Merge branch 'main' into other/path-traversal-fix

Author: cx-aniket-shinde

.github/workflows/ai-code-review.yml

@@ -8,6 +8,7 @@ on:
 
 jobs:
   code_review:
+    if: false
     uses: Checkmarx/plugins-release-workflow/.github/workflows/ai-code-review.yml@main
     with:
       open_ai_model: "gpt-4-1106-preview"

.github/workflows/ci-tests.yml

@@ -132,19 +132,23 @@ jobs:
           skip-pkg-cache: true
           version: v2.11.3
           args: -c .golangci.yml
-            --timeout 5m
+            --timeout 10m
           only-new-issues: true
 
   govulncheck:
     runs-on: ubuntu-latest
     name: govulncheck
     steps:
-      - id: govulncheck
-        uses: golang/govulncheck-action@7da72f730e37eeaad891fcff0a532d27ed737cd4 #v1
-        continue-on-error: true
+      - uses: actions/checkout@1e31de5234b9f8995739874a8ce0492dc87873e2 #v4.0.0
+      - name: Set up Go version
+        uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 #v4
         with:
           go-version-file: go.mod
-          go-package: ./...
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 #1.3.0
+      - name: Run govulncheck
+        run: govulncheck ./...
+        continue-on-error: true
 
   checkDockerImage:
     runs-on: ubuntu-latest
@@ -154,14 +158,14 @@ jobs:
         uses: actions/checkout@722adc63f1aa60a57ec37892e133b1d319cae598 #2.0.0
 
 
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@cf09c5c41b299b55c366aff30022701412eb6ab0 #v1.0.0
+      # - name: Set up Docker
+      #   uses: docker/setup-buildx-action@cf09c5c41b299b55c366aff30022701412eb6ab0 #v1.0.0
 
-      - name: Log in to Docker Hub
-        uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b #v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+      # - name: Log in to Docker Hub
+      #   uses: docker/login-action@49ed152c8eca782a232dede0303416e8f356c37b #v2
+      #   with:
+      #     username: ${{ secrets.DOCKER_USERNAME }}
+      #     password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Build the project
         run: go build -o ./cx ./cmd
       - name: Build Docker image

.github/workflows/nightly-parallel.yml

@@ -490,7 +490,7 @@ jobs:
         run: go install github.com/wadey/gocovmerge@latest
 
       - name: Download all coverage artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 #v4
         with:
           pattern: coverage-*
           merge-multiple: true

.github/workflows/release.yml

@@ -33,6 +33,7 @@ jobs:
     runs-on: macos-15-intel
     env:
       AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
+      AC_USER: ${{ secrets.AC_USER }}
       APPLE_DEVELOPER_CERTIFICATE_P12_BASE64: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_P12_BASE64 }}
       APPLE_DEVELOPER_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_CERTIFICATE_PASSWORD }}
       COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}

.golangci.yml

@@ -2,7 +2,7 @@
 
 version: "2"
 run:
-  timeout: 5m
+  timeout: 10m
 
 linters:
   enable:

.goreleaser-dev.yml

@@ -83,7 +83,7 @@ universal_binaries:
     replace: true
     name_template: "cx"
     hooks:
-      post: gon gonMac.hcl
+      post: bash -c 'envsubst < gonMac.hcl > /tmp/gonMac.hcl && gon /tmp/gonMac.hcl'
 
 blobs:
   - provider: s3

.goreleaser.yml

@@ -110,7 +110,7 @@ universal_binaries:
     replace: true
     name_template: "cx"
     hooks:
-      post: gon gonMac.hcl
+      post: bash -c 'envsubst < gonMac.hcl > /tmp/gonMac.hcl && gon /tmp/gonMac.hcl'
 
 brews:
   - tap:

Dockerfile

@@ -1,4 +1,4 @@
-FROM checkmarx/bash:5.3-r5-98621acba7807a@sha256:98621acba7807a4e128f3e00aba3987e4f659ff352191f79cdbaa7f8a32cfb58
+FROM checkmarx/bash:5.3-r12-0e56cb6e000601@sha256:0e56cb6e000601d35ed11ddcc973ca268c431a176be53cdc31bc85f3208dc44a
 USER nonroot
 
 COPY cx /app/bin/cx

README.md

@@ -136,3 +136,5 @@ Project Link: [https://github.com/Checkmarx/ast-cli](https://github.com/Checkmar
 [issues-url]: https://github.com/Checkmarx/ast-cli/issues
 [license-shield]: https://img.shields.io/github/license/Checkmarx/ast-cli.svg
 [license-url]: https://github.com/Checkmarx/ast-cli/blob/main/LICENSE
+
+