Skip to content

Commit 6121da4

Browse files
rsendenrsenden
committed
docs: Update usage text
1 parent 6c7dff7 commit 6121da4

4 files changed

Lines changed: 98 additions & 8 deletions

File tree

‎README.md‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ The `fortify/github-action` GitHub Action allows for easy integration of OpenTex
1515

1616
As such, this GitHub Action automatically benefits from new features and bug fixes as they are introduced in fcli, although there are options to use a fixed fcli version in case you need more stability. At the time of writing, the fcli `ci` action provides out-of-the-box support for Static Application Security Testing (SAST) and Software Composition Analysis (SCA); support for Dynamic or Mobile Application Security Testing (DAST & MAST) may be added in the future.
1717

18-
Apart from the top-level `fortify/github-action` for running the fcli-based `ci` workflow, this repository also provides the `fortify/github-action/setup` GitHub Action. This action allows for setting up fcli and other Fortify tools like ScanCentral Client for use in a custom GitHub Actions workflow, for example for implementing a fully customized AST scan workflow or some other automation workflow that needs to interact with Fortify products.
18+
Apart from the top-level `fortify/github-action` (and related `fortify/github-action/with-debug-upload-*` sub-actions) for running the fcli-based `ci` workflow, this repository also provides the `fortify/github-action/setup` GitHub Action. This action allows for setting up fcli and other Fortify tools like ScanCentral Client for use in a custom GitHub Actions workflow, for example for implementing a fully customized AST scan workflow or some other automation workflow that needs to interact with Fortify products.
1919

2020

2121
<!-- START-INCLUDE:repo-usage-text.md -->
@@ -42,13 +42,28 @@ jobs:
4242
steps:
4343
- uses: actions/checkout@v4 # Check out source code
4444
- uses: actions/setup-<build-tool>@vX # Set up build tool(s) required to build your project
45-
- uses: fortify/github-action@v3 # Run Fortify scans
45+
# Run Fortify scans and upload debug artifacts if debugging is enabled; use one of
46+
# the following:
47+
# - Upload debug artifacts using github.com-compatible actions/upload-artifact@v7:
48+
# uses: fortify/github-action/with-debug-upload-github@v3
49+
# - Upload debug artifacts using GHES-compatible actions/upload-artifact@v3:
50+
# uses: fortify/github-action/with-debug-upload-ghes@v3
51+
# - Don't upload debug artifacts; use subsequent step to upload to alternative storage:
52+
# uses: fortify/github-action@v3
53+
- uses: fortify/github-action/with-debug-upload-github@v3
54+
name: Run Fortify Scan
55+
id: fortify_scan
4656
env:
4757
FOD_URL: ${{ vars.FOD_URL }}
4858
FOD_CLIENT_ID: ${{ secrets.FOD_CLIENT_ID }}
4959
FOD_CLIENT_SECRET: ${{ secrets.FOD_CLIENT_SECRET }}
5060
# FOD_RELEASE: MyApp:main # Optional: defaults to repo:branch
5161
# FCLI_BOOTSTRAP_VERSION: v3.15 # Optional if you prefer stability over latest
62+
# - name: Upload Fortify debug artifacts (custom)
63+
# if: ${{ always() && steps.fortify_scan.outputs.upload-debug-artifacts == 'true' }}
64+
# uses: <custom upload action>
65+
# with:
66+
# path: ${{ steps.fortify_scan.outputs.debug-artifacts-dir }}
5267
```
5368

5469
#### OpenText Application Security (Fortify Software Security Center)
@@ -71,12 +86,27 @@ jobs:
7186
steps:
7287
- uses: actions/checkout@v4 # Check out source code
7388
- uses: actions/setup-<build-tool>@vX # Set up build tool(s) required to build your project
74-
- uses: fortify/github-action@v3 # Run Fortify scans
89+
# Run Fortify scans and upload debug artifacts if debugging is enabled; use one of
90+
# the following:
91+
# - Upload debug artifacts using github.com-compatible actions/upload-artifact@v7:
92+
# uses: fortify/github-action/with-debug-upload-github@v3
93+
# - Upload debug artifacts using GHES-compatible actions/upload-artifact@v3:
94+
# uses: fortify/github-action/with-debug-upload-ghes@v3
95+
# - Don't upload debug artifacts; use subsequent step to upload to alternative storage:
96+
# uses: fortify/github-action@v3
97+
- uses: fortify/github-action/with-debug-upload-github@v3
98+
name: Run Fortify Scan
99+
id: fortify_scan
75100
env:
76101
SSC_URL: ${{ vars.SSC_URL }}
77102
SSC_TOKEN: ${{ secrets.SSC_TOKEN }}
78103
SC_SAST_TOKEN: ${{ secrets.SC_SAST_TOKEN }}
79104
# SSC_APPVERSION: MyApp:main # Optional: defaults to repo:branch
105+
# - name: Upload Fortify debug artifacts (custom)
106+
# if: ${{ always() && steps.fortify_scan.outputs.upload-debug-artifacts == 'true' }}
107+
# uses: <custom upload action>
108+
# with:
109+
# path: ${{ steps.fortify_scan.outputs.debug-artifacts-dir }}
80110
```
81111

82112
#### Custom workflow

‎USAGE.md‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,13 +28,28 @@ jobs:
2828
steps:
2929
- uses: actions/checkout@v4 # Check out source code
3030
- uses: actions/setup-<build-tool>@vX # Set up build tool(s) required to build your project
31-
- uses: fortify/github-action@v3 # Run Fortify scans
31+
# Run Fortify scans and upload debug artifacts if debugging is enabled; use one of
32+
# the following:
33+
# - Upload debug artifacts using github.com-compatible actions/upload-artifact@v7:
34+
# uses: fortify/github-action/with-debug-upload-github@v3
35+
# - Upload debug artifacts using GHES-compatible actions/upload-artifact@v3:
36+
# uses: fortify/github-action/with-debug-upload-ghes@v3
37+
# - Don't upload debug artifacts; use subsequent step to upload to alternative storage:
38+
# uses: fortify/github-action@v3
39+
- uses: fortify/github-action/with-debug-upload-github@v3
40+
name: Run Fortify Scan
41+
id: fortify_scan
3242
env:
3343
FOD_URL: ${{ vars.FOD_URL }}
3444
FOD_CLIENT_ID: ${{ secrets.FOD_CLIENT_ID }}
3545
FOD_CLIENT_SECRET: ${{ secrets.FOD_CLIENT_SECRET }}
3646
# FOD_RELEASE: MyApp:main # Optional: defaults to repo:branch
3747
# FCLI_BOOTSTRAP_VERSION: v3.15 # Optional if you prefer stability over latest
48+
# - name: Upload Fortify debug artifacts (custom)
49+
# if: ${{ always() && steps.fortify_scan.outputs.upload-debug-artifacts == 'true' }}
50+
# uses: <custom upload action>
51+
# with:
52+
# path: ${{ steps.fortify_scan.outputs.debug-artifacts-dir }}
3853
```
3954

4055
#### OpenText Application Security (Fortify Software Security Center)
@@ -57,12 +72,27 @@ jobs:
5772
steps:
5873
- uses: actions/checkout@v4 # Check out source code
5974
- uses: actions/setup-<build-tool>@vX # Set up build tool(s) required to build your project
60-
- uses: fortify/github-action@v3 # Run Fortify scans
75+
# Run Fortify scans and upload debug artifacts if debugging is enabled; use one of
76+
# the following:
77+
# - Upload debug artifacts using github.com-compatible actions/upload-artifact@v7:
78+
# uses: fortify/github-action/with-debug-upload-github@v3
79+
# - Upload debug artifacts using GHES-compatible actions/upload-artifact@v3:
80+
# uses: fortify/github-action/with-debug-upload-ghes@v3
81+
# - Don't upload debug artifacts; use subsequent step to upload to alternative storage:
82+
# uses: fortify/github-action@v3
83+
- uses: fortify/github-action/with-debug-upload-github@v3
84+
name: Run Fortify Scan
85+
id: fortify_scan
6186
env:
6287
SSC_URL: ${{ vars.SSC_URL }}
6388
SSC_TOKEN: ${{ secrets.SSC_TOKEN }}
6489
SC_SAST_TOKEN: ${{ secrets.SC_SAST_TOKEN }}
6590
# SSC_APPVERSION: MyApp:main # Optional: defaults to repo:branch
91+
# - name: Upload Fortify debug artifacts (custom)
92+
# if: ${{ always() && steps.fortify_scan.outputs.upload-debug-artifacts == 'true' }}
93+
# uses: <custom upload action>
94+
# with:
95+
# path: ${{ steps.fortify_scan.outputs.debug-artifacts-dir }}
6696
```
6797

6898
#### Custom workflow

‎doc-resources/repo-intro.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ The `fortify/github-action` GitHub Action allows for easy integration of OpenTex
22

33
As such, this GitHub Action automatically benefits from new features and bug fixes as they are introduced in fcli, although there are options to use a fixed fcli version in case you need more stability. At the time of writing, the fcli `ci` action provides out-of-the-box support for Static Application Security Testing (SAST) and Software Composition Analysis (SCA); support for Dynamic or Mobile Application Security Testing (DAST & MAST) may be added in the future.
44

5-
Apart from the top-level `fortify/github-action` for running the fcli-based `ci` workflow, this repository also provides the `fortify/github-action/setup` GitHub Action. This action allows for setting up fcli and other Fortify tools like ScanCentral Client for use in a custom GitHub Actions workflow, for example for implementing a fully customized AST scan workflow or some other automation workflow that needs to interact with Fortify products.
5+
Apart from the top-level `fortify/github-action` (and related `fortify/github-action/with-debug-upload-*` sub-actions) for running the fcli-based `ci` workflow, this repository also provides the `fortify/github-action/setup` GitHub Action. This action allows for setting up fcli and other Fortify tools like ScanCentral Client for use in a custom GitHub Actions workflow, for example for implementing a fully customized AST scan workflow or some other automation workflow that needs to interact with Fortify products.
66

77
{{include:repo-usage-text.md}}
88

‎doc-resources/repo-usage-text.md‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,28 @@ jobs:
2020
steps:
2121
- uses: actions/checkout@v4 # Check out source code
2222
- uses: actions/setup-<build-tool>@vX # Set up build tool(s) required to build your project
23-
- uses: fortify/github-action@v3 # Run Fortify scans
23+
# Run Fortify scans and upload debug artifacts if debugging is enabled; use one of
24+
# the following:
25+
# - Upload debug artifacts using github.com-compatible actions/upload-artifact@v7:
26+
# uses: fortify/github-action/with-debug-upload-github@v3
27+
# - Upload debug artifacts using GHES-compatible actions/upload-artifact@v3:
28+
# uses: fortify/github-action/with-debug-upload-ghes@v3
29+
# - Don't upload debug artifacts; use subsequent step to upload to alternative storage:
30+
# uses: fortify/github-action@v3
31+
- uses: fortify/github-action/with-debug-upload-github@v3
32+
name: Run Fortify Scan
33+
id: fortify_scan
2434
env:
2535
FOD_URL: ${{ vars.FOD_URL }}
2636
FOD_CLIENT_ID: ${{ secrets.FOD_CLIENT_ID }}
2737
FOD_CLIENT_SECRET: ${{ secrets.FOD_CLIENT_SECRET }}
2838
# FOD_RELEASE: MyApp:main # Optional: defaults to repo:branch
2939
# FCLI_BOOTSTRAP_VERSION: v3.15 # Optional if you prefer stability over latest
40+
# - name: Upload Fortify debug artifacts (custom)
41+
# if: ${{ always() && steps.fortify_scan.outputs.upload-debug-artifacts == 'true' }}
42+
# uses: <custom upload action>
43+
# with:
44+
# path: ${{ steps.fortify_scan.outputs.debug-artifacts-dir }}
3045
```
3146

3247
#### OpenText Application Security (Fortify Software Security Center)
@@ -49,12 +64,27 @@ jobs:
4964
steps:
5065
- uses: actions/checkout@v4 # Check out source code
5166
- uses: actions/setup-<build-tool>@vX # Set up build tool(s) required to build your project
52-
- uses: fortify/github-action@v3 # Run Fortify scans
67+
# Run Fortify scans and upload debug artifacts if debugging is enabled; use one of
68+
# the following:
69+
# - Upload debug artifacts using github.com-compatible actions/upload-artifact@v7:
70+
# uses: fortify/github-action/with-debug-upload-github@v3
71+
# - Upload debug artifacts using GHES-compatible actions/upload-artifact@v3:
72+
# uses: fortify/github-action/with-debug-upload-ghes@v3
73+
# - Don't upload debug artifacts; use subsequent step to upload to alternative storage:
74+
# uses: fortify/github-action@v3
75+
- uses: fortify/github-action/with-debug-upload-github@v3
76+
name: Run Fortify Scan
77+
id: fortify_scan
5378
env:
5479
SSC_URL: ${{ vars.SSC_URL }}
5580
SSC_TOKEN: ${{ secrets.SSC_TOKEN }}
5681
SC_SAST_TOKEN: ${{ secrets.SC_SAST_TOKEN }}
5782
# SSC_APPVERSION: MyApp:main # Optional: defaults to repo:branch
83+
# - name: Upload Fortify debug artifacts (custom)
84+
# if: ${{ always() && steps.fortify_scan.outputs.upload-debug-artifacts == 'true' }}
85+
# uses: <custom upload action>
86+
# with:
87+
# path: ${{ steps.fortify_scan.outputs.debug-artifacts-dir }}
5888
```
5989

6090
#### Custom workflow

0 commit comments

Comments
 (0)