FortiCNAPP Code Security for GitHub Actions

This repository contains a GitHub Action for using FortiCNAPP's code security offering on your code. In order for the code in this repository to run, you must be a FortiCNAPP customer. Please contact Fortinet support for more information.

Usage

Creating secrets

Before attempting to run this action, you should add three secrets LW_ACCOUNT, LW_SUBACCOUNT (When using a subaccount) LW_API_KEY and LW_API_SECRET to your GitHub repository (or, better yet, your GitHub organization so they can be shared across all your repositories). The value for these secrets can be obtained by following the instructions here to create an API key and then download it.

Running on pull requests

To run an analysis on pull requests that highlights new alerts, create a file called .github/workflows/lacework-code-security-pr.yml with this content:

on:
- pull_requestpermissions:
contents: readpull-requests: writeenv:
LW_ACCOUNT: ${{ secrets.LW_ACCOUNT }}LW_SUBACCOUNT: ${{ secrets.LW_SUBACCOUNT }}LW_API_KEY: ${{ secrets.LW_API_KEY }}LW_API_SECRET: ${{ secrets.LW_API_SECRET }}name: Lacework Code Security (PR)jobs:
run-analysis:
runs-on: ubuntu-latestname: Run analysisstrategy:
matrix:
target: [new, old]steps:
- name: Checkout repositoryuses: actions/checkout@v6with:
fetch-depth: 2
- name: Checkout oldif: ${{ matrix.target == 'old' }}run: git checkout HEAD^1
- name: Analyzeuses: lacework/code-security-action@v1with:
target: ${{ matrix.target }}display-results:
runs-on: ubuntu-latestname: Display resultsneeds:
- run-analysissteps:
- name: Resultsid: code-analysisuses: lacework/code-security-action@v1with:
token: ${{ secrets.GITHUB_TOKEN }}

Running on push or in scheduled mode

To run an analysis on pushes or on a scheduled fashion and upload findings to the Lacework UI, create a file called .github/workflows/lacework-code-security-push.yml with this content:

on:
push:
# Run the scan on evey push in mainbranches: [main]# Run the scan evey day at 7:00amschedule:
- cron: '0 7 * * *'# To manually trigger scans from the GitHub UIworkflow_dispatch:
env:
LW_ACCOUNT: ${{ secrets.LW_ACCOUNT }}LW_API_KEY: ${{ secrets.LW_API_KEY }}LW_API_SECRET: ${{ secrets.LW_API_SECRET }}name: Lacework Code Security (Push)jobs:
run-analysis:
runs-on: ubuntu-latestname: Run analysissteps:
- name: Checkout repositoryuses: actions/checkout@v6
- name: Analyzeuses: lacework/code-security-action@v1with:
target: push

License

The code contained in this repository is released as open-source under the Apache 2.0 license. However, the underlying analysis tools are subject to their own licensing conditions. Thus, you will not be able to use the code found here without having purchased the FortiCNAPP code security offering.