Add comprehensive security scanning workflows for Java #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "CodeQL Security Analysis" | |
| on: | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| schedule: | |
| # Run CodeQL analysis weekly on Mondays at 2 AM UTC | |
| - cron: '0 2 * * 1' | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| analyze: | |
| name: Analyze | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 360 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'java' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Override default queries to include security-extended for more comprehensive analysis | |
| queries: security-extended,security-and-quality | |
| - name: Set up JDK 11 | |
| uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0 | |
| with: | |
| java-version: '11' | |
| distribution: 'temurin' | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0 | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| upload: false # Don't upload to avoid conflict with default setup | |
| - name: Upload CodeQL results manually | |
| uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10 | |
| if: always() | |
| with: | |
| sarif_file: /home/runner/work/aws-xray-sdk-java/results/java.sarif | |
| category: 'custom-codeql-analysis' | |
| dependency-scan: | |
| name: Java Dependency Scan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Set up JDK 11 | |
| uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0 | |
| with: | |
| java-version: '11' | |
| distribution: 'temurin' | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0 | |
| - name: Run OWASP Dependency Check | |
| continue-on-error: true | |
| run: | | |
| # Download and run OWASP Dependency Check | |
| curl -L -o dependency-check-11.1.0-release.zip https://github.com/jeremylong/DependencyCheck/releases/download/v11.1.0/dependency-check-11.1.0-release.zip | |
| unzip -q dependency-check-11.1.0-release.zip | |
| ./dependency-check/bin/dependency-check.sh \ | |
| --project "aws-xray-sdk-java" \ | |
| --scan . \ | |
| --format SARIF \ | |
| --out dependency-check-results.sarif \ | |
| --suppression dependency-check-suppressions.xml \ | |
| --failOnCVSS 7 \ | |
| --enableRetired || echo "Dependency check completed" | |
| - name: Upload OWASP Dependency Check results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10 | |
| if: always() | |
| with: | |
| sarif_file: dependency-check-results.sarif | |
| category: 'dependency-check' | |
| - name: Run Gradle dependency vulnerability check | |
| run: | | |
| # Use Gradle's built-in dependency insight | |
| ./gradlew dependencyInsight --dependency org.apache.logging.log4j || true | |
| ./gradlew dependencies --configuration runtimeClasspath > gradle-dependencies.txt | |
| - name: Upload dependency report | |
| uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0 | |
| if: always() | |
| with: | |
| name: dependency-reports | |
| path: | | |
| dependency-check-results.sarif | |
| gradle-dependencies.txt | |
| security-scan: | |
| name: Java Security Scan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Set up JDK 11 | |
| uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0 | |
| with: | |
| java-version: '11' | |
| distribution: 'temurin' | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0 | |
| - name: Run SpotBugs security analysis | |
| continue-on-error: true | |
| run: | | |
| # Build the project first (skip tests for faster execution) | |
| ./gradlew build -x test --no-daemon || echo "Build completed with warnings" | |
| # Download SpotBugs with security plugin | |
| curl -L -o spotbugs-4.8.6.tgz https://github.com/spotbugs/spotbugs/releases/download/4.8.6/spotbugs-4.8.6.tgz | |
| tar -xzf spotbugs-4.8.6.tgz | |
| # Download security plugin | |
| curl -L -o findsecbugs-plugin-1.13.0.jar https://github.com/find-sec-bugs/find-sec-bugs/releases/download/version-1.13.0/findsecbugs-plugin-1.13.0.jar | |
| # Initialize empty SARIF file | |
| echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","runs":[{"tool":{"driver":{"name":"SpotBugs","version":"4.8.6"}},"results":[]}]}' > spotbugs-results.sarif | |
| # Find and scan JAR files | |
| JAR_COUNT=0 | |
| find . -name "*.jar" -path "*/build/libs/*" -not -path "*/test*" | head -5 | while read jar; do | |
| if [ -f "$jar" ]; then | |
| echo "Scanning $jar" | |
| JAR_COUNT=$((JAR_COUNT + 1)) | |
| ./spotbugs-4.8.6/bin/spotbugs -textui -effort:max -low -sarif \ | |
| -pluginList findsecbugs-plugin-1.13.0.jar \ | |
| -output "spotbugs-${JAR_COUNT}.sarif" \ | |
| "$jar" || echo "SpotBugs scan completed for $jar" | |
| fi | |
| done | |
| # Merge SARIF files if any were created | |
| if ls spotbugs-*.sarif 1> /dev/null 2>&1; then | |
| # Simple merge - just use the first one for now | |
| cp spotbugs-1.sarif spotbugs-results.sarif 2>/dev/null || echo "Using empty SARIF" | |
| fi | |
| echo "SpotBugs analysis completed" | |
| - name: Upload SpotBugs results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10 | |
| if: always() && hashFiles('spotbugs-results.sarif') != '' | |
| with: | |
| sarif_file: spotbugs-results.sarif | |
| category: 'spotbugs-security' |