checkmarx-ltd / cx-flow

Checkmarx Scan and Result Orchestration
Apache License 2.0
87 stars 87 forks source link

Comment parameter not persisted in the metadata of the scan #1368

Closed danstrajan closed 2 weeks ago

danstrajan commented 1 month ago

Description

I am trying to integrate Checkmarx cx-flow GitHub action for our services and I am not able persist in the Checkmarx scan the comment parameter passed as an input, according to documentation: --cx-flow.comment="my version 1.1.1" Please assist.

Job configuration:

    name: Run Checkmarx Scan
    uses: checkmarx-ts/checkmarx-cxflow-github-action@v1.9
    with:
      scanners: sast
      checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
      checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
      checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_TOKEN }}
      project: myProject
      checkmarx_url: https://company.checkmarx.net
      team: CxServer/SP/C/MyTeam
      incremental: false
      break_build: true
      params: |
        --cx-flow.zip-exclude=node_modules/.*,server/.*,build/.*,public/.*,.*\.png,\.git/.*,\.github/.*,tests/.*,docs/.*,.*\.test.tsx,.*\.test.ts \
        --cx-flow.comment=my version 1.1.1
        --cx-flow.thresholds.high=0 \
        --cx-flow.thresholds.medium=0 \
        --cx-flow.thresholds.low=0 \
        --cx-flow.break-build=true \
<!DOCTYPE html> comment   No No Yes User can store comments field in metadata about the scan.

In the end, The Checkmarx scan has some overridden comment: 'CxFlow Automated Scan'

Expected Behavior

comment parameter should behave according to the documentation

Actual Behavior

Some default comment is persisted in the scan.

Reproduction

Logs:

2024-07-17T12:53:20.8230399Z ##[group]Run checkmarx-ts/checkmarx-cxflow-github-action@v1.9 2024-07-17T12:53:20.8230752Z with: 2024-07-17T12:53:20.8230997Z scanners: sast 2024-07-17T12:53:20.8231334Z checkmarx_username: 2024-07-17T12:53:20.8231646Z checkmarx_password: 2024-07-17T12:53:20.8231987Z checkmarx_client_secret: 2024-07-17T12:53:20.8232311Z project: myProject 2024-07-17T12:53:20.8232674Z checkmarx_url: https://company.checkmarx.net 2024-07-17T12:53:20.8233139Z team: CxServer/SP/C/MyTeam 2024-07-17T12:53:20.8233551Z incremental: false 2024-07-17T12:53:20.8233801Z break_build: true 2024-07-17T12:53:20.8234848Z params: --cx-flow.zip-exclude=node_modules/.,server/.,build/.,public/.,..png,.git/.,.github/.,tests/.,docs/.,..test.tsx,..test.ts \ --cx-flow.comment=my version 1.1.1 ** --cx-flow.thresholds.high=0 \ --cx-flow.thresholds.medium=10 \ --cx-flow.thresholds.low=10 \ --cx-flow.break-build=true \

....... 2024-07-17T12:53:49.6582230Z 2024-07-17 12:53:48.128 DEBUG 8 --- [ main] c.c.s.s.CxService [zXd0cyuL] : Creating scan with params: CxScanParams{teamName='CxServer/SP/C/MyTeam', projectName='myProject', incremental=false, isPublic=true, forceScan=false, fileExclude=null, folderExclude=null, scanPreset='High and Medium', scanConfiguration='null', sourceType=FILE, gitUrl='null', filePath='/github/workspace/cx.5e45f5b0-969a-4f07-b863-dbe817c79123.zip', customFields=null, scanCustomFields=null, postAction='null', emailNotifications='null'} and comment: "CxFlow Automated Scan" 2024-07-17T12:53:49.6582789Z 2024-07-17 12:53:48.233 INFO 8 --- [ main] c.c.s.s.CxService [zXd0cyuL] : using SAST version :9.4 2024-07-17T12:53:49.6585019Z 2024-07-17 12:53:48.233 DEBUG 8 --- [ main] c.c.s.s.CxService [zXd0cyuL] : CxScanParams{teamName='CxServer/SP/C/MyTeam', projectName='myProject', incremental=false, isPublic=true, forceScan=false, fileExclude=null, folderExclude=null, scanPreset='High and Medium', scanConfiguration='null', sourceType=FILE, gitUrl='null', filePath='/github/workspace/cx.5e45f5b0-969a-4f07-b863-dbe817c79123.zip', customFields=null, scanCustomFields=null, postAction='null', emailNotifications='null'} 2024-07-17T12:53:49.6585598Z 2024-07-17 12:53:48.234 INFO 8 --- [ main] c.c.s.s.CxService [zXd0cyuL] : Scan will be Full Scan 2024-07-17T12:53:49.6586198Z 2024-07-17 12:53:48.234 INFO 8 --- [ main] c.c.s.s.CxService [zXd0cyuL] : Updating Source details for project Id 37533 2024-07-17T12:53:49.6587143Z 2024-07-17 12:53:48.497 DEBUG 8 --- [ main] c.c.s.s.CxService [zXd0cyuL] : scan: CxScan(projectId=37533, isIncremental=false, isPublic=true, forceScan=false, comment=CxFlow Automated Scan, customFields=null)

satyamchaurasiapersistent commented 1 month ago

Our functionality is working fine. Please raise Salesforce ticket for same and lets have meeting on Teams to resolve your issue.