Skip to content

Commit 49b8342

Browse files
LCSOGthbLCSOGthb
authored
Create sonarcloud.yml (#12)
* Create sonarcloud.yml * Create codacy.yml (#16) * Create defender-for-devops.yml (#15) * Create checkmarx-one.yml (#14) * Create sonarqube.yml (#13)
1 parent a49c8cf commit 49b8342

5 files changed

Lines changed: 296 additions & 0 deletions

File tree

‎.github/workflows/checkmarx-one.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# The Checkmarx One GitHub Action enables you to trigger SAST, SCA, and KICS scans directly from the GitHub workflow.
7+
# It provides a wrapper around the Checkmarx One CLI Tool which creates a zip archive from your source code repository
8+
# and uploads it to Checkmarx One for scanning. The Github Action provides easy integration with GitHub while enabling
9+
# scan customization using the full functionality and flexibility of the CLI tool.
10+
11+
# This is a basic workflow to help you get started with Using Checkmarx One Action,
12+
# documentation can be found here : https://checkmarx.com/resource/documents/en/34965-68702-checkmarx-one-github-actions.html
13+
14+
name: Checkmarx Scan
15+
16+
# Controls when the workflow will run
17+
on:
18+
pull_request:
19+
types: [opened, reopened, synchronize]
20+
branches: [ "main" ]
21+
22+
permissions:
23+
contents: read
24+
25+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
26+
jobs:
27+
# This workflow contains a single job called "build"
28+
build:
29+
permissions:
30+
contents: read # for actions/checkout to fetch code
31+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
32+
actions: read # only required for a private repository by github/codeql-action/upload-sarif
33+
34+
# The type of runner that the job will run on
35+
runs-on: ubuntu-latest
36+
37+
# Steps represent a sequence of tasks that will be executed as part of the job
38+
steps:
39+
# This step checks out a copy of your repository.
40+
- name: Checkout repository
41+
uses: actions/checkout@v4
42+
# This step creates the Checkmarx One scan
43+
- name: Checkmarx One scan
44+
uses: checkmarx/ast-github-action@8e887bb93dacc44e0f5b64ee2b06d5815f89d4fc
45+
with:
46+
base_uri: https://ast.checkmarx.net # This should be replaced by your base uri for Checkmarx One
47+
cx_client_id: ${{ secrets.CX_CLIENT_ID }} # This should be created within your Checkmarx One account : https://checkmarx.com/resource/documents/en/34965-118315-authentication-for-checkmarx-one-cli.html#UUID-a4e31a96-1f36-6293-e95a-97b4b9189060_UUID-4123a2ff-32d0-2287-8dd2-3c36947f675e
48+
cx_client_secret: ${{ secrets.CX_CLIENT_SECRET }} # This should be created within your Checkmarx One account : https://checkmarx.com/resource/documents/en/34965-118315-authentication-for-checkmarx-one-cli.html#UUID-a4e31a96-1f36-6293-e95a-97b4b9189060_UUID-4123a2ff-32d0-2287-8dd2-3c36947f675e
49+
cx_tenant: ${{ secrets.CX_TENANT }} # This should be replaced by your tenant for Checkmarx One
50+
additional_params: --report-format sarif --output-path .
51+
- name: Upload SARIF file
52+
uses: github/codeql-action/upload-sarif@v3
53+
with:
54+
# Path to SARIF file relative to the root of the repository
55+
sarif_file: cx_result.sarif

‎.github/workflows/codacy.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow checks out code, performs a Codacy security scan
7+
# and integrates the results with the
8+
# GitHub Advanced Security code scanning feature. For more information on
9+
# the Codacy security scan action usage and parameters, see
10+
# https://github.com/codacy/codacy-analysis-cli-action.
11+
# For more information on Codacy Analysis CLI in general, see
12+
# https://github.com/codacy/codacy-analysis-cli.
13+
14+
name: Codacy Security Scan
15+
16+
on:
17+
push:
18+
branches: [ "main" ]
19+
pull_request:
20+
# The branches below must be a subset of the branches above
21+
branches: [ "main" ]
22+
schedule:
23+
- cron: '16 6 * * 5'
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
codacy-security-scan:
30+
permissions:
31+
contents: read # for actions/checkout to fetch code
32+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
33+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
34+
name: Codacy Security Scan
35+
runs-on: ubuntu-latest
36+
steps:
37+
# Checkout the repository to the GitHub Actions runner
38+
- name: Checkout code
39+
uses: actions/checkout@v4
40+
41+
# Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
42+
- name: Run Codacy Analysis CLI
43+
uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
44+
with:
45+
# Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
46+
# You can also omit the token and run the tools that support default configurations
47+
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
48+
verbose: true
49+
output: results.sarif
50+
format: sarif
51+
# Adjust severity of non-security issues
52+
gh-code-scanning-compat: true
53+
# Force 0 exit code to allow SARIF file generation
54+
# This will handover control about PR rejection to the GitHub side
55+
max-allowed-issues: 2147483647
56+
57+
# Upload the SARIF file generated in the previous step
58+
- name: Upload SARIF results file
59+
uses: github/codeql-action/upload-sarif@v3
60+
with:
61+
sarif_file: results.sarif

‎.github/workflows/defender-for-devops.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
#
6+
# Microsoft Security DevOps (MSDO) is a command line application which integrates static analysis tools into the development cycle.
7+
# MSDO installs, configures and runs the latest versions of static analysis tools
8+
# (including, but not limited to, SDL/security and compliance tools).
9+
#
10+
# The Microsoft Security DevOps action is currently in beta and runs on the windows-latest queue,
11+
# as well as Windows self hosted agents. ubuntu-latest support coming soon.
12+
#
13+
# For more information about the action , check out https://github.com/microsoft/security-devops-action
14+
#
15+
# Please note this workflow do not integrate your GitHub Org with Microsoft Defender For DevOps. You have to create an integration
16+
# and provide permission before this can report data back to azure.
17+
# Read the official documentation here : https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github
18+
19+
name: "Microsoft Defender For Devops"
20+
21+
on:
22+
push:
23+
branches: [ "main" ]
24+
pull_request:
25+
branches: [ "main" ]
26+
schedule:
27+
- cron: '37 6 * * 0'
28+
29+
jobs:
30+
MSDO:
31+
# currently only windows latest is supported
32+
runs-on: windows-latest
33+
34+
steps:
35+
- uses: actions/checkout@v4
36+
- uses: actions/setup-dotnet@v4
37+
with:
38+
dotnet-version: |
39+
5.0.x
40+
6.0.x
41+
- name: Run Microsoft Security DevOps
42+
uses: microsoft/security-devops-action@v1.6.0
43+
id: msdo
44+
- name: Upload results to Security tab
45+
uses: github/codeql-action/upload-sarif@v3
46+
with:
47+
sarif_file: ${{ steps.msdo.outputs.sarifFile }}

‎.github/workflows/sonarcloud.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow helps you trigger a SonarCloud analysis of your code and populates
7+
# GitHub Code Scanning alerts with the vulnerabilities found.
8+
# Free for open source project.
9+
10+
# 1. Login to SonarCloud.io using your GitHub account
11+
12+
# 2. Import your project on SonarCloud
13+
# * Add your GitHub organization first, then add your repository as a new project.
14+
# * Please note that many languages are eligible for automatic analysis,
15+
# which means that the analysis will start automatically without the need to set up GitHub Actions.
16+
# * This behavior can be changed in Administration > Analysis Method.
17+
#
18+
# 3. Follow the SonarCloud in-product tutorial
19+
# * a. Copy/paste the Project Key and the Organization Key into the args parameter below
20+
# (You'll find this information in SonarCloud. Click on "Information" at the bottom left)
21+
#
22+
# * b. Generate a new token and add it to your Github repository's secrets using the name SONAR_TOKEN
23+
# (On SonarCloud, click on your avatar on top-right > My account > Security
24+
# or go directly to https://sonarcloud.io/account/security/)
25+
26+
# Feel free to take a look at our documentation (https://docs.sonarcloud.io/getting-started/github/)
27+
# or reach out to our community forum if you need some help (https://community.sonarsource.com/c/help/sc/9)
28+
29+
name: SonarCloud analysis
30+
31+
on:
32+
push:
33+
branches: [ "main" ]
34+
pull_request:
35+
branches: [ "main" ]
36+
workflow_dispatch:
37+
38+
permissions:
39+
pull-requests: read # allows SonarCloud to decorate PRs with analysis results
40+
41+
jobs:
42+
Analysis:
43+
runs-on: ubuntu-latest
44+
45+
steps:
46+
- name: Analyze with SonarCloud
47+
48+
# You can pin the exact commit or the version.
49+
# uses: SonarSource/sonarcloud-github-action@v2.2.0
50+
uses: SonarSource/sonarcloud-github-action@4006f663ecaf1f8093e8e4abb9227f6041f52216
51+
env:
52+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Generate a token on Sonarcloud.io, add it to the secrets of this repo with the name SONAR_TOKEN (Settings > Secrets > Actions > add new repository secret)
53+
with:
54+
# Additional arguments for the SonarScanner CLI
55+
args:
56+
# Unique keys of your project and organization. You can find them in SonarCloud > Information (bottom-left menu)
57+
# mandatory
58+
-Dsonar.projectKey=
59+
-Dsonar.organization=
60+
# Comma-separated paths to directories containing main source files.
61+
#-Dsonar.sources= # optional, default is project base directory
62+
# Comma-separated paths to directories containing test source files.
63+
#-Dsonar.tests= # optional. For more info about Code Coverage, please refer to https://docs.sonarcloud.io/enriching/test-coverage/overview/
64+
# Adds more detail to both client and server-side analysis logs, activating DEBUG mode for the scanner, and adding client-side environment variables and system properties to the server-side log of analysis report processing.
65+
#-Dsonar.verbose= # optional, default is false
66+
# When you need the analysis to take place in a directory other than the one from which it was launched, default is .
67+
projectBaseDir: .

‎.github/workflows/sonarqube.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow helps you trigger a SonarQube analysis of your code and populates
7+
# GitHub Code Scanning alerts with the vulnerabilities found.
8+
# (this feature is available starting from SonarQube 9.7, Developer Edition and above)
9+
10+
# 1. Make sure you add a valid GitHub configuration to your SonarQube (Administration > DevOps platforms > GitHub)
11+
12+
# 2. Import your project on SonarQube
13+
# * Add your repository as a new project by clicking "Create project" from your homepage.
14+
#
15+
# 3. Select GitHub Actions as your CI and follow the tutorial
16+
# * a. Generate a new token and add it to your GitHub repository's secrets using the name SONAR_TOKEN
17+
# (On SonarQube, click on your avatar on top-right > My account > Security or ask your administrator)
18+
#
19+
# * b. Copy/paste your SonarQube host URL to your GitHub repository's secrets using the name SONAR_HOST_URL
20+
#
21+
# * c. Copy/paste the project Key into the args parameter below
22+
# (You'll find this information in SonarQube by following the tutorial or by clicking on Project Information at the top-right of your project's homepage)
23+
24+
# Feel free to take a look at our documentation (https://docs.sonarqube.org/latest/analysis/github-integration/)
25+
# or reach out to our community forum if you need some help (https://community.sonarsource.com/c/sq/10)
26+
27+
name: SonarQube analysis
28+
29+
on:
30+
push:
31+
branches: [ "main" ]
32+
pull_request:
33+
branches: [ "main" ]
34+
workflow_dispatch:
35+
36+
permissions:
37+
pull-requests: read # allows SonarQube to decorate PRs with analysis results
38+
39+
jobs:
40+
Analysis:
41+
runs-on: ubuntu-latest
42+
43+
steps:
44+
- name: Analyze with SonarQube
45+
46+
# You can pin the exact commit or the version.
47+
# uses: SonarSource/sonarqube-scan-action@v1.1.0
48+
uses: SonarSource/sonarqube-scan-action@7295e71c9583053f5bf40e9d4068a0c974603ec8
49+
env:
50+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information
51+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # Generate a token on SonarQube, add it to the secrets of this repo with the name SONAR_TOKEN (Settings > Secrets > Actions > add new repository secret)
52+
SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} # add the URL of your instance to the secrets of this repo with the name SONAR_HOST_URL (Settings > Secrets > Actions > add new repository secret)
53+
with:
54+
# Additional arguments for the sonarcloud scanner
55+
args:
56+
# Unique key of your project. You can find it in SonarQube > [my project] > Project Information (top-right menu)
57+
# mandatory
58+
-Dsonar.projectKey=
59+
# Comma-separated paths to directories containing main source files.
60+
#-Dsonar.sources= # optional, default is project base directory
61+
# When you need the analysis to take place in a directory other than the one from which it was launched
62+
#-Dsonar.projectBaseDir= # optional, default is .
63+
# Comma-separated paths to directories containing test source files.
64+
#-Dsonar.tests= # optional. For more info about Code Coverage, please refer to https://docs.sonarcloud.io/enriching/test-coverage/overview/
65+
# Adds more detail to both client and server-side analysis logs, activating DEBUG mode for the scanner, and adding client-side environment variables and system properties to the server-side log of analysis report processing.
66+
#-Dsonar.verbose= # optional, default is false

0 commit comments

Comments
 (0)