Skip to content

Commit a7ad7d5

Browse files
cx-aniket-shindecx-atish-jadhav
cx-aniket-shinde
and
cx-atish-jadhav
authored
AST-146807: Create Claude MD file for ast-cli-java-wrapper repository (#479)
* AST-146807: Create Cloud MD file for ast-cli-java-wrapper repository - Added comprehensive Cloud.md with all essential sections: - Project Overview - Architecture and design patterns - Repository structure - Technology stack (Maven, Java 8, Jackson, Lombok, etc.) - Development setup and prerequisites - Coding standards and guidelines - Project rules and conventions - Testing strategy with JUnit 5 and code coverage - Known issues and limitations - Included recommended sections: - Database schema (N/A for client library) - External integrations (AST Platform, Maven Central) - Deployment information - Performance considerations - API/Endpoints/Interfaces documentation - Security & Access controls - Logging configuration - Debugging steps and common issues - Documentation follows the standardization template from epic AST-146793 * Squashed commit of the following: commit 8e107dc Author: Atish Jadhav <atish.jadhav@checkmarx.com> Date: Tue Jun 23 19:34:27 2026 +0530 security: fix SCA vulnerability for JUnit (#488) Co-authored-by: Luís Ventuzelos <207163323+cx-luis-ventuzelos@users.noreply.github.com> commit 06dafaa Author: Luís Ventuzelos <207163323+cx-luis-ventuzelos@users.noreply.github.com> Date: Mon Jun 22 12:37:18 2026 +0100 security: harden release workflow and declare workflow_call secrets (#487) * security: harden release workflow and declare workflow_call secrets - Replace actions/checkout v4.3.1 with v6.0.3 and switch from PERSONAL_ACCESS_TOKEN to GITHUB_TOKEN - Fix script injection in Download CLI, Tag, Update POM, Build artifactId, and Publish steps by moving inputs to env vars - Replace deprecated ::set-output with $GITHUB_OUTPUT in Tag step - Update actions/setup-java v4.3.0 to v5.2.0 - Add explicit secrets declaration for workflow_call (MAVEN_GPG_PASSPHRASE, MAVEN_GPG_PRIVATE_KEY, OSSRH_TOKEN, OSSRH_USERNAME) - Fix broken shell conditional in Build artifactId property step * chore(gha): harden GitHub Actions workflows security * chore(gha): disable nightly trigger and remove pr-labeler workflow * chore(gha): configure echo mirror for Maven dependency resolution commit 6661e60 Author: Atish Jadhav <141334503+cx-atish-jadhav@users.noreply.github.com> Date: Thu Jun 18 22:49:44 2026 +0530 Updating ast-cli version and binaries 2.3.54 (#485) * Updating ast-cli version and binaries * Harden workflows: scope permissions, fix set-output, replace dev-drprasad, remove repository_dispatch, comment notify and spotbugs * Remove Maven cache from release and CI workflows * Add publish input to gate Maven Central deploy --------- Co-authored-by: Luís Ventuzelos <207163323+cx-luis-ventuzelos@users.noreply.github.com> commit 06b449c Author: Alon Rosenhek <80337069+cx-alon-rosenhek@users.noreply.github.com> Date: Thu Jun 18 16:57:16 2026 +0300 chore: remove .github/workflows/dependabot-auto-merge.yml commit 6fb3166 Author: Ohad Israeli <243351248+cx-ohad-israeli@users.noreply.github.com> Date: Wed Jun 10 17:39:51 2026 +0300 chore: remove Dependabot configuration commit 814a504 Author: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Fri May 29 21:25:57 2026 -0400 [StepSecurity] Apply security best practices (#481) Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com> * Update to AST CLI 2.3.55 and switch to Echo repository Updates the AST CLI binaries to version 2.3.55 across all platforms (Linux, Linux ARM, macOS, Windows). Switches distribution from Sonatype Central to Checkmarx's Echo repository, adds Echo repository configuration to pom.xml for dependencies and plugins, and configures Maven mirror authentication in CI/release workflows with ECHO_LIBRARIES_ACCESS_KEY secret. Also adds .vscode to gitignore. * Release 2.3.56 with Jackson 2.22.0 update Update Jackson dependency from 2.21.1 to 2.22.0 and bump CLI version to 2.3.56. Also includes: - Updated CLI binaries for all platforms (Linux, Linux ARM, macOS, Windows) - Fixed Maven mirror ID in CI workflows from 'echo' to 'echo-repo' for proper dependency resolution * Improve Maven echo mirror config in GH workflows Make configuring the Echo Maven mirror more robust in CI and release workflows. In .github/workflows/ci.yml create ~/.m2 and write a complete settings.xml via heredoc (ensures the file exists and injects the echo-repo server/mirror using the ECHO_LIBRARIES_ACCESS_KEY secret). In .github/workflows/release.yml replace the single fragile sed with two targeted sed commands to insert the server and mirrors entries. These changes reduce brittle sed usage and avoid failures when ~/.m2/settings.xml is missing or structured differently. * test: remove PATH_TO_EXECUTABLE guard to enable previously skipped realtime integration tests * Add Zizmor scan and disable checkout credentials Add a new workflow (scan-github-action.yml) to run the Zizmor linter against GitHub Actions (pedantic persona, annotations/offline disabled). Update existing workflows (.github/workflows/checkmarx-one-scan.yml, ci.yml, update-cli.yml) to set actions/checkout persist-credentials: false to avoid leaking GITHUB_TOKEN to third-party actions. * fix: resolve all Zizmor GitHub Actions security findings * fix: restore integration-tests check name and suppress zizmor anonymous-definition --------- Co-authored-by: Atish Jadhav <141334503+cx-atish-jadhav@users.noreply.github.com> Co-authored-by: atishj99 <atish.jadhav@checkmarx.com>
1 parent 8e107dc commit a7ad7d5

19 files changed

Lines changed: 735 additions & 61 deletions

‎.github/workflows/checkmarx-one-scan.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ on:
88
schedule:
99
- cron: "00 7 * * *" # Every day at 07:00
1010

11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
1115
permissions:
1216
contents: read
1317

@@ -20,6 +24,8 @@ jobs:
2024
steps:
2125
- name: Checkout
2226
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
27+
with:
28+
persist-credentials: false
2329
- name: Checkmarx One CLI Action
2430
uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc #v.2.3.19
2531
with:

‎.github/workflows/ci.yml‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,15 @@ name: AST Java Wrapper CI
22

33
on: [ pull_request ]
44

5+
concurrency:
6+
group: ${{ github.workflow }}-${{ github.ref }}
7+
cancel-in-progress: true
8+
59
permissions:
610
contents: read
711

812
jobs:
9-
integration-tests:
13+
integration-tests: # zizmor: ignore[anonymous-definition]
1014
permissions:
1115
contents: read
1216
runs-on: cx-public-ubuntu-x64
@@ -16,6 +20,7 @@ jobs:
1620
with:
1721
token: ${{ secrets.GITHUB_TOKEN }}
1822
lfs: true
23+
persist-credentials: false
1924

2025
- name: Install Git LFS
2126
run: |
@@ -34,7 +39,28 @@ jobs:
3439

3540
- name: Configure echo mirror for dependency resolution
3641
run: |
37-
sed -i 's|</settings>|<mirrors><mirror><id>echo</id><mirrorOf>central</mirrorOf><url>https://maven.echohq.com</url></mirror></mirrors></settings>|' ~/.m2/settings.xml
42+
mkdir -p ~/.m2
43+
cat > ~/.m2/settings.xml << EOF
44+
<?xml version="1.0" encoding="UTF-8"?>
45+
<settings>
46+
<mirrors>
47+
<mirror>
48+
<id>echo-repo</id>
49+
<mirrorOf>*</mirrorOf>
50+
<url>https://maven.echohq.com</url>
51+
</mirror>
52+
</mirrors>
53+
<servers>
54+
<server>
55+
<id>echo-repo</id>
56+
<username></username>
57+
<password>${ECHO_LIBRARIES_ACCESS_KEY}</password>
58+
</server>
59+
</servers>
60+
</settings>
61+
EOF
62+
env:
63+
ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
3864

3965
- name: Check existence of cx-linux binary
4066
run: |

‎.github/workflows/manual-tag.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,29 +7,37 @@ on:
77
description: 'Next release tag'
88
required: true
99

10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: false
13+
1014
permissions:
1115
contents: read
1216

1317
jobs:
1418
tag-creation:
19+
name: Tag Creation
1520
permissions:
1621
contents: write # for Git to git push
1722
runs-on: cx-public-ubuntu-x64
1823
steps:
1924
- name: Checkout
2025
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
2126
with:
22-
token: ${{ secrets.GITHUB_TOKEN }}
27+
persist-credentials: false
2328
- name: Tag
2429
env:
2530
INPUT_TAG: ${{ github.event.inputs.tag }}
2631
PR_NUMBER: ${{ github.event.pull_request.number }}
2732
PR_TITLE: ${{ github.event.pull_request.title }}
33+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
REPO: ${{ github.repository }}
2835
run: |
2936
echo "$INPUT_TAG"
3037
echo "NEXT_VERSION=$INPUT_TAG" >> $GITHUB_ENV
3138
message="$INPUT_TAG: PR #$PR_NUMBER $PR_TITLE"
3239
git config user.name "${GITHUB_ACTOR}"
3340
git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
41+
git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}"
3442
git tag -a "$INPUT_TAG" -m "$message"
3543
git push origin "$INPUT_TAG"

‎.github/workflows/nightly.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,26 @@ on:
66
# branches:
77
# - main
88

9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: false
12+
913
permissions:
1014
contents: read
1115

1216
jobs:
1317
delete_tag:
18+
name: Delete Tag
1419
permissions:
15-
contents: write
20+
contents: write # for gh release delete to remove tags and releases
1621
runs-on: cx-public-ubuntu-x64
1722
steps:
1823
- name: Delete release and tag
1924
env:
2025
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
26+
GH_REPO: ${{ github.repository }}
2127
run: |
22-
gh release delete "1.0.0-SNAPSHOT" --yes --cleanup-tag --repo ${{ github.repository }} || true
28+
gh release delete "1.0.0-SNAPSHOT" --yes --cleanup-tag --repo "${GH_REPO}" || true
2329
2430
nightly:
2531
needs: delete_tag

‎.github/workflows/release.yml‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,15 +50,22 @@ on:
5050
required: true
5151
OSSRH_USERNAME:
5252
required: true
53+
ECHO_LIBRARIES_ACCESS_KEY:
54+
required: true
55+
56+
concurrency:
57+
group: ${{ github.workflow }}-${{ github.ref }}
58+
cancel-in-progress: false
5359

5460
permissions:
5561
contents: read
5662

5763
jobs:
5864
release:
65+
name: Release
5966
permissions:
60-
id-token: write
61-
contents: write
67+
id-token: write # for Maven Central publishing via OIDC
68+
contents: write # for git push tag and creating GitHub release
6269
runs-on: cx-public-ubuntu-x64
6370
outputs:
6471
CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }}
@@ -67,8 +74,8 @@ jobs:
6774
- name: Checkout
6875
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
6976
with:
70-
token: ${{ secrets.GITHUB_TOKEN }}
7177
lfs: true
78+
persist-credentials: false
7279

7380
- name: Download CLI
7481
if: inputs.cliTag
@@ -105,11 +112,14 @@ jobs:
105112
id: set_tag_name
106113
env:
107114
INPUT_TAG: ${{ inputs.tag }}
115+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
116+
REPO: ${{ github.repository }}
108117
run: |
109118
echo "$INPUT_TAG"
110119
echo "RELEASE_VERSION=$INPUT_TAG" >> $GITHUB_ENV
111120
git config user.name "${GITHUB_ACTOR}"
112121
git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
122+
git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}"
113123
git tag -a "$INPUT_TAG" -m "$INPUT_TAG"
114124
git push origin "$INPUT_TAG"
115125
echo "TAG_NAME=$INPUT_TAG" >> $GITHUB_OUTPUT
@@ -127,7 +137,10 @@ jobs:
127137

128138
- name: Configure echo mirror for dependency resolution
129139
run: |
130-
sed -i 's|</settings>|<mirrors><mirror><id>echo</id><mirrorOf>central</mirrorOf><url>https://maven.echohq.com</url></mirror></mirrors></settings>|' ~/.m2/settings.xml
140+
sed -i 's|</servers>|<server><id>echo-repo</id><username></username><password>'"$ECHO_LIBRARIES_ACCESS_KEY"'</password></server></servers>|' ~/.m2/settings.xml
141+
sed -i 's|</settings>|<mirrors><mirror><id>echo-repo</id><mirrorOf>*</mirrorOf><url>https://maven.echohq.com</url></mirror></mirrors></settings>|' ~/.m2/settings.xml
142+
env:
143+
ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
131144

132145
- name: Update the POM version.
133146
run: mvn -B versions:set -DnewVersion="$RELEASE_VERSION" --file pom.xml -DskipTests

‎.github/workflows/scan-github-action.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Scan for GitHub Actions issues
2+
3+
on:
4+
pull_request:
5+
workflow_call:
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
9+
10+
permissions: {}
11+
12+
jobs:
13+
zizmor:
14+
name: Scan repository contents
15+
runs-on: cx-public-ubuntu-x64
16+
permissions:
17+
contents: read
18+
steps:
19+
- name: Check out repository
20+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
21+
with:
22+
persist-credentials: false
23+
24+
- name: Run Zizmor linter
25+
uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
26+
with:
27+
advanced-security: false
28+
annotations: false
29+
persona: pedantic
30+
fail-on-no-inputs: false
31+
online-audits: false

‎.github/workflows/update-cli.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,23 @@ name: Update checkmarx ast cli
33
on:
44
workflow_dispatch:
55

6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: false
9+
610
permissions:
711
contents: read
812

913
jobs:
1014
update_cli:
15+
name: Update CLI
1116
runs-on: cx-public-ubuntu-x64
1217
steps:
1318
- name: Checkout
1419
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
1520
with:
1621
lfs: true
22+
persist-credentials: false
1723

1824
- name: Install Git LFS
1925
run: |

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,5 @@ docker-compose.override.yml
3232
#################################
3333
Thumbs.db
3434
.directory
35-
.DS_Store
35+
.DS_Store
36+
/.vscode

0 commit comments

Comments
 (0)