Repository navigation
Update: add Checkmarx One scan workflow for public repo testing - #2
Open
cx-shrinil-modhave wants to merge 3 commits into
Open
cx-shrinil-modhave wants to merge 3 commits into
cx-shrinil-modhave wants to merge 3 commits into
Conversation
Original alert (resolved)Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-shrinil-modhave) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
cx-jonathan-hartman
requested changes
Sep 22, 2026
cx-jonathan-hartman
left a comment
cx-jonathan-hartman
left a comment
Contributor
There was a problem hiding this comment.
A couple minor suggestions and otherwise LGTM.
Is this still in testing or is it getting ready to merge? The PR subject says "test:" so I was confused 😄
cx-shrinil-modhave
force-pushed
the
AST-177880/cx-one-scan-test
branch
from
October 14, 2026 07:07
30c77ac to
1d9e4f0
Compare
cx-shrinil-modhave
changed the title
cx-jonathan-hartman
previously approved these changes
Oct 14, 2026
- New cx-one-scan.yaml workflow runs a Checkmarx One scan (SAST/SCA/
IaC/API security/containers/SCS/ASCA) on pull_request, push
(main/master), a daily schedule, and manual dispatch
- Fetch the repo's GitHub custom properties (repo_owner, team_name,
security_champion, repo_component) via the GitHub API and apply them
as both project tags and scan tags, so Checkmarx One findings can be
filtered/owned by team without manual tagging; gracefully skips
tagging (with a warning annotation) instead of failing the scan if
the properties can't be fetched or none are set
- Pin actions/checkout to v7.0.1 and checkmarx/ast-github-action to
2.3.46
- Scope permissions at the job level (contents: read), with
permissions: {} as the workflow-level default
cx-shrinil-modhave
force-pushed
the
AST-177880/cx-one-scan-test
branch
from
October 15, 2026 14:45
0a57ccd to
64dec5e
Compare
Add a workflow_call trigger (declaring the four Checkmarx secrets as required) so other repos can invoke this workflow directly via uses: Checkmarx/doss-github-actions-public/.github/workflows/cx-one-scan.yaml@<ref> instead of duplicating it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Checkmarx One scan workflow (
cx-one-scan.yaml) for this public repo, and tags both the Checkmarx One project and each scan with this repository's GitHub custom properties (repo_owner,team_name,security_champion,repo_component), so findings in Checkmarx One can be filtered/owned by team without manual tagging.What changed
cx-one-scan.yamlruns a Checkmarx One scan (SAST/SCA/IaC/API security/containers/SCS/ASCA) onpull_request,push(main/master), a daily schedule, and manual dispatch.repos/{repo}/properties/values) to read this repo's custom properties, then passes them to the Checkmarx CLI as both--project-tags(persists on the Checkmarx One project) and--tags(applied per scan), using the repo's ownGITHUB_TOKEN— no extra permissions needed since this is a metadata-read-only call.actions/checkoutbumpedv6→v7.0.1checkmarx/ast-github-actionbumped2.3.42→2.3.46(latest)pushtrigger now also runs onmaster, for repos still using the legacy default branch nameWhy
What this achieves
repo_owner,team_name,security_champion, andrepo_component, kept in sync with GitHub on every run (no manual upkeep).checkout7.x andast-github-action2.3.43-2.3.46.master.