Oracle Cloud DevOps

What it does

The Oracle Cloud DevOps card connects Safeguard to code repositories in OCI DevOps projects. Safeguard lists the projects and repositories your credentials can see (or uses the repository URLs you give it), and each repository you select (at a branch or tag) becomes a project that Safeguard clones and scans for an SBOM and findings. With the right policy, Safeguard can also open fix and upgrade pull requests. An optional push trigger, through OCI Events and Notifications, rescans a repository when someone pushes to it. Find the card under Integrations on the Project/Product tab.

Public vs private

Supported auth methods

The dialog's Sign-in method offers three choices. All of them belong to one OCI user, ideally a dedicated integration user in its own group.

Only commercial OCI regions are supported. Government and sovereign realms are not supported yet.

Permissions required

Safeguard calls only the OCI DevOps service (and Git over HTTPS on it). It does not call Object Storage, Identity or any other OCI service. Put the integration user in a group, here called safeguard-readers, and give that group these policy statements. Use in tenancy instead of in compartment <compartment> when you leave Compartment OCID empty.

API signing key and auth token (IAM policies)

Least privilege: the read devops-family statement, plus use devops-repository only if Oracle refuses the clone.

Auth token: the username

The auth token is the password. The username is not your email:

This is the tenancy name, not the Object Storage namespace.

Scan on push (person setting it up)

The person who creates the push trigger needs permission to manage a Notifications topic and its subscriptions (ons-topics) and an Events rule (cloudevents-rules) in the compartment, for example Allow group <admins> to manage ons-topics in compartment <compartment> and Allow group <admins> to manage cloudevents-rules in compartment <compartment>. Safeguard's integration user needs nothing extra for it.

Token types

Expiry: rotate the auth token and API key on a fixed schedule, such as every 90 days. When a credential is deleted or stops working, listing and scans fail until you enter new credentials in the connection.

What we never need: manage devops-family, any Identity, Object Storage or networking permission, or manage devops-repository when you only scan.

Step-by-step setup

Create the credential in Oracle Cloud

1. Create a user for Safeguard (for example safeguard-scan) and a group (for example safeguard-readers), and add the user to the group. Create a policy with the statements above in the compartment that holds the DevOps projects.
2. Sign in as that user, or open the user as an administrator. From the Profile menu choose User settings.
3. For the auth token: on Tokens and keys, in Auth Tokens, select Generate token, enter a description, select Generate token, and copy it. Oracle shows it only once.
4. For the API signing key: under API Keys, click Add API Key, click Download Private Key and keep the file, then click Add. The Configuration File Preview shows the tenancy OCID, user OCID and fingerprint you need.
5. Note your tenancy name (from the Profile menu, Tenancy: followed by the name) for the username, and the region the DevOps projects are in.

Or with the OCI CLI

# Group, user and policy (run as an administrator)
oci iam group create --name safeguard-readers --description "Safeguard scanning"
oci iam user create --name safeguard-scan --description "Safeguard scanning"
oci iam group add-user --group-id <group-ocid> --user-id <user-ocid>
oci iam policy create --compartment-id <compartment-ocid> --name safeguard-devops \
  --description "Safeguard reads DevOps code repositories" \
  --statements '["Allow group safeguard-readers to read devops-family in compartment <compartment-name>"]'

# Auth token for the user (the token is printed once)
oci iam auth-token create --user-id <user-ocid> --description safeguard

# API signing key: create a key pair, then upload the public key
openssl genrsa -out safeguard_api_key.pem 2048
openssl rsa -pubout -in safeguard_api_key.pem -out safeguard_api_key_public.pem
oci iam user api-key upload --user-id <user-ocid> --key-file safeguard_api_key_public.pem

Connect it in Safeguard

1. Open Integrations and choose the Project/Product tab.
2. Click Connect on the Oracle Cloud DevOps card. The connection is always Private.
3. Enter a Name (and an optional Description) and choose the Region.
4. Choose a Sign-in method and fill in its fields:
   • Auth token: Username (see the table above) and Auth token.
   • API signing key: Tenancy OCID, User OCID, Key fingerprint, Private key (PEM) (or Choose a .pem file) and, if the key has one, Key passphrase.
5. Optionally enter the Compartment OCID (empty means the root compartment), Repositories by URL (one HTTPS clone URL per line; required with an auth token alone), or DevOps projects (one project OCID per line).
6. Click Verify Credentials. "Credentials verified." with the number of repositories visible means Oracle accepted them.
7. Click Next, select the repositories and the branch or tag of each, and finish with the Connect button (fast, deep or progressive scan).

Webhooks and triggers

Each selected repository is scanned when you connect it, and you can set a schedule under Integrations > Scheduled; scheduled rescans work whether or not a push trigger is set up.

Scan on push (optional) routes OCI Events for pushes to this connection through OCI Notifications. After the connection is created, the dialog (and the Update dialog later) shows a Scan on push (optional) panel with a Subscription URL (HTTPS, Custom URL), a Username and Secret, and the Event types for the Events rule.

1. In the OCI Console, open Notifications > Topics, create a topic, then create a subscription on it with protocol HTTPS (Custom URL) and paste the Subscription URL from the panel. The URL already carries the username and secret.
2. Safeguard confirms the subscription itself when the first message arrives.
3. Open Events Service > Rules and create a rule for the service DevOps with the event types HTTP Receive Pack (com.oraclecloud.devopscoderepo.httpreceivepack) and SSH Receive Pack (com.oraclecloud.devopscoderepo.sshreceivepack), with the topic as its action.
4. A push to a repository this connection scans then rescans it on its configured branch.

Treat the secret like a password: anyone who has it can start rescans on this connection.

What we read and store

• Read: DevOps projects and code repositories in the compartment (or the ones you listed), their branches and tags, and the contents of each selected repository at the chosen branch or tag. For fix pull requests, the repository's pull requests. From push triggers, the push event.
• Stored: the connection's settings, region and compartment, the repositories you selected, the SBOM and findings of each scan, and the credentials (auth token, private key and passphrase), which are encrypted at rest with a per-workspace key and never shown again after you save them.
• Not stored: source code. The scanner clones into a temporary folder and deletes it when the scan ends.
• No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Rotation and disconnect

• Rotate: generate a second auth token (or add a second API key) for the integration user. Under Project Configurations on the Project/Product tab, open the connection's menu, choose Update, enter the new credentials, click Verify Credentials, and click Save Changes. Then delete the old auth token or API key in the OCI Console.
• Disconnect: choose Delete from the connection's menu under Project Configurations and confirm Delete configuration. Then delete the auth token and API key (or the whole integration user), and delete the Notifications subscription and Events rule if you created them.

Vendor references

• DevOps IAM policies, checked 2026-10-16.
• Managing pull requests, checked 2026-10-16.
• HTTPS authentication for code repositories, checked 2026-10-16.
• Getting an auth token, checked 2026-10-16.
• Required keys and OCIDs (API signing key), checked 2026-10-16.
• DevOps events, checked 2026-10-16.
• Creating an HTTPS (Custom URL) subscription, checked 2026-10-16.