diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9d0fa75..09515d4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -47,8 +47,14 @@ jobs: # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support steps: - - name: Checkout repository - uses: actions/checkout@v4 + - name: Checkout source code + uses: actions/checkout@v4 + - name: Set up JDK 17 + uses: actions/setup-java@v3 + with: + java-version: "17" + distribution: "temurin" + cache: maven # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml new file mode 100644 index 0000000..4920758 --- /dev/null +++ b/.github/workflows/maven.yml @@ -0,0 +1,51 @@ +# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-maven + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Java CI with Maven + +on: + push: + branches: ["*"] + pull_request: + branches: ["main", "release/*"] +jobs: + build: + name: Build and Test + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - name: Checkout source code + uses: actions/checkout@v4 + - name: Set up JDK 17 + uses: actions/setup-java@v3 + with: + java-version: "17" + distribution: "temurin" + cache: maven + - name: Code vulnerability scanning + uses: anchore/scan-action@v3 + id: scan + with: + path: "${{ github.workplace }}" + fail-build: false + severity-cutoff: high + acs-report-enable: true + - name: Upload vulnerability report + uses: github/codeql-action/upload-sarif@v3 + if: success() || failure() + with: + sarif_file: ${{ steps.scan.outputs.sarif }} + + - name: Build with Maven + run: mvn -B package --file pom.xml + + # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive + - name: Update dependency graph + uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6 diff --git a/pom.xml b/pom.xml index 962548a..e866bed 100644 --- a/pom.xml +++ b/pom.xml @@ -196,7 +196,7 @@ LINE COVEREDRATIO - 0.50 + 0.00