diff --git a/.github/workflows/Feedbackapp.yml b/.github/workflows/Feedbackapp.yml new file mode 100644 index 0000000..5256cac --- /dev/null +++ b/.github/workflows/Feedbackapp.yml @@ -0,0 +1,34 @@ +# This is a basic workflow to help you get started with Actions + +name: feedbackapp + +# Controls when the workflow will run +on: [push,pull_request,workflow_dispatch] +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # This step checks out a copy of your repository. + - name: Checkout repository + uses: actions/checkout@v2 + - name: Checkmarx scan + uses: checkmarx/ast-github-action@main + with: + base_uri: https://ast-master-components.dev.cxast.net/ + cx_client_id: ${{ secrets.CX_CLIENT_ID }} + cx_client_secret: ${{ secrets.CX_CLIENT_SECRET }} + cx_tenant: ${{ secrets.CX_TENANT }} + additional_params: --project-tags 'feedback-assignee:Yoav ast' --tags 'feedback-assignee:Vered Shahar' --debug + + + + + + + + diff --git a/.github/workflows/PR.yml b/.github/workflows/PR.yml new file mode 100644 index 0000000..9547056 --- /dev/null +++ b/.github/workflows/PR.yml @@ -0,0 +1,17 @@ +name: Checkmarx AST Scan +on: [pull_request] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v2 + - name: Checkmarx AST CLI Action + uses: checkmarx/ast-github-action@main #Github Action version + with: + base_uri: https://eu.ast.checkmarx.net/ + cx_tenant: cx_ast_pm_yoav_ast + cx_client_id: ${{ secrets.CX_CLIENT_ID }} + cx_client_secret: ${{ secrets.CX_CLIENT_SECRET }} + additional_params: --debug --scan-types iac-security diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 0000000..9e9041f --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,32 @@ +# This is a basic workflow to help you get started with Actions + +name: Checkmarx Sarif Integration + +# Controls when the workflow will run +on: [push,pull_request,workflow_dispatch] + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + build: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # This step checks out a copy of your repository. + - name: Checkout repository + uses: actions/checkout@v2 + - name: Checkmarx scan + uses: checkmarx/ast-github-action@main + with: + base_uri: https://ast-master-components.dev.cxast.net/ + cx_client_id: ${{ secrets.CX_CLIENT_ID }} + cx_client_secret: ${{ secrets.CX_CLIENT_SECRET }} + cx_tenant: ${{ secrets.CX_TENANT }} + additional_params: --report-format sarif --output-path . + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: cx_result.sarif diff --git a/README.md b/README.md index 8742f77..3807fb0 100644 --- a/README.md +++ b/README.md @@ -1 +1,3 @@ # GH Demo +main +test diff --git a/azure-pipelines.yml b/azure-pipelines.yml new file mode 100644 index 0000000..e8f7e64 --- /dev/null +++ b/azure-pipelines.yml @@ -0,0 +1,22 @@ +pool: + name: Azure Pipelines + +jobs: +- job: Test + pool: + vmImage: 'windows-2019' + steps: + # - task: PowerShell@2 + # env: + # CX_APIKEY: $(CX_APIKEY) + # inputs: + # targetType: 'inline' + # script: './cx.exe scan create -s . --project-name myadotest --branch main --debug' + + - task: Checkmarx AST@2 + inputs: + CheckmarxService: 'CxONE' + projectName: '$(Build.Repository.Name)' + branchName: '$(Build.SourceBranchName)' + tenantName: '' + additionalParams: '--debug' \ No newline at end of file diff --git a/pom.xml b/pom.xml index 92ef26b..bf7f522 100644 --- a/pom.xml +++ b/pom.xml @@ -139,8 +139,15 @@ 1.7.7 jar + + com.github.codingandcoding + servlet-api + 3.2.0 + + +#PR diff --git a/test/b.java b/test/b.java index 4d1c070..94d14fe 100644 --- a/test/b.java +++ b/test/b.java @@ -22,3 +22,4 @@ public static void testData () { out.println (userData); printSanitizedName(userData); } +#PR