ast-scan.yml

name: Checkmarx One Scan

on: [ pull_request, workflow_dispatch ]

jobs:
  cx-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Checkmarx One CLI Action
        uses: checkmarx/ast-github-action@1fe318de2993222574e6249750ba9000a4e2a6cd #v2.0.33 - Check for the latest version and updated here if there is a new one
        with:
          base_uri: ${{ secrets.AST_RND_SCANS_BASE_URI }}
          cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }}
          cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }}
          cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }}
          additional_params: --tags phoenix --threshold "sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;sca-critical=1;sca-high=1;sca-medium=2;sca-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1" --debug