RTI-40: Update Checkmarx workflow with scheduled scan support

.github/workflows/checkmarx.yml

@@ -1,48 +1,96 @@
 on:
-  pull_request: {}
+  pull_request:
   push:
     branches:
     - main
     - master
+  schedule:
+    - cron: '0 15 * * 0'
+  workflow_dispatch:
 name: Checkmarx SAST Scan
 jobs:
   checkmarx-scan:
-       name: Checkmarx SAST Scan
-       runs-on: ubuntu-latest
-       timeout-minutes: 300
-
-       steps:
-            - name: Checkout Code
-              uses: actions/checkout@v4
-
-            - name: Run Checkmarx SAST Scan
-              uses: checkmarx-ts/[email protected]
-              with:
-                # Connection parameters
-                checkmarx_url: https://cmxext.deltek.com
-                checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
-                checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
-                checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
-                team: "/CxServer/Security/Deltek/Replicon"
-
-                # Project configuration
-                project: Replicon-${{ github.event.repository.name }}
-                scanners: sast
-                # bug_tracker: GitHub
-                incremental: false
-                break_build: false
-
-                # Scan parameters and thresholds
-                params: >-
-                  --logging.level.com.checkmarx=DEBUG
-                  --namespace=${{ github.repository_owner}}
-                  --checkmarx.settings-override=true
-                  --repo-name=${{ github.event.repository.name}}
-                  --branch=${{ github.ref_name || github.head_ref}}
-                  --checkmarx.scan-timeout=1440
-                  --cx-flow.filterSeverity
-                  --cx-flow.thresholds.high=1
-                  --cx-flow.thresholds.medium=1
-                  --cx-flow.scan-resubmit=true
-                  ${{ github.event.number && format('--merge-id={0}', github.event.number)}}
-
+        name: Checkmarx SAST Scan
+        runs-on: ubuntu-latest
+        concurrency:
+            group: checkmarx-${{ github.head_ref || github.ref }}
+            cancel-in-progress: true
+        timeout-minutes: 90
+        if: github.event_name != 'schedule' && github.event_name != 'workflow_dispatch'
+
+        steps:
+          - name: Checkout Code
+            uses: actions/checkout@v4
+
+          - name: Run Checkmarx SAST Scan
+            uses: checkmarx-ts/[email protected]
+            with:
+              # Connection parameters
+              checkmarx_url: https://cmxext.deltek.com
+              checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
+              checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
+              checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
+              team: "/CxServer/Security/Deltek/Replicon"
+              preset: "ASA Premium"
+
+              # Project configuration
+              project: Replicon-${{ github.event.repository.name }}
+              scanners: sast
+              incremental: true
+              break_build: false
+
+              # Scan parameters and thresholds
+              params: >-
+                --namespace=${{ github.repository_owner}}
+                --checkmarx.settings-override=true
+                --repo-name=${{ github.event.repository.name}}
+                --branch=${{ github.ref_name || github.head_ref}}
+                --cx-flow.filterSeverity
+                --cx-flow.thresholds.high=1
+                --cx-flow.thresholds.medium=1
+                --cx-flow.scan-resubmit=true
+                ${{ github.event.number && format('--merge-id={0}', github.event.number)}}
+
+  checkmarx-scheduled-scan:
+        name: Checkmarx scheduled SAST Scan
+        runs-on: ubuntu-latest
+        concurrency:
+            group: checkmarx-scheduled-scan
+            cancel-in-progress: true
+        timeout-minutes: 360
+        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+
+        steps:
+          - name: Checkout Code
+            uses: actions/checkout@v4
+            with:
+              ref: ${{ github.event.repository.default_branch }}
+
+          - name: Run Checkmarx SAST Scan
+            uses: checkmarx-ts/[email protected]
+            with:
+              # Connection parameters
+              checkmarx_url: https://cmxext.deltek.com
+              checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
+              checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
+              checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}
+              team: "/CxServer/Security/Deltek/Replicon"
+              preset: "ASA Premium"
+
+              # Project configuration
+              project: Replicon-${{ github.event.repository.name }}
+              scanners: sast
+              incremental: false
+              break_build: false
+
+              # Scan parameters and thresholds
+              params: >-
+                --namespace=${{ github.repository_owner}}
+                --checkmarx.settings-override=true
+                --repo-name=${{ github.event.repository.name}}
+                --branch=${{ github.event.repository.default_branch }}
+                --cx-flow.filterSeverity
+                --cx-flow.thresholds.high=1
+                --cx-flow.thresholds.medium=1
+                --cx-flow.scan-resubmit=true
+