Update: add Checkmarx One scan workflow for public repo testing

.github/workflows/cx-one-scan.yaml

@@ -0,0 +1,71 @@
+name: Checkmarx One Scan
+
+# Testing the ruleset policy
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+  schedule:
+    - cron: '00 7 * * *' # Every day at 07:00
+  workflow_call:
+    secrets:
+      AST_RND_SCANS_BASE_URI:
+        required: true
+      AST_RND_SCANS_TENANT:
+        required: true
+      AST_RND_SCANS_CLIENT_ID:
+        required: true
+      AST_RND_SCANS_CLIENT_SECRET:
+        required: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  cx-scan:
+    name: Checkmarx One Scan
+    runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Get repository custom properties
+        id: repo-properties
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -uo pipefail
+          tags=$(gh api "repos/${REPO}/properties/values" \
+            --jq '[.[] | select(.value != null and .property_name != "single-owner-repo") | "\(.property_name):\(.value)"] | join(",")') || tags=""
+          if [ -n "${tags}" ]; then
+            echo "tag_args=--project-tags \"${tags}\" --tags \"${tags}\"" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::No repository custom properties found (or failed to fetch them); scan will run without custom property tags."
+            echo "tag_args=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkmarx One CLI Action
+        uses: checkmarx/ast-github-action@7006afa846f6d23e3e9d351a001b9d8e59c3fb8c # 2.3.46
+        with:
+          base_uri: ${{ secrets.AST_RND_SCANS_BASE_URI }}
+          cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }}
+          cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }}
+          additional_params: >-
+            --scan-timeout 60
+            --scan-types sast,sca,iac-security,api-security,containers,scs,aisc
+            --scs-engines secret-detection
+            ${{ steps.repo-properties.outputs.tag_args }}
+            --threshold "sca-critical=1;sca-high=1;sca-medium=1;sca-low=1;sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;api-security-critical=1;api-security-high=1;api-security-medium=1;api-security-low=1;containers-critical=1;containers-high=1;containers-medium=1;containers-low=1;sscs-secret-detection-critical=1;sscs-secret-detection-high=1;sscs-secret-detection-medium=1;sscs-secret-detection-low=1"