checkmarx-sca-scan-push.yml

# This workflow is to automate Checkmarx SCA scans.  It runs on a push to the main branch.
#
# The following GitHub Secrets must be first defined:
#   - CHECKMARX_SCA_USERNAME
#   - CHECKMARX_SCA_PASSWORD
#
# The following variables must be inserted below:
#   - <ProjectName>
#   - <SCATenant>
#   - <GitHubRepoUrl>
#
# For full documentation, including a list of all inputs, please refer to the README https://github.com/checkmarx-ts/checkmarx-cxflow-github-action

name: Checkmarx SCA Scan
on:
  push:
    branches:
      - main
      - master
    
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v2
    - name: Checkmarx CxFlow Action
      uses: checkmarx-ts/checkmarx-cxflow-github-action@v1.4 # GitHub Action version
      with:
        project: ${{ secrets.CHECKMARX_PROJECT }}  # <-- Insert Checkmarx CxSCA Project Name
        sca_api_url: https://api.scacheckmarx.com
        sca_app_url: https://sca.scacheckmarx.com
        sca_access_control_url: https://platform.checkmarx.net
        sca_tenant: <SCATenant>  # <-- Insert Checkmarx CxSCA Tenant
        sca_username: ${{ secrets.CHECKMARX_SCA_USERNAME }} # To be stored in GitHub Secrets.
        sca_password: ${{ secrets.CHECKMARX_SCA_PASSWORD }} # To be stored in GitHub Secrets.
        break_build: false
        scanners: sca
        bug_tracker: Sarif
        params: --namespace=${{ github.repository_owner }} --checkmarx.settings-override=true --repo-name=${{ github.event.repository.name }} --branch=${{ github.ref_name }} --repo-url="<GitHubRepoUrl>" --cx-flow.filterSeverity --cx-flow.filterCategory

    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: cx.sarif