checkmarx-cxflow-push.yml

# This is a basic workflow using the Checkmarx CxFlow GitHub Action, and runs on a push to the main branch.
# A default sarif report is generated, and can be uploaded for CodeQL / Security Alerts Processing


name: checkmarx-cxflow-push

on:
  push:
    branches: [ master ]

jobs:
  build:

    runs-on: ubuntu-latest
    env : #Set the environment variables for RepoName and PR number.
      REPO_NAME: ${{ github.event.repository.name }}
      BR_NAME: ${{ github.ref }} 
      
    steps:
    - uses: actions/checkout@v2
    
    # Extract the short branch name
    - name: Extract branch name
      shell: bash
      run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
      id: extract_branch
    
    # Extracts the Org name from GitHub's environment variables and stores in another env variable.
    - name: Get the Organization Name
      #run: echo ::set-env name=ORG_NAME::$(echo "$GITHUB_REPOSITORY" | awk -F / '{print $1}')
      run: |
        echo "ORG_NAME=$(echo "$GITHUB_REPOSITORY" | awk -F / '{print $1}')" >> $GITHUB_ENV
    
    # Runs the Checkmarx Scan leveraging the latest version of CxFlow - REFER to Action README for list of inputs
    - name: Checkmarx CxFlow Action
      uses: checkmarx-ts/checkmarx-cxflow-github-action@v1.1
      with:
        project: ${{ env.REPO_NAME }}-${{ steps.extract_branch.outputs.branch }}
        # 15-Apr-21: Test
        team: 'CxServer/SP/APAC/${{ env.ORG_NAME }}'
        checkmarx_url: ${{ secrets.CHECKMARX_URL }}
        checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
        checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
        checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
        incremental: false
        break_build: true
        scanners: sast
        bug_tracker: Sarif
        params: --namespace=${{ github.repository_owner }} --repo-name=${{ github.event.repository.name }} --branch=${{ github.ref }} --severity=High --severity=Medium
        
    # Upload the Report for CodeQL/Security Alerts
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: cx.sarif
        
   # Down JDK for build
    - name: Set up JDK 1.8
      uses: actions/setup-java@v1
      with:
        java-version: 1.8
    
    # Build the JavaVulnerableLab project
    - name: Build with Maven
      run: mvn -B package --file pom.xml