ScannerProfile

Which scanners the Software Factory runs, the SLSA level its builds must reach, and the evidence it keeps. One per tenant. These are the security.scanners, security.scanners.custom, security.slsa_min and security.evidence settings of the factory settings document: applying saves a new revision of that document, with one audit entry per changed setting, and a FactorySettings document never carries them, so the two kinds never write the same setting. A field left out means its default. Deleting the document puts all four settings back to their defaults.

apiVersion	vulnetix.com/v1
kind	ScannerProfile
Group	Scanners and gates
Status	Served. The config engine plans and applies it.
Objects per tenant	one (metadata.name: default)
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists ScannerProfile in its kinds. See Management tokens.
Terraform resource	vulnetix_scanner_profile, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/ScannerProfile.schema.json
Newest schema	latest/ScannerProfile.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema ScannerProfile

Minimal

Only the fields the kind requires. From examples/ScannerProfile/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ScannerProfile.schema.json
apiVersion: vulnetix.com/v1
kind: ScannerProfile
metadata:
  name: default
spec: {}

HCL (resource vulnetix_scanner_profile)

# Only the arguments the kind requires. From config-schemas examples/ScannerProfile/minimal.yaml.

resource "vulnetix_scanner_profile" "default" {
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ScannerProfile.schema.json
apiVersion: vulnetix.com/v1
kind: ScannerProfile
metadata:
  name: default
spec: {}
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/ScannerProfile/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ScannerProfile.schema.json
apiVersion: vulnetix.com/v1
kind: ScannerProfile
metadata:
  name: default
  labels:
    team: security
  annotations:
    ticket: https://tracker.example.com/SEC-210
spec:
  scanners: custom
  custom:
    - sca
    - malscan
    - secrets
    - sast
  slsaMin: L2
  evidence: sbom_only

HCL (resource vulnetix_scanner_profile)

# Every argument the kind supports. From config-schemas examples/ScannerProfile/advanced.yaml.

resource "vulnetix_scanner_profile" "default" {
  custom   = ["sca", "malscan", "secrets", "sast"]
  evidence = "sbom_only"
  scanners = "custom"
  slsa_min = "L2"
  labels = {
    team = "security"
  }
  annotations = {
    ticket = "https://tracker.example.com/SEC-210"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ScannerProfile.schema.json
apiVersion: vulnetix.com/v1
kind: ScannerProfile
metadata:
  name: default
  labels:
    team: security
  annotations:
    ticket: https://tracker.example.com/SEC-210
spec:
  scanners: custom
  custom:
    - sca
    - malscan
    - secrets
    - sast
  slsaMin: L2
  evidence: sbom_only
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly ScannerProfile	Always ScannerProfile.
metadata	object	yes		no other keys	Metadata for a kind the tenant has exactly one of. The name is fixed to default.
metadata.name	string	yes		exactly default; pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.scanners	string	no	minimum	minimum, all, custom	The scanners a factory scan runs. minimum: software composition analysis, malware and secrets. all: every scanner. custom: the scanners listed in custom. The security.scanners setting.
spec.custom	array of string	no	[]	0 to 100 items; each item: length 1 to 64	The scanner ids to run when scanners is custom; required then, and kept but unused otherwise. The security.scanners.custom setting.
spec.slsaMin	string	no	L3	L1, L2, L3	The lowest SLSA build level the factory accepts for what it builds. The security.slsa_min setting.
spec.evidence	string	no	cdx_slsa	cdx_slsa, sbom_only	The evidence kept for a build. cdx_slsa: a CycloneDX SBOM and SLSA provenance. sbom_only: the SBOM alone. The security.evidence setting.

Rules

Conditions the schema enforces beyond each field’s own type. vulnetix config validate and the engine’s plan report a document that breaks one.

On	Rule
spec	When scanners is custom: custom is required and custom must be 1 to any items.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.
• Singleton. There is one per tenant, and its name is always default.

How apply treats it

A singleton over the factory settings keys security.scanners, security.scanners.custom, security.slsa_min and security.evidence, all filled with defaults on read. It uses the same writer as FactorySettings, and the two kinds own disjoint keys. Delete resets the four keys.

Terraform and OpenTofu

The resource is vulnetix_scanner_profile in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_scanner_profile.

Import an object that already exists by its name (default):

# Import an existing ScannerProfile by its name (metadata.name).
terraform import vulnetix_scanner_profile.default default

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.