Add Fortify AST Scan workflow - #281
Conversation
This workflow integrates Fortify Application Security Testing into GitHub workflows, enabling SAST and SCA scans.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| FOD_URL: https://ams.fortify.com # Must be hardcoded or configured through GitHub variable, not secret | ||
| FOD_TENANT: ${{secrets.FOD_TENANT}} # Either tenant/user/password or client id/secret are required; | ||
| FOD_USER: ${{secrets.FOD_USER}} # these should be configured through GitHub secrets. | ||
| FOD_PASSWORD: ${{secrets.FOD_PAT}} |
There was a problem hiding this comment.
This workflow runs on every pull_request to main but the Fortify action is configured with FoD credentials from repository secrets (FOD_TENANT, FOD_USER, FOD_PASSWORD). GitHub does not expose repository secrets to pull_request events from forks, so any forked PR will execute this job with empty credentials and the Fortify login will fail before scanning. Consider restricting the trigger to trusted branches or adding an if guard to skip/short-circuit when secrets are unavailable so external PRs do not see immediate CI failures.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR adds a new GitHub Actions workflow for integrating Fortify Application Security Testing (AST) into the CI/CD pipeline, enabling Static Application Security Testing (SAST) and Software Composition Analysis (SCA) scans.
Key Changes:
- Adds
.github/workflows/fortify.ymlworkflow with triggers for push, pull requests, scheduled scans, and manual dispatch - Configures the Fortify GitHub Action (v1.6.2) with both SAST and Debricked SCA scanning enabled
- Includes configuration templates for both Fortify on Demand (FoD) and Software Security Center (SSC) deployment options
| ############################################################# | ||
| ##### Fortify on Demand configuration | ||
| ##### Remove this section if you're integrating with Fortify Hosted/Software Security Center (see below) | ||
| ### Required configuration | ||
| FOD_URL: https://ams.fortify.com # Must be hardcoded or configured through GitHub variable, not secret | ||
| FOD_TENANT: ${{secrets.FOD_TENANT}} # Either tenant/user/password or client id/secret are required; | ||
| FOD_USER: ${{secrets.FOD_USER}} # these should be configured through GitHub secrets. | ||
| FOD_PASSWORD: ${{secrets.FOD_PAT}} | ||
| # FOD_CLIENT_ID: ${{secrets.FOD_CLIENT_ID}} | ||
| # FOD_CLIENT_SECRET: ${{secrets.FOD_CLIENT_SECRET}} | ||
| ### Optional configuration | ||
| # FOD_LOGIN_EXTRA_OPTS: --socket-timeout=60s # Extra 'fcli fod session login' options | ||
| # FOD_RELEASE: MyApp:MyRelease # FoD release name, default: <org>/<repo>:<branch> | ||
| # DO_SETUP: true # Setup FoD application, release & static scan configuration | ||
| # SETUP_ACTION: <URL or file> # Customize setup action | ||
| # Pass extra options to setup action: | ||
| # SETUP_EXTRA_OPTS: --copy-from "${{ github.repository }}:${{ github.event.repository.default_branch }}" | ||
| # PACKAGE_EXTRA_OPTS: -oss -bt mvn # Extra 'scancentral package' options | ||
| # FOD_SAST_SCAN_EXTRA_OPTS: # Extra 'fcli fod sast-scan start' options | ||
| # DO_WAIT: true # Wait for successful scan completion (implied if post-scan actions enabled) | ||
| # DO_POLICY_CHECK: true # Fail pipeline if security policy outcome is FAIL | ||
| # POLICY_CHECK_ACTION: <URL or file> # Customize security policy checks | ||
| # POLICY_CHECK_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to policy check action | ||
| # DO_JOB_SUMMARY: true # Generate workflow job summary | ||
| # JOB_SUMMARY_ACTION: <URL or file> # Customize job summary | ||
| # JOB_SUMMARY_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to job summary action | ||
| # DO_PR_COMMENT: true # Generate PR comments, only used on pull_request triggers | ||
| # PR_COMMENT_ACTION: <URL or file> # Customize PR comments | ||
| # PR_COMMENT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to PR comment action | ||
| # DO_EXPORT: true # Export vulnerability data to GitHub code scanning dashboard | ||
| # EXPORT_ACTION: <URL or file> # Customize export action | ||
| # EXPORT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to export action | ||
| # TOOL_DEFINITIONS: <URL> # URL from where to retrieve Fortify tool definitions | ||
|
|
||
| ############################################################# | ||
| ##### Fortify Hosted / Software Security Center & ScanCentral | ||
| ##### Remove this section if you're integrating with Fortify on Demand (see above) | ||
| ### Required configuration | ||
| SSC_URL: ${{vars.SSC_URL}} # Must be hardcoded or configured through GitHub variable, not secret | ||
| SSC_TOKEN: ${{secrets.SSC_TOKEN}} # SSC CIToken; credentials should be configured through GitHub secrets | ||
| SC_SAST_TOKEN: ${{secrets.SC_CLIENT_AUTH_TOKEN}} # ScanCentral SAST client_auth_token, required if SAST scan is enabled | ||
| DEBRICKED_TOKEN: ${{secrets.DEBRICKED_TOKEN}} # Debricked token, required if Debricked scan is enabled | ||
| SC_SAST_SENSOR_VERSION: 24.4.0 # Sensor version to use for the scan, required if SAST scan is enabled | ||
| ### Optional configuration | ||
| # SSC_LOGIN_EXTRA_OPTS: --socket-timeout=60s # Extra 'fcli ssc session login' options | ||
| # SC_SAST_LOGIN_EXTRA_OPTS: --socket-timeout=60s # Extra 'fcli sc-sast session login' options | ||
| # SSC_APPVERSION: MyApp:MyVersion # SSC application version name, default: <org>/<repo>:<branch> | ||
| # DO_SETUP: true # Set up SSC application & version | ||
| # SETUP_ACTION: <URL or file> # Customize setup action | ||
| # SETUP_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to setup action | ||
| # PACKAGE_EXTRA_OPTS: -bt mvn # Extra 'scancentral package' options | ||
| # EXTRA_SC_SAST_SCAN_OPTS: # Extra 'fcli sc-sast scan start' options | ||
| # DO_WAIT: true # Wait for successful scan completion (implied if post-scan actions enabled) | ||
| # DO_POLICY_CHECK: true # Fail pipeline if security policy outcome is FAIL | ||
| # POLICY_CHECK_ACTION: <URL or file> # Customize security policy checks | ||
| # POLICY_CHECK_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to policy check action | ||
| # DO_JOB_SUMMARY: true # Generate workflow job summary | ||
| # JOB_SUMMARY_ACTION: <URL or file> # Customize job summary | ||
| # JOB_SUMMARY_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to job summary action | ||
| # DO_PR_COMMENT: true # Generate PR comments, only used on pull_request triggers | ||
| # PR_COMMENT_ACTION: <URL or file> # Customize PR comments | ||
| # PR_COMMENT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to PR comment action | ||
| # DO_EXPORT: true # Export vulnerability data to GitHub code scanning dashboard | ||
| # EXPORT_ACTION: <URL or file> # Customize export action | ||
| # EXPORT_EXTRA_OPTS: --on-unsigned=ignore # Pass extra options to export action | ||
| # TOOL_DEFINITIONS: <URL> # URL from where to retrieve Fortify tool definitions |
There was a problem hiding this comment.
Both Fortify on Demand (FoD) and Software Security Center (SSC) configurations are active simultaneously. The comments on lines 66 and 100 indicate these sections should be mutually exclusive ("Remove this section if you're integrating with..."), but both sections are present with uncommented configuration values. This will cause the workflow to attempt to connect to both services, which is likely unintended.
Recommendation: Comment out or remove the configuration section that is not being used. If using FoD, remove/comment lines 98-129. If using SSC, remove/comment lines 64-96.
| # FOD_CLIENT_ID: ${{secrets.FOD_CLIENT_ID}} | ||
| # FOD_CLIENT_SECRET: ${{secrets.FOD_CLIENT_SECRET}} |
There was a problem hiding this comment.
Both authentication methods for Fortify on Demand are partially configured. Lines 69-71 specify tenant/user/password authentication, while lines 72-73 show commented client ID/secret authentication. Having both credential sets configured (even with one commented) may lead to confusion about which authentication method is in use.
Recommendation: Remove or clearly document which authentication method should be used. If using tenant/user/password, remove the commented FOD_CLIENT_ID and FOD_CLIENT_SECRET lines. If using client credentials, comment out lines 69-71 and uncomment lines 72-73.
| # FOD_CLIENT_ID: ${{secrets.FOD_CLIENT_ID}} | |
| # FOD_CLIENT_SECRET: ${{secrets.FOD_CLIENT_SECRET}} |
| SSC_TOKEN: ${{secrets.SSC_TOKEN}} # SSC CIToken; credentials should be configured through GitHub secrets | ||
| SC_SAST_TOKEN: ${{secrets.SC_CLIENT_AUTH_TOKEN}} # ScanCentral SAST client_auth_token, required if SAST scan is enabled | ||
| DEBRICKED_TOKEN: ${{secrets.DEBRICKED_TOKEN}} # Debricked token, required if Debricked scan is enabled | ||
| SC_SAST_SENSOR_VERSION: 24.4.0 # Sensor version to use for the scan, required if SAST scan is enabled |
There was a problem hiding this comment.
The SC_SAST_SENSOR_VERSION is hardcoded to version 24.4.0. Hardcoding specific versions in workflow files can lead to maintenance issues as versions become outdated. This value should either be:
- Configured through a GitHub variable for easier updates across workflows
- Documented with a comment about when/how to update it
- Referenced from a centralized configuration
Recommendation: Consider using ${{vars.SC_SAST_SENSOR_VERSION}} instead of hardcoding, or add a comment indicating this value should be reviewed and updated periodically.
| SC_SAST_SENSOR_VERSION: 24.4.0 # Sensor version to use for the scan, required if SAST scan is enabled | |
| SC_SAST_SENSOR_VERSION: ${{vars.SC_SAST_SENSOR_VERSION}} # Sensor version to use for the scan, required if SAST scan is enabled |
| # uses the commit id corresponding to version 1.6.2. It is recommended to check whether any later releases | ||
| # are available at https://github.com/fortify/github-action/releases. Depending on the amount of stability | ||
| # required, you may want to consider using fortify/github-action@v1 instead to use the latest 1.x.y version | ||
| # of this action, allowing your workflows to automatically benefit from any new features and bug fixes. |
There was a problem hiding this comment.
[nitpick] The workflow uses a specific commit SHA (ef5539bf4bd9c45c0bd971978f635a69eae55297) for the Fortify GitHub Action, which the comment states corresponds to version 1.6.2. However, there's no validation that this commit SHA is correct or that this is indeed a secure, verified version of the action.
Recommendation: While using commit SHAs is a security best practice for supply chain security, consider:
- Verifying this commit SHA is correct for version 1.6.2 at https://github.com/fortify/github-action/releases
- Adding a comment with the actual version tag for easier tracking (e.g.,
# v1.6.2: ef5539bf4bd9c45c0bd971978f635a69eae55297) - Periodically reviewing for newer stable versions
| # of this action, allowing your workflows to automatically benefit from any new features and bug fixes. | |
| # of this action, allowing your workflows to automatically benefit from any new features and bug fixes. | |
| # v1.6.2: ef5539bf4bd9c45c0bd971978f635a69eae55297 |
This workflow integrates Fortify Application Security Testing into GitHub workflows, enabling SAST and SCA scans.