APIsec #22
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow uses actions that are not certified by GitHub. | |
| # They are provided by a third-party and are governed by | |
| # separate terms of service, privacy policy, and support | |
| # documentation. | |
| # APIsec addresses the critical need to secure APIs before they reach production. | |
| # APIsec provides the industry’s only automated and continuous API testing platform that uncovers security vulnerabilities and logic flaws in APIs. | |
| # Clients rely on APIsec to evaluate every update and release, ensuring that no APIs go to production with vulnerabilities. | |
| # How to Get Started with APIsec.ai | |
| # 1. Schedule a demo at https://www.apisec.ai/request-a-demo . | |
| # | |
| # 2. Register your account at https://cloud.apisec.ai/#/signup . | |
| # | |
| # 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly. | |
| # | |
| # 4. Get GitHub Actions scan attributes from APIsec Project -> Configurations -> Integrations -> CI-CD -> GitHub Actions | |
| # | |
| # apisec-run-scan | |
| # | |
| # This action triggers the on-demand scans for projects registered in APIsec. | |
| # If your GitHub account allows code scanning alerts, you can then upload the sarif file generated by this action to show the scan findings. | |
| # Else you can view the scan results from the project home page in APIsec Platform. | |
| # The link to view the scan results is also displayed on the console on successful completion of action. | |
| # This is a starter workflow to help you get started with APIsec-Scan Actions | |
| name: APIsec | |
| # Controls when the workflow will run | |
| on: | |
| # Triggers the workflow on push or pull request events but only for the "master" branch | |
| # Customize trigger events based on your DevSecOps processes. | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| branches: [ "master" ] | |
| schedule: | |
| - cron: '20 9 * * 4' | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| Trigger_APIsec_scan: | |
| permissions: | |
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | |
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: APIsec scan | |
| uses: apisec-inc/apisec-run-scan@025432089674a28ba8fb55f8ab06c10215e772ea | |
| with: | |
| # The APIsec username with which the scans will be executed | |
| apisec-username: ${{ secrets.apisec_username }} | |
| # The Password of the APIsec user with which the scans will be executed | |
| apisec-password: ${{ secrets.apisec_password}} | |
| # The name of the project for security scan | |
| apisec-project: "VAmPI" | |
| # The name of the sarif format result file The file is written only if this property is provided. | |
| sarif-result-file: "apisec-results.sarif" | |
| - name: Import results | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: ./apisec-results.sarif |