• About Accuknox

Description
This GitHub Action runs a Static Application Security Testing (SAST) using SonarQube, then uploads the generated report to the AccuKnox CSPM panel. The action can be configured with specific inputs to integrate seamlessly with your DevSecOps pipeline.

1. Checkout into the Repo
   Use the checkout action to ensure your codebase is available for scanning.

2. Add AccuKnox SAST Scan Action
   Use the accuknox/[email protected] repository with the desired version tag, e.g., v1.0.0.

3. Token Generation from AccuKnox SaaS and Viewing Tenant ID
   To obtain the accuknox_token and tenant_id values needed to authenticate with AccuKnox:

   • Navigate to Tokens
     Go to the Settings section in the AccuKnox SaaS sidebar.

     

   • Create Token
     In the "Tokens" section, click on Create Token. This action will display your tenant_id and allow you to generate an access token.

     

   • Generate the Token
     After clicking Generate, copy the accuknox_token to use in the workflow.

   

name: AccuKnox SAST Workflow
on:
  push:
    branches:
      - main

jobs:
  sast-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Run AccuKnox SAST
        uses: accuknox/[email protected]
        with:
          sonar_token: ${{ secrets.SONAR_TOKEN }}
          sonar_host_url: ${{ secrets.SONAR_HOST_URL }}
          accuknox_endpoint: ${{ secrets.ACCUKNOX_ENDPOINT }}
          tenant_id: ${{ secrets.TENANT_ID }}
          accuknox_token: ${{ secrets.ACCUKNOX_TOKEN }}
          label: "my-sast-scan"
          sonar_project_key: "my-project-key"

• SonarQube SAST: The action runs a SAST scan on the specified project in SonarQube, using the provided credentials and project key.
• AccuKnox Report Generation: The action uses AccuKnox's Docker container to generate a SAST report.
• Report Upload: The generated report is uploaded to the AccuKnox CSPM panel for centralized monitoring and insights.
• Quality Gate Check: Verifies if the project meets the set quality standards on SonarQube.

• Ensure all necessary secrets (SONAR_TOKEN, SONAR_HOST_URL, ACCUKNOX_ENDPOINT, TENANT_ID, and ACCUKNOX_TOKEN) are securely stored in your repository's settings.
• AccuKnox panel provides a centralized view of all SAST results, enabling detailed security monitoring and analytics.