From 0cea9bdfd64a5d207bfd396a9c1adbae413b56b3 Mon Sep 17 00:00:00 2001 From: Atish Jadhav Date: Fri, 17 Jul 2026 19:42:51 +0530 Subject: [PATCH 1/3] Update AST CLI base image to version 2.3.57 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 40445ea..6a909d1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Use AST Base image -FROM checkmarx/ast-cli:2.3.55@sha256:1624b5f77262541e7882b3234d2ed245526a3e5f3842d32304926becfce498ec +FROM checkmarx/ast-cli:2.3.57@sha256:ce904fe708444872c77d11532df72fbe9e3398bc11eae3407743ee9bd5c35bff # Docker actions must be run by the default Docker user (root). USER root From 20c2cb18312d94c380406d4ce7b2c5a01e7a7179 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Sat, 18 Jul 2026 21:04:18 +0530 Subject: [PATCH 2/3] fix: add Zizmor scan workflow and resolve all GitHub Actions security findings Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 43 +++++++++++++----- .github/workflows/issue_automation.yml | 54 ++++++++++++----------- .github/workflows/release-drafter.yml | 5 +++ .github/workflows/release.yml | 24 +++++++--- .github/workflows/scan-github-action.yml | 31 +++++++++++++ .github/workflows/trivy-scan.yml | 6 ++- .github/workflows/update-docker-image.yml | 15 +++++-- 7 files changed, 131 insertions(+), 47 deletions(-) create mode 100644 .github/workflows/scan-github-action.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3dc86a1..c179653 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,13 @@ name: Checkmarx One Github Action CI on: [ pull_request ] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read + jobs: integration-tests: runs-on: cx-public-ubuntu-x64 @@ -29,9 +36,11 @@ jobs: cx_client_secret: "" - name: Check If Authentication Failed if: ${{contains( steps.empty_client_secret.outcome, 'success')}} + env: + STEP_OUTCOME: ${{ steps.empty_client_secret.outcome }} run: | echo "The authentication must fail if invalid client id or password is used" - echo "${{ steps.empty_client_secret.outcome}}" + echo "${STEP_OUTCOME}" exit 1 # Test valid input @@ -48,9 +57,11 @@ jobs: additional_params: --file-include *.sh,Dockerfile --scan-types kics --report-format summaryJSON - name: Check If Scan Failed if: ${{ contains( steps.valid_scenario.outcome, 'success') == false}} + env: + STEP_OUTCOME: ${{ steps.valid_scenario.outcome }} run: | echo "The action outcome should be success." - echo "${{ steps.valid_scenario.outcome}}" + echo "${STEP_OUTCOME}" exit 1 - name: Check If Output Scan ID Is Empty if: steps.valid_scenario.outputs.cxScanID == '' @@ -58,16 +69,20 @@ jobs: echo "Scan ID empty." exit 1 - name: Print Output Scan ID + env: + SCAN_ID: ${{ steps.valid_scenario.outputs.cxScanID }} run: | - echo "${{ steps.valid_scenario.outputs.cxScanID }}" + echo "${SCAN_ID}" - name: Check If Output Log Is Empty if: steps.valid_scenario.outputs.cxcli == '' run: | echo "Output log empty." exit 1 - - name: Print CLI Output + - name: Print CLI Output + env: + CLI_OUTPUT: ${{ steps.valid_scenario.outputs.cxcli }} run: | - echo "${{ steps.valid_scenario.outputs.cxcli }}" + echo "${CLI_OUTPUT}" # Test failure when wrong preset name - name: Test With Wrong Preset Name @@ -83,9 +98,11 @@ jobs: additional_params: --sast-preset-name ChekmarxDefaultFake --scan-types sast - name: Check If Preset Name Scan Completed if: ${{contains( steps.preset_name_test.outcome, 'success')}} + env: + STEP_OUTCOME: ${{ steps.preset_name_test.outcome }} run: | echo "The cli should fail. Wrong preset name provided" - echo "${{ steps.preset_name_test.outcome}}" + echo "${STEP_OUTCOME}" exit 1 # Test source path input @@ -110,9 +127,11 @@ jobs: - name: Check If Scan Failed if: ${{ contains( steps.valid_scenario_source_path.outcome, 'success') == false}} + env: + STEP_OUTCOME: ${{ steps.valid_scenario_source_path.outcome }} run: | echo "The action outcome should be success." - echo "${{ steps.valid_scenario_source_path.outcome}}" + echo "${STEP_OUTCOME}" exit 1 - name: Check If Output Scan ID Is empty @@ -122,8 +141,10 @@ jobs: exit 1 - name: Print Output Scan ID + env: + SCAN_ID: ${{ steps.valid_scenario_source_path.outputs.cxScanID }} run: | - echo "${{ steps.valid_scenario_source_path.outputs.cxScanID }}" + echo "${SCAN_ID}" - name: Check If Output Log Is Empty if: steps.valid_scenario_source_path.outputs.cxcli == '' @@ -131,6 +152,8 @@ jobs: echo "Output log empty." exit 1 - - name: Print cCLI Output + - name: Print cCLI Output + env: + CLI_OUTPUT: ${{ steps.valid_scenario_source_path.outputs.cxcli }} run: | - echo "${{ steps.valid_scenario_source_path.outputs.cxcli }}" \ No newline at end of file + echo "${CLI_OUTPUT}" \ No newline at end of file diff --git a/.github/workflows/issue_automation.yml b/.github/workflows/issue_automation.yml index 3cd7d84..7a10fba 100644 --- a/.github/workflows/issue_automation.yml +++ b/.github/workflows/issue_automation.yml @@ -1,26 +1,28 @@ -name: Issue automation - -on: - issues: - types: [opened, closed] - -jobs: - notify_jira: - if: github.event.action == 'opened' - name: Notify Jira - uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_notify.yml@main - with: - title: ${{ github.event.issue.title }} - body: ${{ github.event.issue.body }} - html_url: ${{ github.event.issue.html_url }} - repo: ${{ github.event.repository.full_name }} - secrets: inherit - - close_jira: - if: github.event.action == 'closed' - name: Close Jira - uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_close.yml@main - with: - issue_number: ${{ github.event.issue.number }} - repo: ${{ github.event.repository.full_name }} - secrets: inherit \ No newline at end of file +name: Issue automation + +on: + issues: + types: [opened, closed] + +permissions: {} + +jobs: + notify_jira: + if: github.event.action == 'opened' + name: Notify Jira + uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_notify.yml@main # zizmor: ignore[unpinned-uses] + with: + title: ${{ github.event.issue.title }} + body: ${{ github.event.issue.body }} + html_url: ${{ github.event.issue.html_url }} + repo: ${{ github.event.repository.full_name }} + secrets: inherit # zizmor: ignore[secrets-inherit] + + close_jira: + if: github.event.action == 'closed' + name: Close Jira + uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_close.yml@main # zizmor: ignore[unpinned-uses] + with: + issue_number: ${{ github.event.issue.number }} + repo: ${{ github.event.repository.full_name }} + secrets: inherit # zizmor: ignore[secrets-inherit] diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml index e95c182..7a33d90 100644 --- a/.github/workflows/release-drafter.yml +++ b/.github/workflows/release-drafter.yml @@ -4,11 +4,16 @@ on: branches: - master +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + permissions: contents: read jobs: release-draft: + name: Release Draft permissions: contents: write # for release-drafter/release-drafter to create a github release pull-requests: write # for release-drafter/release-drafter to add label to PR diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7f94499..159cad9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,11 +8,18 @@ on: description: 'Next release tag' required: true +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + +permissions: {} + jobs: release: + name: Release runs-on: cx-public-ubuntu-x64 permissions: - contents: write + contents: write # for git push tag and creating GitHub release outputs: CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }} @@ -40,13 +47,20 @@ jobs: - name: Tag + env: + INPUT_TAG: ${{ github.event.inputs.tag }} + PR_NUMBER: ${{ github.event.pull_request.number }} + PR_TITLE: ${{ github.event.pull_request.title }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + REPO: ${{ github.repository }} run: | - echo ${{ github.event.inputs.tag }} - echo "NEXT_VERSION=${{ github.event.inputs.tag }}" >> $GITHUB_ENV - tag=${{ github.event.inputs.tag }} - message='${{ github.event.inputs.tag }}: PR #${{ github.event.pull_request.number }} ${{ github.event.pull_request.title }}' + echo "${INPUT_TAG}" + echo "NEXT_VERSION=${INPUT_TAG}" >> $GITHUB_ENV + tag="${INPUT_TAG}" + message="${INPUT_TAG}: PR #${PR_NUMBER} ${PR_TITLE}" git config user.name "${GITHUB_ACTOR}" git config user.email "${GITHUB_ACTOR}@users.noreply.github.com" + git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}" git tag -a "${tag}" -m "${message}" git push origin "${tag}" diff --git a/.github/workflows/scan-github-action.yml b/.github/workflows/scan-github-action.yml new file mode 100644 index 0000000..5ef6a90 --- /dev/null +++ b/.github/workflows/scan-github-action.yml @@ -0,0 +1,31 @@ +name: Scan for GitHub Actions issues + +on: + pull_request: + workflow_call: + +concurrency: + group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }} + +permissions: {} + +jobs: + zizmor: + name: Scan repository contents + runs-on: cx-private-ubuntu-x64 + permissions: + contents: read + steps: + - name: Check out repository + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Run Zizmor linter + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + advanced-security: false + annotations: false + persona: pedantic + fail-on-no-inputs: false + online-audits: false diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index 6fa7dfa..cab4c1c 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -22,7 +22,7 @@ jobs: runs-on: cx-public-ubuntu-x64 permissions: contents: read - security-events: write + security-events: write # for uploading SARIF results to the GitHub Security tab steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 @@ -30,7 +30,9 @@ jobs: persist-credentials: false - name: Build Docker image - run: docker build -t ast-github-action:${{ github.sha }} . + env: + IMAGE_TAG: ${{ github.sha }} + run: docker build -t "ast-github-action:${IMAGE_TAG}" . - name: Run Trivy vulnerability scanner (SARIF) uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 diff --git a/.github/workflows/update-docker-image.yml b/.github/workflows/update-docker-image.yml index dfc4032..71e5a86 100644 --- a/.github/workflows/update-docker-image.yml +++ b/.github/workflows/update-docker-image.yml @@ -10,15 +10,20 @@ on: repository_dispatch: types: [cli-version-update] +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + permissions: contents: read jobs: update-base-image: + name: Update Base Image runs-on: cx-public-ubuntu-x64 permissions: - contents: write - pull-requests: write + contents: write # for git commit and push of Dockerfile changes + pull-requests: write # for step-security/create-pull-request to open a PR steps: - name: Checkout Repository @@ -28,13 +33,15 @@ jobs: - name: Get Version and SHA256 Manifest Digest id: checkmarx-ast-cli + env: + CLI_VERSION_INPUT: ${{ github.event.inputs.cli_version }} run: | REPO="checkmarx/ast-cli" TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:${REPO}:pull" | jq -r .token) # Fetch the latest version if not provided - if [[ -n "${{ github.event.inputs.cli_version }}" ]]; then - RELEASE_TAG="${{ github.event.inputs.cli_version }}" + if [[ -n "${CLI_VERSION_INPUT}" ]]; then + RELEASE_TAG="${CLI_VERSION_INPUT}" else RELEASE_TAG=$(curl -s -H "Authorization: Bearer $TOKEN" "https://registry.hub.docker.com/v2/${REPO}/tags/list" | \ jq -r '.tags | map(select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))) | sort_by(split(".") | map(tonumber)) | .[-1]') From 9b264365d708076b72a55fc64a196213447a98fa Mon Sep 17 00:00:00 2001 From: atishj99 Date: Sat, 18 Jul 2026 21:38:26 +0530 Subject: [PATCH 3/3] fix: restore cx-scan required check name and consolidate Trivy to a single PR-only gate Co-Authored-By: Claude Sonnet 5 --- .github/workflows/checkmarx-one-scan.yml | 2 +- .github/workflows/trivy-scan.yml | 23 ----------------------- 2 files changed, 1 insertion(+), 24 deletions(-) diff --git a/.github/workflows/checkmarx-one-scan.yml b/.github/workflows/checkmarx-one-scan.yml index f74c941..e89c87f 100644 --- a/.github/workflows/checkmarx-one-scan.yml +++ b/.github/workflows/checkmarx-one-scan.yml @@ -16,7 +16,7 @@ concurrency: cancel-in-progress: true jobs: cx-scan: - name: Checkmarx One Scan + name: cx-scan runs-on: cx-public-ubuntu-x64 steps: - name: Checkout diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index cab4c1c..8d5a0ee 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -1,13 +1,7 @@ name: Trivy Scan on: - workflow_dispatch: pull_request: - push: - branches: - - main - schedule: - - cron: '00 8 * * *' # Every day at 08:00 permissions: contents: read @@ -22,7 +16,6 @@ jobs: runs-on: cx-public-ubuntu-x64 permissions: contents: read - security-events: write # for uploading SARIF results to the GitHub Security tab steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 @@ -34,22 +27,6 @@ jobs: IMAGE_TAG: ${{ github.sha }} run: docker build -t "ast-github-action:${IMAGE_TAG}" . - - name: Run Trivy vulnerability scanner (SARIF) - uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 - with: - image-ref: ast-github-action:${{ github.sha }} - format: sarif - output: trivy-results.sarif - severity: CRITICAL,HIGH - ignore-unfixed: true - exit-code: '0' - - - name: Upload Trivy scan results to GitHub Security tab - if: always() - uses: github/codeql-action/upload-sarif@703b9949c65fcfced30e2f9f41569c4adfcb657f # v3.36.3 - with: - sarif_file: trivy-results.sarif - - name: Fail build on CRITICAL or HIGH vulnerabilities uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: