Add FINOS Security Actions

[TheJuanAndOnly99]

This PR adds 2 GitHub actions that perform a CVE and static code scan.

With the CVE scanning I could use some help as we are a bit unfamiliar with Gradle. The scan is passing but I am not sure if dependencyCheckAnalyze task is taking in consideration all project sub-modules. Could you please point me in the right direction here?

As far as the static code scan goes there were also many findings. Please also take a look at these as we believe this tool does a good job at pointing out any potential vulnerabilities. If you need to bypass any you can do so (like I did here).

Additional steps that would greatly improve the security posture of this project:

• Enable RenovateBot - please let me know if I can enable it on this repo. This tool will help greatly with keeping your dependencies up to date.
• Add GitHub (security) Action badges at the top of the project README
• Apply for the OpenSSF Passing badge - https://bestpractices.coreinfrastructure.org/

Eager to hear your thoughts on it, and happy to adjust the aim based on your feedback.

[TheJuanAndOnly99]

Hi @yinan-symphony I added the Renovate bot I mentioned in the PR on my fork. You can see the results here TheJuanAndOnly99#3.

[symphony-soufiane]

I would prefer this action to run on every push/pull_request if it lasts a reasonable duration. WDYT?

[symphony-soufiane]

Also, the documentation mentions "dependencyCheckUpdate" task to update NVD from NIST. Do we need to add it to be sure the NVD is uptodate?

[TheJuanAndOnly99]

Hi @symphony-soufiane fair question. I think for a GitHub action it is not needed as the action does not cache any build artifacts.

As for the action to run on every push/pull/request. It seems it takes around ~6 min to complete. I have added the change to the action if you want to go ahead with it.

[symphony-soufiane]

I think that 'dependencyCheckAggregate' should be used rather to scan all modules.
Running locally dependencyCheckAnalyze showed in the report "Dependencies Scanned: 0 (0 unique)" while with 'dependencyCheckAggregate' I can see 'Dependencies Scanned: 151 (151 unique)'

[yinan-symphony]

yes, in multi-module project, Aggregate should be the one to use.

[TheJuanAndOnly99]

Thanks @symphony-soufiane and @yinan-symphony! I've changed it in the PR. As you can see there are a few CVEs. Can you please take a look. If they are safe to ignore you can use the allow-list.xml file to do so.

[yinan-symphony]

Hi @yinan-symphony I added the Renovate bot I mentioned in the PR on my fork. You can see the results here TheJuanAndOnly99#3.

sure, thx ! we will have a look

[yinan-symphony]

Hi @yinan-symphony I added the Renovate bot I mentioned in the PR on my fork. You can see the results here TheJuanAndOnly99#3.

@TheJuanAndOnly99 could you please configure the Renovate to set
{ "dependencyDashboardApproval": true }
before enabling it in main branch.
many thx

[TheJuanAndOnly99]

@yinan-symphony I have added a renovate.json file to the PR with the { "dependencyDashboardApproval": true } config.

[yinan-symphony]

@TheJuanAndOnly99 thank you for your contribute, could you please create a new PR to feature/security-scanning branch, so that i can update some config files before merging to main branch. Thank you in advance.