AST_GitHubAction.yml

name: Checkmarx AST scan
on: 
  [push, pull_request]
jobs:  
  pull_request_with_block:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3.2.0
      - name: Type scan
        id: pull_request_scan
        run : echo "Run on" ${{ github.event_name }}
      - name: Checkmarx One - Check vulnerabilities with block
        uses: checkmarx/ast-github-action@main #Github Action version
        with:
          project_name: ${{ github.repository }}
          cx_tenant: ${{ secrets.CHECKMARX_TENANT_NAME }}
          base_uri: ${{ secrets.CHECKMARX_BASE_URI }} 
          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
          cx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
          additional_params: ${{ secrets.CHECKMARX_SCAN_PARAMETER_ON_PR }} 
  push_scan:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3.2.0
      - name: Type scan
        id: pull_scan
        run : echo "Run on" ${{ github.event_name }}
      - name: Checkmarx One - Check vulnerabilities without block
        uses: checkmarx/ast-github-action@main #Github Action version
        with:
          project_name: ${{ github.repository }}
          cx_tenant: ${{ secrets.CHECKMARX_TENANT_NAME }}
          base_uri: ${{ secrets.CHECKMARX_BASE_URI }} 
          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
          cx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
          additional_params: ${{ secrets.CHECKMARX_SCAN_PARAMETER_ON_PUSH }}