ast-cli-javascript-wrapper/.github/workflows/update-cli.yml at main · Checkmarx/ast-cli-javascript-wrapper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
name: Update checkmarx ast cli

on:
  workflow_dispatch:
  repository_dispatch:
    types: [cli-version-update]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  update-checkmarx-cli:
    name: Update Checkmarx CLI Binaries
    permissions:
      contents: write # For pushing updated CLI binaries
    runs-on: cx-public-ubuntu-x64
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          lfs: true
          persist-credentials: false

      - name: Install Git LFS
        run: |
          sudo apt-get update
          sudo apt-get install git-lfs
          git lfs install

      - name: Configure Git user
        run: |
          git config --global user.name github-actions
          git config --global user.email github-actions@github.com

      - name: Get Latest Checkmarx API version
        id: checkmarx-ast-cli
        run: |
          echo "release_tag=$(curl -sL https://api.github.com/repos/Checkmarx/ast-cli/releases/latest | jq -r '.tag_name')" >> $GITHUB_OUTPUT
          echo "current_tag=$(<checkmarx-ast-cli.version)" >> $GITHUB_OUTPUT

      - name: Update Checkmarx cli version
        if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
        env:
          RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
        run: |
          echo "$RELEASE_TAG" > checkmarx-ast-cli.version

      - name: Download latest cli and update branch
        if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
        env:
          RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
        run: |
          chmod +x ./.github/scripts/update_cli.sh
          ./.github/scripts/update_cli.sh "$RELEASE_TAG"

      - name: Track large files with Git LFS
        if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
        run: |
          git lfs track "src/main/wrapper/resources/cx-linux"
          git lfs track "src/main/wrapper/resources/cx.exe"
          git lfs track "src/main/wrapper/resources/cx-mac"
          git add .gitattributes
          git add src/main/wrapper/resources/cx-linux src/main/wrapper/resources/cx.exe src/main/wrapper/resources/cx-mac
          git commit -m "Track Checkmarx CLI binaries with Git LFS"

      - name: Create Pull Request
        id: cretae_pull_request
        if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
        uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
        with:
          token: ${{ secrets.AUTOMATION_TOKEN }}
          commit-message: Update checkmarx-ast-cli to ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
          title: Update checkmarx-ast-cli binaries with ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
          body: |
            Updates [checkmarx-ast-cli][1] to ${{ steps.checkmarx-ast-cli.outputs.release_tag }}

            Auto-generated by [create-pull-request][2]

            [1]: https://github.com/Checkmarx/checkmarx-ast-cli
          labels: cxone
          branch: feature/update_cli_${{ steps.checkmarx-ast-cli.outputs.release_tag }}