diff --git a/.github/workflows/shiftleft.yml b/.github/workflows/shiftleft.yml
new file mode 100644
index 000000000..b48bc6213
--- /dev/null
+++ b/.github/workflows/shiftleft.yml
@@ -0,0 +1,59 @@
+---
+# This workflow integrates ShiftLeft NG SAST with GitHub
+# Visit https://docs.shiftleft.io for help
+name: ShiftLeft
+
+on:
+ pull_request:
+ workflow_dispatch:
+
+jobs:
+ NextGen-Static-Analysis:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v2
+ # We are building this application with Java 11
+ - name: Setup Java JDK
+ uses: actions/setup-java@v1.4.3
+ with:
+ java-version: 11.0.x
+ - name: Package with maven
+ run: mvn compile package
+ - name: Download ShiftLeft CLI
+ run: |
+ curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
+ # ShiftLeft requires Java 1.8. Post the package step override the version
+ - name: Setup Java JDK
+ uses: actions/setup-java@v1.4.3
+ with:
+ java-version: 1.8
+ - name: Extract branch name
+ shell: bash
+ run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
+ id: extract_branch
+ - name: NextGen Static Analysis
+ run: ${GITHUB_WORKSPACE}/sl analyze --wait --app shiftleft-java-l4 --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --vcs-prefix-correction "io/shiftleft=src/main/java/" --java --cpg target/hello-shiftleft-0.0.1.jar
+ env:
+ SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
+
+ Build-Rules:
+ runs-on: ubuntu-latest
+ needs: NextGen-Static-Analysis
+ steps:
+ - uses: actions/checkout@v2
+ - name: Download ShiftLeft CLI
+ run: |
+ curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
+ - name: Validate Build Rules
+ run: |
+ ${GITHUB_WORKSPACE}/sl check-analysis --app shiftleft-java-demo \
+ --branch "${{ github.head_ref || steps.extract_branch.outputs.branch }}" \
+ --report \
+ --github-pr-number=${{github.event.number}} \
+ --github-pr-user=${{ github.repository_owner }} \
+ --github-pr-repo=${{ github.event.repository.name }} \
+ --github-token=${{ secrets.GITHUB_TOKEN }}
+ env:
+ SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
+
+
diff --git a/azure-pipelines-1.yml b/azure-pipelines-1.yml
new file mode 100644
index 000000000..34edff52a
--- /dev/null
+++ b/azure-pipelines-1.yml
@@ -0,0 +1,22 @@
+# Maven
+# Build your Java project and run tests with Apache Maven.
+# Add steps that analyze code, save build artifacts, deploy, and more:
+# https://docs.microsoft.com/azure/devops/pipelines/languages/java
+
+trigger:
+- master
+
+pool:
+ vmImage: ubuntu-latest
+
+steps:
+- task: Maven@3
+ inputs:
+ mavenPomFile: 'pom.xml'
+ mavenOptions: '-Xmx3072m'
+ javaHomeOption: 'JDKVersion'
+ jdkVersionOption: '1.8'
+ jdkArchitectureOption: 'x64'
+ publishJUnitResults: true
+ testResultsFiles: '**/surefire-reports/TEST-*.xml'
+ goals: 'package'
diff --git a/pom.xml b/pom.xml
index eb17410c8..1cce22ff0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -31,6 +31,11 @@
jasypt
1.9.2
+
+ org.apache.logging.log4j
+ log4j-api
+ 2.14.0
+
com.github.ulisesbocchio
jasypt-spring-boot-starter
diff --git a/shiftleft.yml b/shiftleft.yml
new file mode 100644
index 000000000..941a13288
--- /dev/null
+++ b/shiftleft.yml
@@ -0,0 +1,17 @@
+build_rules:
+ - id: allow-zero-findings
+ finding_types:
+ - vuln
+ - secret
+ - insight
+ - "*"
+ severity:
+ - SEVERITY_MEDIUM_IMPACT
+ - SEVERITY_HIGH_IMPACT
+ - SEVERITY_LOW_IMPACT
+ threshold: 0
+ - id: reachable-oss-vuln
+ finding_types: [oss_vuln]
+ options:
+ reachable: true
+ num_findings: 10
diff --git a/src/main/java/io/shiftleft/controller/CustomerController.java b/src/main/java/io/shiftleft/controller/CustomerController.java
index 40e1c4917..4aa577de6 100644
--- a/src/main/java/io/shiftleft/controller/CustomerController.java
+++ b/src/main/java/io/shiftleft/controller/CustomerController.java
@@ -123,7 +123,8 @@ public Customer getCustomer(@PathVariable("customerId") Long customerId) {
}
Account account = new Account(4242l,1234, "savings", 1, 0);
- log.info("Account Data is {}", account);
+ //FOR DEBUGGING ONLY
+ //log.info("Account Data is {}", account);
log.info("Customer Data is {}", customer);
try {