diff --git a/.github/workflows/run.yaml b/.github/workflows/run.yaml index 2b44622..cb10fde 100644 --- a/.github/workflows/run.yaml +++ b/.github/workflows/run.yaml @@ -96,5 +96,5 @@ jobs: - name: Upload Scan Report uses: actions/upload-artifact@v3 with: - name: Scan-Report + name: Qualys_WAS_Scan_Result path: ./outputs \ No newline at end of file diff --git a/README.md b/README.md index 9b76286..484914c 100644 --- a/README.md +++ b/README.md @@ -64,6 +64,22 @@ jobs: EXCLUDE: ${{ vars.EXCLUDE }} FAIL_ON_SCAN_ERROR: ${{ vars.FAIL_ON_SCAN_ERROR }} WAIT_FOR_RESULT: ${{ vars.WAIT_FOR_RESULT }} + +# Checkout the repository to download the scan result in your repository. +# if repository is private then add PAT (personal access token) token in the checkout step.: + - name: checkout code + uses: actions/checkout@v3 + with: + repository: GITHUB_USERNAME/REPOSITORY_NAME + ref: BRANCH_NAME + path: ./ + PAT: ${{ secrets.ACCESS_TOKEN }} + + - name: Download Result + uses: actions/download-artifact@v3 + with: + name: Qualys_WAS_Scan_Result + path: PATH_TO_TARGET_DIRECTORY ``` ### Scan Web App in your repository on pull request event @@ -113,6 +129,22 @@ jobs: EXCLUDE: ${{ vars.EXCLUDE }} FAIL_ON_SCAN_ERROR: ${{ vars.FAIL_ON_SCAN_ERROR }} WAIT_FOR_RESULT: ${{ vars.WAIT_FOR_RESULT }} + +# Checkout the repository to download the scan result in your repository. +# if repository is private then add PAT (personal access token) token in the checkout step.: + - name: checkout code + uses: actions/checkout@v3 + with: + repository: GITHUB_USERNAME/REPOSITORY_NAME + ref: BRANCH_NAME + path: ./ + PAT: ${{ secrets.ACCESS_TOKEN }} + + - name: Download Result + uses: actions/download-artifact@v3 + with: + name: Qualys_WAS_Scan_Result + path: PATH_TO_TARGET_DIRECTORY ``` ### Scan Web App in your repository on manual trigger @@ -159,6 +191,22 @@ jobs: EXCLUDE: ${{ vars.EXCLUDE }} FAIL_ON_SCAN_ERROR: ${{ vars.FAIL_ON_SCAN_ERROR }} WAIT_FOR_RESULT: ${{ vars.WAIT_FOR_RESULT }} + +# Checkout the repository to download the scan result in your repository. +# if repository is private then add PAT (personal access token) token in the checkout step.: + - name: checkout code + uses: actions/checkout@v3 + with: + repository: GITHUB_USERNAME/REPOSITORY_NAME + ref: BRANCH_NAME + path: ./ + PAT: ${{ secrets.ACCESS_TOKEN }} + + - name: Download Result + uses: actions/download-artifact@v3 + with: + name: Qualys_WAS_Scan_Result + path: PATH_TO_TARGET_DIRECTORY ``` ## Prerequisites for Qualys WAS GithHub Action @@ -190,9 +238,6 @@ jobs: | CANCEL_HOURS | | NO | "" | Input parameter | | SEVERITY_CHECK | | NO | false | Input parameter | | SEVERITY_LEVEL | | NO | 0 | Input parameter | -| IS_FAIL_ON_QID_FOUND | | NO | false | Input parameter | -| QID_LIST | | NO | "" | Input parameter | -| EXCLUDE | | NO | "" | Input parameter | | FAIL_ON_SCAN_ERROR | | NO | false | Input parameter | | WAIT_FOR_RESULT | | NO | true | Input parameter | diff --git a/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java b/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java index f9ae1f5..8b45aa0 100644 --- a/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java +++ b/src/main/java/com/example/GitHubActionsQWas/service/QualysWASScanBuilder.java @@ -225,12 +225,14 @@ public void launchWebApplicationScan() { logger.info("Qualys task - Started Launching web app scanning with WAS"); String scanId = service.launchScan(); if (scanId != null && !scanId.isEmpty()) { - String message1 = "Scan successfully launched with scan id: " + scanId; - String message2 = "Please switch to WAS Classic UI and Check for report..."; - String message3 = "To check scan result, please follow the url: " + portalUrl + "/portal-front/module/was/#forward=/module/was/&scan-report=" + scanId; + String message1 = "Launching scan with 'WAIT_FOR_RESULT:" + waitForResult + "'"; + String message2 = "Scan successfully launched with scan id: " + scanId; + String message3 = "Please switch to WAS Classic UI and Check for report..."; + String message4 = "To check scan result, please follow the url: " + portalUrl + "/portal-front/module/was/#forward=/module/was/&scan-report=" + scanId; logger.info(message1); logger.info(message2); logger.info(message3); + logger.info(message4); if (waitForResult) { logger.info("Qualys task - Fetching scan finished status"); getScanFinishedStatus(scanId); @@ -259,7 +261,7 @@ public void launchWebApplicationScan() { logger.info("Scan finished status fetched successfully"); } } else { - String message = message1 + "\n" + message2 + "\n" + message3; + String message = message1 + "\n" + message2 + "\n" + message3 + "\n" + message4; String fileName = "Qualys_Wasscan_" + webAppId + ".txt"; Helper.dumpDataIntoFile(message, fileName); }