Skip to content

Commit fd30e61

Browse files
rsendenrsenden
authored
Merge branch 'main' into fortify-action-update
2 parents 01f72fa + 88c7344 commit fd30e61

3 files changed

Lines changed: 131 additions & 75 deletions

File tree

‎.github/workflows/fortify.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,5 +52,3 @@ jobs:
5252
DO_SCA_SCAN: true
5353
DO_AVIATOR_AUDIT: true
5454
COPY_FROM_RELEASE: "${{ github.repository }}:${{ github.event.repository.default_branch }}"
55-
#DO_PR_COMMENT: true
56-
#DO_POLICY_CHECK: true

‎devops-integrations/azure/azure-pipelines-fortify-sast-fod.yml‎

Lines changed: 78 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,80 @@
1-
# Integrate Fortify on Demand Static AppSec Testing (SAST) into your Azure DevOps pipeline
2-
# The following service connection must be establish before using this job
3-
# - FoD_AMS
4-
#
5-
# The following task parameter must be defined
6-
# - ReleaseId
1+
# Integrate Fortify on Demand Static AppSec Testing (SAST) into your Azure DevOps pipeline
2+
# The following pipeline variables must be defined before using SAST stage:
3+
# - $FOD_URL
4+
# - $FOD_CLIENT_ID
5+
# - $FOD_CLIENT_SECRET
6+
# The following pipeline variables are optional and can be defined to enable additional features:
7+
# - $FOD_RELEASE
8+
# - $FOD_PARENT_RELEASE
9+
# - $FOD_DEFAULT_OWNER
10+
# For more information on using Fortify on Demand SAST in Azure DevOps, see the documentation:
11+
# https://fortify.github.io/fcli/v3/ci/ado/script/ast-workflow-fod.html
712

8-
trigger:
9-
- main
10-
11-
pool:
12-
vmImage: ubuntu-latest
1313

14-
steps:
15-
- task: Maven@3
16-
inputs:
17-
mavenPomFile: 'pom.xml'
18-
publishJUnitResults: true
19-
testResultsFiles: '**/surefire-reports/TEST-*.xml'
20-
javaHomeOption: 'JDKVersion'
21-
jdkVersionOption: '1.11'
22-
mavenVersionOption: 'Default'
23-
mavenOptions: '-Xmx3072m'
24-
mavenAuthenticateFeed: false
25-
effectivePomSkip: false
26-
sonarQubeRunAnalysis: false
27-
- task: FortifyOnDemandStatic@8
28-
inputs:
29-
FortifyProjects: '$(Build.Repository.LocalPath)'
30-
FodConnection: 'FoD_AMS' # create Azure DevOps Service connection with name FoD_AMS
31-
ReleaseOptions: '0'
32-
ReleaseId: 00000 # update FoD RELEASE ID
33-
EntitlementSelection: '1'
34-
EntitlementPreference: '2'
35-
OverrideScanSettings: '2'
36-
InProgressScanActionType: '0'
37-
RemediationScanPreference: '2'
38-
BuildType: 'mvn'
39-
PolicyFailAction: '0'
14+
trigger:
15+
- none
16+
stages:
17+
- stage: Build
18+
jobs:
19+
- job: Build
20+
displayName: Building IWA Project
21+
pool:
22+
vmImage: ubuntu-latest
23+
steps:
24+
- task: Maven@3
25+
inputs:
26+
mavenPomFile: 'pom.xml'
27+
mavenOptions: '-Xmx3072m'
28+
javaHomeOption: 'JDKVersion'
29+
jdkVersionOption: '1.17'
30+
jdkArchitectureOption: 'x64'
31+
publishJUnitResults: true
32+
testResultsFiles: '**/surefire-reports/TEST-*.xml'
33+
goals: 'package'
34+
- job: SAST
35+
displayName: Fortify SAST
36+
dependsOn:
37+
- Build
38+
pool:
39+
vmImage: 'ubuntu-latest'
40+
steps:
41+
- checkout: self
42+
persistCredentials: "true"
43+
clean: "true"
44+
- task: Bash@3
45+
displayName: 'Install Fortify CLI via @fortify/setup'
46+
inputs:
47+
targetType: 'inline'
48+
script: |
49+
npx @fortify/setup@v2 env init --tools=fcli:bootstrapped
50+
npx @fortify/setup@v2 env ado
51+
- task: Bash@3
52+
displayName: 'Run Fortify on Demand SAST CI Scan'
53+
inputs:
54+
targetType: 'inline'
55+
script: |
56+
set -euo pipefail
57+
fcli action run ci
58+
env:
59+
FOD_URL: $(FOD_URL)
60+
FOD_CLIENT_ID: $(FOD_CLIENT_ID)
61+
FOD_CLIENT_SECRET: $(FOD_CLIENT_SECRET)
62+
# FOD_RELEASE is optional, defaults to <org>/<repo>:<branch>
63+
#FOD_RELEASE: "$(FOD_RELEASE)"
64+
# Uncomment the following line to copy from an existing release
65+
#COPY_FROM_RELEASE: "$(FOD_PARENT_RELEASE)"
66+
# Uncomment to set the default Static Assessment type when a new release is created
67+
#SAST_ASSESSMENT_TYPE: "Static Assessment"
68+
# Example of setting extra options for when creating a new release
69+
#SETUP_EXTRA_OPTS: '--sdlc-status Development --app-owner "$(FOD_DEFAULT_OWNER)"'
70+
DO_SETUP: true
71+
DO_SAST_SCAN: true
72+
# Uncomment to enable Aviator AI audit and remedation
73+
#DO_AVIATOR_AUDIT: true
74+
#SAST_WAIT_EXTRA_OPTS: --timeout 2h
75+
DO_SCA_SCAN: true
76+
DO_WAIT: true
77+
DO_POLICY_CHECK: true
78+
DO_JOB_SUMMARY: true
79+
DO_PR_COMMENT: true
80+
DO_EXPORT: true

‎devops-integrations/azure/azure-pipelines-fortify-sast-scancentral.yml‎

Lines changed: 53 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
# Integrate Fortify ScanCentral Static AppSec Testing (SAST) into your Azure DevOps pipeline
2-
# The following pipeline variables must be defined before using SAST stage
3-
# - $_FCLI_DEFAULT_SC_SAST_CLIENT_AUTH_TOKEN
4-
# - $_FCLI_DEFAULT_SSC_USER
5-
# - $_FCLI_DEFAULT_SSC_PASSWORD
6-
# - $_FCLI_DEFAULT_SSC_CI_TOKEN
7-
# - $_FCLI_DEFAULT_SSC_URL
8-
# - $_SSC_APP_VERSION_ID
2+
# The following pipeline variables must be defined before using SAST stage:
3+
# - $SSC_URL
4+
# - $SSC_TOKEN
5+
# - $SC_SAST_TOKEN
6+
# The following pipeline variables are optional and can be defined to enable additional features:
7+
# - $SSC_APPVERSION
8+
# - $AVIATOR_URL
9+
# - $AVIATOR_TOKEN
10+
# - $AVIATOR_APP
11+
# - $DEBRICKED_ACCESS_TOKEN
12+
# For more information on using Fortify ScanCentral SAST in Azure DevOps, see the documentation:
13+
# https://fortify.github.io/fcli/v3/ci/ado/script/ast-workflow-ssc.html
914

1015
trigger:
1116
- none
@@ -33,33 +38,45 @@ stages:
3338
- Build
3439
pool:
3540
vmImage: 'ubuntu-latest'
36-
container:
37-
image: fortifydocker/fortify-ci-tools:5.4.1-jdk-17
38-
options: "--add-host=<<SSC_FQDN_NAME>>:x.x.x.x"
39-
env:
40-
FCLI_DEFAULT_SC_SAST_CLIENT_AUTH_TOKEN: $(_FCLI_DEFAULT_SC_SAST_CLIENT_AUTH_TOKEN)
41-
FCLI_DEFAULT_SSC_USER: $(_FCLI_DEFAULT_SSC_USER)
42-
FCLI_DEFAULT_SSC_PASSWORD: $(_FCLI_DEFAULT_SSC_PASSWORD)
43-
FCLI_DEFAULT_SSC_CI_TOKEN: $(_FCLI_DEFAULT_SSC_CI_TOKEN)
44-
FCLI_DEFAULT_SSC_URL: $(_FCLI_DEFAULT_SSC_URL)
45-
SSC_APP_VERSION_ID: $(_SSC_APP_VERSION_ID)
46-
SC_SAST_SENSOR_VERSION: 24.2
4741
steps:
48-
- script: |
49-
echo Setting connection with Fortify Platform
50-
echo $FORTIFY_SSC_IP fortify.cyberxdemo.com >> /etc/hosts
51-
#Use --insecure switch if the SSL certificate is self generated.
52-
fcli ssc session login
53-
fcli sc-sast session login
54-
55-
scancentral package -bt mvn -o package.zip
56-
fcli sc-sast scan start --publish-to=$SSC_APP_VERSION_ID --sensor-version=$SC_SAST_SENSOR_VERSION --package-file=package.zip --store=Id
57-
58-
fcli sc-sast scan wait-for ::Id:: --interval=30s
59-
fcli ssc issue count --appversion=$SSC_APP_VERSION_ID
60-
61-
echo Terminating connection with Fortify Platform
62-
fcli sc-sast session logout
63-
fcli ssc session logout
64-
displayName: Scan Central Scan
65-
continueOnError: false
42+
- checkout: self
43+
persistCredentials: "true"
44+
clean: "true"
45+
- task: Bash@3
46+
displayName: 'Install Fortify CLI via @fortify/setup'
47+
inputs:
48+
targetType: 'inline'
49+
script: |
50+
npx @fortify/setup@v2 env init --tools=fcli:bootstrapped
51+
npx @fortify/setup@v2 env ado
52+
- task: Bash@3
53+
displayName: 'Run ScanCentral SAST CI Scan'
54+
inputs:
55+
targetType: 'inline'
56+
script: |
57+
set -euo pipefail
58+
fcli action run ci
59+
env:
60+
SSC_URL: $(SSC_URL)
61+
SSC_TOKEN: $(SSC_TOKEN)
62+
SC_SAST_TOKEN: $(SC_SAST_TOKEN)
63+
# Uncomment to enable Aviatior AI audit and remediation
64+
#AVIATOR_URL: $(AVIATOR_URL)
65+
#AVIATOR_TOKEN: $(AVIATOR_TOKEN)
66+
#AVIATOR_APP: $(AVIATOR_APP)
67+
# Uncomment to enable Debricked SCA scan
68+
#DEBRICKED_ACCESS_TOKEN: $(DEBRICKED_ACCESS_TOKEN)
69+
# SSC_APPVERSION is optional, defaults to <org>/<repo>:<branch>
70+
#SSC_APPVERSION: "$(SSC_APPVERSION)"
71+
DO_SETUP: true
72+
DO_SAST_SCAN: true
73+
#SAST_WAIT_EXTRA_OPTS: --timeout 2h
74+
#DO_DEBRICKED_SCAN: true
75+
#DO_AVIATOR_AUDIT: true
76+
DO_WAIT: true
77+
DO_APPVERSION_SUMMARY: true
78+
DO_POLICY_CHECK: true
79+
DO_JOB_SUMMARY: true
80+
DO_PR_COMMENT: true
81+
DO_EXPORT: true
82+

0 commit comments

Comments
 (0)