8cba5f7710
Add CodeQL (SAST), SpotBugs+FindSecBugs (SAST via verify), OWASP Dependency Check and OWASP ZAP baseline scan (DAST) to the CI/CD pipeline. Docker deploy is gated behind ci, sast-codeql and dast jobs. Fix DM_DEFAULT_ENCODING spotted by SpotBugs: use StandardCharsets.UTF_8 in Basic Auth encoding.
104 lines
3.0 KiB
XML
104 lines
3.0 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
|
|
<parent>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-parent</artifactId>
|
|
<version>3.3.5</version>
|
|
<relativePath/>
|
|
</parent>
|
|
|
|
<groupId>ch.hesso.pi</groupId>
|
|
<artifactId>notification-service</artifactId>
|
|
<version>0.0.1-SNAPSHOT</version>
|
|
<name>notification-service</name>
|
|
<description>Air quality alert notifications via Telegram</description>
|
|
|
|
<properties>
|
|
<java.version>17</java.version>
|
|
</properties>
|
|
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-web</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.projectlombok</groupId>
|
|
<artifactId>lombok</artifactId>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>me.paulschwarz</groupId>
|
|
<artifactId>spring-dotenv</artifactId>
|
|
<version>4.0.0</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-actuator</artifactId>
|
|
</dependency>
|
|
|
|
<dependency>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-starter-test</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
</dependencies>
|
|
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.springframework.boot</groupId>
|
|
<artifactId>spring-boot-maven-plugin</artifactId>
|
|
<configuration>
|
|
<excludes>
|
|
<exclude>
|
|
<groupId>org.projectlombok</groupId>
|
|
<artifactId>lombok</artifactId>
|
|
</exclude>
|
|
</excludes>
|
|
</configuration>
|
|
</plugin>
|
|
|
|
<!-- SAST: SpotBugs + FindSecBugs -->
|
|
<plugin>
|
|
<groupId>com.github.spotbugs</groupId>
|
|
<artifactId>spotbugs-maven-plugin</artifactId>
|
|
<version>4.8.3.1</version>
|
|
<configuration>
|
|
<effort>Max</effort>
|
|
<threshold>High</threshold>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>com.h3xstream.findsecbugs</groupId>
|
|
<artifactId>findsecbugs-plugin</artifactId>
|
|
<version>1.13.0</version>
|
|
</plugin>
|
|
</plugins>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<goals><goal>check</goal></goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
|
|
<!-- Dependency vulnerability scan: OWASP -->
|
|
<plugin>
|
|
<groupId>org.owasp</groupId>
|
|
<artifactId>dependency-check-maven</artifactId>
|
|
<version>9.0.9</version>
|
|
<configuration>
|
|
<failBuildOnCVSS>7</failBuildOnCVSS>
|
|
<formats>HTML,JSON</formats>
|
|
</configuration>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
|
|
</project>
|