder profile status list --name quickstart-profile --detailed
This command shows you the overall status of your profile, and how each rule evaluates for each of your registered repositories.
You should see an entry for each repository that you registered. If the repository has secret scanning enabled, you should see a status of "Success"; if the repository does not have secret scanning enabled, you should see a status of "Failure".
What's next?
There's a lot more to Minder than just secret scanning!
Now that you have everything set up, you can continue to run minder
commands
against the public instance of Minder where you can manage your registered
repositories, create profiles, rules and much more, so you can ensure your
repositories are configured consistently and securely.
- Register more repositories to take advantage of Minder for more of your organization
- Add additional rules and profiles to define your full security profile for your organization; you can see all of Minder's ready-to-use rules and example profiles on GitHub.
In case there's something you don't find there yet, Minder is designed to be extensible. This allows for users to create their own custom rule types and profiles and ensure the specifics of their security posture are attested to.
More information
For more information about minder
, see: