fortify / github-action

Fortify GitHub Actions
Other
10 stars 8 forks source link

Allow setting up of ScanCentral Client v23.2.0 #22

Closed crance closed 8 months ago

crance commented 9 months ago

Fortify version 23.2 has been released, however fortify/github-action/setup@v1 does not support the setting for sc-client: 23.2.0.

It seems this is related to the code from fcli which only allowed selected versions specified in this code.

defaultDownloadUrl: https://tools.fortify.com/scancentral/Fortify_ScanCentral_Client_{toolVersion}_x64.zip
defaultVersion: 23.1.0
versions:
  - version: 23.1.0
    digest: SHA-256:012e00fab914495ad235e8658207702869e02fffbd4d2adfcc3c2baf50fe8de9
  - version: 22.2.1
    digest: SHA-256:1b63e4e8bb0f9314d7ad1b0b925b0fbf878bfa37a1436774357de36fefbeeedf

Error Message: image

MikeTheSnowman commented 9 months ago

@crance, this at the time of writing, it appears that there are two issues. 1) fcli has not yet been updated to include a reference for the SC-SAST 23.2.0 client. 2) fcli has a dependency on the sc-sast clients being available for download on https://tools.fortify.com. So until it's available there, we can't push out a updated version of fcli that can download that client, but I have internally raised a request for that to be addressed.

rsenden commented 8 months ago

The latest fcli (2.2.0) and github-action (1.2.0) versions now support updateable tool definitions, by default downloaded from https://github.com/fortify/tool-definitions/releases/tag/v1. This means that we no longer need to release a new fcli version or GitHub Action in order to support a new tool version; any new tool versions should be automatically recognized by the GitHub Action as soon as such releases are added to the tool definitions. ScanCentral Client 23.2.1 is now available in the latest tool definitions, and as such can be installed using the GitHub Action.