mercedes-benz / sechub

SecHub provides a central API to test software with different security tools.
https://mercedes-benz.github.io/sechub/
MIT License
259 stars 58 forks source link

Provide "latest" for client version in GitHub action and use as default #3101

Closed de-jcup closed 1 month ago

de-jcup commented 2 months ago

Situation

Currently the GitHub action default is a dedicated version (e.g. '1.4.0'). It's also mentioned inside https://github.com/mercedes-benz/sechub/blob/develop/github-actions/scan/README.adoc

The problem is, that client version updates are not automatically used by the SecHub GitHub action

Wanted

The default shall be latest

Solution

Details: change download implementation

https://github.com/mercedes-benz/sechub/blob/develop/github-actions/scan/src/client-download.ts

must be changed in a way, that when client version is lastest, the

 const zipDownloadUrl = `https://github.com/mercedes-benz/sechub/releases/download/v${clientVersion}-client/sechub-cli-${clientVersion}.zip`;

uses instead (in this case)

 zipDownloadUrl = `https://mercedes-benz.github.io/sechub/latest/sechub-client.html`;

Details: change README

latest must be the example entry - means people just copying the example will automatically use the latest client version