Skip to content

Commit 7864e7a

Browse files
jmserverajmservera
authored
Merge pull request #2 from jmservera/v0.2
V0.2
2 parents cd89fc2 + 7cdf784 commit 7864e7a

3 files changed

Lines changed: 222 additions & 23 deletions

File tree

‎README.md‎

Lines changed: 73 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,92 @@
22

33
Run [SpotBugs](https://spotbugs.readthedocs.io/en/latest/) as a Github action.
44

5+
## Inputs
6+
7+
### outputType
8+
9+
Output type for the report. It can be 'xml', 'html', 'sarif', 'emacs'
10+
or 'xdocs'. Default value is 'sarif' as it is the used by GitHub Advanced
11+
Security.
12+
13+
> default: 'sarif' <br/>
14+
> required: true
15+
16+
### packages
17+
18+
Comma separated list of packages to scan. It will fill the
19+
-onlyAnalyze parameter in spotbugs. It can contain the wildcards '\*' and
20+
'-': com.example.\* for single package or com.example.- for all
21+
subpackages.
22+
23+
> If not specified, it will scan all packages.
24+
25+
See more at https://spotbugs.readthedocs.io/en/stable/running.html#text-ui-options
26+
27+
### arguments
28+
29+
A string with any additional command arguments to be sent to [spotbugs](https://spotbugs.readthedocs.io/en/stable/running.html#text-ui-options)
30+
31+
### output
32+
33+
The output filename. If not specified, it will use the default name 'results.[EXTENSION]'
34+
35+
### target
36+
37+
It can be a file or a directory, it is usually the ./target folder where you compiled your project.
38+
39+
### dependenciesPath
40+
41+
Path to the dependencies folder. For example, for Maven it is usually stored
42+
in the `~/.m2` folder.
43+
44+
### basePath
45+
46+
The basePath is used as a prefix in the sarif file to help GitHub find the
47+
right file of the issue. It is tipically something like 'src/main/java'.
48+
49+
## Example usage
50+
51+
This workflow would analyze a Java application that builds a set of
52+
packages under the com.example package name and outputs the results in
53+
sarif format to upload it to the GitHub Security tab:
54+
555
```yaml
656
name: SpotBugs
757

858
on: [push, pull_request]
959

1060
jobs:
11-
spotbugs-analyze:
61+
spotbugs-analyze:
1262
name: Analyze
1363
runs-on: ubuntu-latest
14-
steps:
64+
steps:
65+
66+
# checkout and build the project
1567
- name: Checkout code
16-
uses: actions/checkout@v2
68+
uses: actions/checkout@v3
69+
70+
- name: Set up JDK 11
71+
uses: actions/setup-java@v3
72+
with:
73+
java-version: '11'
74+
distribution: 'temurin'
75+
cache: maven
76+
- name: Build with Maven
77+
run: mvn clean package -B -Dmaven.test.skip
1778

18-
- name: Run SpotBugs
19-
uses: spotbugs/spotbugs-github-action@v1
79+
# Run SpotBugs and upload the SARIF file
80+
- name: Run SpotBugs action
81+
if: always()
82+
uses: abirismyname/spotbugs-github-action@v2
2083
with:
21-
arguments: '-sarif'
22-
target: './HelloWorld.jar'
23-
output: 'results.sarif'
24-
spotbugs-version: 'latest'
84+
packages: com.example.-
85+
target: ./target
86+
dependenciesPath: ~/.m2
87+
basePath: src/main/java
2588

2689
- name: Upload analysis results to GitHub Security tab
27-
uses: github/codeql-action/upload-sarif@v1
90+
uses: github/codeql-action/upload-sarif@v2
2891
with:
2992
sarif_file: ${{github.workspace}}/results.sarif
3093
```

‎action.yml‎

Lines changed: 49 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,54 @@ branding:
55
color: 'blue'
66
inputs:
77
spotbugs-version:
8-
description: 'SpotBugs version to use.'
8+
description: 'SpotBugs version to use. Default: latest.'
99
default: 'latest'
1010
required: false
11+
packages:
12+
description: >
13+
Comma separated list of packages to scan. It will fill the
14+
-onlyAnalyze parameter in spotbugs. It can contain the wildcards '*' and
15+
'-': com.example.* for single package or com.example.- for all
16+
subpackages.
17+
18+
If not specified, it will scan all packages.
19+
See more: https://spotbugs.readthedocs.io/en/stable/running.html#text-ui-options
20+
required: false
1121
arguments:
12-
description: 'Command arguments to be sent to SpotBugs'
13-
required: true
14-
default: ''
22+
description: >
23+
A string with any additional command arguments to be sent to spotbugs.
24+
See more: https://spotbugs.readthedocs.io/en/stable/running.html#text-ui-options
25+
required: false
1526
output:
16-
description: 'Output file name'
17-
required: true
27+
description: >
28+
The output filename. If not specified, it will use the default name
29+
'results.EXTENSION'
1830
target:
19-
description: 'Target of what you want to analyze'
20-
required: true
31+
description: >
32+
Target of what you want to analyze. It can be a file or a directory, it
33+
is usually the ./target folder where you compiled your project.
34+
required: false
35+
outputType:
36+
description: >
37+
Output type for the report. It can be 'xml', 'html', 'sarif', 'emacs'
38+
or 'xdocs'. Default value is 'sarif' as it is the used by GitHub Advanced
39+
Security.
40+
default: 'sarif'
41+
required: true
42+
dependenciesPath:
43+
description: >
44+
Path to the dependencies folder. For Maven it is usually stored in the
45+
'~/.m2' folder.
46+
required: false
47+
basePath:
48+
description: >
49+
The basePath is used as a prefix in the sarif file to help GitHub find the
50+
right file of the issue. It is tipically something like 'src/main/java'.
51+
required: false
52+
progress:
53+
description: >
54+
Set it to true to enable showing progress.
55+
required: false
2156
runs:
2257
using: "composite"
2358
steps:
@@ -26,6 +61,11 @@ runs:
2661
shell: bash
2762
env:
2863
SPOTBUGS_VERSION: ${{ inputs.spotbugs-version }}
64+
PACKAGES: ${{ inputs.packages }}
2965
OUTPUT: ${{ inputs.output }}
66+
OUTPUT_TYPE: ${{ inputs.outputType }}
3067
ARGUMENTS: ${{ inputs.arguments }}
31-
TARGET: ${{ inputs.target }}
68+
TARGET: ${{ inputs.target }}
69+
DEPENDENCIES_PATH: ${{ inputs.dependenciesPath }}
70+
BASE_PATH: ${{ inputs.basePath }}
71+
PROGRESS: ${{ inputs.progress }}

‎analyze.sh‎

Lines changed: 100 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,112 @@
11
#!/bin/bash
22

3+
# set com.example.demo and all chid packages (.- means all children, .* this package only)
4+
# PACKAGES="com.example.demo.-"
5+
# source path to prepend to the class path
6+
# BASEPATH="src/main/java"
7+
# DEPENDENCIES_PATH="~/.m2"
8+
# OUTPUT_TYPE="sarif"
9+
310
# Check whether to use latest version of PMD
4-
if [ "$SPOTBUGS_VERSION" == 'latest' ]; then
11+
if [ "$SPOTBUGS_VERSION" == 'latest' ] || [ "$SPOTBUGS_VERSION" == "" ]; then
512
LATEST_TAG="$(curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/spotbugs/spotbugs/releases/latest | jq --raw-output '.tag_name')"
613
SPOTBUGS_VERSION=$LATEST_TAG
714
fi
815

916
# Download SpotBugs
10-
wget https://github.com/spotbugs/spotbugs/releases/download/"${SPOTBUGS_VERSION}"/spotbugs-"${SPOTBUGS_VERSION}".zip
11-
unzip spotbugs-"${SPOTBUGS_VERSION}".zip
17+
wget -q -N https://github.com/spotbugs/spotbugs/releases/download/"${SPOTBUGS_VERSION}"/spotbugs-"${SPOTBUGS_VERSION}".zip
18+
unzip -q -o spotbugs-"${SPOTBUGS_VERSION}".zip
1219

1320
# Run SpotBugs
1421
SPOTBUGS_HOME=spotbugs-"${SPOTBUGS_VERSION}"
1522
SPOTBUGS=${SPOTBUGS_HOME}/bin/spotbugs
16-
sh $SPOTBUGS -textui -output "${OUTPUT}" "${ARGUMENTS}" "${TARGET}"
23+
24+
#sh $SPOTBUGS -textui -output "${OUTPUT}" "${ARGUMENTS}" "${TARGET}"
25+
26+
# Take care of parameter order, sometimes does not work if you change it
27+
28+
CMD="java -Xmx1900M -Dlog4j2.formatMsgNoLookups=true \
29+
-jar ${SPOTBUGS_HOME}/lib/spotbugs.jar -textui "
30+
31+
if [ "$PACKAGES" != "" ]; then
32+
CMD="$CMD -onlyAnalyze ${PACKAGES}"
33+
fi
34+
35+
CMD="$CMD -quiet -effort:max -low -noClassOk"
36+
37+
case $OUTPUT_TYPE in
38+
"xml")
39+
if [ "$OUTPUT" == "" ]; then
40+
OUTPUT="results.xml"
41+
fi
42+
CMD="$CMD -xml:withMessages=./$OUTPUT"
43+
;;
44+
"html")
45+
if [ "$OUTPUT" == "" ]; then
46+
OUTPUT="results.html"
47+
fi
48+
CMD="$CMD -html:withMessages=./$OUTPUT"
49+
;;
50+
"emacs")
51+
if [ "$OUTPUT" == "" ]; then
52+
OUTPUT="results.emacs"
53+
fi
54+
CMD="$CMD -emacs:withMessages=./$OUTPUT"
55+
;;
56+
"xdocs")
57+
if [ "$OUTPUT" == "" ]; then
58+
OUTPUT="results.xdocs"
59+
fi
60+
CMD="$CMD -xdoc:withMessages=./$OUTPUT"
61+
;;
62+
*)
63+
OUTPUT_TYPE="sarif"
64+
if [ "$OUTPUT" == "" ]; then
65+
OUTPUT="results.sarif"
66+
fi
67+
CMD="$CMD -sarif:withMessages=./resultspre.sarif"
68+
;;
69+
esac
70+
71+
if [ "$DEPENDENCIES_PATH" != "" ]; then
72+
DEP_CMD="find ${DEPENDENCIES_PATH} -name \"*.jar\" -type f > /tmp/jardependencies.txt"
73+
echo "Scanning jars with: ${DEP_CMD}"
74+
eval ${DEP_CMD}
75+
CMD="$CMD -auxclasspathFromFile /tmp/jardependencies.txt"
76+
echo "Found dependencies: "
77+
cat /tmp/jardependencies.txt
78+
fi
79+
80+
if [ "$PROGRESS" == "true"]; then
81+
CMD="$CMD -progress"
82+
fi
83+
84+
if [ "$BASE_PATH" != "" ]; then
85+
if [[ "$BASE_PATH" != */ ]]; then
86+
BASE_PATH="$BASE_PATH/"
87+
fi
88+
# using sourcepath does not work for GitHub's sarif parser
89+
# but keeping there just in case
90+
CMD="$CMD -sourcepath ${BASE_PATH}"
91+
fi
92+
93+
if [ "$ARGUMENTS" != "" ]; then
94+
CMD="$CMD ${ARGUMENTS}"
95+
fi
96+
97+
if [ "$TARGET" != "" ]; then
98+
CMD="$CMD ${TARGET}"
99+
else
100+
CMD="$CMD ."
101+
fi
102+
103+
echo "Running SpotBugs with command: $CMD"
104+
105+
eval ${CMD}
106+
107+
if [ "$OUTPUT_TYPE" == "sarif" ] && [ "$BASE_PATH" != "" ]; then
108+
# prepend the pyhsical path
109+
echo "Transform sarif file to include the physical path"
110+
jq -c "(.runs[].results[].locations[].physicalLocation.artifactLocation.uri) |=\"$BASE_PATH\"+." resultspre.sarif > "$OUTPUT"
111+
fi
112+

0 commit comments

Comments
 (0)