From 4f0f3e716db32badb9a62be949ebaa26967d0bca Mon Sep 17 00:00:00 2001 From: Shubham malik Date: Thu, 27 Jan 2022 15:38:23 +0530 Subject: [PATCH 1/4] Update crunch42.yml --- code-scanning/crunch42.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/code-scanning/crunch42.yml b/code-scanning/crunch42.yml index 1d44bf9..e8e2447 100644 --- a/code-scanning/crunch42.yml +++ b/code-scanning/crunch42.yml @@ -33,8 +33,14 @@ on: schedule: - cron: $cron-weekly +permissions: + contents: read + jobs: rest-api-static-security-testing: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for 42Crunch/api-security-audit-action to upload results to Github Code Scanning runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 From 8430b6f878f9e8318ab48462eeed25731396f568 Mon Sep 17 00:00:00 2001 From: h0x0er <84621253+h0x0er@users.noreply.github.com> Date: Mon, 31 Jan 2022 14:23:00 +0530 Subject: [PATCH 2/4] Update --- code-scanning/anchore.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/code-scanning/anchore.yml b/code-scanning/anchore.yml index d90f68c..fcca708 100644 --- a/code-scanning/anchore.yml +++ b/code-scanning/anchore.yml @@ -20,8 +20,14 @@ on: schedule: - cron: $cron-weekly +permissions: + contents: read + jobs: Anchore-Build-Scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest steps: - name: Checkout the code @@ -36,4 +42,4 @@ jobs: - name: Upload Anchore Scan Report uses: github/codeql-action/upload-sarif@v1 with: - sarif_file: results.sarif \ No newline at end of file + sarif_file: results.sarif From 34d35389d179c8f3da46255ed31976853cb6ebcb Mon Sep 17 00:00:00 2001 From: h0x0er <84621253+h0x0er@users.noreply.github.com> Date: Mon, 31 Jan 2022 14:23:00 +0530 Subject: [PATCH 3/4] updated gh_token permissions for anchore/scan-action --- code-scanning/anchore.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/code-scanning/anchore.yml b/code-scanning/anchore.yml index d90f68c..fcca708 100644 --- a/code-scanning/anchore.yml +++ b/code-scanning/anchore.yml @@ -20,8 +20,14 @@ on: schedule: - cron: $cron-weekly +permissions: + contents: read + jobs: Anchore-Build-Scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest steps: - name: Checkout the code @@ -36,4 +42,4 @@ jobs: - name: Upload Anchore Scan Report uses: github/codeql-action/upload-sarif@v1 with: - sarif_file: results.sarif \ No newline at end of file + sarif_file: results.sarif From d71bfc344e4081dfbeb2fcca7cd8839ae5d06e31 Mon Sep 17 00:00:00 2001 From: Shubham malik Date: Tue, 1 Feb 2022 22:34:47 +0530 Subject: [PATCH 4/4] Create checkmarx.yml --- code-scanning/checkmarx.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/code-scanning/checkmarx.yml b/code-scanning/checkmarx.yml index 96b9897..d012bce 100644 --- a/code-scanning/checkmarx.yml +++ b/code-scanning/checkmarx.yml @@ -17,10 +17,18 @@ on: - cron: $cron-weekly # A workflow run is made up of one or more jobs that can run sequentially or in parallel - this job is specifically configured to use the Checkmarx CxFlow Action +permissions: + contents: read + jobs: # This workflow contains a single job called "build" build: # The type of runner that the job will run on - Ubuntu is required as Docker is leveraged for the action + permissions: + contents: read # for actions/checkout to fetch code + issues: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to github issues + pull-requests: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to PR + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results runs-on: ubuntu-latest # Steps require - checkout code, run CxFlow Action, Upload SARIF report (optional)