Update AST CLI base image to version 2.3.55 (AST-162048)

.github/workflows/checkmarx-one-scan.yml

@@ -8,18 +8,26 @@ on:
       - main
   schedule:
     - cron: '00 7 * * *' # Every day at 07:00
+permissions:
+  contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 jobs:
   cx-scan:
+    name: Checkmarx One Scan
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v6
+        with:
+          persist-credentials: false
       - name: Checkmarx One CLI Action
-        uses: checkmarx/ast-github-action@9fda5a4a2c297608117a5a56af424502a9192e57 # v.2.0.34
+        uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc
         with:
           base_uri: ${{ secrets.AST_RND_SCANS_BASE_URI }}
           cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }}
           cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }}
           cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }}
-          additional_params: --tags phoenix --threshold "sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;sca-critical=1;sca-high=1;sca-medium=1;sca-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;"
+          additional_params: --tags sypher --threshold "sca-critical=1;sca-high=1;sca-medium=1;sca-low=1;sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1"

.github/workflows/ci.yml

@@ -8,8 +8,10 @@ jobs:
 
     name: Integration Testing
     steps:
-      - name: Checkout the repository
-        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Create source file
         run: |
@@ -22,7 +24,7 @@ jobs:
         uses: ./
         with:
           project_name: ${{ github.event.repository.name }}-tests
-          base_uri: https://fake.com
+          base_uri: ${{ secrets.CX_BASE_URI }}
           cx_client_id: ""
           cx_client_secret: ""
       - name: Check If Authentication Failed

.github/workflows/release.yml

@@ -24,8 +24,8 @@ jobs:
           api-key: ${{ secrets.STEP_SECURITY_API_KEY }}
       - name: Checkout
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
-        # with:
-        #   token: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          persist-credentials: false
 
       - name: Extract full CLI version from Dockerfile
         id: extract_cli_version

.github/workflows/trivy-scan.yml

@@ -0,0 +1,58 @@
+name: Trivy Scan
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '00 8 * * *' # Every day at 08:00
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trivy-scan:
+    name: Trivy Image Scan
+    runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Build Docker image
+        run: docker build -t ast-github-action:${{ github.sha }} .
+
+      - name: Run Trivy vulnerability scanner (SARIF)
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: ast-github-action:${{ github.sha }}
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: '0'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        if: always()
+        uses: github/codeql-action/upload-sarif@703b9949c65fcfced30e2f9f41569c4adfcb657f # v3.36.3
+        with:
+          sarif_file: trivy-results.sarif
+
+      - name: Fail build on CRITICAL or HIGH vulnerabilities
+        uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
+        with:
+          image-ref: ast-github-action:${{ github.sha }}
+          format: table
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: '1'

.github/workflows/update-docker-image.yml

@@ -22,7 +22,9 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Get Version and SHA256 Manifest Digest
         id: checkmarx-ast-cli

.trivyignore

@@ -0,0 +1,25 @@
+# Trivy Ignore File for ast-github-action
+# CVEs listed here are accepted risks or have patches pending
+# Format: CVE-XXXX-XXXXX or GHSA-xxxx-xxxx-xxxx
+# Optional: exp=2026-12-31 (expiry date to re-evaluate)
+
+# Wolfi OS Layer (inherited from checkmarx/ast-cli:2.3.55)
+CVE-2026-6791 # glibc fixed version available in newer base images
+
+# Go Binary Dependencies
+# Syft (SBOM generation)
+CVE-2026-33481 # Syft improper temporary file cleanup, fixed in v1.42.3
+
+# Docker/Moby (contained usage, no privilege escalation risk)
+CVE-2026-34040 exp=2027-06-30 # Moby authorization bypass - monitor for v29.3.1+
+CVE-2026-33997 # Moby privilege validation bypass during plugin installation
+
+# ORAS-Go (artifact registry operations)
+CVE-2026-50151 exp=2027-06-30 # oras-go credential forwarding via Location header, fixed in v2.6.1
+CVE-2026-50162 # oras-go symlink traversal in file store
+GHSA-vh4v-2xq2-g5cg # ORAS forwards registry credentials across redirects
+CVE-2026-48978 # oras-go bearer token realm hijacking
+
+# Go Standard Library
+CVE-2026-39822 # Root escape via symlink + trailing slash
+CVE-2026-42505 # ECH privacy leak in crypto/tls

Dockerfile

@@ -1,5 +1,5 @@
 # Use AST Base image
-FROM checkmarx/ast-cli:2.3.54@sha256:ed989645c3919010e80ac9798287e68e9903818ad8a861e1e787823a12feaddd
+FROM checkmarx/ast-cli:2.3.55@sha256:1624b5f77262541e7882b3234d2ed245526a3e5f3842d32304926becfce498ec
 
 # Docker actions must be run by the default Docker user (root).
 USER root