- Deprecation Notice: 
- This action will be deprecated soon. 
- Please consider to migrate ASAP to Checkmarx CxFlow Action available in here: 
- https://github.com/checkmarx-ts/checkmarx-cxflow-github-action

Checkmarx Github Action

Find security vulnerabilities in your Github Repository with Checkmarx using Github Action Integration.

This is a CLI Wrapper to trigger Checkmarx SAST or OSA Scans.

Checkmarx SAST (CxSAST) is an enterprise-grade flexible and accurate static analysis solution used to identify hundreds of security vulnerabilities in custom code. It is used by development, DevOps, and security teams to scan source code early in the SDLC, identify vulnerabilities and provide actionable insights to remediate them. Supporting over 22 coding and scripting languages and their frameworks with zero configuration to scan any language.

Please find more info in the official website: Checkmarx.com

Workflow - Sample SAST Scan with Username and Password Authentication

name: Checkmarx SAST Scan
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxServer: https://checkmarx.company.com
        cxUsername: [email protected]
        cxPassword: ${{ secrets.CX_PASSWORD }}
        cxTeam: \CxServer\SP\Company\TeamA

Workflow - Sample SAST Scan with Token Authentication

name: Checkmarx SAST Scan
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxServer: https://checkmarx.company.com
        cxToken: ${{ secrets.CX_TOKEN }}
        cxTeam: \CxServer\SP\Company\TeamA

Workflow - Sample SAST Scan with Token Authentication with Automatic Github Issues Creation

(v1.0.2 or above)

name: Checkmarx SAST Scan with Github Issues
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxServer: https://checkmarx.company.com
        cxToken: ${{ secrets.CX_TOKEN }}
        cxTeam: \CxServer\SP\Company\TeamA
        cxGithubIssues: true
        cxGithubToken: ${{ secrets.GITHUB_TOKEN }}
        cxGithubLabels: bug,test
        cxGithubAssignees: miguelfreitas93

Note: This will created automatically Github Issues and Commit Comment with detailed information about Checkmarx SAST Project, Scan and Results

Workflow - Sample OSA Scan with Token Authentication with Automatic Github Issues Creation

(v1.0.2 or above)

name: Checkmarx OSA Scan with Github Issues
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxAction: OsaScan
        cxServer: https://checkmarx.company.com
        cxToken: ${{ secrets.CX_TOKEN }}
        cxTeam: \CxServer\SP\Company\TeamA
        cxExecutePackageDependency: true
        cxGithubIssues: true
        cxGithubToken: ${{ secrets.GITHUB_TOKEN }}
        cxGithubLabels: bug,test
        cxGithubAssignees: miguelfreitas93

Note: This will created automatically Github Issues and Commit Comment with detailed information about OSA Libraries and Results

Workflow - Sample OSA Scan

name: Checkmarx OSA Scan
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxServer: https://checkmarx.company.com
        cxAction: OsaScan
        cxUsername: [email protected]
        cxPassword: ${{ secrets.CX_PASSWORD }}
        cxTeam: \CxServer\SP\Company\TeamA
        cxOsaLocationPath: $GITHUB_WORKSPACE

Workflow - Sample SCA Scan

(v1.0.2 or above)

name: Checkmarx SCA Scan
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxAction: ScaScan
        cxScaAccount: myaccount
        cxScaUsername: [email protected]
        cxScaPassword: ${{ secrets.CX_PASSWORD }}
        cxExecutePackageDependency: true

Workflow - Sample Revoke Token

name: Checkmarx Revoke Token
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxServer: https://checkmarx.company.com
        cxAction: RevokeToken
        cxToken: ${{ secrets.CX_TOKEN }}

Workflow - Sample Generate Token (NOT RECOMMENDED TO USE FOR SECURITY REASONS)

- Security Note: Be aware this can leak Checkmarx Access Token in the build logs

name: Checkmarx Generate Token
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v1
    - name: Checkmarx Action
      uses: checkmarx-ts/checkmarx-github-action@<version>
      with:
        cxServer: https://checkmarx.company.com
        cxAction: GenerateToken
        cxUsername: [email protected]
        cxPassword: ${{ secrets.CX_PASSWORD }}

Inputs

For using this action, there is a set of options that can be used, such as:

Inputs for Actions: Scan, AsyncScan

Inputs for Actions: OsaScan, AsyncOsaScan

Inputs for Actions: ScaScan, AsyncScaScan

Inputs for Actions: GenerateToken

Inputs for Actions: RevokeToken

Inputs for Actions: Gihub Issues

Note: cxGithubIssues set to "true" and cxGithubToken set to "${{ secrets.GITHUB_TOKEN }}" are mandatory for creation of Github issues

CLI Versions Support

There are a few Checkmarx CLI versions this action support. A version can be specified on the field "cxVersion". Please consider to use always the latest for your version.

Here the list of versions supported:

• For 9.X version:
  • 2021.1.1
  • 2020.4.12
  • 2020.4.4
  • 2020.3.1
  • 2020.2.18
  • 2020.2.11
  • 2020.2.7
  • 2020.2.3
  • 2020.1.12
  • 9.00.2
  • 9.00.1
• For 8.9 version:
  • 8.90.2
• For 8.8 version:
  • 8.80.2
• For 8.7 version:
  • 8.70.4
• For 8.6 version:
  • 8.60.3

Secrets

In order to securely configure this action, a password needs to be configured in Secrets section for later use in the YML template. Do the following steps:

• Go to your Repository
• Click on "Settings" Tab (requires you be the admin/owner of the repo)
• Click on "Secrets" section
• Add New Secret:

After setting this, you can access its value in YML template with the following format:

{{ secrets.VARIABLE_NAME }}

in this case:

{{ secrets.CX_PASSWORD }}

Recommended Secrets:

To avoid maximum confidentiality of user and server details you should use the following as Secrets:

• cxServer: {{ secrets.CX_SERVER }}
• cxUsername: {{ secrets.CX_USER }}
• cxTeam: {{ secrets.CX_TEAM }}
• cxPreset: {{ secrets.CX_PRESET }}

Important Notes:

• Make sure you do Checkout of the code, before Checkmarx Scan Step;

• Make sure you run the step under an image contains Java version CxCLI supports (Java 8), for example: ubuntu-latest;

• Project name will be always the name of the Repository concatenated with branch scanned. For example: "TestRepository-master". This is considered as Best Practice for naming convention when scanning from any Build Server.

• If there is no project with same name in Checkmarx Server, a new project will be created automatically.

• A proper Checkmarx queue, engine management and sizing should be performed, in order to guarantee pipeline gets feedback from Checkmarx ASAP, so a build could be break or an application could be released faster

• If a build is failing due to "cxHigh", "cxMedium", "cxLow" or "cxOsaHigh", "cxOSAMedium", "cxOSALow" thresholds, it is recommended to use Checkmarx Portal to revise results and mark them properly using "Confirmed" or "Not Exploitable" states. These thresholds only will take into consideration results that are not marked as "Not Exploitable".

• Make sure you Enable local and third party Actions for your repository: https://github.com/username/repo/settings/actions

• Make sure, your Github action agents can connect to your Checkmarx Server first, before using this action.

Security:

- For example purposes, cxServer, cxUsername, cxTeam are presented in plaintext. Beside this, to assure confidentiality for production use, please place them under Secrets, as CX_PASSWORD and CX_TOKEN.

- Avoid to use cxAction: GenerateToken, since this can leak Checkmarx access token to the build logs.

- If Github Issues Automation is being used, please assure Issues and Commits are private in order to avoid exposure of: Server URL, Team Name, Username, Email and Vulnerabilities that might be very sensitive such as Passwords exposure.

Challenges:

• If Checkmarx Server is not open to Internet, this action will not be able to reach the server and it will fail.

• Network Rules, Firewalls or Proxies to access Checkmarx Server might block some requests from this Github action, due to not allowing outside connections based on IP, proxy authentication requirements, etc... Please make sure, your Github action agents can connect to your Checkmarx Server first, before using this action.

• Consider to use Self-Hosted Runners for Actions for avoiding connectivity issues:

  • https://help.github.com/en/actions/hosting-your-own-runners/adding-self-hosted-runners

• or if using Github On-Premise Runners please check this page for IP Whitelist:

  • https://help.github.com/en/actions/reference/virtual-environments-for-github-hosted-runners#ip-addresses-of-runners-on-github-hosted-machines

License

Checkmarx Github Action

Copyright (C) 2020 Checkmarx TS

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/.