workflow.yaml

# The REST API Static Security Testing action locates REST API contracts that follow the 
# OpenAPI Specification (OAS, formerly known as Swagger) and runs thorough security checks 
# on them. Both OAS v2 and v3.0.x are supported, in both JSON and YAML format.
#
# Documentation is located here: https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm
#
# To use this workflow, you will need a customer/evaluation tenant on a 42Crunch SaaS platform.
#
# 1. Follow steps at https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm
#    to create an API Token on the 42Crunch platform
#
# 2. Add a secret in GitHub as explained in https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm,
#    store the 42Crunch API Token in that secret, and supply the secret's name as api-token parameter in this workflow
#
# If you have any questions or need help, contact: https://support.42crunch.com

name: "42Crunch REST API Static Security Testing"

# follow standard Code Scanning triggers
on:
  push:
    branches: [ "main" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "main" ]
  schedule:
    - cron: '19 9 * * 6'

jobs:
  rest-api-static-security-testing:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: 42Crunch REST API Static Security Testing
        uses: 42Crunch/api-security-audit-action@v4
        with:
          # Follow these steps to configure API_TOKEN https://docs.42crunch.com/latest/content/tasks/integrate_github_actions.htm
          api-token: ${{ secrets.API_TOKEN }}
          # Fail if any OpenAPI file scores lower than 75
          min-score: 75
          # Upload results to Github code scanning
          upload-to-code-scanning: false
          # Github token for uploading the results
          github-token: ${{ github.token }}