mirror of
https://github.com/centreon/centreon-plugins.git
synced 2025-07-31 01:24:35 +02:00
69 lines
2.2 KiB
YAML
69 lines
2.2 KiB
YAML
name: Checkmarx scans
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
module_name:
|
|
required: true
|
|
type: string
|
|
module_directory:
|
|
required: false
|
|
type: string
|
|
|
|
secrets:
|
|
base_uri:
|
|
required: true
|
|
cx_tenant:
|
|
required: true
|
|
cx_client_id:
|
|
required: true
|
|
cx_client_secret:
|
|
required: true
|
|
|
|
jobs:
|
|
pipeline-scan:
|
|
name: Run a pipeline scan
|
|
runs-on: ubuntu-24.04
|
|
|
|
steps:
|
|
- name: routing
|
|
run: |
|
|
# Quality gate settings
|
|
ENABLE_QG="true"
|
|
if [[ "${{ vars.CHECKMARX_QUALITY_GATE }}" != "yes" ]]; then
|
|
# disabling all QG in case of incident with the service
|
|
ENABLE_QG="false"
|
|
echo "Skipping analysis. Caused by QG override"
|
|
elif [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.user.id }}" == "49699333" ]]; then
|
|
# disabling the QG in case of pull request opened by dependabot bot
|
|
# As dependabot will not be able to access GH secrets
|
|
ENABLE_QG="false"
|
|
echo "Skipping analysis. Caused by dependabot PR"
|
|
fi
|
|
|
|
# Check forced full scan
|
|
SCAN_MODE="--sast-incremental"
|
|
if [[ "${{ github.event_name }}" == "schedule" || "${{ vars.CHECKMARX_FORCE_FULL_SCAN }}" == "yes" ]]; then
|
|
SCAN_MODE="--sast-incremental=false"
|
|
fi
|
|
|
|
echo "scan_mode=$SCAN_MODE" >> $GITHUB_ENV
|
|
echo "enable_analysis=$ENABLE_QG" >> $GITHUB_ENV
|
|
cat $GITHUB_ENV
|
|
|
|
- name: Checkout
|
|
if: env.enable_analysis == 'true'
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Checkmarx One CLI Action
|
|
if: env.enable_analysis == 'true'
|
|
uses: checkmarx/ast-github-action@88c60148b7b9689d67eb05bf66a65bbb871f2f2c # v2.3.20
|
|
with:
|
|
project_name: ${{ inputs.module_name }}
|
|
base_uri: ${{ secrets.base_uri }}
|
|
cx_tenant: ${{ secrets.cx_tenant }}
|
|
cx_client_id: ${{ secrets.cx_client_id }}
|
|
cx_client_secret: ${{ secrets.cx_client_secret }}
|
|
source_dir: "./"
|
|
additional_params: --scan-types "sast,sca,api-security" ${{ env.scan_mode }}
|