devsecops.yml

name: Build and Test Java App with Security Scans

on:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    name: Build and Test Java Application
    environment: Staging
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Set up JDK 11
        uses: actions/setup-java@v2
        with:
          java-version: '11'
          distribution: 'temurin'
          cache: maven

      - name: Build with Maven
        run: |
          mvn -B verify sonar:sonar \
            -Dsonar.projectKey=samplejavaapp \
            -Dsonar.organization=samplejavaapp \
            -Dsonar.host.url=https://sonarcloud.io \
            -Dsonar.login=$SONAR_TOKEN
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  # TruffleHog-Secret-Scan:
  #   runs-on: ubuntu-latest
  #   steps:
  #     - name: Checkout code
  #       uses: actions/checkout@v3
  #       with:
  #         fetch-depth: 0
  #     - name: TruffleHog
  #       uses: trufflesecurity/trufflehog@main
  #       with:
  #         path: ./
  #         base: development # ${{ github.event.repository.default_branch }}
  #         head: HEAD
  #         extra_args: --debug #--only-verified

  dependency-check:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '16'
      - name: Install npm dependencies
        run: npm install
      - name: Depcheck
        uses: dependency-check/Dependency-Check_Action@main
        id: Depcheck
        with:
          project: '${{ github.event.repository.name }}_${{ github.ref_name }}'
          path: '.'
          format: 'HTML'
          out: 'reports'
          args: >
              --failOnCVSS 7
              --enableRetired
      - name: Upload Test results
        uses: actions/upload-artifact@master
        with:
          name: Depcheck report
          path: ${{github.workspace}}/reports
      - name: Upload Test results
        if: always()
        uses: actions/upload-artifact@master
        with:
            name: Depcheck_Report_${{ github.event.repository.name }}_${{ github.ref_name }}
            path: ${{github.workspace}}/reports

  approval:
    needs: dependency-check
    runs-on: ubuntu-latest
    environment: dependency-review # This is the environment that requires approval
    steps:
      - name: Wait for Approval
        run: echo "This job waits for approval in the 'dependency-review' environment."
  # security:
  #   runs-on: ubuntu-latest
  #   needs: build
  #   name: Security Scan and Analysis
  #   environment: Staging
  #   steps:
  #     - name: Checkout code
  #       uses: actions/checkout@v2

  #     - name: Run Snyk to check for vulnerabilities
  #       uses: snyk/actions/maven@master
  #       continue-on-error: true
  #       env:
  #         SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  Docker:
    needs: approval
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Build
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: learndevops083/myjava-app:${{ github.sha }}

  Trivy:
    runs-on: ubuntu-latest
    needs: Docker
    steps:
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'learndevops083/myjava-app:${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'