Skip to content

Commit e56ebf6

Browse files
soul2zimatesoul2zimate
authored
Merge branch 'main' into snyk-upgrade-2f057c52ed35d1723fc72536565316d3
2 parents 40caee3 + 4f98774 commit e56ebf6

36 files changed

+3432
-2068
lines changed

‎.github/workflows/integration.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Integration
3+
4+
on:
5+
workflow_dispatch:
6+
pull_request:
7+
branches:
8+
- main
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
call-shared:
16+
uses: trustification/exhort-integration-tests/.github/workflows/integration.yml@main
17+
with:
18+
language: java
19+
repo-url: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
20+
commit-sha: ${{ github.event.pull_request.head.sha || github.sha }}

‎.github/workflows/pr.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,11 @@ jobs:
1414
checks: write
1515
pull-requests: write
1616
env:
17-
MAIN_JAVA_VER: 11
17+
MAIN_JAVA_VER: 17
1818
RUN_PYTHON_BIN: ${{ vars.RUN_PYTHON_BIN }}
1919
strategy:
2020
matrix:
21-
java: [11, 17, 21]
21+
java: [17, 21]
2222
steps:
2323
- name: Checkout sources
2424
uses: actions/checkout@v3

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ jobs:
3131
fetch-depth: 0
3232

3333

34-
- name: Setup Java 11
35-
uses: actions/setup-java@v3
34+
- name: Setup Java 17
35+
uses: actions/setup-java@v4
3636
with:
3737
distribution: temurin
38-
java-version: 11
38+
java-version: 17
3939
cache: maven
4040

4141
- name: create ssh agent

‎.github/workflows/stage.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ jobs:
2525
- name: Checkout sources
2626
uses: actions/checkout@v3
2727

28-
- name: Setup Java 11
29-
uses: actions/setup-java@v3
28+
- name: Setup Java 17
29+
uses: actions/setup-java@v4
3030
with:
3131
distribution: temurin
32-
java-version: 11
32+
java-version: 17
3333
cache: maven
3434

3535
- name: Get pom specs

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
# Maven
2323
target
2424
.flattened-pom.xml
25+
dependency-reduced-pom.xml
2526

2627
# Gradle
2728
.gradle
@@ -40,8 +41,12 @@ target
4041
# Node
4142
node_modules
4243

44+
# Python virtual envs
45+
.venv
46+
4347
# project stuff
4448
http_requests
4549
json_responses
4650
**/.DS_Store
4751
.idea/
52+

‎README.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -503,6 +503,73 @@ By Default, The API algorithm will use native commands of PIP installer as data
503503
It's also possible, to use lightweight Python PIP utility [pipdeptree](https://pypi.org/project/pipdeptree/) as data source instead, in order to activate this,
504504
Need to set environment variable/system property - `EXHORT_PIP_USE_DEP_TREE` to true.
505505

506+
### CLI Support
507+
508+
The Exhort Java API includes a command-line interface for standalone usage.
509+
510+
#### Building the CLI
511+
512+
To build the CLI JAR with all dependencies included:
513+
514+
```shell
515+
mvn clean package
516+
```
517+
518+
This creates two JAR files in the `target/` directory:
519+
- `exhort-java-api.jar` - Library JAR (for programmatic use)
520+
- `exhort-java-api-cli.jar` - CLI JAR (includes all dependencies)
521+
522+
#### Usage
523+
524+
```shell
525+
java -jar target/exhort-java-api-cli.jar <COMMAND> <FILE_PATH> [OPTIONS]
526+
```
527+
528+
#### Commands
529+
530+
**Stack Analysis**
531+
```shell
532+
java -jar exhort-java-api-cli.jar stack <file_path> [--summary|--html]
533+
```
534+
Perform stack analysis on the specified manifest file.
535+
536+
Options:
537+
- `--summary` - Output summary in JSON format
538+
- `--html` - Output full report in HTML format
539+
- (default) - Output full report in JSON format
540+
541+
**Component Analysis**
542+
```shell
543+
java -jar exhort-java-api-cli.jar component <file_path> [--summary]
544+
```
545+
Perform component analysis on the specified manifest file.
546+
547+
Options:
548+
- `--summary` - Output summary in JSON format
549+
- (default) - Output full report in JSON format
550+
551+
#### Examples
552+
553+
```shell
554+
# Stack analysis with JSON output (default)
555+
java -jar exhort-java-api-cli.jar stack /path/to/pom.xml
556+
557+
# Stack analysis with summary
558+
java -jar exhort-java-api-cli.jar stack /path/to/package.json --summary
559+
560+
# Stack analysis with HTML output
561+
java -jar exhort-java-api-cli.jar stack /path/to/build.gradle --html
562+
563+
# Component analysis with JSON output (default)
564+
java -jar exhort-java-api-cli.jar component /path/to/requirements.txt
565+
566+
# Component analysis with summary
567+
java -jar exhort-java-api-cli.jar component /path/to/go.mod --summary
568+
569+
# Show help
570+
java -jar exhort-java-api-cli.jar --help
571+
```
572+
506573
### Image Support
507574

508575
Generate vulnerability analysis report for container images.

‎pom.xml‎

Lines changed: 89 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
<code.coverage.threshold>81%</code.coverage.threshold>
1717
<mutation.coverage.threshold>50</mutation.coverage.threshold>
1818
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
19-
<maven.compiler.release>11</maven.compiler.release>
19+
<maven.compiler.release>17</maven.compiler.release>
2020
<!-- Dependencies -->
2121
<exhort-api.version>1.0.6</exhort-api.version>
2222
<jackson.version>2.15.0</jackson.version>
@@ -30,7 +30,7 @@
3030
<mockito.version>5.17.0</mockito.version>
3131
<!-- Plugins -->
3232
<maven-clean-plugin.version>3.2.0</maven-clean-plugin.version>
33-
<maven-compiler-plugin.version>3.11.0</maven-compiler-plugin.version>
33+
<maven-compiler-plugin.version>3.12.1</maven-compiler-plugin.version>
3434
<maven-dependency-plugin.version>3.6.0</maven-dependency-plugin.version>
3535
<maven-deploy-plugin.version>3.1.1</maven-deploy-plugin.version>
3636
<maven-enforcer-plugin.version>3.3.0</maven-enforcer-plugin.version>
@@ -44,6 +44,7 @@
4444
<maven-site-plugin.version>4.0.0-M6</maven-site-plugin.version>
4545
<maven-source-plugin.version>3.2.1</maven-source-plugin.version>
4646
<maven-surefire-plugin.version>3.5.3</maven-surefire-plugin.version>
47+
<maven-shade-plugin.version>3.4.1</maven-shade-plugin.version>
4748
<build-helper-maven-plugin.version>3.4.0</build-helper-maven-plugin.version>
4849
<extra-enforcer-rules.version>1.6.2</extra-enforcer-rules.version>
4950
<flatten-maven-plugin.version>1.4.1</flatten-maven-plugin.version>
@@ -454,6 +455,11 @@ limitations under the License.]]>
454455
<artifactId>spotless-maven-plugin</artifactId>
455456
<version>${spotless-maven-plugin.version}</version>
456457
</plugin>
458+
<plugin>
459+
<groupId>org.apache.maven.plugins</groupId>
460+
<artifactId>maven-shade-plugin</artifactId>
461+
<version>${maven-shade-plugin.version}</version>
462+
</plugin>
457463
</plugins>
458464
</pluginManagement>
459465

@@ -651,6 +657,87 @@ limitations under the License.]]>
651657
</execution>
652658
</executions>
653659
</plugin>
660+
<plugin>
661+
<artifactId>maven-jar-plugin</artifactId>
662+
<configuration>
663+
<archive>
664+
<manifest>
665+
<mainClass>com.redhat.exhort.cli.App</mainClass>
666+
</manifest>
667+
</archive>
668+
</configuration>
669+
</plugin>
670+
<plugin>
671+
<groupId>org.apache.maven.plugins</groupId>
672+
<artifactId>maven-shade-plugin</artifactId>
673+
<executions>
674+
<execution>
675+
<phase>package</phase>
676+
<goals>
677+
<goal>shade</goal>
678+
</goals>
679+
<configuration>
680+
<shadedArtifactAttached>true</shadedArtifactAttached>
681+
<shadedClassifierName>cli</shadedClassifierName>
682+
683+
<!-- Filters to exclude problematic files -->
684+
<filters>
685+
<filter>
686+
<artifact>*:*</artifact>
687+
<excludes>
688+
<!-- Exclude module-info.class files to avoid strong encapsulation warnings -->
689+
<exclude>module-info.class</exclude>
690+
<exclude>META-INF/versions/*/module-info.class</exclude>
691+
<!-- Exclude signature files -->
692+
<exclude>META-INF/*.SF</exclude>
693+
<exclude>META-INF/*.DSA</exclude>
694+
<exclude>META-INF/*.RSA</exclude>
695+
<!-- Exclude duplicate MANIFEST.MF files (will be recreated) -->
696+
<exclude>META-INF/MANIFEST.MF</exclude>
697+
</excludes>
698+
</filter>
699+
</filters>
700+
701+
<!-- Transformers to handle overlapping resources -->
702+
<transformers>
703+
<!-- Main class transformer -->
704+
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
705+
<mainClass>com.redhat.exhort.cli.App</mainClass>
706+
</transformer>
707+
708+
<!-- Service files transformer for Jackson and other services -->
709+
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
710+
711+
<!-- Append NOTICE files -->
712+
<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
713+
<resource>META-INF/NOTICE</resource>
714+
</transformer>
715+
<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
716+
<resource>META-INF/NOTICE.txt</resource>
717+
</transformer>
718+
<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
719+
<resource>META-INF/NOTICE.md</resource>
720+
</transformer>
721+
722+
<!-- Append LICENSE files -->
723+
<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
724+
<resource>META-INF/LICENSE</resource>
725+
</transformer>
726+
<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
727+
<resource>META-INF/LICENSE.txt</resource>
728+
</transformer>
729+
<transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
730+
<resource>META-INF/LICENSE.md</resource>
731+
</transformer>
732+
733+
</transformers>
734+
735+
<!-- Create non-verbose output -->
736+
<createDependencyReducedPom>false</createDependencyReducedPom>
737+
</configuration>
738+
</execution>
739+
</executions>
740+
</plugin>
654741
<plugin>
655742
<groupId>com.diffplug.spotless</groupId>
656743
<artifactId>spotless-maven-plugin</artifactId>
@@ -813,9 +900,6 @@ limitations under the License.]]>
813900
<plugin>
814901
<groupId>de.sormuras.junit</groupId>
815902
<artifactId>junit-platform-maven-plugin</artifactId>
816-
<version>${junit-platform-maven-plugin.version}</version>
817-
<configuration>
818-
</configuration>
819903
</plugin>
820904
</plugins>
821905
</build>

0 commit comments

Comments
 (0)