From 1be22cecc3906449c5014d187ad9c1e3bb1159cb Mon Sep 17 00:00:00 2001 From: Justin Hutchings Date: Thu, 13 Oct 2022 13:24:08 -0700 Subject: [PATCH 1/7] Add dependency graph to Maven workflows --- ci/maven.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/ci/maven.yml b/ci/maven.yml index 65e0dff..d762ee9 100644 --- a/ci/maven.yml +++ b/ci/maven.yml @@ -1,6 +1,11 @@ # This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time # For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + name: Java CI with Maven on: @@ -24,3 +29,7 @@ jobs: cache: maven - name: Build with Maven run: mvn -B package --file pom.xml + + # Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive + - name: Update dependency graph + uses: advanced-security/maven-dependency-submission-action@v1 From 03afd8292058dd5860870efad5c27295dd1fc67d Mon Sep 17 00:00:00 2001 From: Justin Hutchings Date: Mon, 24 Oct 2022 15:22:18 -0700 Subject: [PATCH 2/7] Update to latest commit sha --- ci/maven.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/maven.yml b/ci/maven.yml index d762ee9..4a8d107 100644 --- a/ci/maven.yml +++ b/ci/maven.yml @@ -32,4 +32,4 @@ jobs: # Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive - name: Update dependency graph - uses: advanced-security/maven-dependency-submission-action@v1 + uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6 From cf8803940451b743087390d37a4bd1db62503efb Mon Sep 17 00:00:00 2001 From: Justin Hutchings Date: Mon, 24 Oct 2022 15:22:49 -0700 Subject: [PATCH 3/7] Add optional marking --- ci/maven.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/maven.yml b/ci/maven.yml index 4a8d107..31fb19f 100644 --- a/ci/maven.yml +++ b/ci/maven.yml @@ -29,7 +29,7 @@ jobs: cache: maven - name: Build with Maven run: mvn -B package --file pom.xml - - # Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive + + # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive - name: Update dependency graph uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6 From ee5b05445ac5bdd8c014232489d3215d22e0ddf8 Mon Sep 17 00:00:00 2001 From: Jeevan Reddy Ragula Date: Tue, 25 Oct 2022 16:32:52 +0530 Subject: [PATCH 4/7] update zscaler iac scan version --- code-scanning/zscaler-iac-scan.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/code-scanning/zscaler-iac-scan.yml b/code-scanning/zscaler-iac-scan.yml index c6020a5..e880bdf 100644 --- a/code-scanning/zscaler-iac-scan.yml +++ b/code-scanning/zscaler-iac-scan.yml @@ -7,7 +7,7 @@ #which detects security misconfigurations in IaC templates and publishes the findings #under the code scanning alerts section within the repository. -#Log into the Zscaler Workload Posture (ZWP) Admin Portal to begin the onboarding process. +#Log into the Zscaler Posture Control(ZPC) Portal to begin the onboarding process. #Copy the client ID and client secret key generated during the onboarding process and configure. #GitHub secrets (ZSCANNER_CLIENT_ID, ZSCANNER_CLIENT_SECRET). @@ -36,12 +36,12 @@ jobs: - name : Code Checkout uses: actions/checkout@v3 - name : Zscaler IAC Scan - uses : ZscalerCWP/Zscaler-IaC-Action@8f0d8b60bd5a8f44062d444463f66f419ab71cfc + uses : ZscalerCWP/Zscaler-IaC-Action@8d2afb33b10b4bd50e2dc2c932b37c6e70ac1087 id : zscaler-iac-scan with: client_id : ${{ secrets.ZSCANNER_CLIENT_ID }} client_secret : ${{ secrets.ZSCANNER_CLIENT_SECRET }} - #This is the user region specified during the onboarding process within the ZWP Admin Portal. + #This is the user region specified during the onboarding process within the ZPC Admin Portal. region : 'US' iac_dir : #Enter the IaC directory path from root. iac_file : #Enter the IaC file path from root. From 65cfd09f0d556e4bcaf18ed7555c5af1cdce91d3 Mon Sep 17 00:00:00 2001 From: SOOS-JAlvarez Date: Wed, 26 Oct 2022 16:05:53 -0300 Subject: [PATCH 5/7] update soos dast to latest version --- code-scanning/soos-dast-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/soos-dast-scan.yml b/code-scanning/soos-dast-scan.yml index 47f6c48..0b982d3 100644 --- a/code-scanning/soos-dast-scan.yml +++ b/code-scanning/soos-dast-scan.yml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run SOOS DAST Scan - uses: soos-io/soos-dast-github-action@5f8e2a1994d618e6ac9902e0f491fd1656b698e6 + uses: soos-io/soos-dast-github-action@093de8c09530d4b96f12322adeb74444def866db with: client_id: ${{ secrets.SOOS_CLIENT_ID }} api_key: ${{ secrets.SOOS_API_KEY }} From 81a4ed37489870ca8016e5d64aaee8aa1c0c2f03 Mon Sep 17 00:00:00 2001 From: SOOS-JAlvarez Date: Wed, 26 Oct 2022 16:10:52 -0300 Subject: [PATCH 6/7] comment about latest version --- code-scanning/soos-dast-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/soos-dast-scan.yml b/code-scanning/soos-dast-scan.yml index 0b982d3..825f573 100644 --- a/code-scanning/soos-dast-scan.yml +++ b/code-scanning/soos-dast-scan.yml @@ -28,7 +28,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run SOOS DAST Scan - uses: soos-io/soos-dast-github-action@093de8c09530d4b96f12322adeb74444def866db + uses: soos-io/soos-dast-github-action@093de8c09530d4b96f12322adeb74444def866db # Use latest version from https://github.com/marketplace/actions/soos-dast with: client_id: ${{ secrets.SOOS_CLIENT_ID }} api_key: ${{ secrets.SOOS_API_KEY }} From c36348cbc69edcc1766b7c5927c5ceaa3a9d902c Mon Sep 17 00:00:00 2001 From: Angela P Wen Date: Wed, 26 Oct 2022 23:28:17 +0000 Subject: [PATCH 7/7] Add Go to code scanning autobuild comment --- code-scanning/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index 00ffcdb..34c5de7 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -53,7 +53,7 @@ jobs: # queries: security-extended,security-and-quality - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild uses: github/codeql-action/autobuild@v2