Skip to content

feat: Add FAA scan action for SSC and FoD modules and integrate it in to CI workflows - #1133

Open
SangameshV wants to merge 3 commits into
dev/v3.xfrom
feat/v3.x/faa-scan-actions
Open

SangameshV wants to merge 3 commits into
dev/v3.xfrom
feat/v3.x/faa-scan-actions

Conversation

@SangameshV

@SangameshV SangameshV commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

This PR introduces the faa-scan CI action for both SSC and FoD modules and integrates it into the respective CI workflows.

The new action is responsible for:

  • Initializing and registering the Fortify Agentic Analyzer (FAA) tool.
  • Executing FAA scans on the target source directory.
  • Supporting optional Fortify scan result handoff through the --fpr parameter.
  • Uploading generated SARIF results to SSC or FoD as part of the CI pipeline.

Additionally, this change updates the existing CI workflows to invoke the new faa-scan action, enabling automated FAA analysis as part of the standard scanning process.

@SangameshV SangameshV self-assigned this Oct 13, 2026
@SangameshV
SangameshV marked this pull request as ready for review October 13, 2026 11:08
@SangameshV
SangameshV requested a review from rsenden October 13, 2026 11:08

@rsenden rsenden left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now, I've only reviewed docs; please have a look, update where needed, and verify that implementation matches updated docs. Once done, I'll review doc updates & actual implementation.

- var.set: { postScan.skipReason: } # Reset postScan.skipReason to allow post-scan tasks to run


DOWNLOAD_SAST_FPR:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just one more comment, Given that the faa-scan.yaml action already integrates with FoD for publishing the results, I think it would make sense to move FPR download also into faa-scan.yaml (maybe as optional step, maybe also keep supporting --fpr option but I think that makes less sense in this scenario).

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants