Checkmarx / ast-github-action

Checkmarx application security testing (AST) GitHub action
https://github.com/marketplace/actions/checkmarx-ast-github-action
Apache License 2.0
16 stars 23 forks source link

[BUG] cxcli output variables is declared in Action.yml but never referenced anywhere else. #140

Open notarock opened 1 year ago

notarock commented 1 year ago

Describe the bug

The Action.yml files specifies that a cxcli variable is exported and contains the scan's outputs, but this appear to not be the case.

Expected behavior

Referencing the cxcli output from a subsequent steps should yield the scan's outputs. For example, a steps referencing a scan with the id set asscan like this should print the outputs:

      - name: Save relevant summary to cx_result.md
        run: echo "${{ steps.scan.outputs.cxcli }}"

Actual behavior

Using above steps yields an empty string.

Steps to reproduce

  1. Have a github actions file launch a scans.
  2. Add an id: something to the steps calling this action
  3. In a subsequent steps, reference the output variables cxcli like so:
      - name: Save relevant summary to cx_result.md
        run: echo "${{ steps.scan.outputs.cxcli }}"

Additional comments

We're trying to read the text output from the scan. We have resorted to using the output.log file that is created instead

Logs

Using this workflow:

      - name: Checkmarx AST CLI Action
        id: scan
        uses: checkmarx/ast-github-action@main #Github Action version
        with:
          base_uri: https://ast.checkmarx.net/
          cx_tenant: [ Redacted ]
          cx_client_id: ${{ secrets.CX_CLIENT_ID }}
          cx_client_secret: ${{ secrets.CX_CLIENT_SECRET }}

      - name: Save relevant summary to cx_result.md
        run: echo "${{ steps.scan.outputs.cxcli }}"
image
pedrompflopes commented 1 year ago

Hi @notarock Thanks for raising this bug, we will look into it.

In your use case do you need the entire cxoutput, or just the scanId ?

Thanks

notarock commented 1 year ago

I just needed the cxoutput; reading the output.log file solved the issue, but it is confusing that the cxcli output is defined in action.yml but does not contain anything