Merge pull request #8 from lightbend-labs/add-ci

.github/workflows/ci.yml

@@ -0,0 +1,20 @@
+name: test
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: coursier/cache-action@v6
+    - uses: actions/setup-java@v3
+      with:
+        distribution: temurin
+        java-version: 17
+    - name: Test
+      run: sbt test

.github/workflows/fortify.yml

@@ -0,0 +1,69 @@
+name: test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-java@v3
+      with:
+        distribution: temurin
+        java-version: 17
+        cache: sbt
+
+    - uses: actions/cache@v3
+      env:
+        cache-name: fortify
+      with:
+        path: ./Fortify
+        key: fortify-23.1.1
+
+    # https://github.com/gruntwork-io/fetch
+    - uses: Homebrew/actions/setup-homebrew@master
+    - name: Install Fetch
+      run: brew install fetch
+
+    - name: Install secrets
+      env:
+        LIGHTBEND_LICENSE: ${{secrets.LIGHTBEND_LICENSE}}
+        FORTIFY_LICENSE: ${{secrets.FORTIFY_LICENSE}}
+      run: |
+        mkdir -p ~/.lightbend
+        echo "$LIGHTBEND_LICENSE" > ~/.lightbend/license
+        echo "$FORTIFY_LICENSE" > fortify.license
+
+    # The easiest way I could think of to make the Fortify installer available to CI
+    # was to attach it as a release asset to a tag in a private repo.
+    - name: Install Fortify
+      run: |
+        if [[ ! -d Fortify ]] ; then
+          GITHUB_OAUTH_TOKEN=${{secrets.FORTIFY_INSTALLER_TOKEN}} fetch --repo="https://github.com/lightbend/scala-fortify" --tag="23.1.1_linux_x64" --release-asset="Fortify_SCA_23.1.1_linux_x64.run" .
+          chmod +x Fortify_SCA_23.1.1_linux_x64.run
+          mkdir Fortify
+          echo installdir=`pwd`/Fortify/Fortify_SCA_23.1.1 > Fortify_SCA_23.1.1_linux_x64.run.options
+          echo fortify_license_path=`pwd`/fortify.license >> Fortify_SCA_23.1.1_linux_x64.run.options
+          ./Fortify_SCA_23.1.1_linux_x64.run --mode unattended
+          # download the Scala security rules; VersionTests makes sure they're the ones we expect
+          ./Fortify/Fortify_SCA_23.1.1/bin/fortifyupdate
+        fi
+
+    - name: Test
+      run: |
+        sbt compile
+        rm -f target/vulnerabilities-actual.txt
+        ./Fortify/Fortify_SCA_23.1.1/bin/sourceanalyzer \
+          -b akka-http-webgoat \
+          -logfile target/scan.log \
+          -scan \
+          | tail -n +4 > target/vulnerabilities-actual.txt
+        cat target/scan.log
+        sum vulnerabilities.txt target/vulnerabilities-actual.txt
+        diff -u vulnerabilities.txt target/vulnerabilities-actual.txt