Feature: Add GitHub Workflows examples

.github/workflows/veracode-async-scan.yaml

@@ -0,0 +1,34 @@
+name: Veracode Async Scan
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout source code"
+        uses: "actions/checkout@v2.4.0"
+
+      - name: "Build Maven App"
+        run: |
+          # Compile war file
+          mvn install -f app/pom.xml
+
+      - name: "Veracode Async Scan"
+        run: |
+          # Download the API wrapper if it does not exist.
+          if [ ! -f "VeracodeJavaAPI.jar" ]; then 
+            curl -sS -o "VeracodeJavaAPI.jar" https://repo1.maven.org/maven2/com/veracode/vosp/api/wrappers/vosp-api-wrappers-java/23.4.11.2/vosp-api-wrappers-java-23.4.11.2.jar
+          fi
+
+          version=`date +%Y%M%d-%H:%M`"-automated"
+          filepath=./app/target/verademo.war
+          appname="test"
+
+          # Upload a packaged artifact and run a SAST scan.
+          java -jar VeracodeJavaAPI.jar \
+            -action UploadAndScan -vid ${{ secrets.VERACODE_API_KEY_ID }} -vkey ${{ secrets.VERACODE_API_KEY_SECRET }} \
+            -version $version -createprofile 'false' -appname $appname -filepath $filepath

.github/workflows/veracode-pipeline-scan.yaml

@@ -0,0 +1,24 @@
+name: Veracode Pipeline Scan
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout source code"
+        uses: "actions/checkout@v2.4.0"
+
+      - name: "Build Maven App"
+        run: |
+          # Compile war file
+          mvn install -f app/pom.xml
+
+      - name: "Veracode Pipeline Scan"
+        run: |
+          curl -sSO https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
+          unzip -o pipeline-scan-LATEST.zip
+          java -jar pipeline-scan.jar -vid ${{ secrets.VERACODE_API_KEY_ID }} -vkey ${{ secrets.VERACODE_API_KEY_SECRET }} -f ./app/target/verademo.war 

README.md

@@ -54,4 +54,4 @@ To run the container for local development run this:
 docker run --rm -it -p 127.0.0.1:8080:8080 --entrypoint bash -v "$(pwd)/app:/app" verademo
 ```
 
-You will then need to manually run the two commands within `/entrypoint.sh`. The first starts the DB in the background whereas the second compiles and runs the application. Typically a container shouldn't have multiple services but this was done for convenience.
+You will then need to manually run the two commands within `/entrypoint.sh`. The first starts the DB in the background whereas the second compiles and runs the application. Typically a container shouldn't have multiple services but this was done for convenience.

app/pom.xml

@@ -18,8 +18,8 @@
 	<!-- Component Version Properties -->
 	<properties>
 		<spring.version>4.3.10.RELEASE</spring.version>
-		<springboot.version>2.3.1.RELEASE</springboot.version>
-		<fileupload.version>1.3.2</fileupload.version>
+		<springboot.version>3.0.0</springboot.version>
+		<fileupload.version>1.5</fileupload.version>
 	</properties>
 
 	<!-- Dependencies begin here -->
@@ -89,32 +89,32 @@
 		<dependency>
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
-			<version>2.4</version>
+			<version>2.7</version>
 		</dependency>
 
 		<!-- Vuln Method libs -->
 		<dependency>
 			<groupId>org.apache.sling</groupId>
 			<artifactId>maven-sling-plugin</artifactId>
-			<version>2.0.4-incubator</version>
+			<version>2.4.0</version>
 		</dependency>
 
 		<dependency>
 			<groupId>org.mindrot</groupId>
 			<artifactId>jbcrypt</artifactId>
-			<version>0.3m</version>
+			<version>0.4</version>
 		</dependency>
 
 		<dependency>
 			<groupId>org.keycloak</groupId>
 			<artifactId>keycloak-saml-core</artifactId>
-			<version>1.8.1.Final</version>
+			<version>19.0.2</version>
 		</dependency>
 
 		<dependency>
 			<groupId>mysql</groupId>
 			<artifactId>mysql-connector-java</artifactId>
-			<version>5.1.48</version>
+			<version>8.0.28</version>
 		</dependency>
 
 		<dependency>
@@ -130,7 +130,7 @@
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-collections4</artifactId>
-			<version>4.0</version>
+			<version>4.1</version>
 		</dependency>
 	</dependencies>