Skip to content

Commit 26f0a11

Browse files
thomaswoehlkethomaswoehlke
authored
Merge pull request #289 from Spring-Framework-Java-Apps/master
Deployment
2 parents 459f881 + 65991a3 commit 26f0a11

File tree

14 files changed

+425
-47
lines changed

14 files changed

+425
-47
lines changed

‎.github/workflows/codacy-analysis.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# This workflow checks out code, performs a Codacy security scan
2+
# and integrates the results with the
3+
# GitHub Advanced Security code scanning feature. For more information on
4+
# the Codacy security scan action usage and parameters, see
5+
# https://github.com/codacy/codacy-analysis-cli-action.
6+
# For more information on Codacy Analysis CLI in general, see
7+
# https://github.com/codacy/codacy-analysis-cli.
8+
9+
name: Codacy Security Scan
10+
11+
on:
12+
push:
13+
branches: [ "master", "main" ]
14+
pull_request:
15+
branches: [ "master", "main" ]
16+
17+
jobs:
18+
codacy-security-scan:
19+
name: Codacy Security Scan
20+
runs-on: ubuntu-latest
21+
steps:
22+
# Checkout the repository to the GitHub Actions runner
23+
- name: Checkout code
24+
uses: actions/checkout@v2
25+
26+
# Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
27+
- name: Run Codacy Analysis CLI
28+
uses: codacy/codacy-analysis-cli-action@1.0.0
29+
with:
30+
# Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
31+
# You can also omit the token and run the tools that support default configurations
32+
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
33+
verbose: true
34+
output: results.sarif
35+
format: sarif
36+
# Force 0 exit code to allow SARIF file generation
37+
# This will handover control about PR rejection to the GitHub side
38+
max-allowed-issues: 2147483647
39+
40+
# Upload the SARIF file generated in the previous step
41+
- name: Upload SARIF results file
42+
uses: github/codeql-action/upload-sarif@v1
43+
with:
44+
sarif_file: results.sarif

‎.github/workflows/codeql-analysis.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
name: "CodeQL"
7+
8+
on:
9+
push:
10+
branches: [master]
11+
pull_request:
12+
# The branches below must be a subset of the branches above
13+
branches: [master]
14+
schedule:
15+
- cron: '0 19 * * 2'
16+
17+
jobs:
18+
analyze:
19+
name: Analyze
20+
runs-on: ubuntu-latest
21+
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
# Override automatic language detection by changing the below list
26+
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
27+
language: ['java', 'javascript']
28+
# Learn more...
29+
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
30+
31+
steps:
32+
- name: Checkout repository
33+
uses: actions/checkout@v2
34+
with:
35+
# We must fetch at least the immediate parents so that if this is
36+
# a pull request then we can checkout the head.
37+
fetch-depth: 2
38+
39+
# If this run was triggered by a pull request event, then checkout
40+
# the head of the pull request instead of the merge commit.
41+
- run: git checkout HEAD^2
42+
if: ${{ github.event_name == 'pull_request' }}
43+
44+
# Initializes the CodeQL tools for scanning.
45+
- name: Initialize CodeQL
46+
uses: github/codeql-action/init@v1
47+
with:
48+
languages: ${{ matrix.language }}
49+
# If you wish to specify custom queries, you can do so here or in a config file.
50+
# By default, queries listed here will override any specified in a config file.
51+
# Prefix the list here with "+" to use these queries and those in the config file.
52+
# queries: ./path/to/local/query, your-org/your-repo/queries@main
53+
54+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
55+
# If this step fails, then you should remove it and run the build manually (see below)
56+
- name: Autobuild
57+
uses: github/codeql-action/autobuild@v1
58+
59+
# ℹ️ Command-line programs to run using the OS shell.
60+
# 📚 https://git.io/JvXDl
61+
62+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
63+
# and modify them (or add more) to build your code if your project
64+
# uses a compiled language
65+
66+
#- run: |
67+
# make bootstrap
68+
# make release
69+
70+
- name: Perform CodeQL Analysis
71+
uses: github/codeql-action/analyze@v1

‎.github/workflows/fortify-analysis.yml

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
################################################################################################################################################
2+
# Fortify lets you build secure software fast with an appsec platform that automates testing throughout the DevSecOps pipeline. Fortify static,#
3+
# dynamic, interactive, and runtime security testing is available on premises or as a service. To learn more about Fortify, start a free trial #
4+
# or contact our sales team, visit microfocus.com/appsecurity. #
5+
# #
6+
# Use this workflow template as a basis for integrating Fortify on Demand Static Application Security Testing(SAST) into your GitHub workflows.#
7+
# This template demonstrates the steps to prepare the code+dependencies, initiate a scan, download results once complete and import into #
8+
# GitHub Security Code Scanning Alerts. Existing customers should review inputs and environment variables below to configure scanning against #
9+
# an existing application in your Fortify on Demand tenant. Additional information is available in the comments throughout the workflow, the #
10+
# documentation for the Fortify actions used, and the Fortify on Demand / ScanCentral Client product documentation. If you need additional #
11+
# assistance with configuration, feel free to create a help ticket in the Fortify on Demand portal. #
12+
################################################################################################################################################
13+
14+
name: Fortify on Demand Scan
15+
16+
# TODO: Customize trigger events based on your DevSecOps processes and typical FoD SAST scan time
17+
on:
18+
workflow_dispatch:
19+
push:
20+
branches: [master]
21+
pull_request:
22+
# The branches below must be a subset of the branches above
23+
branches: [master]
24+
25+
jobs:
26+
FoD-SAST-Scan:
27+
# Use the appropriate runner for building your source code.
28+
# TODO: Use a Windows runner for .NET projects that use msbuild. Additional changes to RUN commands will be required to switch to Windows syntax.
29+
runs-on: ubuntu-latest
30+
31+
steps:
32+
# Check out source code
33+
- name: Check Out Source Code
34+
uses: actions/checkout@v2
35+
with:
36+
# Fetch at least the immediate parents so that if this is a pull request then we can checkout the head.
37+
fetch-depth: 2
38+
# If this run was triggered by a pull request event, then checkout the head of the pull request instead of the merge commit.
39+
- run: git checkout HEAD^2
40+
if: ${{ github.event_name == 'pull_request' }}
41+
# Java 8 required by ScanCentral Client and FoD Uploader(Univeral CI Tool)
42+
- name: Setup Java
43+
uses: actions/setup-java@v1
44+
with:
45+
java-version: 13
46+
47+
# Prepare source+dependencies for upload. The default example is for a Maven project that uses pom.xml.
48+
# TODO: Update PACKAGE_OPTS based on the ScanCentral Client documentation for your project's included tech stack(s). Helpful hints:
49+
# ScanCentral Client will download dependencies for maven (-bt mvn) and gradle (-bt gradle).
50+
# ScanCentral Client can download dependencies for msbuild projects (-bt msbuild); however, you must convert the workflow to use a Windows runner.
51+
# ScanCentral has additional options that should be set for PHP and Python projects
52+
# For other build tools, add your build commands to download necessary dependencies and prepare according to Fortify on Demand Packaging documentation.
53+
# ScanCentral Client documentation is located at https://www.microfocus.com/documentation/fortify-software-security-center/
54+
- name: Download Fortify ScanCentral Client
55+
uses: fortify/gha-setup-scancentral-client@v1
56+
- name: Package Code + Dependencies
57+
run: scancentral package $PACKAGE_OPTS -o package.zip
58+
env:
59+
PACKAGE_OPTS: "-bt mvn"
60+
61+
# Start Fortify on Demand SAST scan and wait until results complete. For more information on FoDUploader commands, see https://github.com/fod-dev/fod-uploader-java
62+
# TODO: Update ENV variables for your application and create the necessary GitHub Secrets. Helpful hints:
63+
# Credentials and release ID should be obtained from your FoD tenant (either Personal Access Token or API Key can be used).
64+
# Automated Audit preference should be configured for the release's Static Scan Settings in the Fortify on Demand portal.
65+
- name: Download Fortify on Demand Universal CI Tool
66+
uses: fortify/gha-setup-fod-uploader@v1
67+
- name: Perform SAST Scan
68+
run: java -jar $FOD_UPLOAD_JAR -z package.zip -aurl $FOD_API_URL -purl $FOD_URL -rid "$FOD_RELEASE_ID" -tc "$FOD_TENANT" -uc "$FOD_USER" "$FOD_PAT" $FOD_UPLOADER_OPTS -n "$FOD_UPLOADER_NOTES"
69+
env:
70+
FOD_TENANT: ${{ secrets.FOD_TENANT }}
71+
FOD_USER: ${{ secrets.FOD_USER }}
72+
FOD_PAT: ${{ secrets.FOD_PAT }}
73+
FOD_RELEASE_ID: ${{ secrets.FOD_RELEASE_ID }}
74+
FOD_URL: "https://ams.fortify.com/"
75+
FOD_API_URL: "https://api.ams.fortify.com/"
76+
FOD_UPLOADER_OPTS: "-ep 2 -pp 0 -I 1 -apf"
77+
FOD_UPLOADER_NOTES: 'Triggered by GitHub Actions (${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})'
78+
79+
# Once scan completes, pull SAST issues from Fortify on Demand and generate SARIF output.
80+
# TODO: Review Action inputs. For most users, these will be the same as used in the Perform SAST Scan step.
81+
- name: Download Results
82+
uses: fortify/gha-fod-generate-sarif@1.1.0
83+
with:
84+
base-url: https://ams.fortify.com
85+
tenant: ${{ secrets.FOD_TENANT }}
86+
user: ${{ secrets.FOD_USER }}
87+
password: ${{ secrets.FOD_PAT }}
88+
release-id: ${{ secrets.FOD_RELEASE_ID }}
89+
output: ./sarif/output.sarif
90+
91+
# Import Fortify on Demand results to GitHub Security Code Scanning
92+
- name: Import Results
93+
uses: github/codeql-action/upload-sarif@v1
94+
with:
95+
sarif_file: ./sarif/output.sarif

‎.github/workflows/ossar-analysis.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# This workflow integrates a collection of open source static analysis tools
2+
# with GitHub code scanning. For documentation, or to provide feedback, visit
3+
# https://github.com/github/ossar-action
4+
name: OSSAR
5+
6+
on:
7+
push:
8+
branches: [ master ]
9+
pull_request:
10+
branches: [ master ]
11+
12+
jobs:
13+
OSSAR-Scan:
14+
# OSSAR runs on windows-latest.
15+
# ubuntu-latest and macos-latest support coming soon
16+
runs-on: windows-latest
17+
18+
steps:
19+
# Checkout your code repository to scan
20+
- name: Checkout repository
21+
uses: actions/checkout@v2
22+
with:
23+
# We must fetch at least the immediate parents so that if this is
24+
# a pull request then we can checkout the head.
25+
fetch-depth: 2
26+
27+
# If this run was triggered by a pull request event, then checkout
28+
# the head of the pull request instead of the merge commit.
29+
- run: git checkout HEAD^2
30+
if: ${{ github.event_name == 'pull_request' }}
31+
32+
# Ensure a compatible version of dotnet is installed.
33+
# The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201.
34+
# A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action.
35+
# GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped.
36+
# For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action:
37+
# - name: Install .NET
38+
# uses: actions/setup-dotnet@v1
39+
# with:
40+
# dotnet-version: '3.1.x'
41+
42+
# Run open source static analysis tools
43+
- name: Run OSSAR
44+
uses: github/ossar-action@v1
45+
id: ossar
46+
47+
# Upload results to the Security tab
48+
- name: Upload OSSAR results
49+
uses: github/codeql-action/upload-sarif@v1
50+
with:
51+
sarif_file: ${{ steps.ossar.outputs.sarifFile }}

‎.github/workflows/veracode-analysis.yml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert
2+
3+
name: Veracode Static Analysis Pipeline Scan
4+
5+
# Controls when the action will run. Triggers the workflow on push or pull request
6+
# events but only for the master branch
7+
on:
8+
push:
9+
branches: [ master ]
10+
pull_request:
11+
branches: [ master ]
12+
13+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
14+
jobs:
15+
# This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
16+
build-and-pipeline-scan:
17+
# The type of runner that the job will run on
18+
runs-on: ubuntu-latest
19+
steps:
20+
21+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps
22+
- uses: actions/checkout@v2
23+
with:
24+
repository: ''
25+
26+
- uses: papeloto/action-zip@v1
27+
with:
28+
files: /
29+
recursive: true
30+
dest: veracode-pipeline-scan-results-to-sarif.zip
31+
32+
- uses: actions/upload-artifact@v1
33+
with:
34+
name: my-artifact
35+
path: veracode-pipeline-scan-results-to-sarif.zip
36+
37+
# download the Veracode Static Analysis Pipeline scan jar
38+
- uses: wei/curl@master
39+
with:
40+
args: -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
41+
- run: unzip -o pipeline-scan-LATEST.zip
42+
43+
- uses: actions/setup-java@v1
44+
with:
45+
java-version: 13
46+
- run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-pipeline-scan-results-to-sarif.zip
47+
continue-on-error: true
48+
- uses: actions/upload-artifact@v1
49+
with:
50+
name: ScanResults
51+
path: results.json
52+
- name: Convert pipeline scan output to SARIF format
53+
id: convert
54+
uses: veracode/veracode-pipeline-scan-results-to-sarif@master
55+
with:
56+
pipeline-results-json: results.json
57+
- uses: github/codeql-action/upload-sarif@v1
58+
with:
59+
# Path to SARIF file relative to the root of the repository
60+
sarif_file: veracode-results.sarif

‎.idea/compiler.xml

Lines changed: 0 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.idea/modules.xml

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎SECURITY.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
These versions of the project are currently being supported with security updates.
6+
7+
| Version | Supported |
8+
| -------- | ------------------ |
9+
| 2.3.x | :white_check_mark: |
10+
| < 2.3.25 | :x: |
11+
12+
## Reporting a Vulnerability
13+
14+
Use this section to tell people how to report a vulnerability.
15+
16+
Tell them where to go, how often they can expect to get an update on a
17+
reported vulnerability, what to expect if the vulnerability is accepted or
18+
declined, etc.

‎build.sh

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,15 @@ function composeDown() {
1212

1313
function firstSetup() {
1414
export JAVA_OPTS=$JAVA_OPTS_RUN_DEFAULT
15-
showSettings
15+
# showSettings
1616
./mvnw dependency:purge-local-repository
1717
./mvnw -e -DskipTests=true clean dependency:resolve dependency:resolve-plugins dependency:sources dependency:tree
1818
./mvnw -e -DskipTests=true clean package spring-boot:repackage site
1919
}
2020

2121
function setupTravis() {
2222
export JAVA_OPTS=$JAVA_OPTS_RUN_DEFAULT
23-
showSettings
23+
# showSettings
2424
./mvnw -e -DskipTests=true -B -V install -Dmaven.javadoc.skip=true && \
2525
./mvnw -e -DskipTests=true -B -V dependency:purge-local-repository && \
2626
./mvnw -e -DskipTests=true -B -V clean && \
@@ -31,8 +31,8 @@ function setupTravis() {
3131
}
3232

3333
function main() {
34-
# firstSetup
35-
setupTravis
34+
firstSetup
35+
# setupTravis
3636
}
3737

3838
main

0 commit comments

Comments
 (0)