|
1 | | -# Spring PetClinic Sample Application [](https://github.com/spring-projects/spring-petclinic/actions/workflows/maven-build.yml)[](https://github.com/spring-projects/spring-petclinic/actions/workflows/gradle-build.yml) |
| 1 | +# GitHub Security + Ona Automations |
2 | 2 |
|
3 | | -[](https://gitpod.io/#https://github.com/spring-projects/spring-petclinic) [](https://github.com/codespaces/new?hide_repo_select=true&ref=main&repo=7517918) |
| 3 | +Security scanners are good at finding vulnerabilities. Fixing them is the hard part. Teams accumulate a backlog of findings that grows faster than developers can address it. Developers see security fixes as toil. And tools that auto-generate PRs via text search-and-replace often produce changes that are insufficiently tested or break the application — creating more work, not less. |
4 | 4 |
|
5 | | -## Understanding the Spring Petclinic application with a few diagrams |
| 5 | +[Ona](https://ona.com) takes a different approach: |
6 | 6 |
|
7 | | -See the presentation here: |
8 | | -[Spring Petclinic Sample Application (legacy slides)](https://speakerdeck.com/michaelisvy/spring-petclinic-sample-application?slide=20) |
| 7 | +- An **AI software engineer** analyzes each finding and crafts the code change — not a regex substitution, but a reasoned fix that accounts for the project's structure and conventions. |
| 8 | +- The fix is **built and tested in a fully equipped dev environment** where the modified code can actually compile and run. |
| 9 | +- The agent **iterates until the fix is proven not to break the app** — if tests fail, it reads the errors, adjusts, and retries. |
9 | 10 |
|
10 | | -> **Note:** These slides refer to a legacy, pre–Spring Boot version of Petclinic and may not reflect the current Spring Boot–based implementation. |
11 | | -> For up-to-date information, please refer to this repository and its documentation. |
| 11 | +The result is a PR that is ready to review and merge, not a starting point that needs manual cleanup. |
12 | 12 |
|
| 13 | +This repo demonstrates the setup using [Spring PetClinic](https://github.com/spring-projects/spring-petclinic) (Java/Maven) with GitHub's free security features. |
13 | 14 |
|
14 | | -## Run Petclinic locally |
| 15 | +## Security scanning tools |
15 | 16 |
|
16 | | -Spring Petclinic is a [Spring Boot](https://spring.io/guides/gs/spring-boot) application built using [Maven](https://spring.io/guides/gs/maven/) or [Gradle](https://spring.io/guides/gs/gradle/). |
17 | | -Java 17 or later is required for the build, and the application can run with Java 17 or newer. |
| 17 | +All tools below are free for public repos on GitHub's free org plan. |
18 | 18 |
|
19 | | -You first need to clone the project locally: |
| 19 | +### Dependabot alerts |
20 | 20 |
|
21 | | -```bash |
22 | | -git clone https://github.com/spring-projects/spring-petclinic.git |
23 | | -cd spring-petclinic |
24 | | -``` |
25 | | -If you are using Maven, you can start the application on the command-line as follows: |
| 21 | +Dependabot monitors your dependency graph for known vulnerabilities and creates alerts under **Security > Dependabot**. |
26 | 22 |
|
27 | | -```bash |
28 | | -./mvnw spring-boot:run |
29 | | -``` |
30 | | -With Gradle, the command is as follows: |
| 23 | +For Maven projects, GitHub's dependency graph often can't resolve versions inherited from a parent BOM. The [`dependency-submission.yml`](.github/workflows/dependency-submission.yml) workflow solves this by running `mvn` to resolve the full dependency tree and submitting it to GitHub's dependency graph API. |
31 | 24 |
|
32 | | -```bash |
33 | | -./gradlew bootRun |
34 | | -``` |
| 25 | +### Code scanning (CodeQL) |
35 | 26 |
|
36 | | -You can then access the Petclinic at <http://localhost:8080/>. |
| 27 | +[CodeQL](https://codeql.github.com/) performs static analysis on your source code. GitHub's default setup analyzes Java and Actions code on every push and PR. Results appear under **Security > Code scanning**. |
37 | 28 |
|
38 | | -<img width="1042" alt="petclinic-screenshot" src="https://cloud.githubusercontent.com/assets/838318/19727082/2aee6d6c-9b8e-11e6-81fe-e889a5ddfded.png"> |
| 29 | +### Trivy (filesystem scan) |
39 | 30 |
|
40 | | -You can, of course, run Petclinic in your favorite IDE. |
41 | | -See below for more details. |
| 31 | +[Trivy](https://github.com/aquasecurity/trivy) scans dependency files (pom.xml, lock files, etc.) for known CVEs. The [`trivy.yml`](.github/workflows/trivy.yml) workflow runs a filesystem scan and uploads SARIF results to **Security > Code scanning**. |
42 | 32 |
|
43 | | -## Building a Container |
| 33 | +### OSV-Scanner |
44 | 34 |
|
45 | | -There is no `Dockerfile` in this project. You can build a container image (if you have a docker daemon) using the Spring Boot build plugin: |
| 35 | +[OSV-Scanner](https://github.com/google/osv-scanner) checks dependencies against the [OSV database](https://osv.dev/). The [`osv-scanner.yml`](.github/workflows/osv-scanner.yml) workflow runs on push (scheduled scan) and on PRs (diff scan to catch newly introduced vulnerabilities). Results upload to **Security > Code scanning**. |
46 | 36 |
|
47 | | -```bash |
48 | | -./mvnw spring-boot:build-image |
49 | | -``` |
| 37 | +## Ona automations |
50 | 38 |
|
51 | | -## In case you find a bug/suggested improvement for Spring Petclinic |
| 39 | +Two Ona automations in [`.ona/`](.ona/) use the GitHub CLI to fetch the highest-severity open alert, apply a fix, run tests, and open a PR. |
52 | 40 |
|
53 | | -Our issue tracker is available [here](https://github.com/spring-projects/spring-petclinic/issues). |
| 41 | +### `fix-dependabot-alert` |
54 | 42 |
|
55 | | -## Database configuration |
| 43 | +[`.ona/fix-dependabot-alert.yaml`](.ona/fix-dependabot-alert.yaml) |
56 | 44 |
|
57 | | -In its default configuration, Petclinic uses an in-memory database (H2) which |
58 | | -gets populated at startup with data. The h2 console is exposed at `http://localhost:8080/h2-console`, |
59 | | -and it is possible to inspect the content of the database using the `jdbc:h2:mem:<uuid>` URL. The UUID is printed at startup to the console. |
| 45 | +1. **Install gh CLI** if not present |
| 46 | +2. **Fetch** the highest-severity open Dependabot alert via `gh api` |
| 47 | +3. **Analyze** the alert and read the manifest to understand how the dependency is declared |
| 48 | +4. **Upgrade** the dependency to the patched version |
| 49 | +5. **Verify** with `./mvnw compile test` and `./mvnw dependency:tree` |
| 50 | +6. **Open a PR** with alert details, CVE, CVSS score, and verification checklist |
60 | 51 |
|
61 | | -A similar setup is provided for MySQL and PostgreSQL if a persistent database configuration is needed. Note that whenever the database type changes, the app needs to run with a different profile: `spring.profiles.active=mysql` for MySQL or `spring.profiles.active=postgres` for PostgreSQL. See the [Spring Boot documentation](https://docs.spring.io/spring-boot/how-to/properties-and-configuration.html#howto.properties-and-configuration.set-active-spring-profiles) for more detail on how to set the active profile. |
| 52 | +### `fix-codescan-alert` |
62 | 53 |
|
63 | | -You can start MySQL or PostgreSQL locally with whatever installer works for your OS or use docker: |
| 54 | +[`.ona/fix-codescan-alert.yaml`](.ona/fix-codescan-alert.yaml) |
64 | 55 |
|
65 | | -```bash |
66 | | -docker run -e MYSQL_USER=petclinic -e MYSQL_PASSWORD=petclinic -e MYSQL_ROOT_PASSWORD=root -e MYSQL_DATABASE=petclinic -p 3306:3306 mysql:9.5 |
67 | | -``` |
| 56 | +1. **Install gh CLI** if not present |
| 57 | +2. **Fetch** the highest-severity open code scanning alert via `gh api` |
| 58 | +3. **Analyze** the alert, read the affected source file and context |
| 59 | +4. **Fix** the issue (code change for CodeQL findings, dependency upgrade for Trivy/OSV findings) |
| 60 | +5. **Verify** with `./mvnw compile test` |
| 61 | +6. **Open a PR** with alert details and verification checklist |
68 | 62 |
|
69 | | -or |
| 63 | +Both automations authenticate using the token from the git credential helper (`GITHUB_TOKEN` env var), avoiding the need for additional secrets. |
70 | 64 |
|
71 | | -```bash |
72 | | -docker run -e POSTGRES_USER=petclinic -e POSTGRES_PASSWORD=petclinic -e POSTGRES_DB=petclinic -p 5432:5432 postgres:18.1 |
73 | | -``` |
74 | | - |
75 | | -Further documentation is provided for [MySQL](https://github.com/spring-projects/spring-petclinic/blob/main/src/main/resources/db/mysql/petclinic_db_setup_mysql.txt) |
76 | | -and [PostgreSQL](https://github.com/spring-projects/spring-petclinic/blob/main/src/main/resources/db/postgres/petclinic_db_setup_postgres.txt). |
77 | | - |
78 | | -Instead of vanilla `docker` you can also use the provided `docker-compose.yml` file to start the database containers. Each one has a service named after the Spring profile: |
79 | | - |
80 | | -```bash |
81 | | -docker compose up mysql |
82 | | -``` |
83 | | - |
84 | | -or |
85 | | - |
86 | | -```bash |
87 | | -docker compose up postgres |
88 | | -``` |
| 65 | +## Set up on your own repo |
89 | 66 |
|
90 | | -## Test Applications |
| 67 | +### 1. Enable security scanning |
91 | 68 |
|
92 | | -At development time we recommend you use the test applications set up as `main()` methods in `PetClinicIntegrationTests` (using the default H2 database and also adding Spring Boot Devtools), `MySqlTestApplication` and `PostgresIntegrationTests`. These are set up so that you can run the apps in your IDE to get fast feedback and also run the same classes as integration tests against the respective database. The MySql integration tests use Testcontainers to start the database in a Docker container, and the Postgres tests use Docker Compose to do the same thing. |
| 69 | +Set up scanners so that alerts appear under **Security** in your GitHub repo. This repo uses Dependabot, CodeQL, Trivy, and OSV-Scanner — see the [`.github/workflows/`](.github/workflows/) directory for examples. Use whichever combination fits your project. |
93 | 70 |
|
94 | | -## Compiling the CSS |
| 71 | +GitHub docs: |
| 72 | +- [Dependabot alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/configuring-dependabot-alerts) |
| 73 | +- [Code scanning (CodeQL)](https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning/configuring-default-setup-for-code-scanning) |
| 74 | +- [Third-party SARIF uploads](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github) (Trivy, OSV-Scanner, etc.) |
95 | 75 |
|
96 | | -There is a `petclinic.css` in `src/main/resources/static/resources/css`. It was generated from the `petclinic.scss` source, combined with the [Bootstrap](https://getbootstrap.com/) library. If you make changes to the `scss`, or upgrade Bootstrap, you will need to re-compile the CSS resources using the Maven profile "css", i.e. `./mvnw package -P css`. There is no build profile for Gradle to compile the CSS. |
| 76 | +### 2. Add Ona automations |
97 | 77 |
|
98 | | -## Working with Petclinic in your IDE |
| 78 | +Copy the two automation files into your repo: |
99 | 79 |
|
100 | | -### Prerequisites |
101 | | - |
102 | | -The following items should be installed in your system: |
103 | | - |
104 | | -- Java 17 or newer (full JDK, not a JRE) |
105 | | -- [Git command line tool](https://help.github.com/articles/set-up-git) |
106 | | -- Your preferred IDE |
107 | | - - Eclipse with the m2e plugin. Note: when m2e is available, there is a m2 icon in `Help -> About` dialog. If m2e is |
108 | | - not there, follow the installation process [here](https://www.eclipse.org/m2e/) |
109 | | - - [Spring Tools Suite](https://spring.io/tools) (STS) |
110 | | - - [IntelliJ IDEA](https://www.jetbrains.com/idea/) |
111 | | - - [VS Code](https://code.visualstudio.com) |
112 | | - |
113 | | -### Steps |
114 | | - |
115 | | -1. On the command line run: |
116 | | - |
117 | | - ```bash |
118 | | - git clone https://github.com/spring-projects/spring-petclinic.git |
119 | | - ``` |
120 | | - |
121 | | -1. Inside Eclipse or STS: |
122 | | - |
123 | | - Open the project via `File -> Import -> Maven -> Existing Maven project`, then select the root directory of the cloned repo. |
124 | | - |
125 | | - Then either build on the command line `./mvnw generate-resources` or use the Eclipse launcher (right-click on project and `Run As -> Maven install`) to generate the CSS. Run the application's main method by right-clicking on it and choosing `Run As -> Java Application`. |
126 | | -
|
127 | | -1. Inside IntelliJ IDEA: |
128 | | -
|
129 | | - In the main menu, choose `File -> Open` and select the Petclinic [pom.xml](pom.xml). Click on the `Open` button. |
| 80 | +``` |
| 81 | +.ona/fix-dependabot-alert.yaml |
| 82 | +.ona/fix-codescan-alert.yaml |
| 83 | +``` |
130 | 84 |
|
131 | | - - CSS files are generated from the Maven build. You can build them on the command line `./mvnw generate-resources` or right-click on the `spring-petclinic` project then `Maven -> Generates sources and Update Folders`. |
| 85 | +Adjust the agent prompts if your project uses a different build tool (e.g., replace `./mvnw` with `./gradlew` or `npm`). |
132 | 86 |
|
133 | | - - A run configuration named `PetClinicApplication` should have been created for you if you're using a recent Ultimate version. Otherwise, run the application by right-clicking on the `PetClinicApplication` main class and choosing `Run 'PetClinicApplication'`. |
| 87 | +#### Prerequisites |
134 | 88 |
|
135 | | -1. Navigate to the Petclinic |
| 89 | +Log in to Ona before running any `ona ai` commands: |
136 | 90 |
|
137 | | - Visit [http://localhost:8080](http://localhost:8080) in your browser. |
| 91 | +```bash |
| 92 | +ona login |
| 93 | +``` |
138 | 94 |
|
139 | | -## Looking for something in particular? |
| 95 | +#### Install automations |
140 | 96 |
|
141 | | -|Spring Boot Configuration | Class or Java property files | |
142 | | -|--------------------------|---| |
143 | | -|The Main Class | [PetClinicApplication](https://github.com/spring-projects/spring-petclinic/blob/main/src/main/java/org/springframework/samples/petclinic/PetClinicApplication.java) | |
144 | | -|Properties Files | [application.properties](https://github.com/spring-projects/spring-petclinic/blob/main/src/main/resources) | |
145 | | -|Caching | [CacheConfiguration](https://github.com/spring-projects/spring-petclinic/blob/main/src/main/java/org/springframework/samples/petclinic/system/CacheConfiguration.java) | |
| 97 | +Use the Ona CLI to register each automation: |
146 | 98 |
|
147 | | -## Interesting Spring Petclinic branches and forks |
| 99 | +```bash |
| 100 | +ona ai automation create .ona/fix-dependabot-alert.yaml |
| 101 | +ona ai automation create .ona/fix-codescan-alert.yaml |
| 102 | +``` |
148 | 103 |
|
149 | | -The Spring Petclinic "main" branch in the [spring-projects](https://github.com/spring-projects/spring-petclinic) |
150 | | -GitHub org is the "canonical" implementation based on Spring Boot and Thymeleaf. There are |
151 | | -[quite a few forks](https://spring-petclinic.github.io/docs/forks.html) in the GitHub org |
152 | | -[spring-petclinic](https://github.com/spring-petclinic). If you are interested in using a different technology stack to implement the Pet Clinic, please join the community there. |
| 104 | +#### Update automations |
153 | 105 |
|
154 | | -## Interaction with other open-source projects |
| 106 | +After editing a YAML file, update the registered automation. First find the automation ID: |
155 | 107 |
|
156 | | -One of the best parts about working on the Spring Petclinic application is that we have the opportunity to work in direct contact with many Open Source projects. We found bugs/suggested improvements on various topics such as Spring, Spring Data, Bean Validation and even Eclipse! In many cases, they've been fixed/implemented in just a few days. |
157 | | -Here is a list of them: |
| 108 | +```bash |
| 109 | +ona ai automation list |
| 110 | +``` |
158 | 111 |
|
159 | | -| Name | Issue | |
160 | | -|------|-------| |
161 | | -| Spring JDBC: simplify usage of NamedParameterJdbcTemplate | [SPR-10256](https://github.com/spring-projects/spring-framework/issues/14889) and [SPR-10257](https://github.com/spring-projects/spring-framework/issues/14890) | |
162 | | -| Bean Validation / Hibernate Validator: simplify Maven dependencies and backward compatibility |[HV-790](https://hibernate.atlassian.net/browse/HV-790) and [HV-792](https://hibernate.atlassian.net/browse/HV-792) | |
163 | | -| Spring Data: provide more flexibility when working with JPQL queries | [DATAJPA-292](https://github.com/spring-projects/spring-data-jpa/issues/704) | |
| 112 | +Then apply the updated file: |
164 | 113 |
|
165 | | -## Contributing |
| 114 | +```bash |
| 115 | +ona ai automation update <automation-id> .ona/fix-dependabot-alert.yaml |
| 116 | +``` |
166 | 117 |
|
167 | | -The [issue tracker](https://github.com/spring-projects/spring-petclinic/issues) is the preferred channel for bug reports, feature requests and submitting pull requests. |
| 118 | +#### Run automations |
168 | 119 |
|
169 | | -For pull requests, editor preferences are available in the [editor config](.editorconfig) for easy use in common text editors. Read more and download plugins at <https://editorconfig.org>. All commits must include a __Signed-off-by__ trailer at the end of each commit message to indicate that the contributor agrees to the Developer Certificate of Origin. |
170 | | -For additional details, please refer to the blog post [Hello DCO, Goodbye CLA: Simplifying Contributions to Spring](https://spring.io/blog/2025/01/06/hello-dco-goodbye-cla-simplifying-contributions-to-spring). |
| 120 | +Trigger them manually from the Ona dashboard or via the CLI. Each run picks the highest-severity open alert, fixes it, and opens a PR. |
171 | 121 |
|
172 | 122 | ## License |
173 | 123 |
|
|
0 commit comments