Skip to content

Bump bridgecrewio/checkov-action from 12.2750.0 to 12.2754.0 #10045

Bump bridgecrewio/checkov-action from 12.2750.0 to 12.2754.0

Bump bridgecrewio/checkov-action from 12.2750.0 to 12.2754.0 #10045

Workflow file for this run

# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "CodeQL"
on:
push:
branches: [master]
pull_request:
# The branches below must be a subset of the branches above
branches: [master]
schedule:
- cron: '0 4 * * 3'
env:
javaVersion: java21
permissions:
contents: write
security-events: write
pull-requests: read
jobs:
analyze:
name: Analyze
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
# Override automatic language detection by changing the below list
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
language: ['java']
# Learn more...
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
steps:
- name: Harden Runner
uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
with:
egress-policy: audit
allowed-endpoints: >
api.adoptopenjdk.net:443
api.adoptium.net:443
api.github.com:443
archive.apache.org:443
azure.archive.ubuntu.com:80
azure.archive.ubuntu.com:443
security.ubuntu.com:80
security.ubuntu.com:443
github.com:443
maven.java.net:443
maven.vaadin.com:443
objects.githubusercontent.com:443
oss.sonatype.org:443
raw.githubusercontent.com:443
repo.maven.apache.org:443
maven.mirrors.opennms.org:443
repo1.maven.org:443
repository.mulesoft.org:443
tools.google.com:80
tools.vaadin.com:443
uploads.github.com:443
spdx.org:443
repository.jboss.org:443
repository.sonatype.org:443
files.pythonhosted.org:443
pypi.org:443
www.bridgecrew.cloud:443
docs.github.com:433
- name: Checkout repository
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
with:
# We must fetch at least the immediate parents so that if this is
# a pull request then we can checkout the head.
fetch-depth: 2
- name: Run Checkov action
id: checkov
uses: bridgecrewio/checkov-action@cf68996e9b80aaf5e7c74923e08b19659adf1ac1 # master
with:
file: cia-dist-cloudformation/src/main/resources/cia-dist-cloudformation.json
skip_check: CKV_AWS_111,CKV_AWS_109,CKV_AWS_149,CKV_AWS_364,CKV_AWS_161,CKV_AWS_118,CKV_AWS_111
framework: cloudformation
output_format: sarif
output_file_path: reports/results.sarif
download_external_modules: true
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
# queries: ./path/to/local/query, your-org/your-repo/queries@main
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
# - name: Autobuild
# uses: github/codeql-action/autobuild@v1
# ������ Command-line programs to run using the OS shell.
# ���� https://git.io/JvXDl
# ������ If the Autobuild fails above, remove it and uncomment the following three lines
# and modify them (or add more) to build your code if your project
# uses a compiled language
#- run: |
# make bootstrap
# make release
- name: Set up JDK 21
uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
with:
distribution: 'temurin'
java-version: '21'
cache: 'maven'
- name: APT update
run: sudo apt-get update
- name: Install buildtools
run: sudo apt-get install -y graphviz build-essential fakeroot devscripts debhelper dh-make bzr-builddeb wget
- name: Download Maven
run: wget https://archive.apache.org/dist/maven/maven-3/3.9.6/binaries/apache-maven-3.9.6-bin.tar.gz
- name: Unpack Maven
run: tar xzvf apache-maven-3.9.6-bin.tar.gz
- name: Set Maven
run: mv apache-maven-3.9.6 maven
- name: Build with Maven
run: maven/bin/mvn -B install --file pom.xml -DskipTests
- name: Submit Dependency Snapshot
uses: advanced-security/maven-dependency-submission-action@5d0f9011b55d6268922128af45275986303459c3
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6