CVE scanning for KDB-Studio

.github/workflows/cve-scanning.yml

@@ -0,0 +1,29 @@
+name: Gradle CI
+
+on:
+  push:
+    paths:
+      - 'build.gradle'
+      - 'allow-list.xml'
+      - '.github/workflows/cve-scanning.yml'
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt'
+      - name: Scan for CVEs
+        uses: eskatos/gradle-command-action@v1
+        with:
+          arguments: dependencyCheckAnalyze
+      - name: Archive CVE results
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: cve-report
+          path: build/reports/dependency-check-report.html

.github/workflows/semgrep.yml

@@ -0,0 +1,15 @@
+name: Static code analysis
+
+on: [push, pull_request]
+
+jobs:
+  semgrep:
+    name: run-semgrep
+    runs-on: ubuntu-20.04
+    container:
+      image: returntocorp/semgrep
+    steps:
+    - uses: actions/checkout@v3
+    - run: semgrep scan --error --config auto
+      env:
+        SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

allow-list.xml

@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+</suppressions>

build.gradle

@@ -2,6 +2,7 @@ apply plugin: 'idea'
 //and standard one
 apply plugin: 'java'
 apply plugin: 'application'
+apply plugin: 'org.owasp.dependencycheck'
 
 compileJava {
     sourceCompatibility = JavaVersion.VERSION_1_8
@@ -12,6 +13,20 @@ repositories {
     mavenCentral()
 }
 
+buildscript {
+    repositories {
+        mavenCentral()
+    }
+    dependencies {
+        classpath 'org.owasp:dependency-check-gradle:7.1.1'
+    }
+}
+
+dependencyCheck {
+    failBuildOnCVSS=5
+    suppressionFile="allow-list.xml"
+}
+
 dependencies {
     compile group: 'org.netbeans.api', name: 'org-openide-awt', version: 'RELEASE113'
     compile group: 'org.jfree', name: 'jfreechart', version: '1.0.14'