From 3f5d6fc26c8b242ad7eb80b5a0582bc1bb07de82 Mon Sep 17 00:00:00 2001 From: sixer1182 <15432768+sixer1182@users.noreply.github.com> Date: Tue, 8 Sep 2026 11:15:36 +0200 Subject: [PATCH] Exclude test/ and examples/ from the Checkmarx scan The toolbox default filter assumes a Maven layout (**/src/test/**), which does not match this repo. Pass the new cx_extra_filters input so the PHP test suite and the example scripts stay out of SAST, IaC and SCA results. The secrets block is unchanged: the org secrets keep their CX_CONN_EXT_* names and are mapped into the names the reusable workflow declares. Requires unzerdev/unzer-tech-toolbox#13. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01WtZY4exVNimKHWnqfxuMDW --- .github/workflows/security-scan.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml index bef611b2c..1afa75e56 100644 --- a/.github/workflows/security-scan.yaml +++ b/.github/workflows/security-scan.yaml @@ -12,6 +12,11 @@ on: jobs: security-scan: uses: unzerdev/unzer-tech-toolbox/.github/workflows/security-scan.yaml@main + with: + # This repo is a PHP library: its tests and examples live in test/ and + # examples/ at the repo root, which the toolbox default filter + # (Maven's **/src/test/**) does not cover. + cx_extra_filters: "!test/**,!examples/**" secrets: CX_CLIENT_ID: ${{ secrets.CX_CONN_EXT_CLIENT_ID }} CX_CLIENT_SECRET: ${{ secrets.CX_CONN_EXT_CLIENT_SECRET }}