ci: switch to checkmarx one scans

Author: shank-eric

.github/workflows/security.yml

@@ -20,47 +20,18 @@ on:
       - test-gha-security
 
 jobs:
-  Checkmarx:
-    name: Checkmarx CxFlow Action
+  Checkmarx_One:
+    name: Checkmarx One
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      - name: Checkmarx CxFlow Action
-        uses: checkmarx-ts/checkmarx-cxflow-github-action@v1.9 #Github Action version
+      - name: Checkmarx AST Github Action
+        uses: Checkmarx/ast-github-action@2.0.23
         with:
-          # report-file: checkmarx.json
-          # auth-scopes: access_control_api sast_rest_api
-          # version: '9.4'
-          break_build: false
-          checkmarx_url: ${{ vars.CHECKMARX_URL }} # To be stored in GitHub Secrets.
-          checkmarx_username: ${{ vars.CHECKMARX_USERNAME }} # To be stored in GitHub Secrets.
-          checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }} # To be stored in GitHub Secrets.
-          checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }} # To be stored in GitHub Secrets.
-          params: --namespace=${{ github.repository_owner }} --checkmarx.settings-override=true --repo-name=${{ github.event.repository.name }} --branch=${{ github.ref_name }} --cx-flow.filterSeverity --cx-flow.filterCategory  --checkmarx.disable-clubbing=true
-          preset: Blackbaud SAST
-          project: ${{ github.event.repository.name }} # <-- Insert Checkmarx SAST Project Name
-          team: /CxServer/SP/Company/Everfi
-          scanners: sast
-
-  Mend:
-    name: Mend Scan
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Get branch name
-        shell: bash
-        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
-        id: get_branch_name
-      - name: Mend
-        env:
-          WHITESOURCE_API_KEY: ${{ secrets.WHITESOURCE_API_KEY }}
-          WHITESOURCE_API_BASE_URL: ${{ vars.WHITESOURCE_API_BASE_URL }}
-          WHITESOURCE_SERVER_URL: ${{ vars.WHITESOURCE_SERVER_URL }}
-          BRANCH: ${{ steps.get_branch_name.outputs.branch }}
-        shell: bash
-        run: |
-          echo $'\n'projectName=${{ github.event.repository.name }} >>scripts/whitesource/agent.config
-          echo $'\n'productName=foundry >>scripts/whitesource/agent.config
-          bash ./scripts/whitesource/scan.sh
+          base_uri: ${{ vars.CHECKMARX_ONE_BASE_URI}}
+          cx_tenant: ${{ vars.CHECKMARX_ONE_TENANT }}
+          cx_client_id: ${{ vars.CHECKMARX_ONE_CLIENT_ID}}
+          cx_client_secret: ${{ secrets.CHECKMARX_ONE_CLIENT_SECRET }}
+          project_name: ${{ github.event.repository.name }}
+          additional_params: --sast-preset-name "BlackbaudSAST" --project-groups "Everfi"