Add Zizmor scanner workflow and enhance existing workflows(AST-169189)

.github/workflows/ast-scan.yml

@@ -8,17 +8,27 @@ on:
   schedule:
     - cron: '00 7 * * *' # Every day at 07:00
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   cx-scan:
+    name: Checkmarx One Scan
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
       - name: Checkmarx One CLI Action
         uses: checkmarx/ast-github-action@f0869bd1a37fddc06499a096101e6c900e815d81 # v.2.0.36
         with:
           base_uri: ${{ secrets.AST_RND_SCANS_BASE_URI }}
           cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }}
           cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }}
           cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }}
-          additional_params: --tags phoenix --file-filter !checkmarx-ast-eclipse-plugin-tests/ --threshold "sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;sca-critical=1;sca-high=1;sca-medium=1;sca-low=1"
+          additional_params: --tags phoenix --file-filter !checkmarx-ast-eclipse-plugin-tests/ --threshold "sast-critical=1;sast-high=1;sast-medium=1;sast-low=1;iac-security-critical=1;iac-security-high=1;iac-security-medium=1;iac-security-low=1;sca-critical=1;sca-high=1;sca-medium=1;sca-low=1"

.github/workflows/ci.yml

@@ -1,24 +1,33 @@
 name: Integration Tests
-on: 
+on:
   pull_request:
-    branches: 
+    branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
 
   ui-tests:
+    name: UI Tests
     runs-on: cx-public-ubuntu-x64
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           lfs: true
+          persist-credentials: false
       - name: Checkout LFS objects
         run: git lfs checkout
-      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
           distribution: temurin
           java-version: 17
-      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -34,7 +43,7 @@ jobs:
           Xvfb -ac :99 -screen 0 1920x1080x16 &
           mvn verify -Dtest.includes="**/ui/*.java"
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: jacoco-coverage-report-ui
           path: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate
@@ -44,18 +53,20 @@ jobs:
           jacoco-csv-file: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate/jacoco.csv
           generate-summary: true
   integration-tests:
+    name: Integration Tests
     runs-on: cx-public-ubuntu-x64
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           lfs: true
+          persist-credentials: false
       - name: Checkout LFS objects
         run: git lfs checkout
-      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
           distribution: temurin
           java-version: 17
-      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -71,7 +82,7 @@ jobs:
           Xvfb -ac :99 -screen 0 1920x1080x16 &
           mvn verify -Dtest.includes="**/integration/*Test.java"
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: jacoco-coverage-report-integration
           path: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate
@@ -81,18 +92,20 @@ jobs:
           jacoco-csv-file: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate/jacoco.csv
           generate-summary: true
   unit-tests:
+    name: Unit Tests
     runs-on: cx-public-ubuntu-x64
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           lfs: true
+          persist-credentials: false
       - name: Checkout LFS objects
         run: git lfs checkout
-      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
           distribution: temurin
           java-version: 17
-      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -108,7 +121,7 @@ jobs:
           Xvfb -ac :99 -screen 0 1920x1080x16 &
           mvn clean verify -Dtest.includes="**/unit/**/*Test.java"
       - name: Upload Coverage Report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: jacoco-coverage-report-unit
           path: checkmarx-ast-eclipse-plugin-tests/target/site/jacoco-aggregate

.github/workflows/delete-dev-releases.yml

@@ -13,13 +13,19 @@ on:
         description: 'Tag to delete'
         required: true
 
-permissions:
-  id-token: write
-  contents: write
-  packages: write
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions: {}
 
 jobs:
   delete:
+    name: Delete releases and tags
+    permissions:
+      id-token: write  # for OIDC token generation
+      contents: write  # for git tag/release deletion
+      packages: write  # for artifact registry cleanup
     runs-on: cx-public-ubuntu-x64
     steps:
 

.github/workflows/manual-tag.yml

@@ -7,26 +7,36 @@ on:
         description: 'Next release tag'
         required: true
 
-permissions:
-  contents: read
-
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
 jobs:
   tag-creation:
-    permissions:
-      contents: write  # for Git to git push
+    name: Create Release Tag
+    permissions:
+      contents: write  # for Git to git push
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+          persist-credentials: false
       - name: Tag
+        env:
+          TAG_INPUT: ${{ github.event.inputs.tag }}
+          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
         run: |
-          echo ${{ github.event.inputs.tag }}
-          echo "NEXT_VERSION=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
-          tag=${{ github.event.inputs.tag }}
-          message='${{ github.event.inputs.tag }}: PR #${{ github.event.pull_request.number }} ${{ github.event.pull_request.title }}'
+          echo "$TAG_INPUT"
+          echo "NEXT_VERSION=$TAG_INPUT" >> $GITHUB_ENV
+          tag="$TAG_INPUT"
+          message="${TAG_INPUT}: Manual tag creation"
           git config user.name "${GITHUB_ACTOR}"
           git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}"
           git tag -a "${tag}" -m "${message}"
           git push origin "${tag}"

.github/workflows/nightly.yml

@@ -5,8 +5,15 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions: {}
+
 jobs:
   set_tag:
+    name: Generate Release Tag
     runs-on: cx-public-ubuntu-x64
     outputs:
       tag_name: ${{ steps.tagname.outputs.tag_name }}
@@ -15,11 +22,12 @@ jobs:
         run: echo "tag_name=2.0.0" >> "$GITHUB_OUTPUT"
         id: tagname
       - name: Print tagname
-        run: echo "created tag ${{ steps.tagname.outputs.tag_name }}"
+        env:
+          TAG_NAME: ${{ steps.tagname.outputs.tag_name }}
+        run: echo "created tag $TAG_NAME"
   nightly:
     needs: set_tag
-    uses: Checkmarx/ast-eclipse-plugin/.github/workflows/release.yml@main
+    uses: Checkmarx/ast-eclipse-plugin/.github/workflows/release.yml@a776dbbfa70cda798753bec14dd7c1f47d094595
     with:
       tag: ${{ needs.set_tag.outputs.tag_name }}
       rbranch: "nightly"
-    secrets: inherit

.github/workflows/release.yml

@@ -30,22 +30,24 @@ on:
         required: true
         type: string
 
-permissions:
-  id-token: write
-  contents: write
-  packages: write
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions: {}
 
 jobs:
   deleteDevReleases:
-    uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@main
+    uses: Checkmarx/ast-eclipse-plugin/.github/workflows/delete-dev-releases.yml@a776dbbfa70cda798753bec14dd7c1f47d094595
     with:
       tag: ${{ inputs.rbranch }}
-    secrets: inherit
     if: inputs.rbranch
   release:
+    name: Release
     permissions:
-      id-token: write
-      contents: write
+      id-token: write  # for OIDC token generation
+      contents: write  # for git push and release creation
+      packages: write  # for publishing to artifact registry
     runs-on: cx-public-ubuntu-x64
     outputs:
       TAG_NAME: ${{ steps.generate_tag_name.outputs.TAG_NAME }}
@@ -56,20 +58,24 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           lfs: true
+          persist-credentials: false
 
       - name: Checkout LFS objects
         run: git lfs checkout
 
       - name: Create Release Name
         id: generate_tag_name
+        env:
+          TAG_INPUT: ${{ inputs.tag }}
+          RBRANCH_INPUT: ${{ inputs.rbranch }}
         run: |
           echo "Creating release name"
 
-          if [ -z "${{ inputs.rbranch }}" ]; then
-            export GH_RELEASE_TAG_NAME="${{ inputs.tag }}"
+          if [ -z "$RBRANCH_INPUT" ]; then
+            export GH_RELEASE_TAG_NAME="$TAG_INPUT"
             export GH_BRANCH_NAME="main"
           else
-            export GH_RELEASE_TAG_NAME="${{ inputs.tag }}-${{ inputs.rbranch }}"
+            export GH_RELEASE_TAG_NAME="$TAG_INPUT-$RBRANCH_INPUT"
             export GH_BRANCH_NAME="nightly"
           fi
 
@@ -101,8 +107,10 @@ jobs:
           sed -i 's|</settings>|<mirrors><mirror><id>echo</id><mirrorOf>central</mirrorOf><url>https://maven.echohq.com</url></mirror></mirrors></settings>|' ~/.m2/settings.xml
 
 
-      - name: Update the POM version.
-        run: mvn -B org.eclipse.tycho:tycho-versions-plugin:set-version -DnewVersion='${{ inputs.tag }}' --file pom.xml
+      - name: Update the POM version
+        env:
+          VERSION: ${{ inputs.tag }}
+        run: mvn -B org.eclipse.tycho:tycho-versions-plugin:set-version -DnewVersion='${VERSION}' --file pom.xml
 
       - name: Create release
         run: mvn -B clean install --file pom.xml  -DskipTests -pl "!checkmarx-ast-eclipse-plugin-tests"
@@ -115,8 +123,10 @@ jobs:
 
       - name: Echo CLI version to outputs
         id: set_outputs
+        env:
+          CLI_VERSION_ENV: ${{ env.CLI_VERSION }}
         run: |
-          echo "::set-output name=CLI_VERSION::${{ env.CLI_VERSION }}"
+          echo "CLI_VERSION=${CLI_VERSION_ENV}" >> $GITHUB_OUTPUT
 
       - name: Release
         uses: step-security/action-gh-release@277bfa82abcfdb73e5bbb19e213fd76532ee2be5 # v3.0.0