Merge pull request #6 from Qualys/develop

QINT-15645: GitHub App for WAS
Qualys · Dec 18, 2023 · cc00108 · cc00108
2 parents 718e60a + bc3949d
commit cc00108
Show file tree

Hide file tree

Showing 3 changed files with 55 additions and 8 deletions.
diff --git a/.github/workflows/run.yaml b/.github/workflows/run.yaml
@@ -96,5 +96,5 @@ jobs:
       - name: Upload Scan Report
         uses: actions/upload-artifact@v3
         with:
-          name: Scan-Report
+          name: Qualys_WAS_Scan_Result
           path: ./outputs
diff --git a/README.md b/README.md
@@ -64,6 +64,22 @@ jobs:
               EXCLUDE: ${{ vars.EXCLUDE }}
               FAIL_ON_SCAN_ERROR: ${{ vars.FAIL_ON_SCAN_ERROR }}
               WAIT_FOR_RESULT: ${{ vars.WAIT_FOR_RESULT }}
+
+#      Checkout the repository to download the scan result in your repository.
+#      if repository is private then add PAT (personal access token) token in the checkout step.:
+          - name: checkout code
+            uses: actions/checkout@v3
+            with:
+             repository: GITHUB_USERNAME/REPOSITORY_NAME
+             ref: BRANCH_NAME
+             path: ./
+             PAT: ${{ secrets.ACCESS_TOKEN }}
+
+          - name: Download Result
+            uses: actions/download-artifact@v3
+            with:
+             name: Qualys_WAS_Scan_Result
+             path: PATH_TO_TARGET_DIRECTORY 
 ```
 
 ### Scan Web App in your repository on pull request event
@@ -113,6 +129,22 @@ jobs:
           EXCLUDE: ${{ vars.EXCLUDE }}
           FAIL_ON_SCAN_ERROR: ${{ vars.FAIL_ON_SCAN_ERROR }}
           WAIT_FOR_RESULT: ${{ vars.WAIT_FOR_RESULT }}
+
+#      Checkout the repository to download the scan result in your repository.
+#      if repository is private then add PAT (personal access token) token in the checkout step.:
+      - name: checkout code
+        uses: actions/checkout@v3
+        with:
+           repository: GITHUB_USERNAME/REPOSITORY_NAME
+           ref: BRANCH_NAME
+           path: ./
+           PAT: ${{ secrets.ACCESS_TOKEN }}
+
+      - name: Download Result
+        uses: actions/download-artifact@v3
+        with:
+           name: Qualys_WAS_Scan_Result
+           path: PATH_TO_TARGET_DIRECTORY
 ```
 
 ### Scan Web App in your repository on manual trigger
@@ -159,6 +191,22 @@ jobs:
           EXCLUDE: ${{ vars.EXCLUDE }}
           FAIL_ON_SCAN_ERROR: ${{ vars.FAIL_ON_SCAN_ERROR }}
           WAIT_FOR_RESULT: ${{ vars.WAIT_FOR_RESULT }}
+
+#      Checkout the repository to download the scan result in your repository.
+#      if repository is private then add PAT (personal access token) token in the checkout step.:
+      - name: checkout code
+        uses: actions/checkout@v3
+        with:
+           repository: GITHUB_USERNAME/REPOSITORY_NAME
+           ref: BRANCH_NAME
+           path: ./
+           PAT: ${{ secrets.ACCESS_TOKEN }}
+
+      - name: Download Result
+        uses: actions/download-artifact@v3
+        with:
+           name: Qualys_WAS_Scan_Result
+           path: PATH_TO_TARGET_DIRECTORY
 ```
 
 ## Prerequisites for Qualys WAS GithHub Action
@@ -190,9 +238,6 @@ jobs:
 | CANCEL_HOURS         |   | NO       | ""      | Input parameter |
 | SEVERITY_CHECK       |   | NO       | false   | Input parameter |
 | SEVERITY_LEVEL       |   | NO       | 0       | Input parameter |
-| IS_FAIL_ON_QID_FOUND |   | NO       | false   | Input parameter |
-| QID_LIST             |   | NO       | ""      | Input parameter |
-| EXCLUDE              |   | NO       | ""      | Input parameter |
 | FAIL_ON_SCAN_ERROR   |   | NO       | false   | Input parameter |
 | WAIT_FOR_RESULT      |   | NO       | true    | Input parameter |
 
diff --git a/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java b/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java
@@ -225,12 +225,14 @@ public void launchWebApplicationScan() {
             logger.info("Qualys task - Started Launching web app scanning with WAS");
             String scanId = service.launchScan();
             if (scanId != null && !scanId.isEmpty()) {
-                String message1 = "Scan successfully launched with scan id: " + scanId;
-                String message2 = "Please switch to WAS Classic UI and Check for report...";
-                String message3 = "To check scan result, please follow the url: " + portalUrl + "/portal-front/module/was/#forward=/module/was/&scan-report=" + scanId;
+                String message1 = "Launching scan with 'WAIT_FOR_RESULT:" + waitForResult + "'";
+                String message2 = "Scan successfully launched with scan id: " + scanId;
+                String message3 = "Please switch to WAS Classic UI and Check for report...";
+                String message4 = "To check scan result, please follow the url: " + portalUrl + "/portal-front/module/was/#forward=/module/was/&scan-report=" + scanId;
                 logger.info(message1);
                 logger.info(message2);
                 logger.info(message3);
+                logger.info(message4);
                 if (waitForResult) {
                     logger.info("Qualys task - Fetching scan finished status");
                     getScanFinishedStatus(scanId);
@@ -259,7 +261,7 @@ public void launchWebApplicationScan() {
                         logger.info("Scan finished status fetched successfully");
                     }
                 } else {
-                    String message = message1 + "\n" + message2 + "\n" + message3;
+                    String message = message1 + "\n" + message2 + "\n" + message3 + "\n" + message4;
                     String fileName = "Qualys_Wasscan_" + webAppId + ".txt";
                     Helper.dumpDataIntoFile(message, fileName);
                 }