# This workflow executes Checkmarx scans (SAST & SCA) on pull requests. It runs in a self-hosted actions runner
# hosted in AWS. The flow has 3 parts: 1) start the ec2 runner instance 2) carry out the scans via CxFlow and 
# 3) stop the ec2 runner instance. It uses the following GitHub secrets:
#           AWS_EC2_INSTANCE_ID
#           AWS_ACCESS_KEY_ID
#           AWS_SECRET_ACCESS_KEY
#           AWS_REGION
#           CHECKMARX_URL
#           CHECKMARX_USERNAME
#           CHECKMARX_PASSWORD
#           CHECKMARX_URL
#           CHECKMARX_CLIENT_SECRET
#           SCA_USERNAME
#           SCA_PASSWORD
#
# To change the severity threshold, modify the --cx-flow.filter-severity parameter in the CxFlow job below


name: CheckMarx Scan on Pull Request
on: 
  #pull_request:
  workflow_dispatch:
  
jobs:
  start-runner:
    name: Start self-hosted EC2 runner
    runs-on: ubuntu-latest
    steps:
      - name: Start AWS EC2
        # Run AWS Command on the GitHub Hosted runner which starts the instance
        run: |
          aws ec2 start-instances --instance-ids ${{secrets.AWS_EC2_INSTANCE_ID }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}

  run-cxflow:
    name: Execute CxFlow
    # The type of runner that the job will run on - Ubuntu is required as Docker is leveraged for the action
    permissions:
      contents: read # for actions/checkout to fetch code
      issues: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to github issues
      pull-requests: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to PR
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    needs: start-runner # required to start the main job when the runner is ready
    runs-on: [self-hosted, AWS, AppSec]
    # Steps require - checkout code, run CxFlow Action, Upload SARIF report (optional)
    steps:
    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - uses: actions/checkout@v3
    # Runs the Checkmarx Scan leveraging the latest version of CxFlow - REFER to Action README for list of inputs
    - name: Checkmarx CxFlow Action
      uses: checkmarx-ts/checkmarx-cxflow-github-action@49d8269b14ca87910ba003d47a31fa0c7a11f2fe
      with:
        project: SAILPOINT-${{ github.event.repository.name }}
        team: CxServer/SAILPOINT
        # sast secrets
        checkmarx_url: ${{ secrets.CHECKMARX_URL }}
        checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
        checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
        checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
        # sca secrets
        sca_api_url: https://api-sca.checkmarx.net
        sca_app_url: https://sca.checkmarx.net
        sca_access_control_url: https://platform.checkmarx.net
        sca_username: ${{ secrets.SCA_USERNAME }}
        sca_password: ${{ secrets.SCA_PASSWORD }}
        sca_tenant: sailpoint
        scanners: sast, sca
        params: --namespace=${{ github.repository_owner }} --repo-name=${{ github.event.repository.name }} --branch=${{ github.ref }} --cx-flow.filter-severity=high --cx-flow.filter-category --checkmarx.disable-clubbing=true --repo-url=${{ github.event.repository.url }} 
    # Upload the Report for CodeQL/Security Alerts
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: cx.sarif
      #post-job task is a script referenced in .env file (cleans up the _work directory)
      
  stop-runner:
    name: Stop self-hosted EC2 runner
    needs:
      - start-runner # required to get output from the start-runner job
      - run-cxflow # required to wait when the main job is done
    runs-on: ubuntu-latest
    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
    steps:
      - name: Stop AWS EC2
        # Run AWS Command on the GitHub Hosted runner which starts the instance using AWS authentication stored in GitHub Secrets (see below how to add)
        run: |
          aws ec2 stop-instances --instance-ids ${{secrets.AWS_EC2_INSTANCE_ID }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}   
