Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update README for v1.0.3 #31

Merged
merged 1 commit into from
Oct 31, 2023
Merged

Update README for v1.0.3 #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,29 +1,31 @@
# HCL AppScan SAST Github Action
Your code is better and more secure with HCL AppScan.

The HCL AppScan SAST Github Action enables you to run static analysis security testing (SAST) against the files in your repository. The SAST scan identifies security vulnerabilities in your code and stores the results in AppScan on Cloud.
The HCL AppScan SAST Github Action enables you to run static analysis security testing (SAST) and software composition analysis (SCA) against the files in your repository. The SAST scan identifies security vulnerabilities in your code and the SCA scan identifies vulnerabilities in your dependencies. Results are stored in AppScan on Cloud or AppScan 360.

# Usage
## Register
If you don't have an account, register on [HCL AppScan on Cloud (ASoC)](https://www.hcltechsw.com/appscan/codesweep-for-github) to generate your API key and API secret.
If you don't have an account, register on [HCL AppScan on Cloud (ASoC)](https://www.hcltechsw.com/appscan/codesweep-for-github) to generate your API key and API secret. Not required for AppScan 360.

## Setup
1. Generate your API key and API secret on [the API page](https://cloud.appscan.com/main/settings).
- The API key and API secret map to the `asoc_key` and `asoc_secret` parameters for this action. Store the API key and API secret as [secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets) in your repository.
![adingkeys_animation](img/keyAndSecret.gif)
2. Create the application in ASoC.
- The application ID in ASoC maps to application_id for this action.
2. Create the application in ASoC or AppScan 360.
- The application ID in ASoC/AppScan 360 maps to application_id for this action.

# Required Inputs
| Name | Description |
| :---: | :---: |
| asoc_key | Your API key from [the API page](https://cloud.appscan.com/main/settings) |
| asoc_secret | Your API secret from [the API page](https://cloud.appscan.com/main/settings) |
| application_id | The ID of the application in ASoC. |
| application_id | The ID of the application in ASoC or AppScan 360. |

# Optional Inputs
| Name | Description | Default Value |
| :---: | :---: | :---: |
| service_url | The url for connections to AppScan 360. Not required for connections to AppScan on Cloud (ASoC) | https://cloud.appscan.com |
| acceptssl | Allow connections to an AppScan 360 service with an untrusted certificate. Recommended for testing purposes only. | false |
| scan_name | The name of the scan created in ASoC. | The GitHub repository name |
| personal_scan | Make this a [personal scan](https://help.hcltechsw.com/appscan/ASoC/appseccloud_scans_personal.html). | false |
| static_analysis_only | Only run static analysis. Do not run SCA (Software Composition Analysis). | false |
Expand All @@ -46,7 +48,7 @@ jobs:
- name: Checkout
uses: actions/checkout@v3
- name: Run AppScan SAST scan
uses: HCL-TECH-SOFTWARE/[email protected].1
uses: HCL-TECH-SOFTWARE/[email protected].3
with:
asoc_key: ${{secrets.ASOC_KEY}}
asoc_secret: ${{secrets.ASOC_SECRET}}
Expand Down
Loading