Skip to content

Commit 5b39c22

Browse files
rmkandarmkanda
committed
Initial commit
0 parents  commit 5b39c22

File tree

14 files changed

+953
-0
lines changed

14 files changed

+953
-0
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Secure Pipeline Demo - Java
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
9+
jobs:
10+
build:
11+
name: Build
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v2
15+
- name: Set up JDK 11 (LTS)
16+
uses: actions/setup-java@v1
17+
with:
18+
java-version: 11
19+
architecture: x64
20+
- name: Restore Maven cache
21+
uses: actions/cache@v2
22+
with:
23+
path: ~/.m2
24+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
25+
restore-keys: ${{ runner.os }}-m2
26+
- run: java --version && mvn --version
27+
- name: Build project with Maven
28+
run: mvn -B clean package
29+
- name: Publish Artefact
30+
uses: actions/upload-artifact@v1
31+
with:
32+
name: Application Jar
33+
path: target/demo-0.0.1-SNAPSHOT.jar
34+
oss-scan:
35+
name: OSS Scan
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: actions/checkout@master
39+
- name: Run Snyk to check for vulnerabilities
40+
uses: snyk/actions/maven-3-jdk-11@master
41+
continue-on-error: true
42+
env:
43+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
44+
with:
45+
args: --severity-threshold=high

‎.gitignore‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Compiled class file
2+
*.class
3+
4+
# Log file
5+
*.log
6+
7+
# BlueJ files
8+
*.ctxt
9+
10+
# Mobile Tools for Java (J2ME)
11+
.mtj.tmp/
12+
13+
# Package Files #
14+
*.jar
15+
*.war
16+
*.nar
17+
*.ear
18+
*.zip
19+
*.tar.gz
20+
*.rar
21+
22+
# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
23+
hs_err_pid*
24+
25+
# Exclude output
26+
target/
27+
**/.DS_Store

‎.mvn/wrapper/MavenWrapperDownloader.java‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
/*
2+
* Copyright 2007-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
import java.net.*;
17+
import java.io.*;
18+
import java.nio.channels.*;
19+
import java.util.Properties;
20+
21+
public class MavenWrapperDownloader {
22+
23+
private static final String WRAPPER_VERSION = "0.5.6";
24+
/**
25+
* Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided.
26+
*/
27+
private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/"
28+
+ WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar";
29+
30+
/**
31+
* Path to the maven-wrapper.properties file, which might contain a downloadUrl property to
32+
* use instead of the default one.
33+
*/
34+
private static final String MAVEN_WRAPPER_PROPERTIES_PATH =
35+
".mvn/wrapper/maven-wrapper.properties";
36+
37+
/**
38+
* Path where the maven-wrapper.jar will be saved to.
39+
*/
40+
private static final String MAVEN_WRAPPER_JAR_PATH =
41+
".mvn/wrapper/maven-wrapper.jar";
42+
43+
/**
44+
* Name of the property which should be used to override the default download url for the wrapper.
45+
*/
46+
private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl";
47+
48+
public static void main(String args[]) {
49+
System.out.println("- Downloader started");
50+
File baseDirectory = new File(args[0]);
51+
System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath());
52+
53+
// If the maven-wrapper.properties exists, read it and check if it contains a custom
54+
// wrapperUrl parameter.
55+
File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH);
56+
String url = DEFAULT_DOWNLOAD_URL;
57+
if(mavenWrapperPropertyFile.exists()) {
58+
FileInputStream mavenWrapperPropertyFileInputStream = null;
59+
try {
60+
mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile);
61+
Properties mavenWrapperProperties = new Properties();
62+
mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream);
63+
url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url);
64+
} catch (IOException e) {
65+
System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'");
66+
} finally {
67+
try {
68+
if(mavenWrapperPropertyFileInputStream != null) {
69+
mavenWrapperPropertyFileInputStream.close();
70+
}
71+
} catch (IOException e) {
72+
// Ignore ...
73+
}
74+
}
75+
}
76+
System.out.println("- Downloading from: " + url);
77+
78+
File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH);
79+
if(!outputFile.getParentFile().exists()) {
80+
if(!outputFile.getParentFile().mkdirs()) {
81+
System.out.println(
82+
"- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'");
83+
}
84+
}
85+
System.out.println("- Downloading to: " + outputFile.getAbsolutePath());
86+
try {
87+
downloadFileFromURL(url, outputFile);
88+
System.out.println("Done");
89+
System.exit(0);
90+
} catch (Throwable e) {
91+
System.out.println("- Error downloading");
92+
e.printStackTrace();
93+
System.exit(1);
94+
}
95+
}
96+
97+
private static void downloadFileFromURL(String urlString, File destination) throws Exception {
98+
if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) {
99+
String username = System.getenv("MVNW_USERNAME");
100+
char[] password = System.getenv("MVNW_PASSWORD").toCharArray();
101+
Authenticator.setDefault(new Authenticator() {
102+
@Override
103+
protected PasswordAuthentication getPasswordAuthentication() {
104+
return new PasswordAuthentication(username, password);
105+
}
106+
});
107+
}
108+
URL website = new URL(urlString);
109+
ReadableByteChannel rbc;
110+
rbc = Channels.newChannel(website.openStream());
111+
FileOutputStream fos = new FileOutputStream(destination);
112+
fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
113+
fos.close();
114+
rbc.close();
115+
}
116+
117+
}

‎.mvn/wrapper/maven-wrapper.properties‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip
2+
wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar

‎HELP.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Getting Started
2+
3+
### Reference Documentation
4+
For further reference, please consider the following sections:
5+
6+
* [Official Apache Maven documentation](https://maven.apache.org/guides/index.html)
7+
* [Spring Boot Maven Plugin Reference Guide](https://docs.spring.io/spring-boot/docs/2.3.0.RELEASE/maven-plugin/reference/html/)
8+
* [Create an OCI image](https://docs.spring.io/spring-boot/docs/2.3.0.RELEASE/maven-plugin/reference/html/#build-image)
9+
* [Rest Repositories](https://docs.spring.io/spring-boot/docs/2.3.0.RELEASE/reference/htmlsingle/#howto-use-exposing-spring-data-repositories-rest-endpoint)
10+
11+
### Guides
12+
The following guides illustrate how to use some features concretely:
13+
14+
* [Accessing JPA Data with REST](https://spring.io/guides/gs/accessing-data-rest/)
15+
* [Accessing Neo4j Data with REST](https://spring.io/guides/gs/accessing-neo4j-data-rest/)
16+
* [Accessing MongoDB Data with REST](https://spring.io/guides/gs/accessing-mongodb-data-rest/)
17+

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 Ramakrishnan Kandasamy
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# [Java] [GitHub Actions] Secure Pipelines Demo
2+
3+
[![Secure Pipeline Demo - Java](https://github.com/rmkanda/gh-actions-secure-pipeline-java-demo/actions/workflows/build.yaml/badge.svg)](https://github.com/rmkanda/gh-actions-secure-pipeline-java-demo/actions/workflows/build.yaml)
4+
5+
Sample Secure Pipeline with GithHub Actions - Ideal for Open Source Projects
6+
7+
## Setup
8+
9+
- Add SNYK API Token in GitHub Repositority Secrets
10+
11+
## Tools Used
12+
13+
| Stage | Tool | Comments | Open Source Alternative |
14+
| ------------------ | --------------------------------------------------- | -------- | ----------------------- |
15+
| Secrets Scanner | [truffleHog](https://github.com/dxa4481/truffleHog) | | |
16+
| Dependency Checker | [snyk](https://snyk.io/) | | |
17+
| | | | |

‎doc/dependency_decisions.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
- - :permit
3+
- MIT
4+
- :who:
5+
:why:
6+
:versions: []
7+
:when: 2020-05-31 15:26:41.128239000 Z
8+
- - :permit
9+
- Apache 2.0
10+
- :who:
11+
:why:
12+
:versions: []
13+
:when: 2020-05-31 15:26:45.261798000 Z
14+
- - :permit
15+
- BSD
16+
- :who:
17+
:why:
18+
:versions: []
19+
:when: 2020-05-31 15:26:48.756587000 Z
20+
- - :permit
21+
- BSD License 3
22+
- :who:
23+
:why:
24+
:versions: []
25+
:when: 2020-05-31 15:27:11.706253000 Z
26+
- - :permit
27+
- EDL 1.0
28+
- :who:
29+
:why:
30+
:versions: []
31+
:when: 2020-05-31 15:27:21.894141000 Z
32+
- - :permit
33+
- Eclipse Public License v2.0
34+
- :who:
35+
:why:
36+
:versions: []
37+
:when: 2020-05-31 15:27:29.688403000 Z
38+
- - :approve
39+
- logback-core
40+
- :who:
41+
:why:
42+
:versions:
43+
- 1.2.3
44+
:when: 2020-05-31 15:28:30.302764000 Z
45+
- - :approve
46+
- logback-classic
47+
- :who:
48+
:why:
49+
:versions:
50+
- 1.2.3
51+
:when: 2020-05-31 15:29:03.621478000 Z
52+
- - :approve
53+
- jakarta.xml.bind-api
54+
- :who:
55+
:why:
56+
:versions:
57+
- 2.3.3
58+
:when: 2020-05-31 15:29:19.300525000 Z
59+
- - :approve
60+
- jakarta.el
61+
- :who:
62+
:why:
63+
:versions:
64+
- 3.0.3
65+
:when: 2020-05-31 15:29:37.769070000 Z
66+
- - :approve
67+
- jakarta.annotation-api
68+
- :who:
69+
:why:
70+
:versions:
71+
- 1.3.5
72+
:when: 2020-05-31 15:29:53.045616000 Z

0 commit comments

Comments
 (0)