From e1512d3916167a26724d2861a9953390eb1ae2f7 Mon Sep 17 00:00:00 2001 From: mthibeau73 Date: Wed, 21 Sep 2022 14:04:45 -0500 Subject: [PATCH 1/2] Add Zimperium zScan starter workflow --- .../properties/zscan.properties.json | 14 +++++ code-scanning/zscan.yml | 61 +++++++++++++++++++ icons/zscan.svg | 11 ++++ 3 files changed, 86 insertions(+) create mode 100644 code-scanning/properties/zscan.properties.json create mode 100644 code-scanning/zscan.yml create mode 100644 icons/zscan.svg diff --git a/code-scanning/properties/zscan.properties.json b/code-scanning/properties/zscan.properties.json new file mode 100644 index 0000000..18c96d7 --- /dev/null +++ b/code-scanning/properties/zscan.properties.json @@ -0,0 +1,14 @@ +{ + "name": "zScan", + "creator": "Zimperium", + "description": "The zimperium-zscan GitHub action scans your mobile app binary (iOS or Android) and identifies security, privacy, and compliance-related vulnerabilities. ​", + "iconName": "zScan", + "categories": [ + "Code Scanning", + "Java", + "Kotlin", + "Scala", + "Swift", + "Objective C" + ] +} diff --git a/code-scanning/zscan.yml b/code-scanning/zscan.yml new file mode 100644 index 0000000..1ac6bbd --- /dev/null +++ b/code-scanning/zscan.yml @@ -0,0 +1,61 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# The zimperium-zscan GitHub action scans your mobile app binary (iOS or Android) +# and identifies security, privacy, and compliance-related vulnerabilities. ​ +# +# Prerequisites: ​ +# * An active Zimperium zScan account is required. If you are not an existing Zimperium +# zScan customer, please request a zSCAN demo by visiting https://www.zimperium.com/contact-us. +# * Either GitHub Advanced Security (GHAS) or a public repository is required to display +# issues and view the remediation information inside of GitHub code scanning alerts. ​ +# +# For additional information and setup instructions +# please visit: https://github.com/Zimperium/zScanMarketplace#readme + +name: "Zimperium zScan" + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] + +permissions: + contents: read + +jobs: + zscan: + name: zScan + runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + - name: Execute gradle build + run: ./gradlew build # Change this to build your mobile application + + - name: Run Zimperium zScan + uses: zimperium/zscanmarketplace@bfc6670f6648d796098c251ccefcfdb98983174d + timeout-minutes: 60 + with: + # REPLACE: Zimperium Client Environment Name + client_env: env_string + # REPLACE: Zimperium Client ID + client_id: id_string + # REPLACE: Zimperium Client Secret + client_secret: ${{ secrets.ZSCAN_CLIENT_SECRET }} + # REPLACE: The path to an .ipa or .apk + app_file: app-release-unsigned.apk + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: Zimperium.sarif + \ No newline at end of file diff --git a/icons/zscan.svg b/icons/zscan.svg new file mode 100644 index 0000000..1dff416 --- /dev/null +++ b/icons/zscan.svg @@ -0,0 +1,11 @@ + + + + + + + + + + + From 13ad0bf0aef432c6577fcff3afcf10a492f2e907 Mon Sep 17 00:00:00 2001 From: mthibeau73 Date: Fri, 23 Sep 2022 10:32:47 -0500 Subject: [PATCH 2/2] lowercase iconName in properties file --- code-scanning/properties/zscan.properties.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/properties/zscan.properties.json b/code-scanning/properties/zscan.properties.json index 18c96d7..6b55756 100644 --- a/code-scanning/properties/zscan.properties.json +++ b/code-scanning/properties/zscan.properties.json @@ -2,7 +2,7 @@ "name": "zScan", "creator": "Zimperium", "description": "The zimperium-zscan GitHub action scans your mobile app binary (iOS or Android) and identifies security, privacy, and compliance-related vulnerabilities. ​", - "iconName": "zScan", + "iconName": "zscan", "categories": [ "Code Scanning", "Java",