update-cli.yml

name: Update Checkmarx AST CLI

on:
  workflow_dispatch:
    inputs:
      new_cli_version:
        description: 'New CLI version (optional)'
        required: false

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  update-checkmarx-cli:
    name: Update Checkmarx AST CLI
    runs-on: cx-public-ubuntu-x64

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          persist-credentials: false

      # Fetch the latest Checkmarx AST CLI version
      - name: Get Latest Checkmarx API version
        id: checkmarx-ast-cli
        env:
          NEW_CLI_VERSION: ${{ github.event.inputs.new_cli_version }}
        run: |
          if [ "$NEW_CLI_VERSION" ]; then
            LATEST_VERSION="$NEW_CLI_VERSION"
          else
            LATEST_VERSION=$(curl -sL https://api.github.com/repos/Checkmarx/ast-cli/releases/latest | jq -r ".tag_name")
          fi
          CURRENT_VERSION=$(<checkmarx-ast-cli.version)
          echo "release_tag=$LATEST_VERSION" >> $GITHUB_OUTPUT
          echo "current_tag=$CURRENT_VERSION" >> $GITHUB_OUTPUT

      # Update the version file if the latest version differs
      - name: Update Checkmarx CLI version in version file
        if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
        env:
          RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
        run: |
          echo "$RELEASE_TAG" > checkmarx-ast-cli.version

      # Download CLI binaries and generate checksums
      - name: Download CLI and generate checksums
        if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
        env:
          RELEASE_TAG: ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
        run: |
          VERSION=$RELEASE_TAG

          # Initialize checksums object
          CHECKSUMS='{}'

          # Platform configurations: platform_name,architecture,extension,os_platform
          PLATFORMS=(
            "windows,x64,zip,windows"
            "darwin,x64,tar.gz,darwin"
            "linux,x64,tar.gz,linux"
            "linux,arm64,tar.gz,linux"
            "linux,armv6,tar.gz,linux"
          )

          for PLATFORM_CONFIG in "${PLATFORMS[@]}"; do
            IFS=',' read -r OS_TYPE ARCH EXT OS_PLATFORM <<< "$PLATFORM_CONFIG"

            KEY="${OS_PLATFORM}_${ARCH}"
            URL="https://download.checkmarx.com/CxOne/CLI/${VERSION}/ast-cli_${VERSION}_${OS_PLATFORM}_${ARCH}.${EXT}"

            echo "Downloading checksum for ${KEY} from ${URL}..."

            # Download binary
            TEMP_FILE="/tmp/ast-cli_${KEY}.${EXT}"
            if curl -sL -o "$TEMP_FILE" "$URL"; then
              # Calculate SHA-256
              CHECKSUM=$(sha256sum "$TEMP_FILE" | awk '{print $1}')
              echo "✓ ${KEY}: ${CHECKSUM}"

              # Update checksums JSON
              CHECKSUMS=$(echo "$CHECKSUMS" | jq --arg key "$KEY" --arg value "$CHECKSUM" '.[$key] = $value')

              # Cleanup
              rm -f "$TEMP_FILE"
            else
              echo "✗ Failed to download ${KEY}"
              exit 1
            fi
          done

          # Write checksums to file
          echo "$CHECKSUMS" | jq '.' > checkmarx-ast-cli.checksums
          echo "Checksums updated:"
          cat checkmarx-ast-cli.checksums

      # Create a Pull Request with the version changes
      - name: Create Pull Request
        id: cretae_pull_request
        if: steps.checkmarx-ast-cli.outputs.current_tag != steps.checkmarx-ast-cli.outputs.release_tag
        uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1
        with:
          token: ${{ secrets.AUTOMATION_TOKEN }}
          commit-message: Update checkmarx-ast-cli to ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
          title: Update checkmarx-ast-cli binaries with ${{ steps.checkmarx-ast-cli.outputs.release_tag }}
          body: |
            Updates [checkmarx-ast-cli][1] to ${{ steps.checkmarx-ast-cli.outputs.release_tag }}

            Auto-generated by [create-pull-request][2]

            [1]: https://github.com/Checkmarx/checkmarx-ast-cli
          labels: cxone
          branch: feature/update_cli_${{ steps.checkmarx-ast-cli.outputs.release_tag }}