Step 1 : Get access to the Cequence API testing docker image

Request for credentials to download the latest API testing docker image (Skip this step if you already have valid credentials)

Step 2 : Get the Client details

Refer the Cequence documentation here on the steps to create a new client.

Ensure that the client you’d like to use has the API Testing Runner role enabled

Make a note of the Client ID and the Client Secret of your client

Step 3 : Get the Test Plan details

Identify the test plan that you’d like to run from the list present in API Security Testing: Test Plans (create a new Test Plan if one does not exist)

Make a note of the Test Plan ID for your selected test plan

Step 4 : Get the Target details

Target refers to the API endpoint that you’d like Cequence to test during the CI/CD run. Make a note of the Base Host, Target Host and Target Server

For example, if Cequence needs to test an endpoint present at https://demo.example.com, then

Base Host = example.com

Target Host = demo.example.com

Target Server = https://demo.example.com

Step 5 : Create the snippet for the CI/CD configuration file

Set up your the following secrets for your Github Actions:

• Variable name = GITLAB_USERNAME, value = <Insert the username obtained in step 1>

• Variable name = GITLAB_TOKEN, value = <Insert the password obtained in step 1>

Complete the snippet below by filling the sections marked with <> and add it to your pipeline’s configuration file as per your need

cequence-security-scan:
  # Run the api security tests
  runs-on: ubuntu-latest
  env: 
    CQ_UAP_CLIENT_ID: "<Insert the client id from step 2>"
    CQ_UAP_CLIENT_SECRET: "<Insert the client secret from step 2>"
    CQ_TEST_PLAN_ID: "<Insert the test plan id from step 3>"
    CQ_UAP_BASE_HOST: "<Insert the base host from step 4>"
    CQ_TEST_TARGET_HOST: "<Insert the target host from step 4>"
    CQ_TEST_TARGET_SERVER: "<Insert the target server from step 4>"
    CQ_TEST_RUN_CICD_LINK: <github.server_url>/<github.repository>/actions/runs/<github.run_id>
    CQ_TEST_RUN_NAME: <github.sha>
  container:
    image: registry.gitlab.com/cequence/api-testing/{{latest-release-version}}
    credentials:
      username: <secrets.GITLAB_USERNAME>
      password: <secrets.GITLAB_TOKEN>
  steps:
    - name: run tests
      shell: bash
      run: |
          cd /app && node .