PUB-1619 - Added fortify

Jenkinsfile_nightly

@@ -11,4 +11,10 @@ def type = "java"
 def product = "rpe"
 def component = "spring-boot-template"
 
-withNightlyPipeline(type, product, component) {}
+withNightlyPipeline(type, product, component) {
+  enableFortifyScan('pip-ss-kv-stg')
+
+  after('fortify-scan') {
+    steps.archiveArtifacts allowEmptyArchive: true, artifacts: '**/Fortify Scan/**/*'
+  }
+}

README.md

@@ -10,6 +10,7 @@
   - [Installation](#installation)
     - [Publishing the library](#publishing-the-library)
     - [Importing the library](#importing-the-library)
+  - [Fortify](#fortify)
 - [Test Suite](#test-suite)
   - [Unit tests](#unit-tests)
 - [Contributing](#contributing)
@@ -59,6 +60,10 @@ The library can be imported into other projects by using
 
 in your build.gradle file
 
+### Fortify
+
+We use Fortify to scan for security vulnerabilities. This is run as part of our nightly pipelines.
+
 ## Test Suite
 
 This library is comprehensively tested using a suite of unit tests.

build.gradle

@@ -118,6 +118,7 @@ repositories {
   mavenLocal()
   mavenCentral()
   jcenter()
+  maven { url 'https://jitpack.io' }
 }
 
 def versions = [
@@ -150,6 +151,13 @@ dependencies {
     exclude group: 'junit', module: 'junit'
     exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
   }
+  testImplementation group: 'com.github.hmcts', name: 'fortify-client', version: '1.4.0', classifier: 'all'
+}
+
+task fortifyScan(type: JavaExec)  {
+  main = "uk.gov.hmcts.fortifyclient.FortifyClientMainApp"
+  classpath += sourceSets.test.runtimeClasspath
+  jvmArgs = ['--add-opens=java.base/java.lang.reflect=ALL-UNNAMED']
 }
 
 wrapper {

config/fortify-client.properties

@@ -0,0 +1 @@
+fortify.client.releaseId=135326