63 lines
2.6 KiB
YAML
63 lines
2.6 KiB
YAML
|
# This workflow uses actions that are not certified by GitHub.
|
|||
|
|
# They are provided by a third-party and are governed by
|
|||
|
|
# separate terms of service, privacy policy, and support
|
|||
|
|
# documentation.
|
|||
|
|
|
|||
|
|
# APIsec addresses the critical need to secure APIs before they reach production.
|
|||
|
|
# APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs.
|
|||
|
|
# Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities.
|
|||
|
|
|
|||
|
|
# How to Get Started with APIsec.ai
|
|||
|
|
# 1. Schedule a demo at https://www.apisec.ai/request-a-demo .
|
|||
|
|
#
|
|||
|
|
# 2. Register your account at https://cloud.fxlabs.io/#/signup .
|
|||
|
|
#
|
|||
|
|
# 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly.
|
|||
|
|
#
|
|||
|
|
# 4. Get GitHub Actions scan attributes from APIsec Project -> Configurations -> Integrations -> CI-CD -> GitHub Actions
|
|||
|
|
#
|
|||
|
|
# apisec-run-scan
|
|||
|
|
#
|
|||
|
|
# This action triggers the on-demand scans for projects registered in APIsec.
|
|||
|
|
# If your GitHub account allows code scanning alerts, you can then upload the sarif file generated by this action to show the scan findings.
|
|||
|
|
# Else you can view the scan results from the project home page in APIsec Platform.
|
|||
|
|
# The link to view the scan results is also displayed on the console on successful completion of action.
|
|||
|
|
|
|||
|
|
# This is a starter workflow to help you get started with APIsec-Scan Actions
|
|||
|
|
|
|||
|
|
name: APIsec
|
|||
|
|
|
|||
|
|
# Controls when the workflow will run
|
|||
|
|
on:
|
|||
|
|
# Triggers the workflow on push or pull request events but only for the $default-branch branch
|
|||
|
|
# Customize trigger events based on your DevSecOps processes.
|
|||
|
|
push:
|
|||
|
|
branches: [ $default-branch ]
|
|||
|
|
pull_request:
|
|||
|
|
branches: [ $default-branch ]
|
|||
|
|
|
|||
|
|
# Allows you to run this workflow manually from the Actions tab
|
|||
|
|
workflow_dispatch:
|
|||
|
|
|
|||
|
|
|
|||
|
|
jobs:
|
|||
|
|
Trigger-APIsec-Scan:
|
|||
|
|
runs-on: ubuntu-latest
|
|||
|
|
|
|||
|
|
steps:
|
|||
|
|
- name: APIsec Scan
|
|||
|
|
uses: apisec-inc/apisec-run-scan@master
|
|||
|
|
with:
|
|||
|
|
# The APIsec username with which the scans will be executed
|
|||
|
|
apisec-username: ${{ secrets.apisec_username }}
|
|||
|
|
# The Password of the APIsec user with which the scans will be executed
|
|||
|
|
apisec-password: ${{ secrets.apisec_password}}
|
|||
|
|
# The name of the project for security scan
|
|||
|
|
apisec-project: "VAmPI"
|
|||
|
|
# The name of the sarif format result file The file is written only if this property is provided.
|
|||
|
|
sarif-result-file: "apisec-results.sarif"
|
|||
|
|
|
|||
|
|
- name: Import Results
|
|||
|
|
uses: github/codeql-action/upload-sarif@v1
|
|||
|
|
with:
|
|||
|
|
sarif_file: ./apisec-results.sarif
|