This action verifies an application that's onboarded to Contrast by determining whether the application violates a Job Outcome Policy or threshold of open vulnerabilities.

name: Test and Verify
on:
  push:
    branches:
      - main
    pull_request:
jobs:
  test_and_verify:
    runs-on: ubuntu-latest
    steps:
        # check out project
      - uses: actions/checkout@v2
        # record start time so we can verify only newly found vulnerabilities
      - name: Define job start time
        run: |
          import time
          n = int(round(time.time() * 1000))
          print(f"::set-output name=jobStartTime::{n}")
        shell: python
        id: set-job-start-time
      # steps to build and run integration tests
      # - name: Run tests
      #
      - name: Contrast Verify
        uses: Contrast-Security-OSS/integration-verify-github-action@main
        with:
          apiKey: ${{ secrets.CONTRAST_API_KEY }}
          orgId: <organization id>
          apiUrl: https://app.contrastsecurity.com
          authHeader: ${{ secrets.CONTRAST_AUTH_HEADER }}
          appName: App_Name_Here
          #appId: or app_uuid_here if known
          jobStartTime: "${{ steps.set-job-start-time.outputs.jobStartTime }}"

As shown above, the jobStartTime input value can be generated with a script step, running prior to your tests. This approach is useful when you want to consider only new vulnerabilities found by this action run, for example in a pull request.

You may also pass a buildNumber input which will filter for vulnerabilities found in specific builds. The agent must be started with this same build number provided via the CONTRAST__APPLICATION__VERSION environment variable, or equivalent YAML/System Properties.

If both jobStartTime and buildNumber are provided, the step will consider only vulnerabilities found since the specified start time, and with the provided buildNumber.

This integration is available as a Docker image which allows it to be used in other environments outside of GitHub Actions, for example, in GitLab pipelines. For more details, see Container Documentation.

Debug log messages are only made visible when GitHub Actions debug logging is enabled.

A HTTP or HTTPS proxy may be used, by setting the environment variables HTTP_PROXY and HTTPS_PROXY respectively. The value should be the full proxy URL, including authorization details if required.

If your environment requires custom certificate(s) to be trusted, these may be provided via the input caFile in pem format.

1. Run python -m venv venv to setup a virtual environment
2. Run . venv/bin/activate to activate the virtual environment
3. Run pip install -r requirements-dev.txt to install development dependencies (will also include app dependencies)
4. Run pre-commit install to setup the pre-commit hook which handles formatting