Bump version to 1.0.38 and upgrade uuid (#215)

* Bump version to 1.0.38 and upgrade uuid

Bump package version to 1.0.38 in package.json and package-lock.json. Upgrade dependency uuid from ^8.3.2 to ^9.0.0 and regenerate lockfile entries (node_modules/uuid@9.0.1). Removes older nested uuid@8.3.2 entries from lockfile. This updates the UUID package for compatibility/security and refreshes the lockfile to match the new dependency.

* Fix unit test cases

* updated package-lock.json

* removed uuid version 9.0.0 from package.json

* Fix flaky Result List Successful case in integration tests

The test searched tenant-wide completed scan history for one with parseable
results, but that history is dominated by zero-finding scans, causing the
CLI to omit the results key and the test to fail. It now triggers its own
SAST scan against the known-vulnerable tsc/tests/data/python-vul-file.py so
results are always present.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Update AST CLI to 2.3.57

Updates the AST CLI binary version from 2.3.55 to 2.3.57 with new checksums for all supported platforms (Windows x64, Darwin x64, Linux x64/ARM64/ARMv6).

* added zizmor check

* fix: change in runner

* removing dependabot workflows

---------

Co-authored-by: Anurag Dalke <120229307+cx-anurag-dalke@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: 3 people

.github/workflows/auto-merge-pr.yml

@@ -8,13 +8,22 @@ on:
   schedule:
     - cron: '00 7 * * *' # Every day at 07:00
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   cx-scan:
     name: Checkmarx One Scan
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
       - name: Checkmarx One CLI Action
         uses: checkmarx/ast-github-action@ef93013c95adc60160bc22060875e90800d3ecfc #v.2.3.19
         with:

.github/workflows/checkmarx-one-scan.yml

@@ -1,14 +1,22 @@
 name: AST Javascript wrapper CI
 
 on: [ pull_request ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   unit-tests:
+    name: Unit Tests
     runs-on: cx-public-ubuntu-x64
     steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v6
+      with:
+        persist-credentials: false
     - name: Verify single lockfile (Step 0 - Supply Chain Policy)
       run: |
         if [ -f yarn.lock ] && [ -f package-lock.json ]; then
@@ -31,9 +39,12 @@ jobs:
 
       run: npm run test:unit
   integration-tests:
+    name: Integration Tests
     runs-on: cx-public-ubuntu-x64
     steps:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      with:
+        persist-credentials: false
     - name: Verify single lockfile (Step 0 - Supply Chain Policy)
       run: |
         if [ -f yarn.lock ] && [ -f package-lock.json ]; then

.github/workflows/ci.yml

@@ -13,14 +13,19 @@ on:
         description: 'Tag to delete'
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   delete:
+    name: Delete packages and releases
     permissions:
-      contents: write
-      packages: write
+      contents: write  # for gh release delete and tag cleanup
+      packages: write  # for deleting npm package versions
     runs-on: cx-public-ubuntu-x64
     steps:
 

.github/workflows/delete-packages-and-releases.yml

@@ -8,7 +8,11 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   nightly:
-    uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/release.yml@main
-    secrets: inherit
+    uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/release.yml@main # zizmor: ignore[unpinned-uses]
+    secrets: inherit # zizmor: ignore[secrets-inherit]

.github/workflows/dependabot-auto-merge.yml

@@ -44,24 +44,29 @@ on:
         default: true
         type: boolean
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   delete:
     permissions:
-      contents: write
-      packages: write
-    uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/delete-packages-and-releases.yml@main
+      contents: write  # for gh release delete and tag cleanup
+      packages: write  # for deleting npm package versions
+    uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/delete-packages-and-releases.yml@main # zizmor: ignore[unpinned-uses]
     with:
       tag: ${{ inputs.jsTag }}
-    secrets: inherit
+    secrets: inherit # zizmor: ignore[secrets-inherit]
     if: inputs.dev == true
   release:
+    name: Release
     permissions:
-      id-token: write
-      contents: write
-      packages: write
+      id-token: write  # allows this job to request a GitHub OIDC token
+      contents: write  # for git tag push and creating the GitHub release
+      packages: write  # for publishing the npm package to GitHub Packages
     runs-on: cx-public-ubuntu-x64
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -72,7 +77,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
-          fetch-depth: 0
+          persist-credentials: false
 
       - name: Verify single lockfile (Step 0 - Supply Chain Policy)
         run: |
@@ -181,8 +186,8 @@ jobs:
       - name: Push tag
         if: inputs.dev == false
         run: |
-          git pull 
-          git tag ${{env.TAG_NAME}}
+          git pull
+          git tag "$TAG_NAME"
           git push --tags
 
       - name: Publish npm package

.github/workflows/nightly.yml

@@ -0,0 +1,31 @@
+name: Scan for GitHub Actions issues
+
+on:
+  pull_request:
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.ref }}
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Scan repository contents
+    runs-on: cx-public-ubuntu-x64
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Run Zizmor linter
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          advanced-security: false
+          annotations: false
+          persona: pedantic
+          fail-on-no-inputs: false
+          online-audits: false

.github/workflows/release.yml

@@ -7,22 +7,31 @@ on:
         description: 'New CLI version (optional)'
         required: false
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   update-checkmarx-cli:
+    name: Update Checkmarx AST CLI
     runs-on: cx-public-ubuntu-x64
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       # Fetch the latest Checkmarx AST CLI version
       - name: Get Latest Checkmarx API version
         id: checkmarx-ast-cli
+        env:
+          NEW_CLI_VERSION: ${{ github.event.inputs.new_cli_version }}
         run: |
-          if [ "${{ github.event.inputs.new_cli_version }}" ]; then
-            LATEST_VERSION=${{ github.event.inputs.new_cli_version }}
+          if [ "$NEW_CLI_VERSION" ]; then
+            LATEST_VERSION="$NEW_CLI_VERSION"
           else
             LATEST_VERSION=$(curl -sL https://api.github.com/repos/Checkmarx/ast-cli/releases/latest | jq -r ".tag_name")
           fi
@@ -36,7 +45,7 @@ jobs:
         env:
           RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
         run: |
-          echo ${{ steps.checkmarx-ast-cli.outputs.release_tag }} > checkmarx-ast-cli.version
+          echo "$RELEASE_TAG" > checkmarx-ast-cli.version
 
       # Download CLI binaries and generate checksums
       - name: Download CLI and generate checksums

.github/workflows/scan-github-action.yml

@@ -1,7 +1,7 @@
 {
-  "windows_x64": "b93d0564891bf33231a1195cc246605c80f701d19d4c934a2986df341924a029",
-  "darwin_x64":  "b79cb1e6e7832a584f2e96c30046a4dd970ecb1c87cbb526eb799340321ed3d8",
-  "linux_x64":   "861112f7b78a9e84d8d4b4490c0dc6f6f716e5863246111db9c1c24efcf760db",
-  "linux_arm64": "99c47d3686f84daf485a2e724f8d967d380aa00b04c83c3a438f5339e9cf111c",
-  "linux_armv6": "76a2e0b27e4d1d70b2f98785d0ec003bdfe53da021e95b970f4ffac44d99e930"
+  "windows_x64": "8e724f79993cc8ee7f1e20420187fcc9dd6c1ff2dbaa561756c3a62d7256c008",
+  "darwin_x64":  "4298ef700bf29dbfbe315f8bed1a5be8bd0458aad50f155fe1eadfa6d721820b",
+  "linux_x64":   "f4f7dee7d823b98822f389142910ce26896929e6103c3eaba6cfa5499825c5b0",
+  "linux_arm64": "3504e0c66acab302f59fbb536f57b6163ad93428f10fcf299c3bcad5f5058577",
+  "linux_armv6": "fc674c61489b77e0bf6c8716283bee26e17911fca93169847e315d2de270a1f9"
 }