From 9b49869d9d70c742947b97bc81e826781dd73994 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@synopsys.com>
Date: Wed, 24 May 2023 13:18:47 +0200
Subject: [PATCH 01/27] Pull Test for simple workflow

---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a81cbd28..f8efcf3c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,3 +18,4 @@ jobs:
     - name: Run tests
       run: mvn -B package
 
+

From c6c745cad22d465619051f77173fe7ca9e33f2ac Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@synopsys.com>
Date: Wed, 24 May 2023 13:21:17 +0200
Subject: [PATCH 02/27] Change pipeline to run on self-hosted runner.

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8efcf3c..fed6e051 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -3,7 +3,7 @@ on: [push, pull_request]
 jobs:
   run:
     name: Java ${{ matrix.java }}
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     strategy:
       matrix:
         java: [ 8 ]

From 63c4ae51cf298524524133e68780ada2706e4a7f Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@synopsys.com>
Date: Wed, 24 May 2023 14:19:56 +0200
Subject: [PATCH 03/27] New Action based Scan workflow

---
 .github/workflows/coverity.sast.yml | 33 +++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/coverity.sast.yml

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
new file mode 100644
index 00000000..0ffa8114
--- /dev/null
+++ b/.github/workflows/coverity.sast.yml
@@ -0,0 +1,33 @@
+name: Synopsys Coverity SAST Scanning
+
+on:
+  push:
+    branches: [ master, main ]
+
+  pull_request:
+    branches: [ master, main ]
+
+jobs:
+  build:
+    runs-on: self-hosted
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        
+      - name: Synopsys Action
+        uses: synopsys-sig/synopsys-action@v1.2.0
+        with:
+          coverity_url: ${{ secrets.COVERITY_URL }}
+          coverity_user: ${{ secrets.COVERITY_USER }}
+          coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
+          # Many customers prefer to set their Coverity project and stream names to match
+          # the GitHub repository name
+          coverity_project_name: ${{ secrets.COVERITY_PROJECT_NAME }}
+          coverity_stream_name: ${{ github.event.repository.name }}
+          # Optionally you may specify the ID number of a saved view to apply as a "break the build" policy.
+          # If any defects are found within this view when applied to the project, the build will be failed
+          # with an exit code.
+          #coverity_policy_view: 100001
+          # Below fields are optional
+          coverity_repository_name: ${{ secrets.COVERITY_REPOSITORY_NAME }}
+          coverity_branch_name: ${{ secrets.COVERITY_BRANCH_NAME }}
\ No newline at end of file

From 81e0f22039e9f28f1b7c262c24ff748b33eda419 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@synopsys.com>
Date: Wed, 24 May 2023 16:27:36 +0200
Subject: [PATCH 04/27] Restructured action script

---
 .github/workflows/coverity.sast.yml | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 0ffa8114..34245a1b 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -14,20 +14,31 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         
-      - name: Synopsys Action
-        uses: synopsys-sig/synopsys-action@v1.2.0
+      - name: Coverity Full Scan
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: synopsys-sig/synopsys-action@v1.1.0
         with:
           coverity_url: ${{ secrets.COVERITY_URL }}
           coverity_user: ${{ secrets.COVERITY_USER }}
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
-          # Many customers prefer to set their Coverity project and stream names to match
-          # the GitHub repository name
-          coverity_project_name: ${{ secrets.COVERITY_PROJECT_NAME }}
-          coverity_stream_name: ${{ github.event.repository.name }}
+          coverity_project_name: ${{ github.event.repository.name }}
+          coverity_stream_name: ${{ github.event.repository.name }}-${{ github.ref_name }}
+          coverity_policy_view: 10008 # viewID for Outstanding Issues
+      - name: Coverity PR Scan
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: synopsys-sig/synopsys-action@v1.1.0
+        with:
+          coverity_url: ${{ vars.COVERITY_URL }}
+          coverity_user: ${{ secrets.COVERITY_USER }}
+          coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
+          coverity_project_name: ${{ github.event.repository.name }}
+          coverity_stream_name: ${{ github.event.repository.name }}-${{ github.base_ref }}
+          coverity_automation_prcomment: true
+          github_token: ${{ secrets.GITHUB_TOKEN }}
           # Optionally you may specify the ID number of a saved view to apply as a "break the build" policy.
           # If any defects are found within this view when applied to the project, the build will be failed
           # with an exit code.
           #coverity_policy_view: 100001
           # Below fields are optional
-          coverity_repository_name: ${{ secrets.COVERITY_REPOSITORY_NAME }}
-          coverity_branch_name: ${{ secrets.COVERITY_BRANCH_NAME }}
\ No newline at end of file
+          #coverity_repository_name: ${{ secrets.COVERITY_REPOSITORY_NAME }}
+          #coverity_branch_name: ${{ secrets.COVERITY_BRANCH_NAME }}

From ba2927f497d4d1609be6808824040a2b8ed2bff3 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@synopsys.com>
Date: Wed, 24 May 2023 17:38:33 +0200
Subject: [PATCH 05/27] Adding in coverity.conf

---
 .github/workflows/coverity.sast.yml | 12 ++++++------
 coverity.conf                       | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+), 6 deletions(-)
 create mode 100644 coverity.conf

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 34245a1b..ec743c4e 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -16,7 +16,7 @@ jobs:
         
       - name: Coverity Full Scan
         if: ${{ github.event_name != 'pull_request' }}
-        uses: synopsys-sig/synopsys-action@v1.1.0
+        uses: synopsys-sig/synopsys-action@v1.2.0
         with:
           coverity_url: ${{ secrets.COVERITY_URL }}
           coverity_user: ${{ secrets.COVERITY_USER }}
@@ -26,19 +26,19 @@ jobs:
           coverity_policy_view: 10008 # viewID for Outstanding Issues
       - name: Coverity PR Scan
         if: ${{ github.event_name == 'pull_request' }}
-        uses: synopsys-sig/synopsys-action@v1.1.0
+        uses: synopsys-sig/synopsys-action@v1.2.0
         with:
-          coverity_url: ${{ vars.COVERITY_URL }}
+          coverity_url: ${{ secrets.COVERITY_URL }}
           coverity_user: ${{ secrets.COVERITY_USER }}
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
           coverity_project_name: ${{ github.event.repository.name }}
           coverity_stream_name: ${{ github.event.repository.name }}-${{ github.base_ref }}
           coverity_automation_prcomment: true
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.PROJECT_GITHUB_TOKEN }}
           # Optionally you may specify the ID number of a saved view to apply as a "break the build" policy.
           # If any defects are found within this view when applied to the project, the build will be failed
           # with an exit code.
-          #coverity_policy_view: 100001
+          coverity_policy_view: 100008
           # Below fields are optional
           #coverity_repository_name: ${{ secrets.COVERITY_REPOSITORY_NAME }}
-          #coverity_branch_name: ${{ secrets.COVERITY_BRANCH_NAME }}
+          #coverity_branch_name: ${{ secrets.COVERITY_BRANCH_NAME }}
\ No newline at end of file
diff --git a/coverity.conf b/coverity.conf
new file mode 100644
index 00000000..34f76458
--- /dev/null
+++ b/coverity.conf
@@ -0,0 +1,20 @@
+{
+    "type": "Coverity configuration",
+    "format_version": 1,
+    "format_minor_version": 7,
+    "settings": {
+        "server": {
+            "url": "https://poc219.coverity.synopsys.com",
+            "ssl": true,
+            "on_new_cert": "trust"
+        },
+        "stream": "insecure-bank-synopsys-master",
+        "cov_run_desktop": {
+            "build_cmd": ["mvn", "package"],
+            "clean_cmd": ["mvn", "clean"]
+        },
+        "ide": {
+            "build_strategy": "CUSTOM"
+        }
+    }
+}
\ No newline at end of file

From 5aebd71de304f1b5c5ac4bd48bd02d465dc43941 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@synopsys.com>
Date: Thu, 25 May 2023 13:18:39 +0200
Subject: [PATCH 06/27] Streamlined action file

---
 .github/workflows/coverity.sast.yml | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index ec743c4e..948ddc44 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -7,13 +7,16 @@ on:
   pull_request:
     branches: [ master, main ]
 
+env:
+  GITHUB_API_URL: https://api.github.com # explicit API Url for bridge
+
 jobs:
   build:
     runs-on: self-hosted
     steps:
       - name: Checkout
         uses: actions/checkout@v3
-        
+
       - name: Coverity Full Scan
         if: ${{ github.event_name != 'pull_request' }}
         uses: synopsys-sig/synopsys-action@v1.2.0
@@ -23,7 +26,7 @@ jobs:
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
           coverity_project_name: ${{ github.event.repository.name }}
           coverity_stream_name: ${{ github.event.repository.name }}-${{ github.ref_name }}
-          coverity_policy_view: 10008 # viewID for Outstanding Issues
+          coverity_policy_view: 10008 # Saftey Gate View ID
       - name: Coverity PR Scan
         if: ${{ github.event_name == 'pull_request' }}
         uses: synopsys-sig/synopsys-action@v1.2.0
@@ -35,10 +38,5 @@ jobs:
           coverity_stream_name: ${{ github.event.repository.name }}-${{ github.base_ref }}
           coverity_automation_prcomment: true
           github_token: ${{ secrets.PROJECT_GITHUB_TOKEN }}
-          # Optionally you may specify the ID number of a saved view to apply as a "break the build" policy.
-          # If any defects are found within this view when applied to the project, the build will be failed
-          # with an exit code.
-          coverity_policy_view: 100008
-          # Below fields are optional
-          #coverity_repository_name: ${{ secrets.COVERITY_REPOSITORY_NAME }}
-          #coverity_branch_name: ${{ secrets.COVERITY_BRANCH_NAME }}
\ No newline at end of file
+          coverity_policy_view: 10008 # Saftey Gate View ID
+          include_diagnostics: false

From 62c9486fba95e92e6285de9b88f1e946a434082f Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@synopsys.com>
Date: Thu, 25 May 2023 13:21:56 +0200
Subject: [PATCH 07/27] Exluded .vscode dir from version control

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index bec00f88..20edc589 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ build.xml
 /.apt_generated_tests/
 agent.config
 hdivAgentLog.hlg
+.vscode/

From a301fd687ab6030e47d20a11d1dcc6fc7296e114 Mon Sep 17 00:00:00 2001
From: mathkraemer <43319514+mathkraemer@users.noreply.github.com>
Date: Mon, 6 Oct 2025 10:54:45 +0200
Subject: [PATCH 08/27] Update to latest Blackduck Coverity Scan Action

---
 .github/workflows/coverity.sast.yml | 57 ++++++++++++++++++-----------
 1 file changed, 36 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 948ddc44..c9558698 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -15,28 +15,43 @@ jobs:
     runs-on: self-hosted
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Coverity Full Scan
-        if: ${{ github.event_name != 'pull_request' }}
-        uses: synopsys-sig/synopsys-action@v1.2.0
+        uses: actions/checkout@v4
+     - name: Coverity Scan
+        uses: blackduck-inc/black-duck-security-scan@v2
         with:
-          coverity_url: ${{ secrets.COVERITY_URL }}
+          ### SCANNING: Required fields
+          coverity_url: ${{ vars.COVERITY_URL }}
           coverity_user: ${{ secrets.COVERITY_USER }}
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
-          coverity_project_name: ${{ github.event.repository.name }}
-          coverity_stream_name: ${{ github.event.repository.name }}-${{ github.ref_name }}
-          coverity_policy_view: 10008 # Saftey Gate View ID
-      - name: Coverity PR Scan
-        if: ${{ github.event_name == 'pull_request' }}
-        uses: synopsys-sig/synopsys-action@v1.2.0
+                            
+          ### Coverity Connect users - Uncomment below
+          # coverity_local: true
+          
+          ### POLICY ENFORCEMENT: Uncomment to break build on policy
+          # coverity_policy_view: 'Outstanding Issues'
+          
+          ### PULL REQUEST COMMENTS:
+          coverity_prComment_enabled: true
+          ## Use the parameter below to add comments for issues filtered
+          ## by impact. Default is High if unset
+          ## NOTE: Issues matching coverity_policy_view are ignored if set
+          # coverity_prComment_impacts: 'High,Medium,Low,Audit'
+          github_token: ${{ secrets.GITHUB_TOKEN }} # Required when PR comments is enabled 
+                            
+          ### Mark build status if policy violating issues are found
+          # mark_build_status: 'success'
+                            
+      ### Uncomment below configuration to add custom logic based on return status
+      - name: Coverity Scan Postprocessing
+         id: cmdLine
+         run: |
+           EXIT_CODE=${{ steps.black-duck-security-scan.outputs.status }}
+           echo "Black Duck Security Scan exit status - $EXIT_CODE"
+
+      - name: Save Logs
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          coverity_url: ${{ secrets.COVERITY_URL }}
-          coverity_user: ${{ secrets.COVERITY_USER }}
-          coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
-          coverity_project_name: ${{ github.event.repository.name }}
-          coverity_stream_name: ${{ github.event.repository.name }}-${{ github.base_ref }}
-          coverity_automation_prcomment: true
-          github_token: ${{ secrets.PROJECT_GITHUB_TOKEN }}
-          coverity_policy_view: 10008 # Saftey Gate View ID
-          include_diagnostics: false
+          name: bridge-logs
+          path: ${{ github.workspace }}/.bridge
+          include-hidden-files: true

From 5362cbd78e05b853d68be061c5524429b1e79284 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 14:13:26 +0200
Subject: [PATCH 09/27] Updating Security Scan Plugin

---
 .github/workflows/coverity.sast.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index c9558698..848fdec8 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-     - name: Coverity Scan
+      - name: Coverity Scan
         uses: blackduck-inc/black-duck-security-scan@v2
         with:
           ### SCANNING: Required fields
@@ -25,10 +25,10 @@ jobs:
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
                             
           ### Coverity Connect users - Uncomment below
-          # coverity_local: true
+          coverity_local: true
           
           ### POLICY ENFORCEMENT: Uncomment to break build on policy
-          # coverity_policy_view: 'Outstanding Issues'
+          coverity_policy_view: 'Java Security Policy'
           
           ### PULL REQUEST COMMENTS:
           coverity_prComment_enabled: true
@@ -42,9 +42,9 @@ jobs:
           # mark_build_status: 'success'
                             
       ### Uncomment below configuration to add custom logic based on return status
-      - name: Coverity Scan Postprocessing
-         id: cmdLine
-         run: |
+      - name: Postprocessing
+        id: cmdLine
+        run: |
            EXIT_CODE=${{ steps.black-duck-security-scan.outputs.status }}
            echo "Black Duck Security Scan exit status - $EXIT_CODE"
 

From 22515d5451529a4bb36faf2b2394076b01378e2c Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 14:41:22 +0200
Subject: [PATCH 10/27] Added predefined Coverity install dir.

---
 .github/workflows/coverity.sast.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 848fdec8..29cc3263 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -25,6 +25,7 @@ jobs:
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
                             
           ### Coverity Connect users - Uncomment below
+          coverity_install_directory: ${{ vars.COVERITY_INSTALLDIR }}  # not necessary in prod. env.
           coverity_local: true
           
           ### POLICY ENFORCEMENT: Uncomment to break build on policy

From 0d42de157b1b65cfd3302306e0cef9e52d1df257 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 15:15:19 +0200
Subject: [PATCH 11/27] Added Coverity project name

---
 .github/workflows/coverity.sast.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 29cc3263..beba624e 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -23,9 +23,10 @@ jobs:
           coverity_url: ${{ vars.COVERITY_URL }}
           coverity_user: ${{ secrets.COVERITY_USER }}
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
+          coverity_project_nmae: ${{ vars.COVERITY_PROJECT }} # default overwrite
                             
           ### Coverity Connect users - Uncomment below
-          coverity_install_directory: ${{ vars.COVERITY_INSTALLDIR }}  # not necessary in prod. env.
+          coverity_install_directory: ${{ vars.COVERITY_INSTALLDIR }}  # default overwrite
           coverity_local: true
           
           ### POLICY ENFORCEMENT: Uncomment to break build on policy

From c2102320f74aaf279c2d9acf0cd03facf0481672 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 15:30:12 +0200
Subject: [PATCH 12/27] Fixed typo in project_name property.

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index beba624e..ed6a17e7 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -23,7 +23,7 @@ jobs:
           coverity_url: ${{ vars.COVERITY_URL }}
           coverity_user: ${{ secrets.COVERITY_USER }}
           coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
-          coverity_project_nmae: ${{ vars.COVERITY_PROJECT }} # default overwrite
+          coverity_project_name: ${{ vars.COVERITY_PROJECT }} # default overwrite
                             
           ### Coverity Connect users - Uncomment below
           coverity_install_directory: ${{ vars.COVERITY_INSTALLDIR }}  # default overwrite

From 625ee3ca3171e76f0715e0e41b8006c3eb7c7b82 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 16:25:41 +0200
Subject: [PATCH 13/27] Adding coverity.yaml with dummy build cmd.

---
 coverity.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 coverity.yaml

diff --git a/coverity.yaml b/coverity.yaml
new file mode 100644
index 00000000..8cc06c3a
--- /dev/null
+++ b/coverity.yaml
@@ -0,0 +1,6 @@
+capture:
+  build:
+    clean-command: mvn clean
+    #build-command: mvn -B -DskipTests package
+    #build-commnad: mvn -B -DskipTests -DskipITs clean install # default build-command-inference command for Maven projects
+    build-command: echo test
\ No newline at end of file

From 7323bca9fbe22564afc58cb990f33e13beca6d98 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 16:32:15 +0200
Subject: [PATCH 14/27] Chaning policy view string

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index ed6a17e7..af62df28 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -30,7 +30,7 @@ jobs:
           coverity_local: true
           
           ### POLICY ENFORCEMENT: Uncomment to break build on policy
-          coverity_policy_view: 'Java Security Policy'
+          coverity_policy_view: Java Security Policy
           
           ### PULL REQUEST COMMENTS:
           coverity_prComment_enabled: true

From 1c9ec4fb03388356b2e3863b2640a8898942de6c Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 16:41:59 +0200
Subject: [PATCH 15/27] Config only capture config

---
 coverity.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/coverity.yaml b/coverity.yaml
index 8cc06c3a..cf762263 100644
--- a/coverity.yaml
+++ b/coverity.yaml
@@ -1,6 +1,9 @@
 capture:
-  build:
-    clean-command: mvn clean
+  #build:
+    #clean-command: mvn clean
     #build-command: mvn -B -DskipTests package
     #build-commnad: mvn -B -DskipTests -DskipITs clean install # default build-command-inference command for Maven projects
-    build-command: echo test
\ No newline at end of file
+  languages:
+    include:
+    - javascript
+    - configuration
\ No newline at end of file

From f8954d437fb0ab8722f962f43fcff2d977503c61 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 17:53:03 +0200
Subject: [PATCH 16/27] Include diagnostics

---
 .github/workflows/coverity.sast.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index af62df28..3d75e422 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -42,6 +42,8 @@ jobs:
                             
           ### Mark build status if policy violating issues are found
           # mark_build_status: 'success'
+
+          include_diagnostics: true
                             
       ### Uncomment below configuration to add custom logic based on return status
       - name: Postprocessing

From e010ef4a135376a0f71c91445bca72097982c6cd Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 18:02:52 +0200
Subject: [PATCH 17/27] Renamed view

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 3d75e422..3bcb21a6 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -30,7 +30,7 @@ jobs:
           coverity_local: true
           
           ### POLICY ENFORCEMENT: Uncomment to break build on policy
-          coverity_policy_view: Java Security Policy
+          coverity_policy_view: Policy - Java Security
           
           ### PULL REQUEST COMMENTS:
           coverity_prComment_enabled: true

From dcfc46405f0a4f7af6ef5382a94858b2f63f6177 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 18:08:01 +0200
Subject: [PATCH 18/27] Removed diagnostics flag

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 3bcb21a6..3c9d2b09 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -43,7 +43,7 @@ jobs:
           ### Mark build status if policy violating issues are found
           # mark_build_status: 'success'
 
-          include_diagnostics: true
+          #include_diagnostics: true
                             
       ### Uncomment below configuration to add custom logic based on return status
       - name: Postprocessing

From a0188b482fd88f8bb81492dd6d76c426a5b568c2 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 23:03:19 +0200
Subject: [PATCH 19/27] Reactivated build capture

---
 .gitignore    |  4 ++++
 coverity.yaml | 15 ++++++++-------
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 20edc589..d18cafd1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,7 @@ build.xml
 agent.config
 hdivAgentLog.hlg
 .vscode/
+
+
+# Coverity
+.codesight
\ No newline at end of file
diff --git a/coverity.yaml b/coverity.yaml
index cf762263..9178bdf5 100644
--- a/coverity.yaml
+++ b/coverity.yaml
@@ -1,9 +1,10 @@
 capture:
-  #build:
-    #clean-command: mvn clean
-    #build-command: mvn -B -DskipTests package
+  build:
+    clean-command: mvn clean
+    build-command: mvn -B -DskipTests package
     #build-commnad: mvn -B -DskipTests -DskipITs clean install # default build-command-inference command for Maven projects
-  languages:
-    include:
-    - javascript
-    - configuration
\ No newline at end of file
+  # languages:
+  #   include:
+  #   - java
+  #   - javascript
+  #   - configuration
\ No newline at end of file

From 846ec719caff5668a1a48d10cebb7f127d8863db Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 6 Oct 2025 23:20:02 +0200
Subject: [PATCH 20/27] Added Polaris scan script

---
 .gitignore       |  3 ++-
 scan-polaris.cmd | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 scan-polaris.cmd

diff --git a/.gitignore b/.gitignore
index d18cafd1..4496177f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ hdivAgentLog.hlg
 
 
 # Coverity
-.codesight
\ No newline at end of file
+.codesight
+.bridge
\ No newline at end of file
diff --git a/scan-polaris.cmd b/scan-polaris.cmd
new file mode 100644
index 00000000..c61b0edb
--- /dev/null
+++ b/scan-polaris.cmd
@@ -0,0 +1,18 @@
+@echo off
+set BRIDGE_INSTALL_DIR=C:\Products\br\tc
+set BRIDGE_CLI=%BRIDGE_INSTALL_DIR%\bridge-cli.exe
+
+::set BRIDGE_UPDATE=--update
+set BRIDGE_UPDATE=
+
+%BRIDGE_CLI% --stage polaris %BRIDGE_UPDATE% ^
+  polaris.serverurl=https://poc.polaris.blackduck.com ^
+  polaris.application.name=MKM-Demo-Organization ^
+  polaris.project.name=MKM-InsecureBank ^
+  polaris.branch.name=master-cli ^
+  polaris.assessment.types=SCA,SAST ^
+  polaris.test.sca.type=SCA-SIGNATURE ^
+  detect.search.depth=10 ^
+  polaris.reports.sarif.create=false ^
+  polaris.reports.sarif.file.path=results.sarif.json
+

From 0259fd8e63c98c92e888e41948e6c4befb7e026f Mon Sep 17 00:00:00 2001
From: mathkraemer <43319514+mathkraemer@users.noreply.github.com>
Date: Mon, 3 Nov 2025 09:31:09 +0100
Subject: [PATCH 21/27] Overwrite prComment impacts

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 3c9d2b09..605333e4 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -37,7 +37,7 @@ jobs:
           ## Use the parameter below to add comments for issues filtered
           ## by impact. Default is High if unset
           ## NOTE: Issues matching coverity_policy_view are ignored if set
-          # coverity_prComment_impacts: 'High,Medium,Low,Audit'
+          coverity_prComment_impacts: 'High,Medium,Low,Audit'
           github_token: ${{ secrets.GITHUB_TOKEN }} # Required when PR comments is enabled 
                             
           ### Mark build status if policy violating issues are found

From fabb2d090548e7fae8371664c0c0cc20bddc6d3e Mon Sep 17 00:00:00 2001
From: mathkraemer <43319514+mathkraemer@users.noreply.github.com>
Date: Mon, 3 Nov 2025 09:36:17 +0100
Subject: [PATCH 22/27] Updated Action version to 2.6

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index 605333e4..cec8c9ff 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Coverity Scan
-        uses: blackduck-inc/black-duck-security-scan@v2
+        uses: blackduck-inc/black-duck-security-scan@v2.6
         with:
           ### SCANNING: Required fields
           coverity_url: ${{ vars.COVERITY_URL }}

From 2dc3b7cc5d65edae7ddcb0f0b1dda6486c89d264 Mon Sep 17 00:00:00 2001
From: mathkraemer <43319514+mathkraemer@users.noreply.github.com>
Date: Mon, 3 Nov 2025 09:52:02 +0100
Subject: [PATCH 23/27] Updated to action 2.5.0

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index cec8c9ff..c634a2fd 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Coverity Scan
-        uses: blackduck-inc/black-duck-security-scan@v2.6
+        uses: blackduck-inc/black-duck-security-scan@v2.5.0
         with:
           ### SCANNING: Required fields
           coverity_url: ${{ vars.COVERITY_URL }}

From 9dcdd66533e00df60367836902c8d045507e85b0 Mon Sep 17 00:00:00 2001
From: mathkraemer <43319514+mathkraemer@users.noreply.github.com>
Date: Mon, 3 Nov 2025 10:30:27 +0100
Subject: [PATCH 24/27] Returning version to 2

---
 .github/workflows/coverity.sast.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/coverity.sast.yml b/.github/workflows/coverity.sast.yml
index c634a2fd..605333e4 100644
--- a/.github/workflows/coverity.sast.yml
+++ b/.github/workflows/coverity.sast.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Coverity Scan
-        uses: blackduck-inc/black-duck-security-scan@v2.5.0
+        uses: blackduck-inc/black-duck-security-scan@v2
         with:
           ### SCANNING: Required fields
           coverity_url: ${{ vars.COVERITY_URL }}

From d0f9e865328b8ced2c233866cc17356948e24e58 Mon Sep 17 00:00:00 2001
From: mathkraemer <43319514+mathkraemer@users.noreply.github.com>
Date: Mon, 3 Nov 2025 12:28:53 +0100
Subject: [PATCH 25/27] Added feature-2-report function

---
 .../org/hdivsamples/controllers/ActivityController.java     | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/main/java/org/hdivsamples/controllers/ActivityController.java b/src/main/java/org/hdivsamples/controllers/ActivityController.java
index 8d3dd27f..d67e860a 100644
--- a/src/main/java/org/hdivsamples/controllers/ActivityController.java
+++ b/src/main/java/org/hdivsamples/controllers/ActivityController.java
@@ -117,4 +117,10 @@ public String changeAccount(@Valid @ModelAttribute final CashAccount cashAccount
 		return "accountActivity";
 	}
 
+	public void feature-2-report(Object activity){
+		if (activity == null){
+			System.println(activity.toString());
+		}
+	}
+
 }
\ No newline at end of file

From 4240f29c2a2a368a3a13cf4c1bd9b42084e06ae4 Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 3 Nov 2025 12:56:16 +0100
Subject: [PATCH 26/27] Correted implementation

---
 .../java/org/hdivsamples/controllers/ActivityController.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/hdivsamples/controllers/ActivityController.java b/src/main/java/org/hdivsamples/controllers/ActivityController.java
index d67e860a..5aec12df 100644
--- a/src/main/java/org/hdivsamples/controllers/ActivityController.java
+++ b/src/main/java/org/hdivsamples/controllers/ActivityController.java
@@ -119,7 +119,7 @@ public String changeAccount(@Valid @ModelAttribute final CashAccount cashAccount
 
 	public void feature-2-report(Object activity){
 		if (activity == null){
-			System.println(activity.toString());
+			System.out.println(activity.toString());
 		}
 	}
 

From c21c57c6cbc0bc28c33e5f46dce2e14ce746f7ca Mon Sep 17 00:00:00 2001
From: Matthias Kraemer <matthias.kraemer@blackduck.com>
Date: Mon, 3 Nov 2025 13:02:55 +0100
Subject: [PATCH 27/27] Fixed method name

---
 .../java/org/hdivsamples/controllers/ActivityController.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/hdivsamples/controllers/ActivityController.java b/src/main/java/org/hdivsamples/controllers/ActivityController.java
index 5aec12df..57895652 100644
--- a/src/main/java/org/hdivsamples/controllers/ActivityController.java
+++ b/src/main/java/org/hdivsamples/controllers/ActivityController.java
@@ -117,7 +117,7 @@ public String changeAccount(@Valid @ModelAttribute final CashAccount cashAccount
 		return "accountActivity";
 	}
 
-	public void feature-2-report(Object activity){
+	public void feature_2_report(Object activity){
 		if (activity == null){
 			System.out.println(activity.toString());
 		}