Embeded Sca Resolver

Dockerfile

@@ -3,6 +3,23 @@ FROM checkmarx/ast-cli:2.0.72
 
 USER root
 
+ARG CURL_OPTS="--fail --location --show-error --silent"
+ARG SCA_RESOLVER_URL="https://sca-downloads.s3.amazonaws.com/cli/latest/ScaResolver-musl64.tar.gz"
+
+RUN apk add --no-cache libstdc++ zlib
+RUN apk add --no-cache curl                                                    \
+    && _tmp="$(mktemp -t -d scaresolver.XXXXXXX)"                              \
+    && curl ${CURL_OPTS} --output "${_tmp}/scaresolver.tar.gz"                 \
+         "${SCA_RESOLVER_URL}"                                                 \
+    && tar --extract                                                           \
+           --gzip                                                              \
+           --file "${_tmp}/scaresolver.tar.gz"                                 \
+           --directory="/app/bin"                                              \
+    && chmod +x "/app/bin/ScaResolver"                                         \
+    && rm -rf "${_tmp}"                                                        \
+    && unset _tmp                                                              \
+    && apk del --no-cache curl
+
 #Copy the entrypoint script and properties used for the action
 COPY entrypoint.sh /app/entrypoint.sh
 COPY cleanup.sh /app/cleanup.sh

action.yml

@@ -42,6 +42,10 @@ inputs:
     required: false
     default: ${{ github.event.number }}
     description: "Pr Number of the pull request that needs the decoration"
+  use_scaresolver:
+    required: false
+    default: ${{ false }}
+    description: "Use Checkmarx SCA Resolver to locally resolve project dependencies"
 outputs: 
   cxcli:
     description: output from cli
@@ -77,6 +81,7 @@ runs:
     REPO_NAME: ${{ inputs.repo_name }}
     NAMESPACE: ${{ inputs.namespace }}
     PR_NUMBER: ${{ inputs.pr_number }}
+    USE_SCARESOLVER: ${{ inputs.use_scaresolver }}
 
 branding:
   icon: 'check'

entrypoint.sh

@@ -3,6 +3,10 @@
 output_file=./output.log
 
 eval "arr=(${ADDITIONAL_PARAMS})"
+if [ "${USE_SCARESOLVER}" == "true" ]; then
+  arr+=("--sca-resolver" "/app/bin/ScaResolver")
+fi
+
 /app/bin/cx scan create --project-name "${PROJECT_NAME}" -s "." --branch "${BRANCH#refs/heads/}" --scan-info-format json --agent "Github Action" "${arr[@]}" | tee -i $output_file
 exitCode=${PIPESTATUS[0]}