Update README.md

.github/workflows/ci.yml

@@ -1,16 +1,22 @@
 name: AST Javascript wrapper CI
 
 on: [pull_request]
+
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  integration-tests:
+  integration-tests: # zizmor: ignore[anonymous-definition]    
     runs-on: cx-public-ubuntu-x64
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           lfs: true
+          persist-credentials: false
 
       - name: Install Git LFS
         run: |
@@ -67,4 +73,4 @@ jobs:
           CX_BASE_URI: ${{ secrets.CX_BASE_URI }}
           CX_TENANT: ${{ secrets.CX_TENANT }}
           CX_APIKEY: ${{ secrets.CX_APIKEY }}
-        run: npm test
+        run: npm test

.github/workflows/cx-one-scan.yaml

@@ -1,4 +1,8 @@
 name: cx-one-scan
+
+permissions:
+  contents: read # For reading repository code
+
 on:
   workflow_dispatch:
   pull_request:
@@ -8,13 +12,21 @@ on:
   schedule:
     - cron: '00 5 * * *' # Every day at 05:00
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
     cx-one-scan:
-        name: cx-one-scan
+        name: Checkmarx One Security Scan
         runs-on: cx-public-ubuntu-x64
+        permissions:
+          contents: read # For reading repository code
         steps:
         - name: Checkout
           uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+          with:
+            persist-credentials: false
         - name: Checkmarx One CLI Action
           uses: checkmarx/ast-github-action@9fda4ab4c1b67c35de380552a972a82997d97731 # https://github.com/Checkmarx/ast-github-action/releases/tag/2.0.42
           with:

.github/workflows/delete-packages-and-releases.yml

@@ -16,11 +16,16 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   delete:
+    name: Delete Old Packages and Releases
     permissions:
-      contents: write
-      packages: write
+      contents: write # For deleting releases and tags
+      packages: write # For deleting npm packages
     runs-on: cx-public-ubuntu-x64
     steps:
 

.github/workflows/nightly.yml

@@ -8,11 +8,18 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   nightly:
+    name: Nightly Release Job
     permissions:
-      id-token: write
-      contents: write
-      packages: write
-    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/release.yml@main
-    secrets: inherit
+      id-token: write # For signing artifacts
+      contents: write # For pushing tags and releases
+      packages: write # For publishing packages
+    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/release.yml@abe950ede3b052dfc236f730cf11cc290af53d1c
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}

.github/workflows/release.yml

@@ -47,21 +47,28 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   delete:
+    name: Delete Old Packages and Releases
     permissions:
-      contents: write
-      packages: write
-    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/delete-packages-and-releases.yml@main
+      contents: write # For deleting releases
+      packages: write # For deleting packages
+    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/delete-packages-and-releases.yml@abe950ede3b052dfc236f730cf11cc290af53d1c
     with:
       tag: ${{ inputs.jsTag }}
-    secrets: inherit
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     if: inputs.dev == true
   release:
+    name: Release JavaScript Wrapper
     permissions:
-      id-token: write
-      contents: write
-      packages: write
+      id-token: write # For signing artifacts
+      contents: write # For pushing tags and releases
+      packages: write # For publishing packages
     runs-on: cx-public-ubuntu-x64
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -76,6 +83,7 @@ jobs:
         with:
           fetch-depth: 0
           lfs: true  # Ensure LFS files are checked out
+          persist-credentials: false
 
       # VERIFY SINGLE LOCKFILE
       - name: Verify single lockfile
@@ -185,7 +193,7 @@ jobs:
         if: inputs.dev == false
         run: |
           git pull
-          git tag ${{env.TAG_NAME}}
+          git tag ${TAG_NAME}
           git push --tags
 
 

.github/workflows/scan-github-action.yml

@@ -2,6 +2,7 @@ name: Scan for GitHub Actions issues
 
 on:
   pull_request:
+  workflow_call:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
@@ -11,7 +12,7 @@ permissions: {}
 jobs:
   zizmor:
     name: Scan repository contents
-    runs-on: cx-private-ubuntu-x64
+    runs-on: cx-public-ubuntu-x64
     permissions:
       contents: read
     steps:
@@ -27,4 +28,4 @@ jobs:
           annotations: false
           persona: pedantic
           fail-on-no-inputs: false
-          online-audits: false
+          online-audits: false

.github/workflows/update-cli.yml

@@ -1,4 +1,5 @@
 name: Update checkmarx ast cli
+
 on:
   workflow_dispatch:
   repository_dispatch:
@@ -7,15 +8,21 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   update-checkmarx-cli:
+    name: Update Checkmarx CLI Binaries
     permissions:
-      contents: write
+      contents: write # For pushing updated CLI binaries
     runs-on: cx-public-ubuntu-x64
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           lfs: true
+          persist-credentials: false
 
       - name: Install Git LFS
         run: |

README.md

@@ -2,7 +2,7 @@
 <br />
 <p align="center">
   <a href="">
-    <img src="./logo.png" alt="Logo" width="80" height="80">
+    <img src="https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/cx_x_icon.png" alt="Logo" width="80" height="80">
   </a>
 
 <h3 align="center">AST-CLI-JAVASCRIPT-WRAPPER</h3>