From 760b0a2825714cc4cfe9662170f39d847c8360e9 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 31 Jul 2026 13:12:43 +0530 Subject: [PATCH 1/4] Bump CLI version to 2.3.58 and update LFS binaries Update checkmarx-ast-cli.version to 2.3.58 and refresh Git LFS pointers (oid and size) for bundled CLI assets: src/main/resources/cx-linux, cx-linux-arm, cx-mac, and cx.exe. This matches the rebuilt/updated CLI binaries for the new release. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- checkmarx-ast-cli.version | 2 +- src/main/resources/cx-linux | 4 ++-- src/main/resources/cx-linux-arm | 4 ++-- src/main/resources/cx-mac | 4 ++-- src/main/resources/cx.exe | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/checkmarx-ast-cli.version b/checkmarx-ast-cli.version index c532425..b487f22 100644 --- a/checkmarx-ast-cli.version +++ b/checkmarx-ast-cli.version @@ -1 +1 @@ -2.3.57 +2.3.58 diff --git a/src/main/resources/cx-linux b/src/main/resources/cx-linux index 9b4adbb..eba7579 100755 --- a/src/main/resources/cx-linux +++ b/src/main/resources/cx-linux @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:2adc258dd3754f62456970a2c3b3e6f9127dbeede3df373079b2a24ca3e5f28c -size 83243170 +oid sha256:4bd4d4e57a30c2c6c6ea9f8f39792789cef3d432902c776055a43250e0fc17fd +size 83271842 diff --git a/src/main/resources/cx-linux-arm b/src/main/resources/cx-linux-arm index 8867d68..73663c2 100755 --- a/src/main/resources/cx-linux-arm +++ b/src/main/resources/cx-linux-arm @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:3bbf6915f6c7740ad41422859ec8f984402884abffe3777727b1c047b490099d -size 77660322 +oid sha256:3ad0155b4f6a3101dc1138f32894558909aea2ab3f939d1623f03e26cb628c41 +size 77725858 diff --git a/src/main/resources/cx-mac b/src/main/resources/cx-mac index ac4fb35..de98e97 100755 --- a/src/main/resources/cx-mac +++ b/src/main/resources/cx-mac @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:8b0e2df928eb29718936480d2492431e051d7058b60754c3514c87da864e2267 -size 165800304 +oid sha256:0057f625fbd0d3e860b5eb0d4852b6514ebf9c86811c54b3c2b771661d9534f8 +size 165850272 diff --git a/src/main/resources/cx.exe b/src/main/resources/cx.exe index c18ff7f..441654a 100644 --- a/src/main/resources/cx.exe +++ b/src/main/resources/cx.exe @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:08691c1a33980ae863dd8990bdafca9e64622d450727251355118b851306bfae -size 85228864 +oid sha256:6507646e461b46bfd0767395473225bdc119f6b7d162a3a272f03dc708b055ec +size 85257024 From da96e45a0b3328c6dec204d65cafd98dc829575e Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 31 Jul 2026 13:38:43 +0530 Subject: [PATCH 2/4] Remove GitHub Actions scan workflow Delete .github/workflows/scan-github-action.yml which ran the Zizmor linter (zizmorcore/zizmor-action) to scan repository workflows. The removed workflow triggered on pull_request and workflow_call, checked out the repo, and executed on cx-public-ubuntu-x64. --- .github/workflows/scan-github-action.yml | 31 ------------------------ 1 file changed, 31 deletions(-) delete mode 100644 .github/workflows/scan-github-action.yml diff --git a/.github/workflows/scan-github-action.yml b/.github/workflows/scan-github-action.yml deleted file mode 100644 index 1273151..0000000 --- a/.github/workflows/scan-github-action.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: Scan for GitHub Actions issues - -on: - pull_request: - workflow_call: - -concurrency: - group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }} - -permissions: {} - -jobs: - zizmor: - name: Scan repository contents - runs-on: cx-public-ubuntu-x64 - permissions: - contents: read - steps: - - name: Check out repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: Run Zizmor linter - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 - with: - advanced-security: false - annotations: false - persona: pedantic - fail-on-no-inputs: false - online-audits: false From 23bae4cc013cc12c96374a7dc885062dd757ee5b Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 31 Jul 2026 14:17:43 +0530 Subject: [PATCH 3/4] Handle null SCA results in PredicateTest Add guards in PredicateTest to skip scans with null results and to assume SCA result data exists before accessing it. These checks prevent NPEs and make the test resilient when scans or SCA payloads are missing, causing the test to be skipped instead of failing. --- .../java/com/checkmarx/ast/predicate/PredicateTest.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java b/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java index e847046..5bf318a 100644 --- a/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java +++ b/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java @@ -62,7 +62,7 @@ void testGetStates() throws Exception { @Test void testScaTriage() throws Exception { // Automatically find a completed scan that has SCA results - List scans = wrapper.scanList("statuses=Completed"); + List scans = wrapper.scanList("statuses=Completed&limit=50"); Assumptions.assumeTrue(scans != null && scans.size() > 0, "No completed scans available"); Scan scaScan = null; @@ -70,6 +70,9 @@ void testScaTriage() throws Exception { for (Scan scan : scans) { Results results = wrapper.results(UUID.fromString(scan.getId())); + if (results.getResults() == null) { + continue; + } scaResult = results.getResults().stream() .filter(res -> res.getType().equalsIgnoreCase("sca")) .findFirst() @@ -81,6 +84,7 @@ void testScaTriage() throws Exception { } Assumptions.assumeTrue(scaScan != null, "Skipping: no completed scan with SCA results found"); + Assumptions.assumeTrue(scaResult.getData() != null, "Skipping: SCA result has no data/vulnerabilities"); String packageIdentifier = scaResult.getData().getPackageIdentifier(); int firstDash = packageIdentifier.indexOf('-'); From d7b03cac37faf1296382fb982a4da55aec1ddf82 Mon Sep 17 00:00:00 2001 From: atishj99 Date: Fri, 31 Jul 2026 15:22:45 +0530 Subject: [PATCH 4/4] Remove limit param from scanList in test Simplify PredicateTest by calling wrapper.scanList("statuses=Completed") instead of including an explicit &limit=50. This makes the test rely on the API/default pagination behavior and avoids hard-coding a limit that could mask results or cause brittle test failures when the API's default changes. --- src/test/java/com/checkmarx/ast/predicate/PredicateTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java b/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java index 5bf318a..d979472 100644 --- a/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java +++ b/src/test/java/com/checkmarx/ast/predicate/PredicateTest.java @@ -62,7 +62,7 @@ void testGetStates() throws Exception { @Test void testScaTriage() throws Exception { // Automatically find a completed scan that has SCA results - List scans = wrapper.scanList("statuses=Completed&limit=50"); + List scans = wrapper.scanList("statuses=Completed"); Assumptions.assumeTrue(scans != null && scans.size() > 0, "No completed scans available"); Scan scaScan = null;