Spaces:
Build error
Build error
TYH71
commited on
Commit
•
a7c9863
1
Parent(s):
d17dd80
Delete fortify.yml
Browse files
.github/workflows/fortify.yml
DELETED
@@ -1,98 +0,0 @@
|
|
1 |
-
# This workflow uses actions that are not certified by GitHub.
|
2 |
-
# They are provided by a third-party and are governed by
|
3 |
-
# separate terms of service, privacy policy, and support
|
4 |
-
# documentation.
|
5 |
-
|
6 |
-
################################################################################################################################################
|
7 |
-
# Fortify lets you build secure software fast with an appsec platform that automates testing throughout the DevSecOps pipeline. Fortify static,#
|
8 |
-
# dynamic, interactive, and runtime security testing is available on premises or as a service. To learn more about Fortify, start a free trial #
|
9 |
-
# or contact our sales team, visit microfocus.com/appsecurity. #
|
10 |
-
# #
|
11 |
-
# Use this workflow template as a basis for integrating Fortify on Demand Static Application Security Testing(SAST) into your GitHub workflows.#
|
12 |
-
# This template demonstrates the steps to prepare the code+dependencies, initiate a scan, download results once complete and import into #
|
13 |
-
# GitHub Security Code Scanning Alerts. Existing customers should review inputs and environment variables below to configure scanning against #
|
14 |
-
# an existing application in your Fortify on Demand tenant. Additional information is available in the comments throughout the workflow, the #
|
15 |
-
# documentation for the Fortify actions used, and the Fortify on Demand / ScanCentral Client product documentation. If you need additional #
|
16 |
-
# assistance with configuration, feel free to create a help ticket in the Fortify on Demand portal. #
|
17 |
-
################################################################################################################################################
|
18 |
-
|
19 |
-
name: Fortify on Demand Scan
|
20 |
-
|
21 |
-
# TODO: Customize trigger events based on your DevSecOps processes and typical FoD SAST scan time
|
22 |
-
on:
|
23 |
-
workflow_dispatch:
|
24 |
-
push:
|
25 |
-
branches: [ "main" ]
|
26 |
-
schedule:
|
27 |
-
- cron: '21 6 * * 3'
|
28 |
-
|
29 |
-
jobs:
|
30 |
-
FoD-SAST-Scan:
|
31 |
-
# Use the appropriate runner for building your source code.
|
32 |
-
# TODO: Use a Windows runner for .NET projects that use msbuild. Additional changes to RUN commands will be required to switch to Windows syntax.
|
33 |
-
runs-on: ubuntu-latest
|
34 |
-
permissions:
|
35 |
-
actions: read
|
36 |
-
contents: read
|
37 |
-
security-events: write
|
38 |
-
|
39 |
-
steps:
|
40 |
-
# Check out source code
|
41 |
-
- name: Check Out Source Code
|
42 |
-
uses: actions/checkout@v3
|
43 |
-
|
44 |
-
# Java is required to run the various Fortify utilities.
|
45 |
-
# When scanning a Java application, please use the appropriate Java version for building your application.
|
46 |
-
- name: Setup Java
|
47 |
-
uses: actions/setup-java@v3
|
48 |
-
with:
|
49 |
-
java-version: 8
|
50 |
-
distribution: 'temurin'
|
51 |
-
|
52 |
-
# Prepare source+dependencies for upload. The default example is for a Maven project that uses pom.xml.
|
53 |
-
# TODO: Update PACKAGE_OPTS based on the ScanCentral Client documentation for your project's included tech stack(s). Helpful hints:
|
54 |
-
# ScanCentral Client will download dependencies for maven (-bt mvn) and gradle (-bt gradle).
|
55 |
-
# ScanCentral Client can download dependencies for msbuild projects (-bt msbuild); however, you must convert the workflow to use a Windows runner.
|
56 |
-
# ScanCentral has additional options that should be set for PHP and Python projects
|
57 |
-
# For other build tools, add your build commands to download necessary dependencies and prepare according to Fortify on Demand Packaging documentation.
|
58 |
-
# ScanCentral Client documentation is located at https://www.microfocus.com/documentation/fortify-software-security-center/
|
59 |
-
- name: Download Fortify ScanCentral Client
|
60 |
-
uses: fortify/gha-setup-scancentral-client@5b7382f8234fb9840958c49d5f32ae854115f9f3
|
61 |
-
- name: Package Code + Dependencies
|
62 |
-
run: scancentral package $PACKAGE_OPTS -o package.zip
|
63 |
-
env:
|
64 |
-
PACKAGE_OPTS: "-bt mvn"
|
65 |
-
|
66 |
-
# Start Fortify on Demand SAST scan and wait until results complete. For more information on FoDUploader commands, see https://github.com/fod-dev/fod-uploader-java
|
67 |
-
# TODO: Update ENV variables for your application and create the necessary GitHub Secrets. Helpful hints:
|
68 |
-
# Credentials and release ID should be obtained from your FoD tenant (either Personal Access Token or API Key can be used).
|
69 |
-
# Automated Audit preference should be configured for the release's Static Scan Settings in the Fortify on Demand portal.
|
70 |
-
- name: Download Fortify on Demand Universal CI Tool
|
71 |
-
uses: fortify/gha-setup-fod-uploader@6e6bb8a33cb476e240929fa8ebc739ff110e7433
|
72 |
-
- name: Perform SAST Scan
|
73 |
-
run: java -jar $FOD_UPLOAD_JAR -z package.zip -aurl $FOD_API_URL -purl $FOD_URL -rid "$FOD_RELEASE_ID" -tc "$FOD_TENANT" -uc "$FOD_USER" "$FOD_PAT" $FOD_UPLOADER_OPTS -n "$FOD_UPLOADER_NOTES"
|
74 |
-
env:
|
75 |
-
FOD_URL: "https://ams.fortify.com/"
|
76 |
-
FOD_API_URL: "https://api.ams.fortify.com/"
|
77 |
-
FOD_TENANT: ${{ secrets.FOD_TENANT }}
|
78 |
-
FOD_USER: ${{ secrets.FOD_USER }}
|
79 |
-
FOD_PAT: ${{ secrets.FOD_PAT }}
|
80 |
-
FOD_RELEASE_ID: ${{ secrets.FOD_RELEASE_ID }}
|
81 |
-
FOD_UPLOADER_OPTS: "-ep 2 -pp 0 -I 1 -apf"
|
82 |
-
FOD_UPLOADER_NOTES: 'Triggered by GitHub Actions (${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})'
|
83 |
-
|
84 |
-
# Once scan completes, pull SAST issues from Fortify on Demand and generate SARIF output.
|
85 |
-
- name: Export results to GitHub-optimized SARIF
|
86 |
-
uses: fortify/gha-export-vulnerabilities@fcb374411cff9809028c911dabb8b57dbdae623b
|
87 |
-
with:
|
88 |
-
fod_base_url: "https://ams.fortify.com/"
|
89 |
-
fod_tenant: ${{ secrets.FOD_TENANT }}
|
90 |
-
fod_user: ${{ secrets.FOD_USER }}
|
91 |
-
fod_password: ${{ secrets.FOD_PAT }}
|
92 |
-
fod_release_id: ${{ secrets.FOD_RELEASE_ID }}
|
93 |
-
|
94 |
-
# Import Fortify on Demand results to GitHub Security Code Scanning
|
95 |
-
- name: Import Results
|
96 |
-
uses: github/codeql-action/upload-sarif@v2
|
97 |
-
with:
|
98 |
-
sarif_file: ./gh-fortify-sast.sarif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|