diff --git a/README.md b/README.md index d00e686..9bea88a 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ The [Fortify github-action repository](https://github.com/fortify-ps/github-acti **Fortify Sofware Security Center (SSC) / ScanCentral SAST** * [`fortify/github-action`](#fortify-github-action) - For now, this action provides the same functionality as the `ssc-sast-scan` action listed below. Future versions may add support for running other types of scans or performing other SSC / ScanCentral actions. + For now, this action provides the same functionality as the `sc-sast-scan` action listed below. Future versions may add support for running other types of scans or performing other SSC / ScanCentral actions. * [`fortify/github-action/sc-sast-scan`](#fortify-github-action-sc-sast-scan) Package source code, submit SAST scan request to ScanCentral SAST, optionally wait for completion and export results back to the GitHub Security dashboard. * [`fortify/github-action/package`](#fortify-github-action-package) @@ -43,12 +43,12 @@ The [Fortify github-action repository](https://github.com/fortify-ps/github-acti ## fortify/github-action -The primary `fortify/github-action@v1` currently allows for running SAST scans on either Fortify on Demand or ScanCentral SAST. Which activities to perform is controlled through action inputs, the input for those activities is provided through environment variables. Software composition analysis of open source components may also be performed in conjunction with the Fortify on Demand SAST scan for customers who have purchased the functionality. +The primary `fortify/github-action` action currently allows for running SAST scans on either Fortify on Demand or ScanCentral SAST. Which activities to perform is controlled through action inputs, the input for those activities is provided through environment variables. With Fortify on Demand, software composition analysis of open source components may also be performed in conjunction with the SAST scan for customers who have purchased the functionality. ### Action inputs **`sast-scan`** - OPTIONAL -When set to true, the action will run a SAST scan on either Fortify on Demand (if the FOD_URL environment variable has been specified), or on ScanCentral SAST (if the SSC_URL environment variable has been specified). This includes packaging the source code, running the scan, and optionally reporting SAST scan results back into GitHub. +When set to true, the action will run a SAST scan on either Fortify on Demand (if the `FOD_URL` environment variable has been specified), or on ScanCentral SAST (if the `SSC_URL` environment variable has been specified). This includes packaging the source code, running the scan, and optionally reporting SAST scan results back into GitHub. If not specified or when set to false, no SAST scan will be performed. For now, this means that the action will complete without doing any work. Future versions of this action may provide additional inputs, for example allowing you to run a dynamic application security testing (DAST) scan instead of a SAST scan. @@ -97,7 +97,7 @@ Fortify on Demand release to use with this action. This can be specified either **`EXTRA_PACKAGE_OPTS`** - OPTIONAL -By default, this action runs `scancentral package -o package.zip` to package application source code. he `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. +By default, this action runs `scancentral package -o package.zip` to package application source code. The `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. If FoD Software Composition Analysis has been purchased and configured on the applicable release, you'll need to pass the `-oss` option through this environment variable to generate and package the additional dependency files required. @@ -145,7 +145,7 @@ Fortify Software Security Center URL, for example https://ssc.customer.fortifyho Required when authenticating with an SSC token (recommended). Most actions should work fine with a `CIToken`. **`SSC_USER` & `SSC_PASSWORD`** - REQUIRED* -Required when authenticating with user credentials. +Required when authenticating with SSC user credentials. @@ -248,8 +248,8 @@ The sample workflows below demonstrate how to configure the action for running a Depending on input, this action delegates to the appropriate sub-action(s). Please refer to the documentation of these actions for a more detailed description of action behavior & requirements: -* FoD SAST & optional SCA (open source) Scan: [`fortify/github-action/fod-sast-scan@v1`](#fortify-github-action-fod-sast-scan) -* ScanCentral SAST Scan: [`fortify/github-action/sc-sast-scan@v1`](#fortify-github-action-sc-sast-scan) +* FoD SAST & optional SCA (open source) scan: [`fortify/github-action/fod-sast-scan`](#fortify-github-action-fod-sast-scan) +* ScanCentral SAST scan: [`fortify/github-action/sc-sast-scan`](#fortify-github-action-sc-sast-scan) @@ -433,7 +433,7 @@ Fortify on Demand release to use with this action. This can be specified either **`EXTRA_PACKAGE_OPTS`** - OPTIONAL -By default, this action runs `scancentral package -o package.zip` to package application source code. he `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. +By default, this action runs `scancentral package -o package.zip` to package application source code. The `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. If FoD Software Composition Analysis has been purchased and configured on the applicable release, you'll need to pass the `-oss` option through this environment variable to generate and package the additional dependency files required. @@ -579,7 +579,7 @@ Fortify Software Security Center URL, for example https://ssc.customer.fortifyho Required when authenticating with an SSC token (recommended). Most actions should work fine with a `CIToken`. **`SSC_USER` & `SSC_PASSWORD`** - REQUIRED* -Required when authenticating with user credentials. +Required when authenticating with SSC user credentials. @@ -677,7 +677,7 @@ Fortify Software Security Center URL, for example https://ssc.customer.fortifyho Required when authenticating with an SSC token (recommended). Most actions should work fine with a `CIToken`. **`SSC_USER` & `SSC_PASSWORD`** - REQUIRED* -Required when authenticating with user credentials. +Required when authenticating with SSC user credentials. diff --git a/doc-resources/env-fod-package.md b/doc-resources/env-fod-package.md index 4a2780b..6f033d2 100644 --- a/doc-resources/env-fod-package.md +++ b/doc-resources/env-fod-package.md @@ -1,5 +1,5 @@ **`EXTRA_PACKAGE_OPTS`** - OPTIONAL -By default, this action runs `scancentral package -o package.zip` to package application source code. he `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. +By default, this action runs `scancentral package -o package.zip` to package application source code. The `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. If FoD Software Composition Analysis has been purchased and configured on the applicable release, you'll need to pass the `-oss` option through this environment variable to generate and package the additional dependency files required. diff --git a/doc-resources/env-ssc-connection.md b/doc-resources/env-ssc-connection.md index 1ebfce3..8602485 100644 --- a/doc-resources/env-ssc-connection.md +++ b/doc-resources/env-ssc-connection.md @@ -5,4 +5,4 @@ Fortify Software Security Center URL, for example https://ssc.customer.fortifyho Required when authenticating with an SSC token (recommended). Most actions should work fine with a `CIToken`. **`SSC_USER` & `SSC_PASSWORD`** - REQUIRED* -Required when authenticating with user credentials. \ No newline at end of file +Required when authenticating with SSC user credentials. \ No newline at end of file diff --git a/doc-resources/repo-readme.md b/doc-resources/repo-readme.md index 3ec7cac..c7eef50 100644 --- a/doc-resources/repo-readme.md +++ b/doc-resources/repo-readme.md @@ -16,7 +16,7 @@ The [Fortify github-action repository]({{var:repo-url}}) hosts various Fortify-r **Fortify Sofware Security Center (SSC) / ScanCentral SAST** * [`fortify/github-action`](#fortify-github-action) - For now, this action provides the same functionality as the `ssc-sast-scan` action listed below. Future versions may add support for running other types of scans or performing other SSC / ScanCentral actions. + For now, this action provides the same functionality as the `sc-sast-scan` action listed below. Future versions may add support for running other types of scans or performing other SSC / ScanCentral actions. * [`fortify/github-action/sc-sast-scan`](#fortify-github-action-sc-sast-scan) Package source code, submit SAST scan request to ScanCentral SAST, optionally wait for completion and export results back to the GitHub Security dashboard. * [`fortify/github-action/package`](#fortify-github-action-package) @@ -30,12 +30,12 @@ The [Fortify github-action repository]({{var:repo-url}}) hosts various Fortify-r ## fortify/github-action -The primary `fortify/github-action@{{var:action-major-version}}` currently allows for running SAST scans on either Fortify on Demand or ScanCentral SAST. Which activities to perform is controlled through action inputs, the input for those activities is provided through environment variables. Software composition analysis of open source components may also be performed in conjunction with the Fortify on Demand SAST scan for customers who have purchased the functionality. +The primary `fortify/github-action` action currently allows for running SAST scans on either Fortify on Demand or ScanCentral SAST. Which activities to perform is controlled through action inputs, the input for those activities is provided through environment variables. With Fortify on Demand, software composition analysis of open source components may also be performed in conjunction with the SAST scan for customers who have purchased the functionality. ### Action inputs **`sast-scan`** - OPTIONAL -When set to true, the action will run a SAST scan on either Fortify on Demand (if the FOD_URL environment variable has been specified), or on ScanCentral SAST (if the SSC_URL environment variable has been specified). This includes packaging the source code, running the scan, and optionally reporting SAST scan results back into GitHub. +When set to true, the action will run a SAST scan on either Fortify on Demand (if the `FOD_URL` environment variable has been specified), or on ScanCentral SAST (if the `SSC_URL` environment variable has been specified). This includes packaging the source code, running the scan, and optionally reporting SAST scan results back into GitHub. If not specified or when set to false, no SAST scan will be performed. For now, this means that the action will complete without doing any work. Future versions of this action may provide additional inputs, for example allowing you to run a dynamic application security testing (DAST) scan instead of a SAST scan. @@ -85,8 +85,8 @@ The sample workflows below demonstrate how to configure the action for running a Depending on input, this action delegates to the appropriate sub-action(s). Please refer to the documentation of these actions for a more detailed description of action behavior & requirements: -* FoD SAST & optional SCA (open source) Scan: [`fortify/github-action/fod-sast-scan@{{var:action-major-version}}`](#fortify-github-action-fod-sast-scan) -* ScanCentral SAST Scan: [`fortify/github-action/sc-sast-scan@{{var:action-major-version}}`](#fortify-github-action-sc-sast-scan) +* FoD SAST & optional SCA (open source) scan: [`fortify/github-action/fod-sast-scan`](#fortify-github-action-fod-sast-scan) +* ScanCentral SAST scan: [`fortify/github-action/sc-sast-scan`](#fortify-github-action-sc-sast-scan) diff --git a/fod-sast-scan/README.md b/fod-sast-scan/README.md index 0e3826c..44f1778 100644 --- a/fod-sast-scan/README.md +++ b/fod-sast-scan/README.md @@ -66,7 +66,7 @@ Fortify on Demand release to use with this action. This can be specified either **`EXTRA_PACKAGE_OPTS`** - OPTIONAL -By default, this action runs `scancentral package -o package.zip` to package application source code. he `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. +By default, this action runs `scancentral package -o package.zip` to package application source code. The `EXTRA_PACKAGE_OPTS` environment variable can be used to specify additional packaging options. If FoD Software Composition Analysis has been purchased and configured on the applicable release, you'll need to pass the `-oss` option through this environment variable to generate and package the additional dependency files required. diff --git a/sc-sast-scan/README.md b/sc-sast-scan/README.md index 67ac7f4..b89fc0e 100644 --- a/sc-sast-scan/README.md +++ b/sc-sast-scan/README.md @@ -40,7 +40,7 @@ Fortify Software Security Center URL, for example https://ssc.customer.fortifyho Required when authenticating with an SSC token (recommended). Most actions should work fine with a `CIToken`. **`SSC_USER` & `SSC_PASSWORD`** - REQUIRED* -Required when authenticating with user credentials. +Required when authenticating with SSC user credentials. diff --git a/ssc-export/README.md b/ssc-export/README.md index c6c69ca..bf51aef 100644 --- a/ssc-export/README.md +++ b/ssc-export/README.md @@ -25,7 +25,7 @@ Fortify Software Security Center URL, for example https://ssc.customer.fortifyho Required when authenticating with an SSC token (recommended). Most actions should work fine with a `CIToken`. **`SSC_USER` & `SSC_PASSWORD`** - REQUIRED* -Required when authenticating with user credentials. +Required when authenticating with SSC user credentials.