test: add Checkmarx One scan workflow for public repo testing - #2
cx-shrinil-modhave wants to merge 3 commits into
Conversation
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Original alert (resolved)Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-shrinil-modhave) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Testing the new AI Supply Chain Security (AISC) plugin
cx-jonathan-hartman
left a comment
cx-jonathan-hartman
left a comment
There was a problem hiding this comment.
A couple minor suggestions and otherwise LGTM.
Is this still in testing or is it getting ready to merge? The PR subject says "test:" so I was confused 😄
| runs-on: cx-public-ubuntu-x64 | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v6 |
There was a problem hiding this comment.
The latest checkout action is 7.0.1 and the 7.x releases have some good security enhancements over 6.x.
| pull_request: | ||
| push: | ||
| branches: | ||
| - main |
There was a problem hiding this comment.
Some repos still use the legacy default branch name master. So it should probably be included as well.
I wish GitHub had a variable that let you say - ${the repo's default branch} but oh well.
| persist-credentials: false | ||
|
|
||
| - name: Checkmarx One CLI Action | ||
| uses: checkmarx/ast-github-action@7b6a5cee621f92e6819d366dd48c9431314ac600 # 2.3.42 |
There was a problem hiding this comment.
I'm not sure if it contains any urgent fixes, but there's a newer 2.3.44 release now.
3 participants
Added CX-one Scan workflow