Skip to content

Commit cd89fc2

Browse files
abirismynameabirismyname
committed
Initial commit
0 parents  commit cd89fc2

9 files changed

Lines changed: 207 additions & 0 deletions

File tree

‎.gitattributes‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Auto detect text files and perform LF normalization
2+
* text=auto

‎.github/pull_request_template.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<!--
2+
IMPORTANT:
3+
4+
This repository contains configuration for what users see when they click on the `Actions` tab and the setup page for Code Scanning.
5+
6+
It is not:
7+
* A playground to try out scripts
8+
* A place for you to create a workflow for your repository
9+
-->
10+
11+
## Pre-requisites
12+
13+
- [ ] Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: [partner.github.com/apply](https://partner.github.com/apply?partnershipType=Technology+Partner).
14+
15+
---
16+
17+
### **Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.**
18+
19+
---
20+
21+
## Tasks
22+
23+
**For _all_ workflows, the workflow:**
24+
25+
- [ ] Should be contained in a `.yml` file with the language or platform as its filename, in lower, [_kebab-cased_](https://en.wikipedia.org/wiki/Kebab_case) format (for example, [`docker-image.yml`](https://github.com/actions/starter-workflows/blob/main/ci/docker-image.yml)). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
26+
- [ ] Should use sentence case for the names of workflows and steps (for example, "Run tests").
27+
- [ ] Should be named _only_ by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
28+
- [ ] Should include comments in the workflow for any parts that are not obvious or could use clarification.
29+
30+
**For _CI_ workflows, the workflow:**
31+
32+
- [ ] Should be preserved under [the `ci` directory](https://github.com/actions/starter-workflows/tree/main/ci).
33+
- [ ] Should include a matching `ci/properties/*.properties.json` file (for example, [`ci/properties/docker-publish.properties.json`](https://github.com/actions/starter-workflows/blob/main/ci/properties/docker-publish.properties.json)).
34+
- [ ] Should run on `push` to `branches: [ $default-branch ]` and `pull_request` to `branches: [ $default-branch ]`.
35+
- [ ] Packaging workflows should run on `release` with `types: [ created ]`.
36+
- [ ] Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, [`docker-publish.yml`](https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml)).
37+
38+
**For _Code Scanning_ workflows, the workflow:**
39+
40+
- [ ] Should be preserved under [the `code-scanning` directory](https://github.com/actions/starter-workflows/tree/main/ci).
41+
- [ ] Should include a matching `code-scanning/properties/*.properties.json` file (for example, [`code-scanning/properties/codeql.properties.json`](https://github.com/actions/starter-workflows/blob/main/code-scanning/properties/codeql.properties.json)), with properties set as follows:
42+
- [ ] `name`: Name of the Code Scanning integration.
43+
- [ ] `organization`: Name of the organization producing the Code Scanning integration.
44+
- [ ] `description`: Short description of the Code Scanning integration.
45+
- [ ] `categories`: Array of languages supported by the Code Scanning integration.
46+
- [ ] `iconName`: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in [the `icons` directory](https://github.com/actions/starter-workflows/tree/main/icons).
47+
- [ ] Should run on `push` to `branches: [ $default-branch, $protected-branches ]` and `pull_request` to `branches: [ $default-branch ]`. We also recommend a `schedule` trigger of `cron: $cron-weekly` (for example, [`codeql.yml`](https://github.com/actions/starter-workflows/blob/c59b62dee0eae1f9f368b7011cf05c2fc42cf084/code-scanning/codeql.yml#L14-L21)).
48+
49+
**Some general notes:**
50+
51+
- [ ] This workflow must _only_ use actions that are produced by GitHub, [in the `actions` organization](https://github.com/actions), **or**
52+
- [ ] This workflow must _only_ use actions that are produced by the language or ecosystem that the workflow supports. These actions must be [published to the GitHub Marketplace](https://github.com/marketplace?type=actions). We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:
53+
```
54+
# This workflow uses actions that are not certified by GitHub.
55+
# They are provided by a third-party and are governed by
56+
# separate terms of service, privacy policy, and support
57+
# documentation.
58+
```
59+
- [ ] Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
60+
- [ ] Automation and CI workflows cannot be dependent on a paid service or product.

‎.github/workflows/HelloWorld.jar‎

807 Bytes
Binary file not shown.

‎.github/workflows/test.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Code Analysis (SpotBugs)
2+
3+
on:
4+
pull_request:
5+
push:
6+
workflow_dispatch:
7+
jobs:
8+
spotbugs-analyze:
9+
name: Analyze
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout code
13+
uses: actions/checkout@v2
14+
- name: Run SpotBugs
15+
uses: abirismyname/spotbugs-github-action@main
16+
with:
17+
arguments: '-sarif'
18+
target: './.github/workflows/HelloWorld.jar'
19+
output: 'results.sarif'
20+
spotbugs-version: 'latest'
21+
- name: Show results.sarif
22+
run: jq . results.sarif

‎.gitignore‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Compiled class file
2+
*.class
3+
4+
# Log file
5+
*.log
6+
7+
# BlueJ files
8+
*.ctxt
9+
10+
# Mobile Tools for Java (J2ME)
11+
.mtj.tmp/
12+
13+
# Package Files #
14+
*.war
15+
*.nar
16+
*.ear
17+
*.zip
18+
*.tar.gz
19+
*.rar
20+
21+
# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
22+
hs_err_pid*
23+
spotbugs-*
24+
results.sarif
25+
.DS_STORE

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 Abir Majumdar
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# SpotBugs GitHub Action
2+
3+
Run [SpotBugs](https://spotbugs.readthedocs.io/en/latest/) as a Github action.
4+
5+
```yaml
6+
name: SpotBugs
7+
8+
on: [push, pull_request]
9+
10+
jobs:
11+
spotbugs-analyze:
12+
name: Analyze
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v2
17+
18+
- name: Run SpotBugs
19+
uses: spotbugs/spotbugs-github-action@v1
20+
with:
21+
arguments: '-sarif'
22+
target: './HelloWorld.jar'
23+
output: 'results.sarif'
24+
spotbugs-version: 'latest'
25+
26+
- name: Upload analysis results to GitHub Security tab
27+
uses: github/codeql-action/upload-sarif@v1
28+
with:
29+
sarif_file: ${{github.workspace}}/results.sarif
30+
```

‎action.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: 'SpotBugs GitHub Action'
2+
description: 'Runs SpotBugs Static Analysis Tool for Java - https://spotbugs.github.io/'
3+
branding:
4+
icon: 'check'
5+
color: 'blue'
6+
inputs:
7+
spotbugs-version:
8+
description: 'SpotBugs version to use.'
9+
default: 'latest'
10+
required: false
11+
arguments:
12+
description: 'Command arguments to be sent to SpotBugs'
13+
required: true
14+
default: ''
15+
output:
16+
description: 'Output file name'
17+
required: true
18+
target:
19+
description: 'Target of what you want to analyze'
20+
required: true
21+
runs:
22+
using: "composite"
23+
steps:
24+
- id: spotbot-analysis
25+
run: ${{ github.action_path }}/analyze.sh
26+
shell: bash
27+
env:
28+
SPOTBUGS_VERSION: ${{ inputs.spotbugs-version }}
29+
OUTPUT: ${{ inputs.output }}
30+
ARGUMENTS: ${{ inputs.arguments }}
31+
TARGET: ${{ inputs.target }}

‎analyze.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
3+
# Check whether to use latest version of PMD
4+
if [ "$SPOTBUGS_VERSION" == 'latest' ]; then
5+
LATEST_TAG="$(curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/spotbugs/spotbugs/releases/latest | jq --raw-output '.tag_name')"
6+
SPOTBUGS_VERSION=$LATEST_TAG
7+
fi
8+
9+
# Download SpotBugs
10+
wget https://github.com/spotbugs/spotbugs/releases/download/"${SPOTBUGS_VERSION}"/spotbugs-"${SPOTBUGS_VERSION}".zip
11+
unzip spotbugs-"${SPOTBUGS_VERSION}".zip
12+
13+
# Run SpotBugs
14+
SPOTBUGS_HOME=spotbugs-"${SPOTBUGS_VERSION}"
15+
SPOTBUGS=${SPOTBUGS_HOME}/bin/spotbugs
16+
sh $SPOTBUGS -textui -output "${OUTPUT}" "${ARGUMENTS}" "${TARGET}"

0 commit comments

Comments
 (0)