Skip to content

Conversation

rohitbaryha1
Copy link
Collaborator

No description provided.

@rsenden
Copy link
Contributor

rsenden commented Nov 9, 2024

Hi Rohit, looks like you're still utilizing fortify-ci-tools, which we should try to avoid as it's only meant for demo purposes. Also, ideally we should offer similar functionality as the Fortify GitHub Action, like setting up appversion/release, doing policy checks, ...

So, ideally the integration should do the following:

  1. Install fcli (or use fortifydocker/fcli in steps below)
  2. Run fcli tool sc-client install to install ScanCentral Client
  3. Run fcli * session login
  4. Run fcli fod/ssc action run setup-release/setup-appversion
  5. Run scancentral package
  6. Run fcli fod sast-scan start or fcli sc-sast scan start
  7. Run fcli * wait-for to wait for scan completion
  8. Run fcli fod/ssc action run check-policy
  9. Run fcli fod/ssc action run aws-sast-report

Most of these steps are just to get rid of fortifydocker/fortify-ci-tools, offering the same functionality as current templates. Steps 4 & 8 are enhancements to the existing workflow, so although easy to implement, we could defer these to a future version of the templates.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants