Josh Soref
56 lines
2.6 KiB
YAML
56 lines
2.6 KiB
YAML
# This workflow uses actions that are not certified by GitHub.
|
|
# They are provided by a third-party and are governed by
|
|
# separate terms of service, privacy policy, and support
|
|
# documentation.
|
|
|
|
# This is a basic workflow to help you get started with Using Checkmarx CxFlow Action
|
|
|
|
name: CxFlow
|
|
|
|
on:
|
|
push:
|
|
branches: [ $default-branch, $protected-branches ]
|
|
pull_request:
|
|
# The branches below must be a subset of the branches above
|
|
branches: [ $default-branch ]
|
|
schedule:
|
|
- cron: $cron-weekly
|
|
|
|
# A workflow run is made up of one or more jobs that can run sequentially or in parallel - this job is specifically configured to use the Checkmarx CxFlow Action
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# This workflow contains a single job called "build"
|
|
build:
|
|
# The type of runner that the job will run on - Ubuntu is required as Docker is leveraged for the action
|
|
permissions:
|
|
contents: read # for actions/checkout to fetch code
|
|
issues: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to github issues
|
|
pull-requests: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to PR
|
|
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
|
|
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
|
|
runs-on: ubuntu-latest
|
|
|
|
# Steps require - checkout code, run CxFlow Action, Upload SARIF report (optional)
|
|
steps:
|
|
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
|
|
- uses: actions/checkout@v4
|
|
# Runs the Checkmarx Scan leveraging the latest version of CxFlow - REFER to Action README for list of inputs
|
|
- name: Checkmarx CxFlow Action
|
|
uses: checkmarx-ts/checkmarx-cxflow-github-action@49d8269b14ca87910ba003d47a31fa0c7a11f2fe
|
|
with:
|
|
project: ${{ secrets.CHECKMARX_PROJECT }}
|
|
team: ${{ secrets.CHECKMARX_TEAMS }}
|
|
checkmarx_url: ${{ secrets.CHECKMARX_URL }}
|
|
checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
|
|
checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
|
|
checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
|
|
scanners: sast
|
|
params: --namespace=${{ github.repository_owner }} --repo-name=${{ github.event.repository.name }} --branch=${{ github.ref }} --cx-flow.filter-severity --cx-flow.filter-category --checkmarx.disable-clubbing=true --repo-url=${{ github.event.repository.url }}
|
|
# Upload the Report for CodeQL/Security Alerts
|
|
- name: Upload SARIF file
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: cx.sarif
|