shavo007 / api-first-demo

showcase building an API using open api gen and OAS

Showcase api first and open api generator

Pre-requisites

• Install sdkMan
• Install Insomnia
• Install NodeJS
• Install Docker

sdk install java #how to choose which jdk https://whichjdk.com/#tldr
sdk list java #list java versions
sdk current java
"java.jdt.ls.java.home": "/Users/<username>/.sdkman/candidates/java/17.0.4.1-tem" #VSCode settings
sdk use java 14.0.1.j9-adpt #if you want to switch versions for example

Run locally

./mvnw clean install
./mvnw spring-boot:run
open http://localhost:8080/greetings # - OR - alternatively import OAS into insomnia and run the requests

Test for breaking changes

Linting

Using Spectral

Local

npx spectral lint src/main/resources/oas3.yaml --ruleset greetings.spectral.yml
npx @stoplight/spectral-cli lint src/main/resources/oas3.yaml --ruleset greetings.spectral.yml

CI (github actions)

Workflow linting

brew install actionlint
actionlint

Checkov

• docker file policies
• suppressions

Finding commit sha (security hardening for actions)

Usually, you want to pin to the commit SHA of a specific release. To find a release's commit SHA, go to the action's repository releases page (e.g. https://github.com/actions/checkout/releases). Find the release you want to use and click on the shorthand SHA (e.g. a12a394) listed in the summary section to the left of the release. You'll then be redirected to the release details page, which lists the full commit SHA you can use.

Docker best practices

https://aws.github.io/aws-eks-best-practices/security/docs/image/#recommendations

Non root user

docker run -it --rm -v "$PWD/Dockerfile":/Dockerfile:ro redcoolbeans/dockerlint #lint dockerfile
docker build -t shanelee007/api-first-demo . #build docker image
docker run -d -p8080:8080 shanelee007/api-first-demo #run image locally on 8080

2023-02-16T10:22:06.820Z INFO 1 --- [ main] c.e.greetings.GreetingsApplication : Starting GreetingsApplication v0.0.1-SNAPSHOT using Java 17.0.6 with PID 1 (/app/server.jar started by appuser in /app)
#The first log line mentions now that the application is started by appuser and not root.

docker run --tty --rm bridgecrew/checkov --directory /tf docker run --tty --rm bridgecrew/checkov --directory /test-infra