From ae7e1acad839bdeb320c75a21140b8a946556d86 Mon Sep 17 00:00:00 2001 From: Atish Jadhav Date: Wed, 8 Jul 2026 15:46:01 +0530 Subject: [PATCH 1/4] Update AST CLI base image to version 2.3.55 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index b9772fd..40445ea 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Use AST Base image -FROM checkmarx/ast-cli:2.3.54@sha256:ed989645c3919010e80ac9798287e68e9903818ad8a861e1e787823a12feaddd +FROM checkmarx/ast-cli:2.3.55@sha256:1624b5f77262541e7882b3234d2ed245526a3e5f3842d32304926becfce498ec # Docker actions must be run by the default Docker user (root). USER root From a3455b64bf147b8a2d81186ca0b81d48b32ab7c2 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Wed, 8 Jul 2026 16:06:41 +0530 Subject: [PATCH 2/4] workflow changes --- .github/workflows/auto-merge-pr.yml | 20 -------------------- .github/workflows/checkmarx-one-scan.yml | 14 +++++++++++--- .github/workflows/ci.yml | 8 +++++--- .github/workflows/release.yml | 4 ++-- .github/workflows/update-docker-image.yml | 4 +++- 5 files changed, 21 insertions(+), 29 deletions(-) delete mode 100644 .github/workflows/auto-merge-pr.yml diff --git a/.github/workflows/auto-merge-pr.yml b/.github/workflows/auto-merge-pr.yml deleted file mode 100644 index 9a1c820..0000000 --- a/.github/workflows/auto-merge-pr.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: Post-Check Actions -on: [pull_request] - -permissions: - contents: write - -jobs: - dependabot-merge: - runs-on: cx-public-ubuntu-x64 - if: contains(github.head_ref, 'feature/update_cli') - steps: - - name: Enable auto-merge for Dependabot PRs - env: - PR_URL: ${{github.event.pull_request.html_url}} - GITHUB_TOKEN: ${{secrets.PERSONAL_ACCESS_TOKEN }} - run: gh pr merge --auto --merge "$PR_URL" - - name: Auto approve dependabot PRs - uses: step-security/auto-approve-action@0c28339628c8e79ab2f6813291e7e6cd584b4d30 # v4.0.0 - with: - github-token: ${{ secrets.PERSONAL_ACCESS_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/checkmarx-one-scan.yml b/.github/workflows/checkmarx-one-scan.yml index 81a39d5..f74c941 100644 --- a/.github/workflows/checkmarx-one-scan.yml +++ b/.github/workflows/checkmarx-one-scan.yml @@ -8,18 +8,26 @@ on: - main schedule: - cron: '00 7 * * *' # Every day at 07:00 +permissions: + contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true jobs: cx-scan: + name: Checkmarx One Scan runs-on: cx-public-ubuntu-x64 steps: - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v6 + with: + persist-credentials: false - name: Checkmarx One CLI Action - uses: checkmarx/ast-github-action@9fda5a4a2c297608117a5a56af424502a9192e57 # v.2.0.34 + uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc with: base_uri: ${{ secrets.AST_RND_SCANS_BASE_URI }} cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }} cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }} cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }} - additional_params: --tags phoenix --threshold "sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;sca-critical=1;sca-high=1;sca-medium=1;sca-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;" + additional_params: --tags sypher --threshold "sca-critical=1;sca-high=1;sca-medium=1;sca-low=1;sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2aa5795..3dc86a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -8,8 +8,10 @@ jobs: name: Integration Testing steps: - - name: Checkout the repository - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false - name: Create source file run: | @@ -22,7 +24,7 @@ jobs: uses: ./ with: project_name: ${{ github.event.repository.name }}-tests - base_uri: https://fake.com + base_uri: ${{ secrets.CX_BASE_URI }} cx_client_id: "" cx_client_secret: "" - name: Check If Authentication Failed diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1f524f4..7f94499 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,8 +24,8 @@ jobs: api-key: ${{ secrets.STEP_SECURITY_API_KEY }} - name: Checkout uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - # with: - # token: ${{ secrets.GITHUB_TOKEN }} + with: + persist-credentials: false - name: Extract full CLI version from Dockerfile id: extract_cli_version diff --git a/.github/workflows/update-docker-image.yml b/.github/workflows/update-docker-image.yml index e0b4512..dfc4032 100644 --- a/.github/workflows/update-docker-image.yml +++ b/.github/workflows/update-docker-image.yml @@ -22,7 +22,9 @@ jobs: steps: - name: Checkout Repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false - name: Get Version and SHA256 Manifest Digest id: checkmarx-ast-cli From a0393e063c62e28c0da10a08d7794db127ab5f8c Mon Sep 17 00:00:00 2001 From: atishj99 Date: Wed, 8 Jul 2026 17:00:02 +0530 Subject: [PATCH 3/4] adding trivy scan --- .github/workflows/trivy-scan.yml | 58 ++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 .github/workflows/trivy-scan.yml diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml new file mode 100644 index 0000000..6fa7dfa --- /dev/null +++ b/.github/workflows/trivy-scan.yml @@ -0,0 +1,58 @@ +name: Trivy Scan + +on: + workflow_dispatch: + pull_request: + push: + branches: + - main + schedule: + - cron: '00 8 * * *' # Every day at 08:00 + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + trivy-scan: + name: Trivy Image Scan + runs-on: cx-public-ubuntu-x64 + permissions: + contents: read + security-events: write + steps: + - name: Checkout + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + + - name: Build Docker image + run: docker build -t ast-github-action:${{ github.sha }} . + + - name: Run Trivy vulnerability scanner (SARIF) + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 + with: + image-ref: ast-github-action:${{ github.sha }} + format: sarif + output: trivy-results.sarif + severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: '0' + + - name: Upload Trivy scan results to GitHub Security tab + if: always() + uses: github/codeql-action/upload-sarif@703b9949c65fcfced30e2f9f41569c4adfcb657f # v3.36.3 + with: + sarif_file: trivy-results.sarif + + - name: Fail build on CRITICAL or HIGH vulnerabilities + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 + with: + image-ref: ast-github-action:${{ github.sha }} + format: table + severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: '1' \ No newline at end of file From 86e30fc5f1075e01afb628810ff9a506328a626d Mon Sep 17 00:00:00 2001 From: atishj99 Date: Wed, 8 Jul 2026 18:18:57 +0530 Subject: [PATCH 4/4] Adding .trivyignore file --- .trivyignore | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 0000000..55ad2b4 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,25 @@ +# Trivy Ignore File for ast-github-action +# CVEs listed here are accepted risks or have patches pending +# Format: CVE-XXXX-XXXXX or GHSA-xxxx-xxxx-xxxx +# Optional: exp=2026-12-31 (expiry date to re-evaluate) + +# Wolfi OS Layer (inherited from checkmarx/ast-cli:2.3.55) +CVE-2026-6791 # glibc fixed version available in newer base images + +# Go Binary Dependencies +# Syft (SBOM generation) +CVE-2026-33481 # Syft improper temporary file cleanup, fixed in v1.42.3 + +# Docker/Moby (contained usage, no privilege escalation risk) +CVE-2026-34040 exp=2027-06-30 # Moby authorization bypass - monitor for v29.3.1+ +CVE-2026-33997 # Moby privilege validation bypass during plugin installation + +# ORAS-Go (artifact registry operations) +CVE-2026-50151 exp=2027-06-30 # oras-go credential forwarding via Location header, fixed in v2.6.1 +CVE-2026-50162 # oras-go symlink traversal in file store +GHSA-vh4v-2xq2-g5cg # ORAS forwards registry credentials across redirects +CVE-2026-48978 # oras-go bearer token realm hijacking + +# Go Standard Library +CVE-2026-39822 # Root escape via symlink + trailing slash +CVE-2026-42505 # ECH privacy leak in crypto/tls