Scanning

[withinfocus]

Objective

Introduces a new GitHub Actions workflow named Scan in the .github/workflows/scan.yml file. The workflow is triggered on manual dispatch, push to the main, rc, and hotfix-rc branches, and when a pull request is opened or synchronized. The workflow includes two jobs: sast and quality. The sast job runs a Static Application Security Testing (SAST) scan using Checkmarx and uploads the results to GitHub. The quality job runs a quality scan using SonarCloud.

• .github/workflows/scan.yml: Added a new GitHub Actions workflow named Scan. This workflow is triggered on manual dispatch, push to the main, rc, and hotfix-rc branches, and when a pull request is opened or synchronized. The workflow includes two jobs: sast and quality. The sast job runs a Static Application Security Testing (SAST) scan using Checkmarx and uploads the results to GitHub. The quality job runs a quality scan using SonarCloud.

Before you submit

• Please add unit tests where it makes sense to do so

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 60.52%. Comparing base (07a4ceb) to head (43c34fa).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #630   +/-   ##
=======================================
  Coverage   60.52%   60.52%           
=======================================
  Files         172      172           
  Lines       10523    10523           
=======================================
  Hits         6369     6369           
  Misses       4154     4154           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[bitwarden-bot]

Checkmarx One – Scan Summary & Details – 007445b2-938f-4b2d-9658-9142a855b9d0

No New Or Fixed Issues Found

[Hinton]

Checkmarx and github isn't syncing up on triaged status. This is a blocker since it makes checkmarx useless. Example being the command injections in the python example, those were marked as not exploitable in checkmarx a while back.

We also have no use for sonar cloud since it doesn't support rust.

[Hinton]

Did we solve checkmarx not syncing with github?