Skip to content
You're viewing an older version of this GitHub Action. Do you want to see the latest version instead?
checkmarx-ts

GitHub Action

Checkmarx CxFlow Action

v1.0-cxgo

Checkmarx CxFlow Action

checkmarx-ts

Checkmarx CxFlow Action

Simplify Checkmarx Scanning of source code along with Result consumption leveraging Checkmarx CxFlow solution

Installation

Copy and paste the following snippet into your .yml file.

 
              
- name: Checkmarx CxFlow Action

              
  uses: checkmarx-ts/[email protected]
Learn more about this action in checkmarx-ts/checkmarx-cxflow-github-action

Choose a version

Checkmarx CxFlow Github Action Checkmarx Github

License: GPL-3.0 Latest Release Open Issues

Checkmarx CxFlow GitHub Action with SARIF output.

Publish Security Alerts (CodeQL) associated with the code in your Github Repository using Checkmarx with this Github Action Integration.

This is a Wrapper to trigger scans the latest version of CxFlow through Docker to launch Checkmarx SAST or SCA Scans.

Checkmarx

  • Checkmarx SAST (CxSAST) is an enterprise-grade flexible and accurate static analysis solution used to identify hundreds of security vulnerabilities in custom code. It is used by development, DevOps, and security teams to scan source code early in the SDLC, identify vulnerabilities and provide actionable insights to remediate them.
  • Checkmarx SCA (CxSCA) is an effective next-gen software composition analysis solution designed to help development teams ship secure software quickly while giving AppSec teams the insight and control they need to improve your software security risk posture.
  • Checkmarx Flow (CxFlow) is an SDLC orchestration module managing AST scan initiation and results manangement.

Please find more info in the official website: Checkmarx.com

Inputs

Variable Example Value Description Type Required Default
checkmarx_url https://checkmarx.company.com Checkmarx Server URL String Yes N/A
checkmarx_username ${{ secrets.CHECKMARX_USERNAME }} Checkmarx Username String Yes N/A
checkmarx_password ${{ secrets.CHECKMARX_PASSWORD }} Checkmarx Password Secure String Yes N/A
checkmarx_client_secret ${{ secrets.CHECKMARX_CLIENT_SECRET }} Checkmarx OIDC Client Secret Reference 1, 2 Secure String Yes
team \CxServer\SP\Company Checkmarx Team for Project String No \CxServer\SP\Company
project ProjectName Checkmarx Project String Yes N/A
app AppID-1234 Unique Application Identifier used by downstream bug trackers (i.e. Jira) String No SampleApp
preset Checkmarx Express Checkmarx scan preset (SAST) String No Checkmarx Default
break_build true Break build based on results? Boolean No false
incremental true Trigger scan as incremental? (SAST) Boolean No true
github_token ${{ secrets.GITHUB_TOKEN }} GitHub API Token, used for PR Feedback or GitHub Issue Feedback String No \CxServer\SP\Company
params --severity=High --bug-tracker=Json Any additional parameters for CxFlow. See the following String No

Secrets

Note: It is recommentded to leverage secrets for any sensitive inputs

  • checkmarx_url: ${{ secrets.CHECKMARX_URL }}
  • checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
  • checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
  • checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
  • github_token: ${{ secrets.GITHUB_TOKEN }}

Outputs

The default output format for this GitHub Action is a SARIF output report stored in the working directory as ./cx.sarif

CxFlow supports various output formats and defect management integration. See the following.

SARIF Report

The file ./cx.sarif is created containing issue details based on the filtering policy of CxFlow. To make use of the report for CodeQL please make sure the following is considered. See sample useage below.

Example usage

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - uses: actions/checkout@v2
    # Scan code with Checkmarx
    - name: Checkmarx CxFlow Action
      uses: checkmarx-ts/[email protected]
      with:
        project: GithubActionTest
        team: '\CxServer\SP\Checkmarx'
        checkmarx_url: ${{ secrets.CHECKMARX_URL }}
        checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
        checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
        checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
    # Upload SARIF report for CodeQL / Security Alerts PRocessing
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: cx.sarif

Sample Output (Security Alerts)

Sample Alert

How To Contribute

We welcome issues to and pull requests against this repository!

License

Checkmarx Github Action

Copyright (C) 2020 Checkmarx

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.