chore: setup pre-commit, CI secret scanning, and initial lint fixes

.github/workflows/sast.yml

@@ -16,7 +16,7 @@ jobs:
     env:
       SEMGREP_CONFIG_RULESETS: >-
         semgrep-rules/generic semgrep-rules/problem-based-packs semgrep-rules/bash semgrep-rules/java auto
-        semgrep-rules/yaml semgrep-rules/package_managers p/default
+        semgrep-rules/yaml semgrep-rules/package_managers p/default p/gitleaks
       OPENGREP_EXCLUDE: >-
         *.sarif ci/ Dockerfile* .pre-commit-config.yaml docs/** README.md AGENTS.md
       OPENGREP_SARIF_OUTPUT: sast-semgrep-app.sarif

.github/workflows/secrets-scan.yml

@@ -0,0 +1,40 @@
+name: Secret Scanning (gitleaks)
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    env:
+      GITLEAKS_SARIF_OUTPUT: gitleaks.sarif
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Install gitleaks
+        run: bash ci/setup-tools.sh --install-tool gitleaks
+
+      - name: Install and run gitleaks
+        run: >
+          gitleaks dir .
+          --config ci/suppress_gitleaks.toml
+          --redact
+          --report-format sarif
+          --report-path "$GITLEAKS_SARIF_OUTPUT"
+
+      - name: Upload SARIF to code scanning
+        if: always()
+        uses: github/codeql-action/upload-sarif@c35d1b164463ee62a100735382aaaa525c5d3496 #v2.25.6
+        with:
+          sarif_file: ${{ env.GITLEAKS_SARIF_OUTPUT }}
+          category: gitleaks

.pre-commit-config.yaml

@@ -13,3 +13,12 @@ repos:
     - id: pretty-format-json
       args: ["--autofix"]
       exclude: slack.json
+    - id: check-xml
+    - id: detect-private-key
+    - id: check-case-conflict
+    - id: mixed-line-ending
+
+- repo: https://github.com/gitleaks/gitleaks
+  rev: v8.30.0
+  hooks:
+    - id: gitleaks

Dockerfile

@@ -1,15 +1,14 @@
 #######################################################
 # Build the spring boot maven project
 #######################################################
-FROM maven:3.9.11-amazoncorretto-21 AS mvn-build-env
+FROM maven:3.9.11-amazoncorretto-21@sha256:82d98fbed447e3f7dfbf1089840a51bfaeb5651cb47a9c5820139d054db3dde1 AS mvn-build-env
 LABEL maintainer="Thanasis Karampatsis <tkarabatsis@athenarc.gr>"
 
 ENV CODE_PATH="/opt/code"
 WORKDIR $CODE_PATH
 
 COPY pom.xml $CODE_PATH/
 
-# Pre-fetch dependencies first to improve build cache efficiency.
 RUN mvn -B -ntp dependency:go-offline
 
 COPY src/ $CODE_PATH/src
@@ -19,17 +18,11 @@ RUN mvn -B -ntp clean package
 #######################################################
 # Setup the running container
 #######################################################
-FROM amazoncorretto:21-alpine3.21
+FROM amazoncorretto:21-alpine3.21@sha256:392b286e53c7f4cd366bd2f752f509b7e24de9f414564bccd7d152a58214a8b6
 
-#######################################################
-# Setting up timezone
-#######################################################
 ENV TZ=Etc/GMT
 RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
 
-#######################################################
-# Setting up environment
-#######################################################
 ENV APP_CONFIG_TEMPLATE="/opt/config/application.tmpl"
 ENV APP_CONFIG_LOCATION="/opt/config/application.yml"
 ENV SPRING_CONFIG_LOCATION="file:/opt/config/application.yml"
@@ -43,25 +36,15 @@ WORKDIR /opt
 
 RUN apk add --no-cache curl
 
-#######################################################
-# Install dockerize
-#######################################################
+# renovate: datasource=github-releases depName=jwilder/dockerize
 ENV DOCKERIZE_VERSION=v0.14.0
 RUN wget https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
     && tar -C /usr/local/bin -xzvf dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz \
     && rm dockerize-alpine-linux-amd64-$DOCKERIZE_VERSION.tar.gz
 
-
-#######################################################
-# Prepare the spring boot application files
-#######################################################
 COPY config/application.tmpl $APP_CONFIG_TEMPLATE
 COPY --from=mvn-build-env /opt/code/target/platform-backend.jar /usr/share/jars/
 
-
-#######################################################
-# Configuration for the backend config files
-#######################################################
 ENV DISABLED_ALGORITHMS_CONFIG_PATH="/opt/platform/algorithms/disabledAlgorithms.json"
 COPY config/disabledAlgorithms.json $DISABLED_ALGORITHMS_CONFIG_PATH
 VOLUME /opt/platform/api
@@ -73,4 +56,4 @@ RUN addgroup -S appgroup && adduser -S appuser -G appgroup \
 USER appuser
 ENTRYPOINT ["sh", "-ec", "exec dockerize -template ${APP_CONFIG_TEMPLATE}:${APP_CONFIG_LOCATION} java --add-opens java.base/java.io=ALL-UNNAMED -Daeron.term.buffer.length -jar /usr/share/jars/platform-backend.jar"]
 EXPOSE 8080
-HEALTHCHECK --start-period=60s CMD curl --fail --silent --show-error http://localhost:8080/services/actuator/health | grep -q '"status":"UP"'
+HEALTHCHECK --start-period=60s CMD ["sh", "-c", "curl --fail --silent --show-error http://localhost:8080/services/actuator/health | grep -q '\"status\":\"UP\"'"]

ci/sast_scan.py

@@ -19,7 +19,7 @@
 SEMGREP_CONFIG_RULESETS = os.getenv(
     "SEMGREP_CONFIG_RULESETS",
     " semgrep-rules/generic semgrep-rules/problem-based-packs semgrep-rules/bash "
-    " semgrep-rules/java auto semgrep-rules/yaml semgrep-rules/package_managers p/default "
+    " semgrep-rules/java auto semgrep-rules/yaml semgrep-rules/package_managers p/default p/gitleaks "
 ).split()
 OPENGREP_EXCLUDE = os.getenv(
     "OPENGREP_EXCLUDE",

ci/setup-tools.sh

@@ -30,6 +30,10 @@ SEMGREP_RULES_DIR="semgrep-rules"
 HADOLINT_VERSION="${HADOLINT_VERSION:-v2.14.0}"
 HADOLINT_SHA256="${HADOLINT_SHA256:-6bf226944684f56c84dd014e8b979d27425c0148f61b3bd99bcc6f39e9dc5a47}"
 
+# renovate: datasource=github-release-attachments depName=gitleaks/gitleaks
+GITLEAKS_VERSION="${GITLEAKS_VERSION:-v8.30.1}"
+GITLEAKS_SHA256="${GITLEAKS_SHA256:-551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb}"
+
 # renovate: datasource=npm depName=@cyclonedx/cyclonedx-npm
 CYCLONEDX_NPM_VERSION="${CYCLONEDX_NPM_VERSION:-6.0.0}"
 
@@ -128,6 +132,19 @@ if should_install "hadolint"; then
   echo "Hadolint installed OK"
 fi
 
+# --- Gitleaks -----------------------------------------------------------
+if should_install "gitleaks"; then
+  echo "[setup-tools] Installing Gitleaks ${GITLEAKS_VERSION}"
+  GITLEAKS_TARBALL="gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz"
+  download_and_verify \
+    "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/${GITLEAKS_TARBALL}" \
+    "${TMP_DIR}/${GITLEAKS_TARBALL}" \
+    "${GITLEAKS_SHA256}"
+  sudo tar -xzf "${TMP_DIR}/${GITLEAKS_TARBALL}" -C /usr/local/bin gitleaks
+  gitleaks version
+  echo "Gitleaks installed OK"
+fi
+
 # --- SBOM generation ----------------------------------------------------
 case "$SBOM_ECOSYSTEM" in
   maven)

ci/suppress_gitleaks.toml

@@ -0,0 +1,4 @@
+[allowlist]
+paths = [
+  '''AGENTS\.md''',
+]

config/disabledAlgorithms.json

@@ -1,4 +1,4 @@
-[
-	"THREE_C",
-	"KAPLAN_MEIER"
-]
+[
+  "THREE_C",
+  "KAPLAN_MEIER"
+]

pom.xml

@@ -13,7 +13,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>4.0.6</version>
+        <version>4.0.7</version>
     </parent>
 
     <properties>
@@ -31,7 +31,7 @@
         <snakeyaml.version>2.6</snakeyaml.version>
         <nimbus-jose-jwt.version>10.9.1</nimbus-jose-jwt.version>
         <jackson-2-bom.version>2.21.5</jackson-2-bom.version>
-        <jackson-bom.version>3.1.4</jackson-bom.version>
+        <jackson-bom.version>3.1.5</jackson-bom.version>
     </properties>
 
     <dependencies>

renovate.json

@@ -21,6 +21,16 @@
       "matchStrings": [
         "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\n\\s*python-version:\\s*'(?<currentValue>[0-9][0-9.]*)'"
       ]
+    },
+    {
+      "customType": "regex",
+      "description": "Bump DOCKERIZE_VERSION pinned in Dockerfile",
+      "managerFilePatterns": [
+        "/(^|/)Dockerfile[^/]*$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\s*\\nENV DOCKERIZE_VERSION=(?<currentValue>v[0-9][0-9.]*)"
+      ]
     }
   ],
   "enabledManagers": [
@@ -48,6 +58,7 @@
       "matchDatasources": [
         "github-release-attachments",
         "github-tags",
+        "github-releases",
         "npm",
         "python-version"
       ],

src/main/java/hbp/mip/configurations/OpenApiConfig.java

@@ -15,4 +15,4 @@ public OpenAPI usersMicroserviceOpenAPI() {
                 .info(new Info().title("Platform-backend API")
                         .version("1.0"));
     }
-}
+}

src/main/java/hbp/mip/experiment/ExperimentAPI.java

@@ -132,4 +132,4 @@ public ResponseEntity<ExperimentDTO> createTransientExperiment(Authentication au
 
         return new ResponseEntity<>(experimentResponse, HttpStatus.OK);
     }
-}
+}

src/main/java/hbp/mip/user/UserDTO.java

@@ -10,4 +10,4 @@ public UserDTO(UserDAO userDAO){
                 userDAO.getAgreeNDA()
         );
     }
-}
+}

src/main/java/hbp/mip/utils/ControllerExceptionHandler.java

@@ -27,7 +27,7 @@ public ResponseEntity<Object> handleExperimentNotFoundException(ExperimentNotFou
 
         return new ResponseEntity<>(message, HttpStatus.NOT_FOUND);
     }
-    
+
     @ExceptionHandler(BadRequestException.class)
     public ResponseEntity<Object> handleBadRequestException(BadRequestException ex, WebRequest request) {
         ErrorMessage message = new ErrorMessage(

src/main/java/hbp/mip/utils/CustomResourceLoader.java

@@ -18,4 +18,4 @@ public void setResourceLoader(@NonNull ResourceLoader resourceLoader) {
     public Resource getResource(String resourceLocation) {
         return resourceLoader.getResource(resourceLocation);
     }
-}
+}

src/main/java/hbp/mip/utils/Exceptions/BadRequestException.java

@@ -5,4 +5,4 @@ public class BadRequestException extends RuntimeException {
     public BadRequestException(String msg) {
         super(msg);
     }
-}
+}

src/main/java/hbp/mip/utils/Exceptions/ExperimentNotFoundException.java

@@ -5,4 +5,4 @@ public class ExperimentNotFoundException extends RuntimeException {
     public ExperimentNotFoundException(String msg) {
         super(msg);
     }
-}
+}

src/main/java/hbp/mip/utils/Exceptions/InternalServerError.java

@@ -5,4 +5,4 @@ public class InternalServerError extends RuntimeException {
     public InternalServerError(String msg) {
         super(msg);
     }
-}
+}

src/main/java/hbp/mip/utils/Exceptions/NoContent.java

@@ -5,4 +5,4 @@ public class NoContent extends RuntimeException {
     public NoContent(String msg) {
         super(msg);
     }
-}
+}

src/main/java/hbp/mip/utils/Exceptions/UnauthorizedException.java

@@ -5,4 +5,4 @@ public class UnauthorizedException extends RuntimeException {
     public UnauthorizedException(String msg) {
         super(msg);
     }
-}
+}