Sync master with upstream OWASP Benchmark

.github/workflows/codeql-analysis.yml

@@ -34,7 +34,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.37.7
+      uses: github/codeql-action/init@v4.37.8
       with:
         languages: ${{ matrix.language }}
         queries: security-extended, security-experimental, security-and-quality
@@ -43,7 +43,7 @@ jobs:
       run: mvn -DskipTests=true install
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.37.7
+      uses: github/codeql-action/analyze@v4.37.8
 
     - name: Upload Output
       uses: actions/upload-artifact@v7

pom.xml

@@ -1261,8 +1261,8 @@
         <version.fluido>2.1.0</version.fluido>
         <!-- hibernate is up to rev 6+. But 4.0.0. causes this error: symbol: org.hibernate.classic.Session not found -->
         <version.hibernate>3.6.10.Final</version.hibernate>
-        <version.spotbugs.maven>4.10.3.0</version.spotbugs.maven>
-        <version.spotbugs>4.10.3</version.spotbugs>
+        <version.spotbugs.maven>4.10.4.0</version.spotbugs.maven>
+        <version.spotbugs>4.10.4</version.spotbugs>
         <!-- Spring 6.x requires Java 17 -->
         <version.springframework>5.3.39</version.springframework>
         <!-- Tomcat 10 moves from Java EE to Jakarta EE, moving packages javax.* to jakarta.* - code changes likely required to address this change. -->

scripts/runSonarQube.sh

@@ -64,11 +64,12 @@ echo "Starting scan... (might take some time!)"
 container_ip=$(docker inspect "$container_name" | jq -r '.[0].NetworkSettings.Networks.bridge.IPAddress' )
 sonar_docker_host="http://$container_ip:$sonar_internal_port"
 
-docker run --env SONAR_SCANNER_OPTS=-Xmx4g --rm -v ~/.m2:/root/.m2 -v "$(pwd)":"$(pwd)" -w "$(pwd)" sonarsource/sonar-scanner-cli \
+docker run --env SONAR_SCANNER_OPTS=-Xmx4g --rm -v ~/.m2:/root/.m2 -v "$(pwd)":/benchmark -w "/benchmark" sonarsource/sonar-scanner-cli \
+  -Dsonar.projectBaseDir="/benchmark" \
   -Dsonar.java.binaries="target" \
   -Dsonar.projectKey="$sonar_project" \
   -Dsonar.host.url="$sonar_docker_host" \
-  -Dsonar.login="$sonar_token" \
+  -Dsonar.token="$sonar_token" \
   -Dsonar.sources="src" \
   -Dsonar.exclusions="results/**,scorecard/**,scripts/**,tools/**,VMs/**,**/*.js"
 
@@ -82,6 +83,7 @@ done
 echo ""
 echo "Generating report..."
 
+mvn compile
 mvn exec:java -Dexec.mainClass="org.owasp.benchmark.report.sonarqube.SonarReport"
 
 echo "Shutting down SonarQube..."