Make it a multi-project build (#10)

build.sbt

@@ -1,2 +1,4 @@
-name := "sample"
-scalaVersion := "2.13.12"
+lazy val root = project.in(file("."))
+  .aggregate(subproject1, subproject2)
+lazy val subproject1 = project.in(file("subproject1"))
+lazy val subproject2 = project.in(file("subproject2"))

fortify.sbt

@@ -1,10 +1,15 @@
+// note the use of `ThisBuild` throughout to make these settings
+// applicable to all subprojects, not just the root project
+
 lazy val fortifyEnabled =
   settingKey[Boolean](
     "enable Fortify compiler plugin for Scala")
-// enable the plugin only if someone sets the key to "true"
-fortifyEnabled := java.lang.Boolean.getBoolean("fortifyEnabled")
 
-libraryDependencies ++= (
+// enable plugin only if system property is "true"
+ThisBuild / fortifyEnabled :=
+  java.lang.Boolean.getBoolean("fortifyEnabled")
+
+ThisBuild / libraryDependencies ++= (
   if (fortifyEnabled.value)
     Seq(
       compilerPlugin("com.lightbend" %% "scala-fortify" % "1.0.25"
@@ -13,7 +18,7 @@ libraryDependencies ++= (
     Seq()
 )
 
-scalacOptions ++= (
+ThisBuild / scalacOptions ++= (
   if (fortifyEnabled.value)
     Seq("-P:fortify:scaversion=23.1", "-P:fortify:build=sample")
   else

src/main/scala/Sample.scala → subproject1/src/main/scala/Sample1.scala

@@ -1,6 +1,6 @@
 import sys.process._
 
-object Sample {
+object Sample1 {
   def main(args: Array[String]): Unit =
     args(0).!  // command injection vulnerability
 }

subproject2/src/main/scala/Sample2.scala

@@ -0,0 +1,6 @@
+import java.util.Random
+
+object Sample2 {
+  def foo(): Int =
+    (new Random).nextInt(10)  // insecure randomness
+}

vulnerabilities.txt

@@ -1,8 +1,11 @@
-[4D02548E443E641834BD816082B9E863 : critical : Command Injection : dataflow ]
-Sample.scala(5) :  ->ProcessBuilder.!(this)
-    Sample.scala(5) : <->ProcessImplicits.stringToProcess(0->return)
-    Sample.scala(4) :  ->Sample$.main(0[0])
-    Sample.scala(3) :  ->Sample.main(0)
+[21E60E2B831668A393932CEB49C2A6A1 : high : Insecure Randomness : semantic ]
+subproject2/src/main/scala/Sample2.scala(5) : Random.nextInt()
 
-[B1DE11549CA70DBAE2151357DDC15863 : low : J2EE Bad Practices : Leftover Debug Code : structural ]
-    Sample.scala(4)
+[CBCE82F9EBC6726C510E706E09AC0216 : critical : Command Injection : dataflow ]
+subproject1/src/main/scala/Sample1.scala(5) :  ->ProcessBuilder.!(this)
+    subproject1/src/main/scala/Sample1.scala(5) : <->ProcessImplicits.stringToProcess(0->return)
+    subproject1/src/main/scala/Sample1.scala(4) :  ->Sample1$.main(0[0])
+    subproject1/src/main/scala/Sample1.scala(6) :  ->Sample1.main(0)
+
+[BE79AAD699A3BCD5795C87E95E9B87ED : low : J2EE Bad Practices : Leftover Debug Code : structural ]
+    subproject1/src/main/scala/Sample1.scala(4)