Security scanner reference

- name: Scan with SonarQube bundled
  uses: https://github.com/cloudbees-io/sonarqube-bundled-sast-scan-code@v1
  with:
    sonar-exclusion: "**/*.test.js,**/node_modules/**"
    language: "LANGUAGE_JS"
    coverage-file: "coverage/lcov.info"
▼

- name: Scan with SonarQube plugin
  uses: https://github.com/cloudbees-io/sonarqube-plugin@v1
  with:
    server-url: ${{ vars.SONARQUBE_SERVER_URL }}
    username: ${{ secrets.SONARQUBE_USERNAME }}
    password: ${{ secrets.SONARQUBE_PASSWORD }}
    sonar-project-key: "my-project-key"
▼

- name: Scan with Snyk SAST
  uses: https://github.com/cloudbees-io/snyk-sast-scan-code@v1
  with:
    orgname: "your_snyk_organization"
    token: ${{ secrets.SNYK_SECRET }}
    language: "LANGUAGE_JS"
▼

- name: Scan with Mend SAST
  uses: https://github.com/cloudbees-io/mend-sast-scan-code@v1
  with:
    server-url: ${{ vars.MEND_SERVER_URL }}
    token: ${{ secrets.MEND_SECRET }}
    language: "LANGUAGE_PYTHON"
▼

- name: Scan with Nexus IQ SAST
  uses: https://github.com/cloudbees-io/nexusiq-sast-scan-code@v1
  with:
    server-url: ${{ vars.NEXUS_IQ_SERVER_URL }}
    username: ${{ secrets.NEXUS_IQ_USERNAME }}
    password: ${{ secrets.NEXUS_IQ_PASSWORD }}
    application-id: "my-application-id"
    stage: "build"
▼

- name: Scan with GitHub Advanced Security
  uses: https://github.com/cloudbees-io/github-security-sast-scan-code@v1
  with:
    token: ${{ secrets.GITHUB_SECRET }}
    language: "LANGUAGE_JAVA"
▼

- name: Scan with Gosec
  uses: https://github.com/cloudbees-io/gosec-plugin@v1
  with:
    exclude-dirs: "vendor,third_party"
    exclude-rules: "G101,G102"
▼

- name: Scan with FindSecBugs
  uses: https://github.com/cloudbees-io/findsecbugs-hybrid-plugin@v1
  with:
    exclude-filter: "findsecbugs-exclude.xml"
▼

- name: Scan with njsscan
  uses: https://github.com/cloudbees-io/njsscan-hybrid-plugin@v1
  with:
    exclude-paths: "node_modules,dist"
    exclude-rules: "node_crypto_weak_random"
▼

- name: Scan with Checkmarx SAST
  uses: https://github.com/cloudbees-io/checkmarx-sast-scan-code@v1
  with:
    server-url: ${{ vars.CHECKMARX_SERVER_URL }}
    username: ${{ secrets.CHECKMARX_USERNAME }}
    password: ${{ secrets.CHECKMARX_PASSWORD }}
    project-name: "my-application"
    team-name: "Development Team"
▼

- name: Scan with Checkov
  uses: https://github.com/cloudbees-io/checkov-hybrid-plugin@v1
  with:
    file-path: "infrastructure/"
    framework: "terraform"
    skip-check: "CKV_AWS_20,CKV_AWS_57"
▼

- name: Scan with StackHawk
  uses: https://github.com/cloudbees-io/stackhawk-dast-scan-environment@v1
  with:
    api-key: ${{ secrets.STACKHAWK_API_KEY }}
    app-id: "your-app-id"
    env: "production"
▼

- name: Scan with ZAP
  uses: https://github.com/cloudbees-io/zap-dast-scan-environment@v1
  with:
    target-url: "https://your-application.com"
    scan-type: "baseline"
▼

- name: Scan with Anchore
  uses: https://github.com/cloudbees-io/anchore-scan-container@v1
  with:
    image-location: "your-registry/your-image:latest"
▼

- name: Scan with Aqua Security
  uses: https://github.com/cloudbees-io/aquasec-scan-container@v1
  with:
    image-location: "your-registry/your-image:latest"
    aqua-key: ${{ secrets.AQUA_KEY }}
    aqua-secret: ${{ secrets.AQUA_SECRET }}
▼

- name: Scan with JFrog Xray
  uses: https://github.com/cloudbees-io/jfrog-xray-scan-container@v1
  with:
    image-location: "your-registry/your-image:latest"
    server-url: ${{ vars.JFROG_SERVER_URL }}
    username: ${{ secrets.JFROG_USERNAME }}
    password: ${{ secrets.JFROG_PASSWORD }}
▼

- name: Scan with Snyk Container
  uses: https://github.com/cloudbees-io/snyk-scan-container@v1
  with:
    orgname: "your_snyk_organization"
    token: ${{ secrets.SNYK_SECRET }}
    image-location: "your-registry/your-image:latest"
▼

- name: Scan with Nexus IQ Container
  uses: https://github.com/cloudbees-io/nexusiq-scan-container@v1
  with:
    image-location: "your-registry/your-image:latest"
    server-url: ${{ vars.NEXUS_IQ_SERVER_URL }}
    username: ${{ secrets.NEXUS_IQ_USERNAME }}
    password: ${{ secrets.NEXUS_IQ_PASSWORD }}
    application-id: "my-application-id"
▼

- name: Scan with Trivy
  uses: https://github.com/cloudbees-io/trivy-plugin@v1
  with:
    image-location: "your-registry/your-image:latest"
    scan-type: "vuln,secret"
    severity: "HIGH,CRITICAL"
▼

- name: Scan with Black Duck
  uses: https://github.com/cloudbees-io/blackduck-sca-scan-dependency@v1
  with:
    server-url: ${{ vars.BLACKDUCK_SERVER_URL }}
    username: ${{ secrets.BLACKDUCK_USERNAME }}
    password: ${{ secrets.BLACKDUCK_PASSWORD }}
    project-name: "my-application"
    project-version: "1.0.0"
▼

- name: Scan with Mend SCA
  uses: https://github.com/cloudbees-io/mend-sca-scan-dependency@v1
  with:
    server-url: ${{ vars.MEND_SERVER_URL }}
    token: ${{ secrets.MEND_SECRET }}
    product-name: "my-product"
    project-name: "my-project"
▼

- name: Scan with Snyk SCA
  uses: https://github.com/cloudbees-io/snyk-sca-scan-dependency@v1
  with:
    orgname: "your_snyk_organization"
    token: ${{ secrets.SNYK_SECRET }}
    language: "javascript"
▼

- name: Scan with Gitleaks
  uses: https://github.com/cloudbees-io/gitleaks-plugin@v1
  with:
    exclude-paths: "node_modules,dist"
    log-level: "info"
▼

- name: Scan with TruffleHog Code
  uses: https://github.com/cloudbees-io/trufflehog-secret-scan-code@v1
  with:
    base-ref: "main"
    max-depth: "100"
    exclude-paths: "*.log,*.tmp"
▼

- name: Scan with TruffleHog Container
  uses: https://github.com/cloudbees-io/trufflehog-secret-scan-container@v1
  with:
    image-location: "your-registry/your-image:latest"
    exclude-paths: "/tmp,/var/log"
    log-level: "info"
▼

- name: Scan with TruffleHog S3
  uses: https://github.com/cloudbees-io/trufflehog-secret-scan-s3@v1
  with:
    bucket-name: "my-s3-bucket"
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    region: "us-west-2"
▼

- name: Scan with Snyk IaC
  uses: https://github.com/cloudbees-io/snyk-iac-scan@v1
  with:
    orgname: "your_snyk_organization"
    token: ${{ secrets.SNYK_SECRET }}
    file-path: "infrastructure/"
    severity-threshold: "high"
▼