diff --git a/.github/workflows/ast-scan.yml b/.github/workflows/ast-scan.yml
index 22bd5da4..9c901cd7 100644
--- a/.github/workflows/ast-scan.yml
+++ b/.github/workflows/ast-scan.yml
@@ -8,12 +8,22 @@ on:
schedule:
- cron: '00 7 * * *' # Every day at 07:00
+concurrency:
+ group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
jobs:
cx-scan:
+ name: Checkmarx One Scan
runs-on: cx-public-ubuntu-x64
steps:
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+ with:
+ persist-credentials: false
- name: Checkmarx One CLI Action
uses: checkmarx/ast-github-action@f0869bd1a37fddc06499a096101e6c900e815d81 # v.2.0.36
with:
@@ -21,4 +31,4 @@ jobs:
cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }}
cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }}
cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }}
- additional_params: --tags phoenix --file-filter !checkmarx-ast-eclipse-plugin-tests/ --threshold "sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;sca-critical=1;sca-high=1;sca-medium=1;sca-low=1"
+ additional_params: --tags phoenix --file-filter !checkmarx-ast-eclipse-plugin-tests/ --threshold "sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;sca-critical=1;sca-high=1;sca-medium=1;sca-low=1"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 164d587d..69a14b28 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,24 +1,33 @@
name: Integration Tests
-on:
+on:
pull_request:
- branches:
+ branches:
- main
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
jobs:
ui-tests:
+ name: UI Tests
runs-on: cx-public-ubuntu-x64
steps:
- - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
lfs: true
+ persist-credentials: false
- name: Checkout LFS objects
run: git lfs checkout
- - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+ - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
with:
distribution: temurin
java-version: 17
- - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
+ - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -34,7 +43,7 @@ jobs:
Xvfb -ac :99 -screen 0 1920x1080x16 &
mvn verify -Dtest.includes="**/ui/*.java"
- name: Upload Coverage Report
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: jacoco-coverage-report-ui
path: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate
@@ -44,18 +53,20 @@ jobs:
jacoco-csv-file: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate/jacoco.csv
generate-summary: true
integration-tests:
+ name: Integration Tests
runs-on: cx-public-ubuntu-x64
steps:
- - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
lfs: true
+ persist-credentials: false
- name: Checkout LFS objects
run: git lfs checkout
- - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+ - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
with:
distribution: temurin
java-version: 17
- - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
+ - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -71,7 +82,7 @@ jobs:
Xvfb -ac :99 -screen 0 1920x1080x16 &
mvn verify -Dtest.includes="**/integration/*Test.java"
- name: Upload Coverage Report
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: jacoco-coverage-report-integration
path: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate
@@ -81,18 +92,20 @@ jobs:
jacoco-csv-file: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate/jacoco.csv
generate-summary: true
unit-tests:
+ name: Unit Tests
runs-on: cx-public-ubuntu-x64
steps:
- - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
lfs: true
+ persist-credentials: false
- name: Checkout LFS objects
run: git lfs checkout
- - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+ - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
with:
distribution: temurin
java-version: 17
- - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
+ - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -108,7 +121,7 @@ jobs:
Xvfb -ac :99 -screen 0 1920x1080x16 &
mvn clean verify -Dtest.includes="**/unit/**/*Test.java"
- name: Upload Coverage Report
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+ uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: jacoco-coverage-report-unit
path: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate
diff --git a/.github/workflows/delete-dev-releases.yml b/.github/workflows/delete-dev-releases.yml
index 057b008a..6a47fbdb 100644
--- a/.github/workflows/delete-dev-releases.yml
+++ b/.github/workflows/delete-dev-releases.yml
@@ -13,13 +13,19 @@ on:
description: 'Tag to delete'
required: true
-permissions:
- id-token: write
- contents: write
- packages: write
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: false
+
+permissions: {}
jobs:
delete:
+ name: Delete releases and tags
+ permissions:
+ id-token: write # for OIDC token generation
+ contents: write # for git tag/release deletion
+ packages: write # for artifact registry cleanup
runs-on: cx-public-ubuntu-x64
steps:
diff --git a/.github/workflows/issue-automation.yml b/.github/workflows/issue-automation.yml
deleted file mode 100644
index c8a9c654..00000000
--- a/.github/workflows/issue-automation.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: Issue automation
-
-on:
- issues:
- types: [opened, closed]
-
-jobs:
- notify_jira:
- if: github.event.action == 'opened'
- name: Notify Jira
- uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_notify.yml@main
- with:
- title: ${{ github.event.issue.title }}
- body: ${{ github.event.issue.body }}
- html_url: ${{ github.event.issue.html_url }}
- repo: ${{ github.event.repository.full_name }}
- secrets: inherit
-
- close_jira:
- if: github.event.action == 'closed'
- name: Close Jira
- uses: Checkmarx/plugins-release-workflow/.github/workflows/jira_close.yml@main
- with:
- issue_number: ${{ github.event.issue.number }}
- repo: ${{ github.event.repository.full_name }}
- secrets: inherit
\ No newline at end of file
diff --git a/.github/workflows/manual-tag.yml b/.github/workflows/manual-tag.yml
index fb08413e..93303ba9 100644
--- a/.github/workflows/manual-tag.yml
+++ b/.github/workflows/manual-tag.yml
@@ -7,26 +7,36 @@ on:
description: 'Next release tag'
required: true
-permissions:
- contents: read
-
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: false
+
+permissions:
+ contents: read
+
jobs:
tag-creation:
- permissions:
- contents: write # for Git to git push
+ name: Create Release Tag
+ permissions:
+ contents: write # for Git to git push
runs-on: cx-public-ubuntu-x64
steps:
- name: Checkout
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+ uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
with:
token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+ persist-credentials: false
- name: Tag
+ env:
+ TAG_INPUT: ${{ github.event.inputs.tag }}
+ GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
run: |
- echo ${{ github.event.inputs.tag }}
- echo "NEXT_VERSION=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
- tag=${{ github.event.inputs.tag }}
- message='${{ github.event.inputs.tag }}: PR #${{ github.event.pull_request.number }} ${{ github.event.pull_request.title }}'
+ echo "$TAG_INPUT"
+ echo "NEXT_VERSION=$TAG_INPUT" >> $GITHUB_ENV
+ tag="$TAG_INPUT"
+ message="${TAG_INPUT}: Manual tag creation"
git config user.name "${GITHUB_ACTOR}"
git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+ git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}"
git tag -a "${tag}" -m "${message}"
git push origin "${tag}"
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 78956ca5..70bdfaa5 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -5,8 +5,15 @@ on:
branches:
- main
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: false
+
+permissions: {}
+
jobs:
set_tag:
+ name: Generate Release Tag
runs-on: cx-public-ubuntu-x64
outputs:
tag_name: ${{ steps.tagname.outputs.tag_name }}
@@ -15,11 +22,12 @@ jobs:
run: echo "tag_name=2.0.0" >> "$GITHUB_OUTPUT"
id: tagname
- name: Print tagname
- run: echo "created tag ${{ steps.tagname.outputs.tag_name }}"
+ env:
+ TAG_NAME: ${{ steps.tagname.outputs.tag_name }}
+ run: echo "created tag $TAG_NAME"
nightly:
needs: set_tag
- uses: Checkmarx/ast-eclipse-plugin/.github/workflows/release.yml@main
+ uses: Checkmarx/ast-eclipse-plugin/.github/workflows/release.yml@a776dbbfa70cda798753bec14dd7c1f47d094595
with:
tag: ${{ needs.set_tag.outputs.tag_name }}
rbranch: "nightly"
- secrets: inherit
diff --git a/.github/workflows/pr-label.yml b/.github/workflows/pr-label.yml
deleted file mode 100644
index 6c09bd38..00000000
--- a/.github/workflows/pr-label.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: PR Labeler
-on:
- pull_request:
- types: [opened]
-
-permissions:
- contents: read
-
-jobs:
- pr-labeler:
- permissions:
- pull-requests: write # for TimonVS/pr-labeler-action to add labels in PR
- runs-on: cx-public-ubuntu-x64
- steps:
- - uses: TimonVS/pr-labeler-action@8b99f404a073744885d8021d1de4e40c6eaf38e2 # v4
- with:
- configuration-path: .github/pr-labeler.yml # optional, .github/pr-labeler.yml is the default value
- env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5f0a0a21..ab60a6b8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,22 +30,24 @@ on:
required: true
type: string
-permissions:
- id-token: write
- contents: write
- packages: write
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: false
+
+permissions: {}
jobs:
deleteDevReleases:
- uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@main
+ uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@a776dbbfa70cda798753bec14dd7c1f47d094595
with:
tag: ${{ inputs.rbranch }}
- secrets: inherit
if: inputs.rbranch
release:
+ name: Release
permissions:
- id-token: write
- contents: write
+ id-token: write # for OIDC token generation
+ contents: write # for git push and release creation
+ packages: write # for publishing to artifact registry
runs-on: cx-public-ubuntu-x64
outputs:
TAG_NAME: ${{ steps.generate_tag_name.outputs.TAG_NAME }}
@@ -56,20 +58,24 @@ jobs:
with:
token: ${{ secrets.GITHUB_TOKEN }}
lfs: true
+ persist-credentials: false
- name: Checkout LFS objects
run: git lfs checkout
- name: Create Release Name
id: generate_tag_name
+ env:
+ TAG_INPUT: ${{ inputs.tag }}
+ RBRANCH_INPUT: ${{ inputs.rbranch }}
run: |
echo "Creating release name"
- if [ -z "${{ inputs.rbranch }}" ]; then
- export GH_RELEASE_TAG_NAME="${{ inputs.tag }}"
+ if [ -z "$RBRANCH_INPUT" ]; then
+ export GH_RELEASE_TAG_NAME="$TAG_INPUT"
export GH_BRANCH_NAME="main"
else
- export GH_RELEASE_TAG_NAME="${{ inputs.tag }}-${{ inputs.rbranch }}"
+ export GH_RELEASE_TAG_NAME="$TAG_INPUT-$RBRANCH_INPUT"
export GH_BRANCH_NAME="nightly"
fi
@@ -101,8 +107,10 @@ jobs:
sed -i 's||echocentralhttps://maven.echohq.com|' ~/.m2/settings.xml
- - name: Update the POM version.
- run: mvn -B org.eclipse.tycho:tycho-versions-plugin:set-version -DnewVersion='${{ inputs.tag }}' --file pom.xml
+ - name: Update the POM version
+ env:
+ VERSION: ${{ inputs.tag }}
+ run: mvn -B org.eclipse.tycho:tycho-versions-plugin:set-version -DnewVersion='${VERSION}' --file pom.xml
- name: Create release
run: mvn -B clean install --file pom.xml -DskipTests -pl "!checkmarx-ast-eclipse-plugin-tests"
@@ -115,8 +123,10 @@ jobs:
- name: Echo CLI version to outputs
id: set_outputs
+ env:
+ CLI_VERSION_ENV: ${{ env.CLI_VERSION }}
run: |
- echo "::set-output name=CLI_VERSION::${{ env.CLI_VERSION }}"
+ echo "CLI_VERSION=${CLI_VERSION_ENV}" >> $GITHUB_OUTPUT
- name: Release
uses: step-security/action-gh-release@277bfa82abcfdb73e5bbb19e213fd76532ee2be5 # v3.0.0
diff --git a/.github/workflows/update-cli.yml b/.github/workflows/update-cli.yml
index 0bc32471..42cf7e39 100644
--- a/.github/workflows/update-cli.yml
+++ b/.github/workflows/update-cli.yml
@@ -4,16 +4,24 @@ on:
repository_dispatch:
types: [java-wrapper-version-update]
-permissions:
- contents: read
-
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: false
+
+permissions:
+ contents: read
+
jobs:
update-checkmarx-cli:
+ name: Update Checkmarx CLI
runs-on: cx-public-ubuntu-x64
+ permissions:
+ contents: write # for git push
steps:
- - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
lfs: true
+ persist-credentials: false
- name: Install Git LFS
run: git lfs install
@@ -43,11 +51,14 @@ jobs:
- name: Update Checkmarx Java wrapper version
if: steps.ast-cli-java-wrapper.outputs.current_tag != steps.ast-cli-java-wrapper.outputs.release_tag
+ env:
+ RELEASE_TAG: ${{ steps.ast-cli-java-wrapper.outputs.release_tag }}
+ CURRENT_TAG: ${{ steps.ast-cli-java-wrapper.outputs.current_tag }}
run: |
# Update current release
- echo ${{ steps.ast-cli-java-wrapper.outputs.release_tag }} > ast-cli-java-wrapper.version
- current_version=ast-cli-java-wrapper-${{ steps.ast-cli-java-wrapper.outputs.current_tag }}.jar
- new_version=ast-cli-java-wrapper-${{ steps.ast-cli-java-wrapper.outputs.release_tag }}.jar
+ echo "$RELEASE_TAG" > ast-cli-java-wrapper.version
+ current_version=ast-cli-java-wrapper-$CURRENT_TAG.jar
+ new_version=ast-cli-java-wrapper-$RELEASE_TAG.jar
sed -i "s/$current_version/$new_version/g" checkmarx-ast-eclipse-plugin/build.properties
sed -i "s/$current_version/$new_version/g" checkmarx-ast-eclipse-plugin/.classpath
@@ -55,8 +66,8 @@ jobs:
cd checkmarx-ast-eclipse-plugin/lib/
rm -rf "$current_version"
- curl "https://repo1.maven.org/maven2/com/checkmarx/ast/ast-cli-java-wrapper/${{ steps.ast-cli-java-wrapper.outputs.release_tag }}/${new_version}" --output $new_version
-
+ curl "https://repo1.maven.org/maven2/com/checkmarx/ast/ast-cli-java-wrapper/$RELEASE_TAG/${new_version}" --output "$new_version"
+
ls -la
cd ../..
# Track the new JAR file with LFS
@@ -71,12 +82,12 @@ jobs:
fi
git lfs track "$FILE_PATH"
git add .gitattributes
- git add "$FILE_PATH"
- git commit -m "Update ast-cli-java-wrapper to ${{ steps.ast-cli-java-wrapper.outputs.release_tag }}"
+ git add "$FILE_PATH"
+ git commit -m "Update ast-cli-java-wrapper to $RELEASE_TAG"
- name: Create Pull Request
if: steps.ast-cli-java-wrapper.outputs.current_tag != steps.ast-cli-java-wrapper.outputs.release_tag
- uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
+ uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
with:
token: ${{ secrets.AUTOMATION_TOKEN }}
commit-message: Update ast-cli-java-wrapper to ${{ steps.ast-cli-java-wrapper.outputs.release_tag }}
diff --git a/.gitignore b/.gitignore
index f560f662..d644c0cc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@
.vs/
*.jar
!checkmarx-ast-eclipse-plugin/lib/*.jar
+/.vscode
diff --git a/checkmarx-ast-eclipse-plugin-tests/pom.xml b/checkmarx-ast-eclipse-plugin-tests/pom.xml
index 94b4d65c..2d5b4ef1 100644
--- a/checkmarx-ast-eclipse-plugin-tests/pom.xml
+++ b/checkmarx-ast-eclipse-plugin-tests/pom.xml
@@ -47,31 +47,7 @@
-
- check
- verify
- check
-
- ${project.build.directory}/jacoco.exec
- ${project.basedir}/../checkmarx-ast-eclipse-plugin/target/classes
-
- org/eclipse/wb/swt/SWTResourceManager.class
-
-
-
- BUNDLE
-
-
- INSTRUCTION
- COVEREDRATIO
- 0.30
-
-
-
-
-
-
-
+
org.eclipse.tycho
diff --git a/checkmarx-ast-eclipse-plugin/build.properties b/checkmarx-ast-eclipse-plugin/build.properties
index 680259c9..75590c4f 100644
--- a/checkmarx-ast-eclipse-plugin/build.properties
+++ b/checkmarx-ast-eclipse-plugin/build.properties
@@ -6,11 +6,11 @@ bin.includes = plugin.xml,\
lib/slf4j-reload4j-2.0.17.jar,\
lib/slf4j-api-2.0.17.jar,\
lib/jackson-annotations-2.21.jar,\
- lib/jackson-core-2.21.1.jar,\
+ lib/jackson-core-2.21.4.jar,\
lib/commons-lang3-3.18.0.jar,\
lib/ast-cli-java-wrapper-2.4.24.jar,\
lib/org.eclipse.mylyn.commons.ui_4.9.0.v20251121-0615.jar,\
- lib/jackson-databind-2.21.1.jar,\
+ lib/jackson-databind-2.21.5.jar,\
.,\
lib/org-eclipse-mylyn-commons-core.jar
source.. = src/