Update AST CLI base image to version 2.3.57

.github/workflows/checkmarx-one-scan.yml

@@ -16,7 +16,7 @@ concurrency:
   cancel-in-progress: true
 jobs:
   cx-scan:
-    name: Checkmarx One Scan
+    name: cx-scan
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout

.github/workflows/ci.yml

@@ -2,6 +2,13 @@ name: Checkmarx One Github Action CI
 
 on: [ pull_request ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   integration-tests:
     runs-on: cx-public-ubuntu-x64
@@ -29,9 +36,11 @@ jobs:
           cx_client_secret: ""
       - name: Check If Authentication Failed
         if: ${{contains( steps.empty_client_secret.outcome, 'success')}}
+        env:
+          STEP_OUTCOME: ${{ steps.empty_client_secret.outcome }}
         run: |
           echo "The authentication must fail if invalid client id or password is used"
-          echo "${{ steps.empty_client_secret.outcome}}"
+          echo "${STEP_OUTCOME}"
           exit 1
 
       # Test valid input
@@ -48,26 +57,32 @@ jobs:
           additional_params: --file-include *.sh,Dockerfile --scan-types kics --report-format summaryJSON
       - name: Check If Scan Failed
         if: ${{ contains( steps.valid_scenario.outcome, 'success') == false}}
+        env:
+          STEP_OUTCOME: ${{ steps.valid_scenario.outcome }}
         run: |
           echo "The action outcome should be success."
-          echo "${{ steps.valid_scenario.outcome}}"
+          echo "${STEP_OUTCOME}"
           exit 1
       - name: Check If Output Scan ID Is Empty
         if: steps.valid_scenario.outputs.cxScanID == ''
         run: |
           echo "Scan ID empty."
           exit 1
       - name: Print Output Scan ID
+        env:
+          SCAN_ID: ${{ steps.valid_scenario.outputs.cxScanID }}
         run: |
-          echo "${{ steps.valid_scenario.outputs.cxScanID }}"
+          echo "${SCAN_ID}"
       - name: Check If Output Log Is Empty
         if: steps.valid_scenario.outputs.cxcli == ''
         run: |
           echo "Output log empty."
           exit 1
-      - name: Print CLI Output 
+      - name: Print CLI Output
+        env:
+          CLI_OUTPUT: ${{ steps.valid_scenario.outputs.cxcli }}
         run: |
-          echo "${{ steps.valid_scenario.outputs.cxcli }}"
+          echo "${CLI_OUTPUT}"
 
       # Test failure when wrong preset name
       - name: Test With Wrong Preset Name
@@ -83,9 +98,11 @@ jobs:
           additional_params: --sast-preset-name ChekmarxDefaultFake --scan-types sast
       - name: Check If Preset Name Scan Completed
         if: ${{contains( steps.preset_name_test.outcome, 'success')}}
+        env:
+          STEP_OUTCOME: ${{ steps.preset_name_test.outcome }}
         run: |
           echo "The cli should fail. Wrong preset name provided"
-          echo "${{ steps.preset_name_test.outcome}}"
+          echo "${STEP_OUTCOME}"
           exit 1
 
       # Test source path input
@@ -110,9 +127,11 @@ jobs:
 
       - name: Check If Scan Failed
         if: ${{ contains( steps.valid_scenario_source_path.outcome, 'success') == false}}
+        env:
+          STEP_OUTCOME: ${{ steps.valid_scenario_source_path.outcome }}
         run: |
           echo "The action outcome should be success."
-          echo "${{ steps.valid_scenario_source_path.outcome}}"
+          echo "${STEP_OUTCOME}"
           exit 1
 
       - name: Check If Output Scan ID Is empty
@@ -122,15 +141,19 @@ jobs:
           exit 1
 
       - name: Print Output Scan ID
+        env:
+          SCAN_ID: ${{ steps.valid_scenario_source_path.outputs.cxScanID }}
         run: |
-          echo "${{ steps.valid_scenario_source_path.outputs.cxScanID }}"
+          echo "${SCAN_ID}"
 
       - name: Check If Output Log Is Empty
         if: steps.valid_scenario_source_path.outputs.cxcli == ''
         run: |
           echo "Output log empty."
           exit 1
 
-      - name: Print cCLI Output 
+      - name: Print cCLI Output
+        env:
+          CLI_OUTPUT: ${{ steps.valid_scenario_source_path.outputs.cxcli }}
         run: |
-          echo "${{ steps.valid_scenario_source_path.outputs.cxcli }}"
+          echo "${CLI_OUTPUT}"

.github/workflows/issue_automation.yml

@@ -1,26 +1,28 @@
-name: Issue automation
-
-on:
-  issues:
-    types: [opened, closed]
-
-jobs:
-  notify_jira:
-    if: github.event.action == 'opened'
-    name: Notify Jira
-    uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_notify.yml@main
-    with:
-      title: ${{ github.event.issue.title }}
-      body: ${{ github.event.issue.body }}
-      html_url: ${{ github.event.issue.html_url }}
-      repo: ${{ github.event.repository.full_name }}
-    secrets: inherit
-
-  close_jira:
-    if: github.event.action == 'closed'
-    name: Close Jira
-    uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_close.yml@main
-    with:
-      issue_number: ${{ github.event.issue.number }}
-      repo: ${{ github.event.repository.full_name }}
-    secrets: inherit
+name: Issue automation
+
+on:
+  issues:
+    types: [opened, closed]
+
+permissions: {}
+
+jobs:
+  notify_jira:
+    if: github.event.action == 'opened'
+    name: Notify Jira
+    uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_notify.yml@main # zizmor: ignore[unpinned-uses]
+    with:
+      title: ${{ github.event.issue.title }}
+      body: ${{ github.event.issue.body }}
+      html_url: ${{ github.event.issue.html_url }}
+      repo: ${{ github.event.repository.full_name }}
+    secrets: inherit # zizmor: ignore[secrets-inherit]
+
+  close_jira:
+    if: github.event.action == 'closed'
+    name: Close Jira
+    uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_close.yml@main # zizmor: ignore[unpinned-uses]
+    with:
+      issue_number: ${{ github.event.issue.number }}
+      repo: ${{ github.event.repository.full_name }}
+    secrets: inherit # zizmor: ignore[secrets-inherit]

.github/workflows/release-drafter.yml

@@ -4,11 +4,16 @@ on:
     branches:
       - master
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   release-draft:
+    name: Release Draft
     permissions:
       contents: write  # for release-drafter/release-drafter to create a github release
       pull-requests: write  # for release-drafter/release-drafter to add label to PR

.github/workflows/release.yml

@@ -8,11 +8,18 @@ on:
         description: 'Next release tag'
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions: {}
+
 jobs:
   release:
+    name: Release
     runs-on: cx-public-ubuntu-x64
     permissions:
-      contents: write
+      contents: write  # for git push tag and creating GitHub release
     outputs:
       CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }}
 
@@ -40,13 +47,20 @@ jobs:
 
 
       - name: Tag
+        env:
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
         run: |
-          echo ${{ github.event.inputs.tag }}
-          echo "NEXT_VERSION=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
-          tag=${{ github.event.inputs.tag }}
-          message='${{ github.event.inputs.tag }}: PR #${{ github.event.pull_request.number }} ${{ github.event.pull_request.title }}'
+          echo "${INPUT_TAG}"
+          echo "NEXT_VERSION=${INPUT_TAG}" >> $GITHUB_ENV
+          tag="${INPUT_TAG}"
+          message="${INPUT_TAG}: PR #${PR_NUMBER} ${PR_TITLE}"
           git config user.name "${GITHUB_ACTOR}"
           git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}"
           git tag -a "${tag}" -m "${message}"
           git push origin "${tag}"
 

.github/workflows/scan-github-action.yml

@@ -0,0 +1,31 @@
+name: Scan for GitHub Actions issues
+
+on:
+  pull_request:
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Scan repository contents
+    runs-on: cx-private-ubuntu-x64
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Run Zizmor linter
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          advanced-security: false
+          annotations: false
+          persona: pedantic
+          fail-on-no-inputs: false
+          online-audits: false

.github/workflows/trivy-scan.yml

@@ -1,13 +1,7 @@
 name: Trivy Scan
 
 on:
-  workflow_dispatch:
   pull_request:
-  push:
-    branches:
-      - main
-  schedule:
-    - cron: '00 8 * * *' # Every day at 08:00
 
 permissions:
   contents: read
@@ -22,31 +16,16 @@ jobs:
     runs-on: cx-public-ubuntu-x64
     permissions:
       contents: read
-      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
       - name: Build Docker image
-        run: docker build -t ast-github-action:${{ github.sha }} .
-
-      - name: Run Trivy vulnerability scanner (SARIF)
-        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
-        with:
-          image-ref: ast-github-action:${{ github.sha }}
-          format: sarif
-          output: trivy-results.sarif
-          severity: CRITICAL,HIGH
-          ignore-unfixed: true
-          exit-code: '0'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        if: always()
-        uses: github/codeql-action/upload-sarif@703b9949c65fcfced30e2f9f41569c4adfcb657f # v3.36.3
-        with:
-          sarif_file: trivy-results.sarif
+        env:
+          IMAGE_TAG: ${{ github.sha }}
+        run: docker build -t "ast-github-action:${IMAGE_TAG}" .
 
       - name: Fail build on CRITICAL or HIGH vulnerabilities
         uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0

.github/workflows/update-docker-image.yml

@@ -10,15 +10,20 @@ on:
   repository_dispatch:
     types: [cli-version-update]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   update-base-image:
+    name: Update Base Image
     runs-on: cx-public-ubuntu-x64
     permissions:
-      contents: write
-      pull-requests: write
+      contents: write  # for git commit and push of Dockerfile changes
+      pull-requests: write  # for step-security/create-pull-request to open a PR
 
     steps:
       - name: Checkout Repository
@@ -28,13 +33,15 @@ jobs:
 
       - name: Get Version and SHA256 Manifest Digest
         id: checkmarx-ast-cli
+        env:
+          CLI_VERSION_INPUT: ${{ github.event.inputs.cli_version }}
         run: |
           REPO="checkmarx/ast-cli"
           TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:${REPO}:pull" | jq -r .token)
 
           # Fetch the latest version if not provided
-          if [[ -n "${{ github.event.inputs.cli_version }}" ]]; then
-            RELEASE_TAG="${{ github.event.inputs.cli_version }}"
+          if [[ -n "${CLI_VERSION_INPUT}" ]]; then
+            RELEASE_TAG="${CLI_VERSION_INPUT}"
           else
             RELEASE_TAG=$(curl -s -H "Authorization: Bearer $TOKEN" "https://registry.hub.docker.com/v2/${REPO}/tags/list" | \
               jq -r '.tags | map(select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))) | sort_by(split(".") | map(tonumber)) | .[-1]')

Dockerfile

@@ -1,5 +1,5 @@
 # Use AST Base image
-FROM checkmarx/ast-cli:2.3.55@sha256:1624b5f77262541e7882b3234d2ed245526a3e5f3842d32304926becfce498ec
+FROM checkmarx/ast-cli:2.3.57@sha256:ce904fe708444872c77d11532df72fbe9e3398bc11eae3407743ee9bd5c35bff
 
 # Docker actions must be run by the default Docker user (root).
 USER root