|
| 1 | +# This workflow uses actions that are not certified by GitHub. |
| 2 | +# They are provided by a third-party and are governed by |
| 3 | +# separate terms of service, privacy policy, and support |
| 4 | +# documentation. |
| 5 | + |
| 6 | +################################################################################################################################################ |
| 7 | +# Fortify Application Security provides your team with solutions to empower DevSecOps practices, enable cloud transformation, and secure your # |
| 8 | +# software supply chain. To learn more about Fortify, start a free trial or contact our sales team, visit fortify.com. # |
| 9 | +# # |
| 10 | +# Use this starter workflow as a basis for integrating Fortify Application Security Testing into your GitHub workflows. This template # |
| 11 | +# demonstrates the steps to package the code+dependencies, initiate a scan, and optionally import SAST vulnerabilities into GitHub Security # |
| 12 | +# Code Scanning Alerts. Additional information is available in the workflow comments and the Fortify AST Action / fcli / Fortify product # |
| 13 | +# documentation. If you need additional assistance, please contact Fortify support. # |
| 14 | +################################################################################################################################################ |
| 15 | + |
| 16 | +name: Fortify AST Scan |
| 17 | + |
| 18 | +# Customize trigger events based on your DevSecOps process and/or policy |
| 19 | +on: |
| 20 | + push: |
| 21 | + branches: [ "main" ] |
| 22 | + pull_request: |
| 23 | + # The branches below must be a subset of the branches above |
| 24 | + branches: [ "main" ] |
| 25 | + schedule: |
| 26 | + - cron: '33 19 * * 2' |
| 27 | + workflow_dispatch: |
| 28 | + |
| 29 | +jobs: |
| 30 | + Fortify-AST-Scan: |
| 31 | + # Use the appropriate runner for building your source code. Ensure dev tools required to build your code are present and configured appropriately (MSBuild, Python, etc). |
| 32 | + runs-on: ubuntu-latest |
| 33 | + permissions: |
| 34 | + actions: read |
| 35 | + contents: read |
| 36 | + security-events: write |
| 37 | + |
| 38 | + steps: |
| 39 | + # Check out source code |
| 40 | + - name: Check Out Source Code |
| 41 | + uses: actions/checkout@v4 |
| 42 | + |
| 43 | + # Java is required to run the various Fortify utilities. Ensuring proper version is installed on the runner. |
| 44 | + - name: Setup Java |
| 45 | + uses: actions/setup-java@v4 |
| 46 | + with: |
| 47 | + java-version: 17 |
| 48 | + distribution: 'temurin' |
| 49 | + |
| 50 | + # Perform SAST and optionally SCA scan via Fortify on Demand/Fortify Hosted/Software Security Center, then |
| 51 | + # optionally export SAST results to the GitHub code scanning dashboard. In case further customization is |
| 52 | + # required, you can use sub-actions like fortify/github-action/setup@v1 to set up the various Fortify tools |
| 53 | + # and run them directly from within your pipeline; see https://github.com/fortify/github-action#readme for |
| 54 | + # details. |
| 55 | + - name: Run FoD SAST Scan |
| 56 | + uses: fortify/github-action@a92347297e02391b857e7015792cd1926a4cd418 |
| 57 | + with: |
| 58 | + sast-scan: true |
| 59 | + env: |
| 60 | + ### Required configuration when integrating with Fortify on Demand |
| 61 | + FOD_URL: https://ams.fortify.com |
| 62 | + FOD_TENANT: ${{secrets.FOD_TENANT}} |
| 63 | + FOD_USER: ${{secrets.FOD_USER}} |
| 64 | + FOD_PASSWORD: ${{secrets.FOD_PAT}} |
| 65 | + ### Optional configuration when integrating with Fortify on Demand |
| 66 | + # EXTRA_PACKAGE_OPTS: -oss # Extra 'scancentral package' options, like '-oss'' if |
| 67 | + # Debricked SCA scan is enabled on Fortify on Demand |
| 68 | + # EXTRA_FOD_LOGIN_OPTS: --socket-timeout=60s # Extra 'fcli fod session login' options |
| 69 | + # FOD_RELEASE: MyApp:MyRelease # FoD release name, default: <org>/<repo>:<branch>; may |
| 70 | + # replace app+release name with numeric release ID |
| 71 | + # DO_WAIT: true # Wait for scan completion, implied if 'DO_EXPORT: true' |
| 72 | + # DO_EXPORT: true # Export SAST results to GitHub code scanning dashboard |
| 73 | + ### Required configuration when integrating with Fortify Hosted / Software Security Center & ScanCentral |
| 74 | + # SSC_URL: ${{secrets.SSC_URL}} # SSC URL |
| 75 | + # SSC_TOKEN: ${{secrets.SSC_TOKEN}} # SSC CIToken or AutomationToken |
| 76 | + # SC_SAST_TOKEN: ${{secrets.SC_SAST_TOKEN}} # ScanCentral SAST client auth token |
| 77 | + # SC_SAST_SENSOR_VERSION: ${{vars.SC_SAST_SENSOR_VERSION}} # Sensor version on which to run the scan; |
| 78 | + # usually defined as organization or repo variable |
| 79 | + ### Optional configuration when integrating with Fortify Hosted / Software Security Center & ScanCentral |
| 80 | + # EXTRA_SC_SAST_LOGIN_OPTS: --socket-timeout=60s # Extra 'fcli sc-sast session login' options |
| 81 | + # SSC_APPVERSION: MyApp:MyVersion # SSC application version, default: <org>/<repo>:<branch> |
| 82 | + # EXTRA_PACKAGE_OPTS: -bv myCustomPom.xml # Extra 'scancentral package' options |
| 83 | + # DO_WAIT: true # Wait for scan completion, implied if 'DO_EXPORT: true' |
| 84 | + # DO_EXPORT: true # Export SAST results to GitHub code scanning dashboard |
0 commit comments