nleach999/Checkmarx CxFlow++ GitHub Action

Orchestrates vulnerability scanning and issue tracker item lifecycle.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stalelast commit Jul 11, 2024
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: nleach999/plugin_test@65ab19d2c10ad6b0d5bf7a12c09ca46febd4cc87 # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
project-name	The name of the scan project. This should include the branch being scanned using your organization's established system naming convention. The string `{branch}` will be replaced by the event's branch name if found in the project name.	yes	—
app-name	The name of the application used when making issue tracker tags.	yes	—
sast-url	The base URL to the Checkmarx SAST server (do not include CxWebClient).	no	—
sast-team	The full path of the SAST team that owns the project to scan.	no	—
sast-username	The username of the SAST account to use for scanning.	no	—
sast-password	The password for the selected SAST account.	no	—
sca-tenant	The name of the SCA tenant.	no	—
sca-username	The username of the SCA account to use for scanning.	no	—
sca-password	The password for the selected SCA account.	no	—
cxflow-jar-path	The local path to the CxFlow jar. If blank, CxFlow will be downloaded.	—	""
cxflow-version	The CxFlow version to use for execution. Ignored if cxflow-jar-path is set.	—	latest
cxflow-params	Command line parameters to pass to CxFlow at every execution.	—	—
pull-request-cxflow-params	Command line parameters passed to CxFlow only when executing during a pull-request event.	—	—
push-cxflow-params	Command line parameters passed to CxFlow only when executing during a push event.	—	—
docker-login-registry	The name of the container registry to use for login.	—	docker.io
docker-login-username	The username for the container registry login.	—	""
docker-login-password	The password for the container registry login.	—	""
upload-sarif-file	Uploads the Sarif file to create entries on the GitHub security tab during push events.	—	true
delete-sarif-file	Set to "false" when using the Sarif feedback channel to keep the Sarif file at the path returned in the sarif-path output parameter.	—	true
default-branch	The default branch of the repository used as the root parent project in SAST from which branch projects are derived. This defaults to the repo's defined default branch.	—	${{ github.event.repository.default_branch }}
disable-sast-scan	Set to true to disable SAST scanning.	—	false
disable-sca-scan	Set to true to disable SCA scanning.	—	false
enable-wire-trace	Set to true to emit web API I/O wire tracing to the action logs.	—	false
sast-log-level	The logging level for CxFlow output emitted as the action executes. (TRACE, DEBUG, ERROR, INFO)	—	INFO
java-opts	Options to pass to the JVM.	—	-Xms512m -Xmx2048m
java-props	Properties to pass to the JVM.	—	-Djava.security.egd=file:/dev/./urandom
push-feedback-channel	The feedback channel to use when scanning for a push.	—	Sarif
pull-request-feedback-channel	The feedback channel to use when scanning for a pull request.	—	GITHUBPULL
application-yaml-path	A path to a CxFlow yaml configuration file.	—	""
scaresolver-tag	The tag for the containerized SCAResolver build environment where the action will execute dependency scanning. The image must not be built with a *-bare target. If this is not supplied, the SCA dependency scan will execute on the SCA server.	—	""
spring-props	Spring boot properties to pass to the JVM.	—	""
custom-ca-path	Path to a file or directory containing a custom CA cert chain that is imported into the Java runtime cacerts store.	—	""
action-root	The root directory containing the action artifacts.	—	.
action-artifact-path	The path under the root directory where the action artifacts can be found.	—	—

Outputs

name	description
sarif-path	The path to the Sarif file produced from the scan.