From 64dec5e4e1ceb1e5cf73e4d2f536065ae73337c2 Mon Sep 17 00:00:00 2001 From: Shrinil Modhave <318497438+cx-shrinil-modhave@users.noreply.github.com> Date: Thu, 15 Oct 2026 20:15:16 +0530 Subject: [PATCH 1/5] Add Checkmarx One scan workflow with repo custom property tagging - New cx-one-scan.yaml workflow runs a Checkmarx One scan (SAST/SCA/ IaC/API security/containers/SCS/ASCA) on pull_request, push (main/master), a daily schedule, and manual dispatch - Fetch the repo's GitHub custom properties (repo_owner, team_name, security_champion, repo_component) via the GitHub API and apply them as both project tags and scan tags, so Checkmarx One findings can be filtered/owned by team without manual tagging; gracefully skips tagging (with a warning annotation) instead of failing the scan if the properties can't be fetched or none are set - Pin actions/checkout to v7.0.1 and checkmarx/ast-github-action to 2.3.46 - Scope permissions at the job level (contents: read), with permissions: {} as the workflow-level default --- .github/workflows/cx-one-scan.yaml | 59 ++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 .github/workflows/cx-one-scan.yaml diff --git a/.github/workflows/cx-one-scan.yaml b/.github/workflows/cx-one-scan.yaml new file mode 100644 index 0000000..b273e73 --- /dev/null +++ b/.github/workflows/cx-one-scan.yaml @@ -0,0 +1,59 @@ +name: Checkmarx One Scan + +on: + workflow_dispatch: + pull_request: + push: + branches: + - main + - master + schedule: + - cron: '00 7 * * *' # Every day at 07:00 + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + cx-scan: + name: Checkmarx One Scan + runs-on: cx-public-ubuntu-x64 + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Get repository custom properties + id: repo-properties + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + REPO: ${{ github.repository }} + run: | + set -uo pipefail + tags=$(gh api "repos/${REPO}/properties/values" \ + --jq '[.[] | select(.value != null and .property_name != "single-owner-repo") | "\(.property_name):\(.value)"] | join(",")') || tags="" + if [ -n "${tags}" ]; then + echo "tag_args=--project-tags \"${tags}\" --tags \"${tags}\"" >> "$GITHUB_OUTPUT" + else + echo "::warning::No repository custom properties found (or failed to fetch them); scan will run without custom property tags." + echo "tag_args=" >> "$GITHUB_OUTPUT" + fi + + - name: Checkmarx One CLI Action + uses: checkmarx/ast-github-action@7006afa846f6d23e3e9d351a001b9d8e59c3fb8c # 2.3.46 + with: + base_uri: ${{ secrets.AST_RND_SCANS_BASE_URI }} + cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }} + cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }} + cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }} + additional_params: >- + --scan-timeout 60 + --scan-types sast,sca,iac-security,api-security,containers,scs,aisc + --scs-engines secret-detection + ${{ steps.repo-properties.outputs.tag_args }} + --threshold "sca-critical=1;sca-high=1;sca-medium=1;sca-low=1;sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;api-security-critical=1;api-security-high=1;api-security-medium=1;api-security-low=1;containers-critical=1;containers-high=1;containers-medium=1;containers-low=1;sscs-secret-detection-critical=1;sscs-secret-detection-high=1;sscs-secret-detection-medium=1;sscs-secret-detection-low=1" From bf1f698550018028723bdf6c34ddbdd5f3bcbc73 Mon Sep 17 00:00:00 2001 From: Shrinil Modhave <318497438+cx-shrinil-modhave@users.noreply.github.com> Date: Thu, 15 Oct 2026 22:21:03 +0530 Subject: [PATCH 2/5] Make cx-one-scan workflow callable as a reusable workflow Add a workflow_call trigger (declaring the four Checkmarx secrets as required) so other repos can invoke this workflow directly via uses: Checkmarx/doss-github-actions-public/.github/workflows/cx-one-scan.yaml@ instead of duplicating it. --- .github/workflows/cx-one-scan.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/cx-one-scan.yaml b/.github/workflows/cx-one-scan.yaml index b273e73..ae4a4b4 100644 --- a/.github/workflows/cx-one-scan.yaml +++ b/.github/workflows/cx-one-scan.yaml @@ -9,6 +9,16 @@ on: - master schedule: - cron: '00 7 * * *' # Every day at 07:00 + workflow_call: + secrets: + AST_RND_SCANS_BASE_URI: + required: true + AST_RND_SCANS_TENANT: + required: true + AST_RND_SCANS_CLIENT_ID: + required: true + AST_RND_SCANS_CLIENT_SECRET: + required: true concurrency: group: ${{ github.workflow }}-${{ github.ref }} From 00004feaf8053b7829ec7f2eb5f1ea3c0a3fbdab Mon Sep 17 00:00:00 2001 From: Shrinil Modhave <318497438+cx-shrinil-modhave@users.noreply.github.com> Date: Wed, 21 Oct 2026 12:35:11 +0530 Subject: [PATCH 3/5] Add comment testing ruleset policy --- .github/workflows/cx-one-scan.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/cx-one-scan.yaml b/.github/workflows/cx-one-scan.yaml index ae4a4b4..6bd1f14 100644 --- a/.github/workflows/cx-one-scan.yaml +++ b/.github/workflows/cx-one-scan.yaml @@ -1,5 +1,7 @@ name: Checkmarx One Scan +# Testing the ruleset policy + on: workflow_dispatch: pull_request: From ef765fd4e60ff2c3323974755f5d8498c1592506 Mon Sep 17 00:00:00 2001 From: Shrinil Modhave <318497438+cx-shrinil-modhave@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:05:15 +0530 Subject: [PATCH 4/5] Dummy commit to re-trigger ruleset/workflow checks From b574f20a306f118b76c9fdc4dda734f707adcb5f Mon Sep 17 00:00:00 2001 From: Shrinil Modhave <318497438+cx-shrinil-modhave@users.noreply.github.com> Date: Wed, 21 Oct 2026 17:08:29 +0530 Subject: [PATCH 5/5] Dummy commit to re-trigger ruleset/workflow checks