You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
89 lines
2.8 KiB
89 lines
2.8 KiB
name: Scan |
|
|
|
on: |
|
workflow_dispatch: |
|
push: |
|
branches: |
|
- "main" |
|
pull_request_target: |
|
types: [opened, synchronize] |
|
|
|
jobs: |
|
check-run: |
|
name: Check PR run |
|
uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main |
|
|
|
sast: |
|
name: SAST scan |
|
runs-on: ubuntu-22.04 |
|
needs: check-run |
|
permissions: |
|
contents: read |
|
pull-requests: write |
|
security-events: write |
|
|
|
steps: |
|
- name: Check out repo |
|
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 |
|
with: |
|
ref: ${{ github.event.pull_request.head.sha }} |
|
|
|
- name: Scan with Checkmarx |
|
uses: checkmarx/ast-github-action@1fe318de2993222574e6249750ba9000a4e2a6cd # 2.0.33 |
|
env: |
|
INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}" |
|
with: |
|
project_name: ${{ github.repository }} |
|
cx_tenant: ${{ secrets.CHECKMARX_TENANT }} |
|
base_uri: https://ast.checkmarx.net/ |
|
cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }} |
|
cx_client_secret: ${{ secrets.CHECKMARX_SECRET }} |
|
additional_params: | |
|
--report-format sarif \ |
|
--filter "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT" \ |
|
--output-path . ${{ env.INCREMENTAL }} |
|
|
|
- name: Upload Checkmarx results to GitHub |
|
uses: github/codeql-action/upload-sarif@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0 |
|
with: |
|
sarif_file: cx_result.sarif |
|
|
|
quality: |
|
name: Quality scan |
|
runs-on: ubuntu-22.04 |
|
needs: check-run |
|
permissions: |
|
contents: read |
|
pull-requests: write |
|
|
|
steps: |
|
- name: Set up JDK 17 |
|
uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2 |
|
with: |
|
java-version: 17 |
|
distribution: "zulu" |
|
|
|
- name: Check out repo |
|
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 |
|
with: |
|
fetch-depth: 0 |
|
ref: ${{ github.event.pull_request.head.sha }} |
|
|
|
- name: Set up .NET |
|
uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee # v4.0.1 |
|
|
|
- name: Install SonarCloud scanner |
|
run: dotnet tool install dotnet-sonarscanner -g |
|
|
|
- name: Scan with SonarCloud |
|
env: |
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
|
run: | |
|
dotnet-sonarscanner begin /k:"${{ github.repository_owner }}_${{ github.event.repository.name }}" \ |
|
/d:sonar.test.inclusions=test/ \ |
|
/d:sonar.exclusions=test/ \ |
|
/o:"${{ github.repository_owner }}" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" \ |
|
/d:sonar.host.url="https://sonarcloud.io" |
|
dotnet build |
|
dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}"
|
|
|