SAST Scans #4

	name: SAST Scans

	on:
	#push:
	workflow_dispatch: # to allow to run manually

	jobs:


	SAST-Scan:
	runs-on: ubuntu-latest

	steps:

	- name: Checkout Sources
	uses: actions/checkout@v4

	- name: Set up JDK
	uses: actions/setup-java@v4
	with:
	java-version: 8
	distribution: 'temurin'

	- name: Setup Maven Dependency Cache
	uses: actions/cache@v4
	with:
	path: ~/.m2/repository
	key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
	restore-keys: \|
	${{ runner.os }}-maven-

	- name: Build with Maven & Run SpotBugs
	run: mvn clean install -DskipTests com.github.spotbugs:spotbugs-maven-plugin:3.1.12:spotbugs

	- name: Inspect SpotBugs Report
	uses: jwgmeligmeyling/spotbugs-github-action@master
	with:
	path: '**/spotbugsXml.xml'

	- name: Grype Dependency Scanner (Report)
	id: scan
	uses: anchore/scan-action@v5
	with:
	path: "."
	#acs-report-enable: true
	fail-build: false # to always generate the report, then again a scan that might fail

	- name: Inspect Dependency SARIF Report
	run: cat ${{ steps.scan.outputs.sarif }}

	- name: Secret Scan with Trufflehog
	uses: UnicornGlobal/trufflehog-actions-scan@master
	with: # exclusions in .truffleignore file
	branch: ${{ github.head_ref }}

	- name: Hadolint Dockerfile Linter
	uses: hadolint/[email protected]
	with:
	dockerfile: Dockerfile
	recursive: true

Provide feedback