Merge 053f12a545 into 862df88970

.github/pull_request_template.md

@@ -0,0 +1,11 @@
+### What I did
+
+<!-- Quick summary of the work your code accomplished (less technical) -->
+
+### How I did it
+
+<!-- Overview of how the code is put together (more technical). Document more specific design decisions in the code as comments. -->
+
+### Example screenshots/gifs (suggested for frontend work)
+
+<!-- Before and after screenshots/gifs -->

.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  workflow_dispatch:
+  pull_request: # Allow building on any PR
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  checkmarx:
+    name: ✅ Checkmarx Vulnerability Scan ✅
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Scan project
+        uses: Checkmarx/ast-github-action@2.0.14
+        with:
+          base_uri: https://ast.checkmarx.net/
+          cx_tenant: shifttechnologies
+          cx_client_id: ${{ secrets.CHECKMARX_CLIENT_ID }}
+          cx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
+          project_name: ${{ github.repository }}
+          branch: ${{ github.ref }}
+          additional_params: --sast-incremental --scan-types sast --filter status=NEW --threshold "sast-high=18"