From b53b3f4b1a240735196af1fc5132ab453f7876ea Mon Sep 17 00:00:00 2001 From: Eric Sognefest Date: Fri, 31 Jul 2026 14:46:23 -0400 Subject: [PATCH 1/2] chore: remove checkmarx from repo --- .github/workflows/examples/scan.yaml | 172 ------------------ .../default_actions.json | 7 +- 2 files changed, 1 insertion(+), 178 deletions(-) delete mode 100644 .github/workflows/examples/scan.yaml diff --git a/.github/workflows/examples/scan.yaml b/.github/workflows/examples/scan.yaml deleted file mode 100644 index 36d89d17..00000000 --- a/.github/workflows/examples/scan.yaml +++ /dev/null @@ -1,172 +0,0 @@ -# Workflow templates are based on starter workflows provided by github at -# https://github.com/actions/starter-workflows/tree/main and customized to -# represent common practices used on Bitwarden repositories. - -# The Scan Workflow enables you to trigger SAST and quality scans directly -# From the GitHub workflow. - -name: Scan - -on: - # Controls when the workflow will run - - # Can use other triggers such as multiple events, activity types and fiters: - # https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#on - workflow_dispatch: # When triggered manually - - push: - # On push to the following branches. Temporarily add a development - # branch to prompt workflow runs for troubleshooting - branches: - - "main" - - "rc" - - "hotfix-rc" - pull_request_target: # zizmor: ignore[dangerous-triggers] - # When a pull request event occurs. Default is opened or reopened unless - # otherwise specified, as below: - types: [opened, synchronize] # Options include labeled, unlabeled, reopened - branches: "main" - -permissions: {} - -# A workflow run is made up of one or more jobs that can run sequentially or in -# parallel -jobs: - # This workflow contains the jobs "check-run", "sast", and "quality" - # This job is relatively simple and just imports a previously written action - # to be used in this workflow - check-run: # You set this value with the name of the job you're describing - name: Check PR run # Human readable descriptor - # location and branch of bitwarden-owned action being used - uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main - permissions: - contents: read - - sast: - # A more complex job that has multiple actions as steps described below - name: SAST scan - runs-on: ubuntu-22.04 # The type of runner that the job will run on - needs: check-run # This job will wait until check-run completes - permissions: # Sets permissions of the GITHUB_TOKEN - contents: read # For actions/checkout to fetch code - pull-requests: write # For github actions to upload feedback to PR - # For github/codeql-action/upload-sarif to upload SARIF results - security-events: write - id-token: write # For bitwarden/gh-actions/azure-login to get an ID token - - # Steps represent a sequence of tasks executed as part of the job - steps: - - name: Check out repo - # Always pin a public action version to a full git SHA. - # Version pins are insecure and can introduce vulnerabilities - # into workflows. - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - # Parameters specific to this action that need to be defined - # in order for the step to be completed - ref: ${{ github.event.pull_request.head.sha }} - persist-credentials: false # We don't need to push code - - - name: Log in to Azure - uses: bitwarden/gh-actions/azure-login@main - with: - subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - tenant_id: ${{ secrets.AZURE_TENANT_ID }} - client_id: ${{ secrets.AZURE_CLIENT_ID }} - - - name: Get Azure Key Vault secrets - id: get-kv-secrets - uses: bitwarden/gh-actions/get-keyvault-secrets@main - with: - keyvault: gh-org-bitwarden - secrets: "CHECKMARX-TENANT,CHECKMARX-CLIENT-ID,CHECKMARX-SECRET" - - - name: Log out from Azure - uses: bitwarden/gh-actions/azure-logout@main - - - name: Scan with Checkmarx - if: github.event.pull_request.draft == false # Prevent step from running on draft PR - uses: checkmarx/ast-github-action@f0869bd1a37fddc06499a096101e6c900e815d81 # 2.0.36 - # Environment variables set for this step but not accessible by all - # workflows, steps or jobs - env: - INCREMENTAL: "${{ contains(github.event_name, 'pull_request') \ - && '--sast-incremental' || '' }}" - with: - project_name: ${{ github.repository }} - cx_tenant: ${{ steps.get-kv-secrets.outputs.CHECKMARX-TENANT }} - base_uri: https://ast.checkmarx.net/ - cx_client_id: ${{ steps.get-kv-secrets.outputs.CHECKMARX-CLIENT-ID }} - cx_client_secret: ${{ steps.get-kv-secrets.outputs.CHECKMARX-SECRET }} - additional_params: | - --report-format sarif \ - --filter \ - "state=TO_VERIFY;PROPOSED_NOT_EXPLOITABLE;CONFIRMED;URGENT"\ - --output-path . ${{ env.INCREMENTAL }} - - - name: Upload Checkmarx results to GitHub - uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd # v3.27.0 - with: - sarif_file: cx_result.sarif - sha: ${{ contains(github.event_name, 'pull_request') && github.event.pull_request.head.sha || github.sha }} - ref: ${{ contains(github.event_name, 'pull_request') && format('refs/pull/{0}/head', github.event.pull_request.number) || github.ref }} - - quality: - name: Quality scan - runs-on: ubuntu-22.04 - needs: check-run - permissions: - contents: read - pull-requests: write - id-token: write - - steps: - # Set up whatever resources your environment will need - # to run workflows on your code - - name: Set up JDK 17 - uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0 - with: - java-version: 17 - distribution: "zulu" - # This step checks out a copy of your repository - - name: Set up .NET - uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4.1.0 - # Install a tool without a Github Action - - name: Install SonarCloud scanner - run: dotnet tool install dotnet-sonarscanner -g - - - name: Log in to Azure - uses: bitwarden/gh-actions/azure-login@main - with: - subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - tenant_id: ${{ secrets.AZURE_TENANT_ID }} - client_id: ${{ secrets.AZURE_CLIENT_ID }} - - - name: Get Azure Key Vault secrets - id: get-kv-secrets - uses: bitwarden/gh-actions/get-keyvault-secrets@main - with: - keyvault: gh-org-bitwarden - secrets: "SONAR-TOKEN" - - - name: Log out from Azure - uses: bitwarden/gh-actions/azure-logout@main - - - name: Scan with SonarCloud - env: - SONAR_TOKEN: ${{ steps.get-kv-secrets.outputs.SONAR-TOKEN }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - _REPOSITORY_OWNER: ${{ github.repository_owner }} - _REPOSITORY_NAME: ${{ github.event.repository.name }} - - # Additional scripts to run outside of a Github Action - run: | - dotnet-sonarscanner begin /k:" \ - ${_REPOSITORY_OWNER}_${_REPOSITORY_NAME}" \ - /d:sonar.test.inclusions=test/,bitwarden_license/test/ \ - /d:sonar.exclusions=test/,bitwarden_license/test/ \ - /o:"$_REPOSITORY_OWNER" \ - /d:sonar.token="$SONAR_TOKEN" \ - /d:sonar.host.url="https://sonarcloud.io" - dotnet build - dotnet-sonarscanner end /d:sonar.token="$SONAR_TOKEN" diff --git a/src/bitwarden_workflow_linter/default_actions.json b/src/bitwarden_workflow_linter/default_actions.json index 2cb45363..1a9f4b15 100644 --- a/src/bitwarden_workflow_linter/default_actions.json +++ b/src/bitwarden_workflow_linter/default_actions.json @@ -204,11 +204,6 @@ "sha": "b94431e051d1c52dcbe9a7092a4f10f827795416", "version": "v2.1.0" }, - "checkmarx/ast-github-action": { - "name": "checkmarx/ast-github-action", - "sha": "b74e8d514feae4ad5ad2b43e72590935bd2daf5f", - "version": "2.0.39" - }, "chrnorm/deployment-action": { "name": "chrnorm/deployment-action", "sha": "55729fcebec3d284f60f5bcabbd8376437d696b1", @@ -579,4 +574,4 @@ "sha": "5ca5fc7a4779c5263a3ffa0e1f693009994446d1", "version": "v0.1.2" } -} \ No newline at end of file +} From c829f9dda6d688b8a3dbfdf627330666230c1ad0 Mon Sep 17 00:00:00 2001 From: Eric Sognefest Date: Fri, 31 Jul 2026 14:49:44 -0400 Subject: [PATCH 2/2] chore: remove sonar from repo --- src/bitwarden_workflow_linter/default_actions.json | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/bitwarden_workflow_linter/default_actions.json b/src/bitwarden_workflow_linter/default_actions.json index 1a9f4b15..44d2f4f7 100644 --- a/src/bitwarden_workflow_linter/default_actions.json +++ b/src/bitwarden_workflow_linter/default_actions.json @@ -524,11 +524,6 @@ "sha": "7b4da11513bf3f43f9999e90eabced41ab8bb048", "version": "v2.2.0" }, - "sonarsource/sonarqube-scan-action": { - "name": "sonarsource/sonarqube-scan-action", - "sha": "bfd4e558cda28cda6b5defafb9232d191be8c203", - "version": "v4.2.1" - }, "sravinet/toml-select": { "name": "sravinet/toml-select", "sha": "fe2e680f88a09851a0cd887dba0bbd19d3babe11",