---
title: A GitHub Action to download and use our enterprise tool vcn in CI - Codenotary
description: MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®
image: https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg
---

**$ protect --distro linux --machines 25 --free**

[Start now](https://apps.codenotary.com/linux)

[![cn-logo-black-nobg](https://codenotary.com/hubfs/cn-logo-black-nobg.svg)](https://codenotary.com/)

- Product
  
  #### [![AgentMon Start](https://codenotary.com/hubfs/chub_backup/AgentMon%20Start.svg) **AgentMon Start** See what your AI agents are doing on your machine. TRY NOW →](https://codenotary.com/agentmon-start)
  
  #### [![AgentMon for Enterprise](https://codenotary.com/hubfs/AgentMon%20for%20Enterprise.svg) **AgentMon** Currently monitors more \> 7 million agent interactions/day. TRY NOW →](https://codenotary.com/agentmon)
  
  #### [![AgentX](https://codenotary.com/hubfs/AgentX.svg) **AgentX** Agentic network control middleware. TRY NOW →](https://codenotary.com/agent-network-control)
  
  #### [![Autonomous Security](https://codenotary.com/hubfs/Autonomous%20Security.svg) **Autonomous Security** AI Agents keep your servers secure. TRY NOW →](https://codenotary.com/trust)
- Use Cases
  
  #### [**AI Agent Risk Monitoring** Continuous oversight of autonomous agents across every environment.](https://codenotary.com/use-cases#risk)
  
  #### [**Autonomous Security Operations** Self-healing defenses that detect, contain, and remediate threats.](https://codenotary.com/use-cases#agentops)
  
  #### [**AI Coding Governance & Performance Monitoring** AI-generated code reviewed, tracked, and held to quality standards.](https://codenotary.com/use-cases#performance)
  
  #### [**AI Tool Cost & Usage Optimization** Spend and consumption optimized across every AI service in use.](https://codenotary.com/use-cases#cost)
  
  #### [**AI Tool Security & Policy Enforcement** Approved AI usage enforced with guardrails and policy controls.](https://codenotary.com/use-cases#security#security)
  
  #### [**Shadow AI Governance** Unsanctioned AI tools discovered, surfaced, and brought under control.](https://codenotary.com/use-cases#shadowit)
- [Blog](https://codenotary.com/blog)
- [Press](https://codenotary.com/press)
- Resources
  
  #### [**Integrations** Connect with your favorite tools and platforms. LEARN MORE →](https://codenotary.com/integrations)
  
  #### [**Support** Get help from our dedicated support team. GET HELP →](https://support.codenotary.com)
  
  #### [**Success Stories** Read how customers achieve their goals. READ MORE →](https://codenotary.com/success)
  
  #### [**Learn** Access documentation and learning resources. EXPLORE →](https://codenotary.com/learn)

[Login](https://apps.codenotary.com/auth/login)

[All posts](https://codenotary.com/blog/all)

 Jul 03, 2022

# A GitHub Action to download and use our enterprise tool vcn in CI

 By  [@marco](https://codenotary.com/blog/author/marco)  ·   3 minute read

Recently, we at Codenotary released [a new version of a GitHub Action](https://github.com/Codenotary/vcn-github-action/releases/tag/v2.0.1) that can be used to download our enterprise CLI tool `vcn` and execute commands with it. [Available on GitHub’s marketplace](https://github.com/marketplace/actions/vcn-general-purpose-action), it can be implemented by our customers in GitHub Action continuous integration pipelines to notarize and authenticate digital assets as part of an attestation process.

The Action has two different usages: **standard** and **custom**. The standard uses all available inputs, while the custom usage takes only the version input, leaving all the other configurations for the user.

**Standard usage**

This is the default usage, meaning you don’t need to configure the `standard_usage` input when you want to use it.

Now, as an example, let’s say you wanted to download the latest version of `vcn` and notarize a binary file compiled for your application. This task can be easily accomplished with an `yaml` file like below:

```
name: notarize-binary

on:
  push:
    branches: [main]

jobs:
  notarize-on-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Build binary
      # Steps in which you build, test, scan, etc...

      - name: Download vcn and notarize binary
        uses: Codenotary/vcn-github-action@v2
        with:
            mode: notarize
            asset: my_binary
            cnc_host: Codenotary-trustcenter-url
            cnc_grpc_port: 443
            cnc_api_key: $
```

This GitHub Action `yaml` configuration file will run on every push to the main branch of the repository where it is. It will then use the major version 2 of our `vcn-github-action` to download the latest version of `vcn`. Following that, it will execute the `notarize` command, as specified with the mode input, on the `my_binary` asset. The command will run with the `--lc-host`, `--lc-port` and `--lc-api-key` flags passing the values from the `cnc_host`, `cnc_grpc_port` and the `cnc_api_key` inputs, respectively.

Notice how we used a secret for the API key instead of hardcoding it on the file. As a secret, it will also be redacted in the GitHub Action logs.

This is what will be logged on the `Download vcn and notarize binary` step:

```
Run Codenotary/vcn-github-action@v2
Run chmod +x /home/runner/work/_actions/Codenotary/vcn-github-action/v2/get-vcn.sh && bash /home/runner/work/_actions/Codenotary/vcn-github-action/v2/get-vcn.sh 

This action will download VCN version latest.
Downloading vcn from https://vcn-releases.Codenotary.com/vcn-latest-linux-amd64-static
Successfully downloaded file.
vcn: application/x-executable; charset=binary
File https://vcn-releases.Codenotary.com/vcn-latest-linux-amd64-static is executable.

Run test "true" = "true" && { ./vcn notarize my_binary --lc-host Codenotary-trustcenter-url --lc-port 443 --lc-api-key my_trustcenter_api_key || exit 2; }  || exit 0
VCN saved locally the trusted public key
VCN automatically trusted the signature found on current connection
Your assets will not be uploaded. They will be processed locally.
Notarization in progress...
UID:		1656698789407294142
Kind:		file
Name:		my_binary
Hash:		e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Timestamp:	2022-07-01 18:06:29.407294142 +0000 UTC
SignerID:	signer-id-number
Apikey revoked:	no
Status:		TRUSTED
```

**Custom usage**

The custom usage is for more experienced users who have a broader knowledge of `vcn` and want to make use of more options. The `standard_usage` input must then be configured with `false` and, as mentioned above, the only input the Action will consider is the `version`.

For this example I’ll show how you can `notarize` an asset built in a pipeline.

```
name: notarize-artifact

on:
  push:
    branches: [main]

jobs:
  notarize-on-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      # This downloads the vcn binary. No other inputs needed
      - name: Download vcn
        uses: Codenotary/vcn-github-action@v2
        with:
          standard_usage: false
      # Intermediate steps in which you build, test, scan, etc...
      ...
      # Simple notarization, including an attachment
      - name: Notarize artifact
        run: ./vcn notarize my_artifact.jar --lc-host Codenotary-trustcenter-url --lc-port 443 --lc-api-key $ --attach reports/my_scan_report
        shell: bash
```

Again, the Action will download the `vcn` tool and execute the command defined in the configuration file. As you can see, the process is very similar, however, you need to specify the `vcn` command with all the options as you would on a console.

This is what the `Notarize artifact` step will log:

```
Run ./vcn notarize my_artifact.jar --lc-host Codenotary-trustcenter-url --lc-port 443 --lc-api-key my_trustcenter_api_key
VCN saved locally the trusted public key
VCN automatically trusted the signature found on current connection
Your assets will not be uploaded. They will be processed locally.
Notarization in progress...
UID:		1656699498966060617
Kind:		file
Name:		my_artifact.jar
Hash:		e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Timestamp:	2022-07-01 18:18:18.966060617 +0000 UTC
SignerID:	signer-id-number-901
Apikey revoked:	no
Status:		TRUSTED
```

**Conclusion**

These examples are just a starting point showing some ways this Action can be used in continuous integration pipelines on GitHub. The main benefit is to skip the download part and be able to choose which `vcn` version should be used.

[![Share on twitter](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/twitter-color.png?width=35&height=35&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://codenotary.com/blog/a-github-action-to-download-and-use-our-enterprise-tool-vcn-in-ci&utm_medium=social&utm_source=twitter&url=https://codenotary.com/blog/a-github-action-to-download-and-use-our-enterprise-tool-vcn-in-ci&utm_medium=social&utm_source=twitter&source=tweetbutton&text=) [![Share on facebook](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/facebook-color.png?width=35&height=35&name=facebook-color.png)](http://www.facebook.com/share.php?u=https://codenotary.com/blog/a-github-action-to-download-and-use-our-enterprise-tool-vcn-in-ci&utm_medium=social&utm_source=facebook) [![Share on linkedin](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/01-marketplace/linkedin-color.png?width=35&height=35&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://codenotary.com/blog/a-github-action-to-download-and-use-our-enterprise-tool-vcn-in-ci&utm_medium=social&utm_source=linkedin) [![Share on pinterest](https://4059529.fs1.hubspotusercontent-na1.net/hub/4059529/hubfs/pinterest.jpg?width=35&height=35&name=pinterest.jpg)](http://pinterest.com/pin/create/button/?url=https://codenotary.com/blog/a-github-action-to-download-and-use-our-enterprise-tool-vcn-in-ci&utm_medium=social&utm_source=pinterest&media=)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "@marco",
    "url" : "https://codenotary.com/blog/author/marco"
  },
  "dateModified" : "2023-03-03T06:27:29.935Z",
  "datePublished" : "2022-07-03T23:48:24.000Z",
  "headline" : "A GitHub Action to download and use our enterprise tool vcn in CI - Codenotary",
  "image" : [ "https://codenotary.com/hubfs/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://codenotary.com/blog/a-github-action-to-download-and-use-our-enterprise-tool-vcn-in-ci",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://codenotary.com/hubfs/logo-light.svg"
    },
    "name" : "Codenotary, Inc."
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "@marco" ],
    "url" : "https://codenotary.com/blog/author/marco"
  },
  "datePublished" : "2022-07-03T23:48:24+0000",
  "description" : "MONITOR & MANAGE THE RISK EXPOSURE OF YOUR APPLICATIONS WITH TRUESBOM®",
  "headline" : "A GitHub Action to download and use our enterprise tool vcn in CI",
  "image" : "https://23873599.fs1.hubspotusercontent-na1.net/hubfs/23873599/Imported_Blog_Media/Blog-Default-Cloud-Feb-10-2023-08-07-19-1640-AM.jpg",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://cdn2.hubspot.net/hubfs/23873599/logo-light.svg"
    },
    "name" : ""
  },
  "url" : "https://codenotary.com/blog/a-github-action-to-download-and-use-our-enterprise-tool-vcn-in-ci"
}
```