diff --git a/.github/workflows/cx.yml b/.github/workflows/cx.yml index b807343..fddbac0 100644 --- a/.github/workflows/cx.yml +++ b/.github/workflows/cx.yml @@ -1,24 +1,25 @@ -name: cx +name: Checkmarx AST Scan on: + push: + branches: + - main + - master pull_request: + types: [opened, reopened, synchronize] #Types specify which pull request events will trigger the workflow. For more events refer Github Actions documentation. branches: - master -# push: + - master + jobs: - ast_scan: + build: runs-on: ubuntu-latest - name: Checkmarx scan run steps: - - name: Run scan - uses: CheckmarxDev/ast-github-action@more_engines - id: scan + - name: Checkout + uses: actions/checkout@v2 + - name: Checkmarx AST CLI Action + uses: checkmarx/ast-github-action@main #Github Action version with: - github_repo_token: ${{ secrets.GITHUB_TOKEN }} - ast_uri: ${{ secrets.AST_URI }} - ast_access_key_id: ${{ secrets.AST_ACCESS_KEY_ID }} - ast_access_key_secret: ${{ secrets.AST_ACCESS_KEY_SECRET }} - sca_user: ${{ secrets.SCA_USER }} - sca_password: ${{ secrets.SCA_PASSWORD }} - action_scan_complete_timeout_secs: 600 - high_results_threshold: 0 - medium_results_threshold: 10 + base_uri: https://ast.checkmarx.net/ + cx_tenant: ${{ secrets.CX_TENANT }} + cx_client_id: ${{ secrets.CX_CLIENT_ID }} + cx_client_secret: ${{ secrets.CX_CLIENT_SECRET }} diff --git a/README.md b/README.md index 80e96b0..56cdc9a 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,4 @@ +PR Test ![](https://github.com/CheckmarxDev/NodeGoat-test/workflows/cx/badge.svg) This is a "Vulnerable" Web Application developed by Cyber Security and Privacy Foundation(www.cysecurity.org). This app is intended for the Java Programmers and other people who wish to learn about Web application vulnerabilities and write secure code.123 diff --git a/azure-pipelines.yml b/azure-pipelines.yml new file mode 100644 index 0000000..5691b0c --- /dev/null +++ b/azure-pipelines.yml @@ -0,0 +1,28 @@ +# Starter pipeline +# Start with a minimal pipeline that you can customize to build and deploy your code. +# Add steps that build, run tests, deploy, and more: +# https://aka.ms/yaml + +trigger: +- master + +pool: + vmImage: ubuntu-latest + +steps: +- script: echo Hello, world! + displayName: 'Run a one-line script' + +- script: | + echo Add other tasks to build, test, and deploy your project. + echo See https://aka.ms/yaml + displayName: 'Run a multi-line script' +- task: Application security testing@2021 + inputs: + projectName: 'SC_JVL_ADO' + enableProxy: false + enableSastScan: true + CheckmarxService: 'CxSAST' + fullTeamName: 'ADO' + incScan: false + enableDependencyScan: false \ No newline at end of file diff --git a/testtest.txt b/testtest.txt new file mode 100644 index 0000000..bc3f9c8 --- /dev/null +++ b/testtest.txt @@ -0,0 +1,3 @@ +#test +#test +#test