Bajaj Finances - CICD Integration - July 2026

Configure SBOM360 scans for Bajaj Finances GitHub repositories using GitHub Actions.

Scope

Integrate SBOM360 scan with one repository on GitHub using GitHub Actions.

This can be later expanded to Azure DevOps as well using Azure Pipelines.

Prerequisites

1. Runner (VM) to run the GitHub Action

   • Either a GitHub-hosted runner or Self-hosted runner (link)

   • Linux only (ubuntu-latest recommended). x86_64 and aarch64 supported. Windows / macOS runners are not supported.

   • Network access to Open-Source repositories (NPM, Maven etc.) and Lineaje APIs (*.prod.veedna.in, ap-south-1-indiaprod-veedna-*.s3.ap-south-1.amazonaws.com)

   • Should have required permissions to private artifactories, like Azure Artifactory.

2. Lineaje Personal Access Token (PAT) (instructions are below)

3. User permissions to create a GitHub Action workflow and trigger workflows

Most Bajaj Finances repositories use private artifactories. This was configured on the existing Bajaj VM. The GitHub Action Runner needs to be configured accordingly and provided. For network access, full list of URLs can be shared again if required.

Steps

1

Create a Lineaje Personal Access Token (PAT)

Follow the steps in Authentication

2

Add the Lineaje PAT to GitHub Repository or Organization.

Create a repository-level or organization-level secret to store the Lineaje PAT.

For repository-level secret,

1. Open your GitHub repository.

2. Go to Settings.

3. Open Secrets and variables.

4. Select Actions.

5. Click New repository secret.

6. Provide the name as LINEAJE_CLI_TOKEN. Copy-and-paste the PAT from Step 1 as the value.

For organization-level secret, please follow this link.

3

Create the GitHub Action workflow

1. Add the following workflow file in your repository: .github/workflows/lineaje-scan.yml

2. Copy-and-paste the following contents into the YML file.

name: Trigger Lineaje Scan

on:
  workflow_dispatch:
    inputs:
      source_branch:
        description: "Branch to scan"
        required: true
      group:
        description: "Lineaje organization group"
        required: false
        default: "Root Organization"

jobs:
  scan:
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.source_branch }}

      - name: Lineaje scan
        uses: lineaje-actions/lineaje-actions@v1.9.1
        with:
          scan_type: source
          lineaje_cli_token: ${{ secrets.LINEAJE_CLI_TOKEN }}
          org_name: ${{ github.event.inputs.group }}
          language: node
          language_version: "22"
          post_scan: scan_only

For the full list of supported languages, visit lineaje-scan#supported-language-versions.

4

Trigger the workflow

Go to the Actions tab in the GitHub repository, and run the "Trigger Lineaje Scan" workflow. In the "Branch to scan" section, enter the name of the branch you would like to scan.

Once the scan is completed, the results will be available in SBOM360.

The above workflow is configured to run off a manual trigger. But the same action can be configured to run when a new pull request is created, on changes to specific branches, or when a new release is created.

Refer to choose-when-workflows-run/trigger-a-workflow to configure these options.