Skip to content

Commit b988790

Browse files
lukeina2zlukeina2z
committed
Add comprehensive security scanning workflows for Java
This commit implements complete security scanning for aws-xray-sdk-java: ## CodeQL Security Analysis (.github/workflows/codeql-analysis.yml) - CodeQL analysis for Java code security scanning with security-extended queries - OWASP Dependency Check for comprehensive dependency vulnerability scanning - SpotBugs with FindSecBugs plugin for Java-specific security analysis - Uses commit hashes instead of version tags for supply chain security - Runs on PR/push and weekly schedule ## Daily Security Scan (.github/workflows/daily-scan.yml) - Scans published Maven artifacts from Maven Central twice daily - Monitors core, aws-sdk, and apache-http modules separately - Detects new vulnerabilities in existing published artifacts - Focuses on HIGH/CRITICAL severity issues requiring immediate action - Generates actionable summary reports with error handling ## Key Features - Comprehensive coverage: source code, dependencies, published Maven artifacts - Java-focused: OWASP Dependency Check, SpotBugs, FindSecBugs - Security-focused: commit hashes, proper permissions, categorized results - Production-ready: scans actual published artifacts from Maven Central - Robust: proper timeouts, error handling, and job dependencies - Actionable: clear reporting and GitHub Security tab integration Includes OWASP Dependency Check suppressions file for managing false positives. Addresses the critical security gap where aws-xray-sdk-java had no automated security scanning despite being critical infrastructure used in production.
1 parent 55038f7 commit b988790

File tree

3 files changed

+349
-0
lines changed

3 files changed

+349
-0
lines changed

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
name: "CodeQL Security Analysis"
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
8+
schedule:
9+
# Run CodeQL analysis weekly on Mondays at 2 AM UTC
10+
- cron: '0 2 * * 1'
11+
12+
permissions:
13+
actions: read
14+
contents: read
15+
security-events: write
16+
17+
jobs:
18+
analyze:
19+
name: Analyze
20+
runs-on: ubuntu-latest
21+
timeout-minutes: 360
22+
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
language: [ 'java' ]
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
31+
32+
- name: Initialize CodeQL
33+
uses: github/codeql-action/init@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
34+
with:
35+
languages: ${{ matrix.language }}
36+
# Override default queries to include security-extended for more comprehensive analysis
37+
queries: security-extended,security-and-quality
38+
39+
- name: Set up JDK 11
40+
uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
41+
with:
42+
java-version: '11'
43+
distribution: 'temurin'
44+
45+
- name: Setup Gradle
46+
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0
47+
48+
- name: Autobuild
49+
uses: github/codeql-action/autobuild@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
50+
51+
- name: Perform CodeQL Analysis
52+
uses: github/codeql-action/analyze@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
53+
with:
54+
category: "/language:${{matrix.language}}"
55+
56+
dependency-scan:
57+
name: Java Dependency Scan
58+
runs-on: ubuntu-latest
59+
timeout-minutes: 30
60+
61+
steps:
62+
- name: Checkout repository
63+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
64+
65+
- name: Set up JDK 11
66+
uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
67+
with:
68+
java-version: '11'
69+
distribution: 'temurin'
70+
71+
- name: Setup Gradle
72+
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0
73+
74+
- name: Run OWASP Dependency Check
75+
run: |
76+
# Download and run OWASP Dependency Check
77+
wget -q https://github.com/jeremylong/DependencyCheck/releases/download/v11.1.0/dependency-check-11.1.0-release.zip
78+
unzip -q dependency-check-11.1.0-release.zip
79+
./dependency-check/bin/dependency-check.sh \
80+
--project "aws-xray-sdk-java" \
81+
--scan . \
82+
--format SARIF \
83+
--out dependency-check-results.sarif \
84+
--suppression dependency-check-suppressions.xml \
85+
--failOnCVSS 7 \
86+
--enableRetired
87+
88+
- name: Upload OWASP Dependency Check results to GitHub Security tab
89+
uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
90+
if: always()
91+
with:
92+
sarif_file: dependency-check-results.sarif
93+
category: 'dependency-check'
94+
95+
- name: Run Gradle dependency vulnerability check
96+
run: |
97+
# Use Gradle's built-in dependency insight
98+
./gradlew dependencyInsight --dependency org.apache.logging.log4j || true
99+
./gradlew dependencies --configuration runtimeClasspath > gradle-dependencies.txt
100+
101+
- name: Upload dependency report
102+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
103+
if: always()
104+
with:
105+
name: dependency-reports
106+
path: |
107+
dependency-check-results.sarif
108+
gradle-dependencies.txt
109+
110+
security-scan:
111+
name: Java Security Scan
112+
runs-on: ubuntu-latest
113+
timeout-minutes: 30
114+
115+
steps:
116+
- name: Checkout repository
117+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
118+
119+
- name: Set up JDK 11
120+
uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
121+
with:
122+
java-version: '11'
123+
distribution: 'temurin'
124+
125+
- name: Setup Gradle
126+
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0
127+
128+
- name: Run SpotBugs security analysis
129+
run: |
130+
# Add SpotBugs with security rules
131+
./gradlew build -x test || true
132+
133+
# Download SpotBugs with security plugin
134+
wget -q https://github.com/spotbugs/spotbugs/releases/download/4.8.6/spotbugs-4.8.6.tgz
135+
tar -xzf spotbugs-4.8.6.tgz
136+
137+
# Download security plugin
138+
wget -q https://github.com/find-sec-bugs/find-sec-bugs/releases/download/version-1.13.0/findsecbugs-plugin-1.13.0.jar
139+
140+
# Run SpotBugs with security rules on compiled classes
141+
find . -name "*.jar" -path "*/build/libs/*" | head -5 | while read jar; do
142+
echo "Scanning $jar"
143+
./spotbugs-4.8.6/bin/spotbugs -textui -effort:max -low -sarif \
144+
-pluginList findsecbugs-plugin-1.13.0.jar \
145+
-output spotbugs-results.sarif \
146+
"$jar" || true
147+
done
148+
149+
- name: Upload SpotBugs results to GitHub Security tab
150+
uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
151+
if: always()
152+
with:
153+
sarif_file: spotbugs-results.sarif
154+
category: 'spotbugs-security'

‎.github/workflows/daily-scan.yml‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
name: "Daily Security Scan"
2+
3+
on:
4+
schedule:
5+
# Run twice daily at 6 AM and 6 PM UTC
6+
- cron: '0 6,18 * * *'
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
security-events: write
12+
13+
jobs:
14+
scan-published-artifacts:
15+
name: Scan Published Maven Artifacts
16+
runs-on: ubuntu-latest
17+
timeout-minutes: 45
18+
19+
strategy:
20+
fail-fast: false
21+
matrix:
22+
include:
23+
- artifact: "com.amazonaws:aws-xray-recorder-sdk-core"
24+
name: "core"
25+
- artifact: "com.amazonaws:aws-xray-recorder-sdk-aws-sdk"
26+
name: "aws-sdk"
27+
- artifact: "com.amazonaws:aws-xray-recorder-sdk-apache-http"
28+
name: "apache-http"
29+
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
33+
34+
- name: Set up JDK 11
35+
uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
36+
with:
37+
java-version: '11'
38+
distribution: 'temurin'
39+
40+
- name: Download latest published artifact
41+
continue-on-error: true
42+
timeout-minutes: 10
43+
run: |
44+
# Create temp directory for artifact analysis
45+
mkdir -p temp-scan/${{ matrix.name }}
46+
cd temp-scan/${{ matrix.name }}
47+
48+
# Get latest version from Maven Central
49+
LATEST_VERSION=$(curl -s "https://search.maven.org/solrsearch/select?q=g:com.amazonaws+AND+a:$(echo '${{ matrix.artifact }}' | cut -d: -f2)&rows=1&wt=json" | jq -r '.response.docs[0].latestVersion // "UNKNOWN"')
50+
echo "Latest version: $LATEST_VERSION"
51+
52+
if [ "$LATEST_VERSION" != "UNKNOWN" ] && [ "$LATEST_VERSION" != "null" ]; then
53+
# Download the JAR file
54+
ARTIFACT_PATH=$(echo '${{ matrix.artifact }}' | sed 's/:/\//g' | sed 's/\./\//g')
55+
JAR_NAME=$(echo '${{ matrix.artifact }}' | cut -d: -f2)
56+
57+
wget -q "https://repo1.maven.org/maven2/${ARTIFACT_PATH}/${LATEST_VERSION}/${JAR_NAME}-${LATEST_VERSION}.jar" -O "${JAR_NAME}-${LATEST_VERSION}.jar" || echo "Failed to download JAR"
58+
59+
# Download POM for dependency analysis
60+
wget -q "https://repo1.maven.org/maven2/${ARTIFACT_PATH}/${LATEST_VERSION}/${JAR_NAME}-${LATEST_VERSION}.pom" -O "${JAR_NAME}-${LATEST_VERSION}.pom" || echo "Failed to download POM"
61+
62+
echo "Downloaded artifacts for ${{ matrix.artifact }} version $LATEST_VERSION"
63+
ls -la
64+
else
65+
echo "Could not determine latest version for ${{ matrix.artifact }}"
66+
fi
67+
68+
- name: Run OWASP Dependency Check on published artifact
69+
continue-on-error: true
70+
timeout-minutes: 20
71+
run: |
72+
cd temp-scan/${{ matrix.name }}
73+
74+
# Download and run OWASP Dependency Check
75+
wget -q https://github.com/jeremylong/DependencyCheck/releases/download/v11.1.0/dependency-check-11.1.0-release.zip
76+
unzip -q dependency-check-11.1.0-release.zip
77+
78+
# Scan the downloaded artifacts
79+
if ls *.jar 1> /dev/null 2>&1; then
80+
./dependency-check/bin/dependency-check.sh \
81+
--project "aws-xray-sdk-java-${{ matrix.name }}" \
82+
--scan . \
83+
--format SARIF \
84+
--out "dependency-check-${{ matrix.name }}-results.sarif" \
85+
--failOnCVSS 7 \
86+
--enableRetired || echo "Dependency check completed with findings"
87+
else
88+
echo "No JAR files found to scan"
89+
fi
90+
91+
- name: Upload OWASP Dependency Check results to GitHub Security tab
92+
uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
93+
if: always()
94+
with:
95+
sarif_file: 'temp-scan/${{ matrix.name }}/dependency-check-${{ matrix.name }}-results.sarif'
96+
category: 'daily-scan-${{ matrix.name }}'
97+
98+
- name: Generate summary report
99+
if: always()
100+
run: |
101+
echo "## Daily Security Scan Results for ${{ matrix.artifact }}" >> $GITHUB_STEP_SUMMARY
102+
echo "Scan completed at $(date)" >> $GITHUB_STEP_SUMMARY
103+
echo "Artifact: ${{ matrix.artifact }}" >> $GITHUB_STEP_SUMMARY
104+
echo "Component: ${{ matrix.name }}" >> $GITHUB_STEP_SUMMARY
105+
106+
# Check if vulnerabilities were found
107+
SARIF_FILE="temp-scan/${{ matrix.name }}/dependency-check-${{ matrix.name }}-results.sarif"
108+
if [ -f "$SARIF_FILE" ]; then
109+
VULN_COUNT=$(jq '.runs[0].results | length' "$SARIF_FILE" 2>/dev/null || echo "0")
110+
echo "Vulnerabilities found: $VULN_COUNT" >> $GITHUB_STEP_SUMMARY
111+
112+
if [ "$VULN_COUNT" -gt "0" ]; then
113+
echo "⚠️ **Action Required**: Vulnerabilities detected in published artifact" >> $GITHUB_STEP_SUMMARY
114+
echo "Check the Security tab for detailed findings" >> $GITHUB_STEP_SUMMARY
115+
else
116+
echo "✅ No high/critical vulnerabilities found" >> $GITHUB_STEP_SUMMARY
117+
fi
118+
else
119+
echo "❌ Scan failed or artifact not accessible" >> $GITHUB_STEP_SUMMARY
120+
fi
121+
122+
scan-latest-dependencies:
123+
name: Scan Latest Dependencies
124+
runs-on: ubuntu-latest
125+
timeout-minutes: 30
126+
127+
steps:
128+
- name: Checkout repository
129+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
130+
131+
- name: Set up JDK 11
132+
uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
133+
with:
134+
java-version: '11'
135+
distribution: 'temurin'
136+
137+
- name: Setup Gradle
138+
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4.1.0
139+
140+
- name: Run dependency vulnerability scan
141+
continue-on-error: true
142+
run: |
143+
# Generate current dependency tree
144+
./gradlew dependencies --configuration runtimeClasspath > current-dependencies.txt
145+
146+
# Download and run OWASP Dependency Check on current dependencies
147+
wget -q https://github.com/jeremylong/DependencyCheck/releases/download/v11.1.0/dependency-check-11.1.0-release.zip
148+
unzip -q dependency-check-11.1.0-release.zip
149+
150+
./dependency-check/bin/dependency-check.sh \
151+
--project "aws-xray-sdk-java-current" \
152+
--scan . \
153+
--format SARIF \
154+
--out dependency-check-current-results.sarif \
155+
--failOnCVSS 7 \
156+
--enableRetired || echo "Dependency check completed"
157+
158+
- name: Upload current dependency scan results
159+
uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
160+
if: always()
161+
with:
162+
sarif_file: dependency-check-current-results.sarif
163+
category: 'daily-scan-current-deps'
164+
165+
- name: Upload dependency reports
166+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
167+
if: always()
168+
with:
169+
name: daily-dependency-reports
170+
path: |
171+
dependency-check-current-results.sarif
172+
current-dependencies.txt

‎dependency-check-suppressions.xml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
<!--
4+
This file contains suppressions for OWASP Dependency Check false positives.
5+
Each suppression should include:
6+
1. A clear reason for suppression
7+
2. The specific CVE or vulnerability being suppressed
8+
3. The affected file pattern or GAV coordinates
9+
10+
Example suppression:
11+
<suppress>
12+
<notes><![CDATA[
13+
This CVE affects a different component with the same name.
14+
Our usage is not vulnerable because we don't use the affected functionality.
15+
]]></notes>
16+
<packageUrl regex="true">^pkg:maven/com\.example/.*@.*$</packageUrl>
17+
<cve>CVE-2023-12345</cve>
18+
</suppress>
19+
-->
20+
21+
<!-- Add specific suppressions here as needed -->
22+
23+
</suppressions>

0 commit comments

Comments
 (0)