Introduction to LGTM Integration
LGTM.com (Looks Good To Me) is a code analysis platform that helps identify security vulnerabilities, bugs, and code quality issues. This guide covers integrating LGTM into Java projects for continuous code analysis and quality monitoring.
System Architecture Overview
LGTM Integration Pipeline ├── Code Analysis Setup │ ├ - LGTM Project Configuration │ ├ - Analysis Configuration │ ├ - Query Suites │ └ - Custom Queries ├── CI/CD Integration │ ├ - GitHub Actions │ ├ - Jenkins Pipeline │ ├ - GitLab CI │ └ - Local Analysis ├── Results Processing │ ├ - Alert Management │ ├ - Result Filtering │ ├ - Report Generation │ └ - Trend Analysis └── Developer Workflow ├ - IDE Integration ├ - PR Checks ├ - Notifications └ - Fix Verification
Core Implementation
1. Maven Dependencies
<properties>
<lgtm.maven.plugin.version>1.0</lgtm.maven.plugin.version>
<github.api.version>1.1.0</github.api.version>
<jackson.version>2.15.2</jackson.version>
<okhttp.version>4.11.0</okhttp.version>
</properties>
<dependencies>
<!-- LGTM API Client -->
<dependency>
<groupId>com.lgtm</groupId>
<artifactId>lgtm-java-client</artifactId>
<version>1.0.0</version>
</dependency>
<!-- GitHub API for PR integration -->
<dependency>
<groupId>org.kohsuke</groupId>
<artifactId>github-api</artifactId>
<version>${github.api.version}</version>
</dependency>
<!-- HTTP Client -->
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>${okhttp.version}</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- Maven Plugin API -->
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-plugin-api</artifactId>
<version>3.8.1</version>
</dependency>
<!-- Code Analysis Tools -->
<dependency>
<groupId>org.sonarsource.sonarlint.core</groupId>
<artifactId>sonarlint-core</artifactId>
<version>8.0.0</version>
</dependency>
</dependencies>
<build>
<plugins>
<!-- LGTM Maven Plugin -->
<plugin>
<groupId>com.lgtm</groupId>
<artifactId>lgtm-maven-plugin</artifactId>
<version>${lgtm.maven.plugin.version}</version>
<executions>
<execution>
<goals>
<goal>analyze</goal>
</goals>
</execution>
</executions>
<configuration>
<outputDirectory>${project.build.directory}/lgtm</outputDirectory>
<format>sarif</format>
<failOnCritical>true</failOnCritical>
</configuration>
</plugin>
</plugins>
</build>
2. LGTM Configuration Files
lgtm.yml
# lgtm.yml - LGTM analysis configuration path_classifiers: docs: - "**/*.md" - "**/*.rst" - "**/*.txt" code: - "**/*.java" - "**/*.kt" # Kotlin files test: - "**/test/**" - "**/*Test.java" - "**/*Spec.java" extraction: java: index: # Java version for analysis jdk: 11 # Build configuration maven: # Maven goals to run for building the project goals: - "clean" - "compile" - "test-compile" # Exclude generated code and dependencies exclude: - "**/target/**" - "**/generated/**" - "**/node_modules/**" queries: # Include security queries - include: java/security # Include performance queries - include: java/performance # Include maintainability queries - include: java/maintainability # Exclude specific queries - exclude: java/security/audit/xss # Custom query packs - pack: custom-queries query_filters: - exclude: "**/test/**" - exclude: "**/*Test.java" alerters: # PR integration settings pull_requests: comments: true status: true # Only show new alerts in PRs new_alerts_only: true # Alert threshold threshold: warning
Custom Query Suite
# custom-queries.yml
name: "custom-java-queries"
version: "1.0.0"
description: "Custom Java queries for our project"
queries:
- id: "custom/sql-injection"
name: "Potential SQL Injection"
description: "Detects potential SQL injection vulnerabilities"
severity: error
tags: [security, sql]
query: |
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
from MethodAccess call, Expr source
where
call.getMethod().hasName("executeQuery") and
TaintTracking::localTaint(DataFlow::parameterNode(source), DataFlow::exprNode(call.getArgument(0)))
select call, "Potential SQL injection from $@", source, source.toString()
- id: "custom/log-injection"
name: "Log Injection"
description: "Detects user input in log statements"
severity: warning
tags: [security, logging]
query: |
import java
import semmle.code.java.dataflow.DataFlow
from MethodAccess logCall, Expr userInput
where
logCall.getMethod().getName().matches("info|warn|error|debug") and
logCall.getMethod().getDeclaringType().getASupertype*().hasQualifiedName("org.slf4j", "Logger") and
DataFlow::localFlow(DataFlow::parameterNode(userInput), DataFlow::exprNode(logCall.getArgument(0)))
select logCall, "User input used in log statement: $@", userInput, userInput.toString()
3. LGTM API Client
package com.example.lgtm.client;
import com.fasterxml.jackson.databind.ObjectMapper;
import okhttp3.*;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import java.io.IOException;
import java.util.List;
import java.util.concurrent.TimeUnit;
@Component
public class LGTMApiClient {
private static final String BASE_URL = "https://lgtm.com/api/v1.0";
private final OkHttpClient client;
private final ObjectMapper objectMapper;
@Value("${lgtm.api.token:}")
private String apiToken;
public LGTMApiClient() {
this.client = new OkHttpClient.Builder()
.connectTimeout(30, TimeUnit.SECONDS)
.readTimeout(60, TimeUnit.SECONDS)
.writeTimeout(30, TimeUnit.SECONDS)
.build();
this.objectMapper = new ObjectMapper();
}
public AnalysisResult getProjectAnalysis(String projectId) throws IOException {
Request request = new Request.Builder()
.url(BASE_URL + "/projects/" + projectId + "/analysis")
.addHeader("Authorization", "Bearer " + apiToken)
.build();
try (Response response = client.newCall(request).execute()) {
if (!response.isSuccessful()) {
throw new IOException("Unexpected code: " + response);
}
return objectMapper.readValue(response.body().string(), AnalysisResult.class);
}
}
public List<Alert> getProjectAlerts(String projectId, String severity) throws IOException {
HttpUrl.Builder urlBuilder = HttpUrl.parse(BASE_URL + "/projects/" + projectId + "/alerts").newBuilder();
if (severity != null) {
urlBuilder.addQueryParameter("severity", severity);
}
Request request = new Request.Builder()
.url(urlBuilder.build())
.addHeader("Authorization", "Bearer " + apiToken)
.build();
try (Response response = client.newCall(request).execute()) {
if (!response.isSuccessful()) {
throw new IOException("Unexpected code: " + response);
}
return objectMapper.readValue(
response.body().string(),
objectMapper.getTypeFactory().constructCollectionType(List.class, Alert.class)
);
}
}
public void triggerAnalysis(String projectId) throws IOException {
Request request = new Request.Builder()
.url(BASE_URL + "/projects/" + projectId + "/analyses")
.post(RequestBody.create("", MediaType.get("application/json")))
.addHeader("Authorization", "Bearer " + apiToken)
.build();
try (Response response = client.newCall(request).execute()) {
if (!response.isSuccessful()) {
throw new IOException("Failed to trigger analysis: " + response);
}
}
}
public AnalysisStatus getAnalysisStatus(String analysisId) throws IOException {
Request request = new Request.Builder()
.url(BASE_URL + "/analyses/" + analysisId)
.addHeader("Authorization", "Bearer " + apiToken)
.build();
try (Response response = client.newCall(request).execute()) {
if (!response.isSuccessful()) {
throw new IOException("Unexpected code: " + response);
}
return objectMapper.readValue(response.body().string(), AnalysisStatus.class);
}
}
// Data models
public static class AnalysisResult {
private String id;
private String status;
private String projectId;
private int alertCount;
private String commitId;
private String createdAt;
private String completedAt;
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public String getStatus() { return status; }
public void setStatus(String status) { this.status = status; }
public String getProjectId() { return projectId; }
public void setProjectId(String projectId) { this.projectId = projectId; }
public int getAlertCount() { return alertCount; }
public void setAlertCount(int alertCount) { this.alertCount = alertCount; }
public String getCommitId() { return commitId; }
public void setCommitId(String commitId) { this.commitId = commitId; }
public String getCreatedAt() { return createdAt; }
public void setCreatedAt(String createdAt) { this.createdAt = createdAt; }
public String getCompletedAt() { return completedAt; }
public void setCompletedAt(String completedAt) { this.completedAt = completedAt; }
}
public static class Alert {
private String id;
private String queryId;
private String file;
private int line;
private String severity;
private String message;
private String description;
private String category;
private boolean fixed;
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public String getQueryId() { return queryId; }
public void setQueryId(String queryId) { this.queryId = queryId; }
public String getFile() { return file; }
public void setFile(String file) { this.file = file; }
public int getLine() { return line; }
public void setLine(int line) { this.line = line; }
public String getSeverity() { return severity; }
public void setSeverity(String severity) { this.severity = severity; }
public String getMessage() { return message; }
public void setMessage(String message) { this.message = message; }
public String getDescription() { return description; }
public void setDescription(String description) { this.description = description; }
public String getCategory() { return category; }
public void setCategory(String category) { this.category = category; }
public boolean isFixed() { return fixed; }
public void setFixed(boolean fixed) { this.fixed = fixed; }
}
public static class AnalysisStatus {
private String id;
private String status;
private String projectId;
private int progress;
private String startedAt;
private String finishedAt;
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public String getStatus() { return status; }
public void setStatus(String status) { this.status = status; }
public String getProjectId() { return projectId; }
public void setProjectId(String projectId) { this.projectId = projectId; }
public int getProgress() { return progress; }
public void setProgress(int progress) { this.progress = progress; }
public String getStartedAt() { return startedAt; }
public void setStartedAt(String startedAt) { this.startedAt = startedAt; }
public String getFinishedAt() { return finishedAt; }
public void setFinishedAt(String finishedAt) { this.finishedAt = finishedAt; }
}
}
4. LGTM Analysis Service
package com.example.lgtm.service;
import com.example.lgtm.client.LGTMApiClient;
import com.example.lgtm.client.LGTMApiClient.Alert;
import com.example.lgtm.client.LGTMApiClient.AnalysisResult;
import com.example.lgtm.client.LGTMApiClient.AnalysisStatus;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
import java.io.*;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.*;
import java.util.concurrent.CompletableFuture;
import java.util.concurrent.TimeUnit;
import java.util.stream.Collectors;
@Service
public class LGTMAnalysisService {
private static final Logger logger = LoggerFactory.getLogger(LGTMAnalysisService.class);
private final LGTMApiClient lgtmClient;
private final GitHubService githubService;
private final NotificationService notificationService;
@Value("${lgtm.project.id:}")
private String projectId;
@Value("${lgtm.analysis.timeout:600}")
private int analysisTimeoutSeconds;
public LGTMAnalysisService(LGTMApiClient lgtmClient,
GitHubService githubService,
NotificationService notificationService) {
this.lgtmClient = lgtmClient;
this.githubService = githubService;
this.notificationService = notificationService;
}
/**
* Trigger LGTM analysis and wait for completion
*/
public AnalysisResult triggerAndWaitForAnalysis() throws Exception {
logger.info("Triggering LGTM analysis for project: {}", projectId);
// Trigger analysis
lgtmClient.triggerAnalysis(projectId);
// Wait for analysis to complete
AnalysisResult result = waitForAnalysisCompletion();
logger.info("LGTM analysis completed with {} alerts", result.getAlertCount());
return result;
}
/**
* Get current analysis results
*/
public AnalysisResult getCurrentAnalysis() throws Exception {
return lgtmClient.getProjectAnalysis(projectId);
}
/**
* Get alerts filtered by severity
*/
public List<Alert> getAlertsBySeverity(String severity) throws Exception {
return lgtmClient.getProjectAlerts(projectId, severity);
}
/**
* Get alerts grouped by category
*/
public Map<String, List<Alert>> getAlertsByCategory() throws Exception {
List<Alert> allAlerts = lgtmClient.getProjectAlerts(projectId, null);
return allAlerts.stream()
.collect(Collectors.groupingBy(Alert::getCategory));
}
/**
* Get alert statistics
*/
public AlertStatistics getAlertStatistics() throws Exception {
List<Alert> allAlerts = lgtmClient.getProjectAlerts(projectId, null);
AlertStatistics stats = new AlertStatistics();
stats.setTotalAlerts(allAlerts.size());
stats.setCriticalAlerts((int) allAlerts.stream().filter(a -> "error".equals(a.getSeverity())).count());
stats.setWarningAlerts((int) allAlerts.stream().filter(a -> "warning".equals(a.getSeverity())).count());
stats.setFixedAlerts((int) allAlerts.stream().filter(Alert::isFixed).count());
// Group by category
Map<String, Long> categoryCounts = allAlerts.stream()
.collect(Collectors.groupingBy(Alert::getCategory, Collectors.counting()));
stats.setAlertsByCategory(categoryCounts);
// Group by file
Map<String, Long> fileCounts = allAlerts.stream()
.collect(Collectors.groupingBy(Alert::getFile, Collectors.counting()));
stats.setAlertsByFile(fileCounts);
return stats;
}
/**
* Analyze pull request and post comments
*/
public PullRequestAnalysis analyzePullRequest(String repo, int pullRequestNumber) throws Exception {
logger.info("Analyzing pull request {}/{}", repo, pullRequestNumber);
PullRequestAnalysis prAnalysis = new PullRequestAnalysis();
prAnalysis.setRepository(repo);
prAnalysis.setPullRequestNumber(pullRequestNumber);
// Get PR details
PullRequestDetails prDetails = githubService.getPullRequestDetails(repo, pullRequestNumber);
prAnalysis.setBaseCommit(prDetails.getBaseCommit());
prAnalysis.setHeadCommit(prDetails.getHeadCommit());
// Trigger analysis for the PR
lgtmClient.triggerAnalysis(projectId);
AnalysisResult analysis = waitForAnalysisCompletion();
// Get new alerts (compared to base)
List<Alert> newAlerts = getNewAlerts(prDetails.getBaseCommit(), prDetails.getHeadCommit());
prAnalysis.setNewAlerts(newAlerts);
// Get fixed alerts
List<Alert> fixedAlerts = getFixedAlerts(prDetails.getBaseCommit(), prDetails.getHeadCommit());
prAnalysis.setFixedAlerts(fixedAlerts);
// Post PR comments
if (!newAlerts.isEmpty()) {
postPRComments(repo, pullRequestNumber, newAlerts);
}
// Update PR status
updatePRStatus(repo, pullRequestNumber, newAlerts.isEmpty());
// Send notifications
sendAnalysisNotifications(prAnalysis);
return prAnalysis;
}
/**
* Generate analysis report
*/
public AnalysisReport generateReport() throws Exception {
AnalysisResult currentAnalysis = getCurrentAnalysis();
AlertStatistics statistics = getAlertStatistics();
List<Alert> criticalAlerts = getAlertsBySeverity("error");
List<Alert> warningAlerts = getAlertsBySeverity("warning");
AnalysisReport report = new AnalysisReport();
report.setGeneratedAt(new Date());
report.setProjectId(projectId);
report.setAnalysisId(currentAnalysis.getId());
report.setTotalAlerts(currentAnalysis.getAlertCount());
report.setStatistics(statistics);
report.setCriticalAlerts(criticalAlerts);
report.setWarningAlerts(warningAlerts);
report.setTrend(getAlertTrend());
return report;
}
/**
* Export alerts to SARIF format
*/
public String exportToSarif() throws Exception {
List<Alert> allAlerts = lgtmClient.getProjectAlerts(projectId, null);
SarifReport sarif = new SarifReport();
sarif.setVersion("2.1.0");
List<SarifReport.Run> runs = new ArrayList<>();
SarifReport.Run run = new SarifReport.Run();
List<SarifReport.Result> results = allAlerts.stream()
.map(this::convertAlertToSarifResult)
.collect(Collectors.toList());
run.setResults(results);
runs.add(run);
sarif.setRuns(runs);
// Convert to JSON
ObjectMapper mapper = new ObjectMapper();
return mapper.writerWithDefaultPrettyPrinter().writeValueAsString(sarif);
}
/**
* Run local analysis using LGTM CLI
*/
public LocalAnalysisResult runLocalAnalysis(Path projectPath) throws Exception {
logger.info("Running local LGTM analysis on: {}", projectPath);
LocalAnalysisResult result = new LocalAnalysisResult();
result.setProjectPath(projectPath.toString());
result.setStartedAt(new Date());
// Check if LGTM CLI is available
if (!isLGTMCliAvailable()) {
throw new IllegalStateException("LGTM CLI is not available");
}
// Run analysis
ProcessBuilder pb = new ProcessBuilder("lgtm", "analyze", "--format", "sarif", projectPath.toString());
pb.directory(projectPath.toFile());
Process process = pb.start();
boolean completed = process.waitFor(analysisTimeoutSeconds, TimeUnit.SECONDS);
if (!completed) {
process.destroy();
throw new RuntimeException("LGTM analysis timed out");
}
result.setCompletedAt(new Date());
result.setExitCode(process.exitValue());
// Read results
String output = readProcessOutput(process);
result.setRawOutput(output);
if (process.exitValue() == 0) {
result.setSuccess(true);
// Parse SARIF output
result.setSarifResults(parseSarifOutput(output));
} else {
result.setSuccess(false);
result.setError(output);
}
return result;
}
private AnalysisResult waitForAnalysisCompletion() throws Exception {
long startTime = System.currentTimeMillis();
long timeout = analysisTimeoutSeconds * 1000L;
while (System.currentTimeMillis() - startTime < timeout) {
AnalysisResult result = lgtmClient.getProjectAnalysis(projectId);
if ("completed".equals(result.getStatus())) {
return result;
} else if ("failed".equals(result.getStatus())) {
throw new RuntimeException("LGTM analysis failed");
}
// Wait before polling again
Thread.sleep(10000); // 10 seconds
}
throw new RuntimeException("LGTM analysis timed out");
}
private List<Alert> getNewAlerts(String baseCommit, String headCommit) throws Exception {
// This would compare alerts between two commits
// Implementation depends on LGTM API capabilities
return new ArrayList<>();
}
private List<Alert> getFixedAlerts(String baseCommit, String headCommit) throws Exception {
// This would identify alerts that were fixed between commits
return new ArrayList<>();
}
private void postPRComments(String repo, int prNumber, List<Alert> alerts) throws Exception {
StringBuilder comment = new StringBuilder();
comment.append("## LGTM Analysis Results\n\n");
comment.append("Found ").append(alerts.size()).append(" new alerts:\n\n");
for (Alert alert : alerts) {
comment.append(String.format("### %s\n", alert.getSeverity().toUpperCase()));
comment.append(String.format("**File:** %s (Line %d)\n", alert.getFile(), alert.getLine()));
comment.append(String.format("**Message:** %s\n", alert.getMessage()));
comment.append(String.format("**Category:** %s\n\n", alert.getCategory()));
}
githubService.createPRComment(repo, prNumber, comment.toString());
}
private void updatePRStatus(String repo, int prNumber, boolean passed) throws Exception {
String status = passed ? "success" : "failure";
String description = passed ? "No new alerts found" : "New alerts found";
githubService.updatePRStatus(repo, prNumber, "lgtm-analysis", status, description);
}
private void sendAnalysisNotifications(PullRequestAnalysis analysis) {
if (!analysis.getNewAlerts().isEmpty()) {
notificationService.sendAlertNotification(analysis);
}
}
private AlertTrend getAlertTrend() throws Exception {
// This would fetch historical data and calculate trends
// Implementation would depend on data storage
return new AlertTrend();
}
private boolean isLGTMCliAvailable() throws Exception {
Process process = Runtime.getRuntime().exec("lgtm --version");
return process.waitFor() == 0;
}
private String readProcessOutput(Process process) throws IOException {
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(process.getInputStream()))) {
return reader.lines().collect(Collectors.joining("\n"));
}
}
private SarifReport.Result convertAlertToSarifResult(Alert alert) {
SarifReport.Result result = new SarifReport.Result();
result.setRuleId(alert.getQueryId());
result.setMessage(alert.getMessage());
SarifReport.Location location = new SarifReport.Location();
location.setUri(alert.getFile());
location.setLine(alert.getLine());
result.setLocations(List.of(location));
result.setLevel(mapSeverityToSarifLevel(alert.getSeverity()));
return result;
}
private String mapSeverityToSarifLevel(String severity) {
switch (severity) {
case "error": return "error";
case "warning": return "warning";
default: return "note";
}
}
private Object parseSarifOutput(String output) {
try {
ObjectMapper mapper = new ObjectMapper();
return mapper.readValue(output, Object.class);
} catch (Exception e) {
logger.warn("Failed to parse SARIF output", e);
return null;
}
}
// Data models
public static class AlertStatistics {
private int totalAlerts;
private int criticalAlerts;
private int warningAlerts;
private int fixedAlerts;
private Map<String, Long> alertsByCategory;
private Map<String, Long> alertsByFile;
// Getters and setters
public int getTotalAlerts() { return totalAlerts; }
public void setTotalAlerts(int totalAlerts) { this.totalAlerts = totalAlerts; }
public int getCriticalAlerts() { return criticalAlerts; }
public void setCriticalAlerts(int criticalAlerts) { this.criticalAlerts = criticalAlerts; }
public int getWarningAlerts() { return warningAlerts; }
public void setWarningAlerts(int warningAlerts) { this.warningAlerts = warningAlerts; }
public int getFixedAlerts() { return fixedAlerts; }
public void setFixedAlerts(int fixedAlerts) { this.fixedAlerts = fixedAlerts; }
public Map<String, Long> getAlertsByCategory() { return alertsByCategory; }
public void setAlertsByCategory(Map<String, Long> alertsByCategory) { this.alertsByCategory = alertsByCategory; }
public Map<String, Long> getAlertsByFile() { return alertsByFile; }
public void setAlertsByFile(Map<String, Long> alertsByFile) { this.alertsByFile = alertsByFile; }
}
public static class PullRequestAnalysis {
private String repository;
private int pullRequestNumber;
private String baseCommit;
private String headCommit;
private List<Alert> newAlerts;
private List<Alert> fixedAlerts;
private Date analyzedAt;
// Getters and setters
public String getRepository() { return repository; }
public void setRepository(String repository) { this.repository = repository; }
public int getPullRequestNumber() { return pullRequestNumber; }
public void setPullRequestNumber(int pullRequestNumber) { this.pullRequestNumber = pullRequestNumber; }
public String getBaseCommit() { return baseCommit; }
public void setBaseCommit(String baseCommit) { this.baseCommit = baseCommit; }
public String getHeadCommit() { return headCommit; }
public void setHeadCommit(String headCommit) { this.headCommit = headCommit; }
public List<Alert> getNewAlerts() { return newAlerts; }
public void setNewAlerts(List<Alert> newAlerts) { this.newAlerts = newAlerts; }
public List<Alert> getFixedAlerts() { return fixedAlerts; }
public void setFixedAlerts(List<Alert> fixedAlerts) { this.fixedAlerts = fixedAlerts; }
public Date getAnalyzedAt() { return analyzedAt; }
public void setAnalyzedAt(Date analyzedAt) { this.analyzedAt = analyzedAt; }
}
public static class AnalysisReport {
private Date generatedAt;
private String projectId;
private String analysisId;
private int totalAlerts;
private AlertStatistics statistics;
private List<Alert> criticalAlerts;
private List<Alert> warningAlerts;
private AlertTrend trend;
// Getters and setters...
}
public static class AlertTrend {
private Map<Date, Integer> dailyCounts;
private double trendSlope;
private boolean improving;
// Getters and setters...
}
public static class LocalAnalysisResult {
private String projectPath;
private Date startedAt;
private Date completedAt;
private int exitCode;
private boolean success;
private String rawOutput;
private String error;
private Object sarifResults;
// Getters and setters...
}
public static class SarifReport {
private String version;
private List<Run> runs;
// Getters and setters...
public static class Run {
private List<Result> results;
// Getters and setters...
}
public static class Result {
private String ruleId;
private String message;
private List<Location> locations;
private String level;
// Getters and setters...
}
public static class Location {
private String uri;
private int line;
// Getters and setters...
}
}
}
5. GitHub Integration Service
package com.example.lgtm.integration;
import org.kohsuke.github.*;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
import java.io.IOException;
import java.util.List;
@Service
public class GitHubService {
@Value("${github.token:}")
private String githubToken;
private GitHub github;
public GitHub connect() throws IOException {
if (github == null) {
github = new GitHubBuilder().withOAuthToken(githubToken).build();
}
return github;
}
public PullRequestDetails getPullRequestDetails(String repo, int prNumber) throws IOException {
GHRepository repository = connect().getRepository(repo);
GHPullRequest pr = repository.getPullRequest(prNumber);
PullRequestDetails details = new PullRequestDetails();
details.setNumber(prNumber);
details.setTitle(pr.getTitle());
details.setBaseCommit(pr.getBase().getSha());
details.setHeadCommit(pr.getHead().getSha());
details.setAuthor(pr.getUser().getLogin());
return details;
}
public void createPRComment(String repo, int prNumber, String comment) throws IOException {
GHRepository repository = connect().getRepository(repo);
GHPullRequest pr = repository.getPullRequest(prNumber);
pr.comment(comment);
}
public void updatePRStatus(String repo, int prNumber, String context, String state, String description) throws IOException {
GHRepository repository = connect().getRepository(repo);
GHPullRequest pr = repository.getPullRequest(prNumber);
pr.getHead().createCommitStatus(
GHCommitState.valueOf(state.toUpperCase()),
null,
description,
context
);
}
public List<GHPullRequest> getOpenPullRequests(String repo) throws IOException {
GHRepository repository = connect().getRepository(repo);
return repository.getPullRequests(GHIssueState.OPEN);
}
public static class PullRequestDetails {
private int number;
private String title;
private String baseCommit;
private String headCommit;
private String author;
// Getters and setters
public int getNumber() { return number; }
public void setNumber(int number) { this.number = number; }
public String getTitle() { return title; }
public void setTitle(String title) { this.title = title; }
public String getBaseCommit() { return baseCommit; }
public void setBaseCommit(String baseCommit) { this.baseCommit = baseCommit; }
public String getHeadCommit() { return headCommit; }
public void setHeadCommit(String headCommit) { this.headCommit = headCommit; }
public String getAuthor() { return author; }
public void setAuthor(String author) { this.author = author; }
}
}
6. CI/CD Integration
GitHub Actions Workflow
# .github/workflows/lgtm-analysis.yml
name: LGTM Analysis
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main ]
jobs:
lgtm-analysis:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Set up Java
uses: actions/setup-java@v3
with:
java-version: '11'
distribution: 'temurin'
cache: maven
- name: Build with Maven
run: mvn -B compile test-compile -DskipTests
- name: Run LGTM Analysis
uses: lgtm-com/lgtm-action@v1
with:
project-token: ${{ secrets.LGTM_PROJECT_TOKEN }}
output-format: sarif
output-file: lgtm-results.sarif
- name: Upload SARIF results
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: lgtm-results.sarif
- name: Check for critical alerts
run: |
# Custom script to check results
python scripts/check-lgtm-results.py
- name: Notify on critical issues
if: failure()
uses: actions/github-script@v6
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: '🚨 Critical LGTM alerts found! Please review the analysis results.'
})
Jenkins Pipeline
// Jenkinsfile
pipeline {
agent any
environment {
LGTM_PROJECT_TOKEN = credentials('lgtm-project-token')
}
stages {
stage('Build') {
steps {
sh 'mvn clean compile test-compile -DskipTests'
}
}
stage('LGTM Analysis') {
steps {
sh '''
# Install LGTM CLI
curl -s https://lgtm.com/ci/lgtm-cli-installer.sh | sh
# Run analysis
lgtm analyze --format sarif --output lgtm-results.sarif .
# Check results
python scripts/check_lgtm_results.py
'''
}
post {
always {
archiveArtifacts artifacts: 'lgtm-results.sarif', fingerprint: true
publishSARIF filePattern: 'lgtm-results.sarif'
}
failure {
emailext (
subject: "LGTM Analysis Failed - ${env.JOB_NAME}",
body: "Critical alerts found in ${env.BUILD_URL}",
to: "[email protected]"
)
}
}
}
}
}
7. REST API Controllers
package com.example.lgtm.controller;
import com.example.lgtm.service.LGTMAnalysisService;
import com.example.lgtm.service.LGTMAnalysisService.AnalysisReport;
import com.example.lgtm.service.LGTMAnalysisService.AlertStatistics;
import com.example.lgtm.service.LGTMAnalysisService.PullRequestAnalysis;
import com.example.lgtm.client.LGTMApiClient.Alert;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;
import java.util.List;
import java.util.Map;
@RestController
@RequestMapping("/api/lgtm")
public class LGTMController {
private final LGTMAnalysisService analysisService;
public LGTMController(LGTMAnalysisService analysisService) {
this.analysisService = analysisService;
}
@PostMapping("/analyze")
public ResponseEntity<String> triggerAnalysis() {
try {
analysisService.triggerAndWaitForAnalysis();
return ResponseEntity.ok("Analysis completed successfully");
} catch (Exception e) {
return ResponseEntity.internalServerError().body("Analysis failed: " + e.getMessage());
}
}
@GetMapping("/alerts")
public ResponseEntity<List<Alert>> getAlerts(@RequestParam(required = false) String severity) {
try {
List<Alert> alerts = analysisService.getAlertsBySeverity(severity);
return ResponseEntity.ok(alerts);
} catch (Exception e) {
return ResponseEntity.internalServerError().build();
}
}
@GetMapping("/alerts/statistics")
public ResponseEntity<AlertStatistics> getAlertStatistics() {
try {
AlertStatistics stats = analysisService.getAlertStatistics();
return ResponseEntity.ok(stats);
} catch (Exception e) {
return ResponseEntity.internalServerError().build();
}
}
@GetMapping("/alerts/categories")
public ResponseEntity<Map<String, List<Alert>>> getAlertsByCategory() {
try {
Map<String, List<Alert>> alertsByCategory = analysisService.getAlertsByCategory();
return ResponseEntity.ok(alertsByCategory);
} catch (Exception e) {
return ResponseEntity.internalServerError().build();
}
}
@PostMapping("/pr/{repo}/{prNumber}/analyze")
public ResponseEntity<PullRequestAnalysis> analyzePullRequest(
@PathVariable String repo,
@PathVariable int prNumber) {
try {
PullRequestAnalysis analysis = analysisService.analyzePullRequest(repo, prNumber);
return ResponseEntity.ok(analysis);
} catch (Exception e) {
return ResponseEntity.internalServerError().build();
}
}
@GetMapping("/report")
public ResponseEntity<AnalysisReport> generateReport() {
try {
AnalysisReport report = analysisService.generateReport();
return ResponseEntity.ok(report);
} catch (Exception e) {
return ResponseEntity.internalServerError().build();
}
}
@GetMapping("/export/sarif")
public ResponseEntity<String> exportToSarif() {
try {
String sarif = analysisService.exportToSarif();
return ResponseEntity.ok()
.header("Content-Type", "application/sarif+json")
.header("Content-Disposition", "attachment; filename=lgtm-results.sarif")
.body(sarif);
} catch (Exception e) {
return ResponseEntity.internalServerError().build();
}
}
@GetMapping("/health")
public ResponseEntity<Map<String, String>> healthCheck() {
try {
analysisService.getCurrentAnalysis();
return ResponseEntity.ok(Map.of("status", "healthy"));
} catch (Exception e) {
return ResponseEntity.status(503)
.body(Map.of("status", "unhealthy", "error", e.getMessage()));
}
}
}
8. Application Configuration
# application.yml
lgtm:
api:
token: ${LGTM_API_TOKEN}
base-url: https://lgtm.com/api/v1.0
project:
id: ${LGTM_PROJECT_ID}
analysis:
timeout: 600
fail-on-critical: true
github:
token: ${GITHUB_TOKEN}
notification:
slack:
webhook-url: ${SLACK_WEBHOOK_URL}
email:
enabled: false
recipients: [email protected]
logging:
level:
com.example.lgtm: DEBUG
Best Practices
1. Query Optimization
// Custom query for specific project patterns
public class CustomQueries {
/**
* Query to detect unsafe file operations
*/
public static final String UNSAFE_FILE_OPERATION = """
import java
import semmle.code.java.dataflow.DataFlow
import semmle.code.java.dataflow.TaintTracking
from MethodAccess fileOp, Expr userInput
where
fileOp.getMethod().getName().matches("delete|rename|create") and
fileOp.getMethod().getDeclaringType().hasQualifiedName("java.io", "File") and
DataFlow::localFlow(DataFlow::parameterNode(userInput), DataFlow::exprNode(fileOp.getArgument(0)))
select fileOp, "Unsafe file operation with user input: $@", userInput, userInput.toString()
""";
}
2. Alert Management
@Component
public class AlertManagementService {
public void autoCloseFalsePositives(List<Alert> alerts) {
// Auto-close known false positives
alerts.stream()
.filter(this::isFalsePositive)
.forEach(this::closeAlert);
}
private boolean isFalsePositive(Alert alert) {
// Implement false positive detection logic
return alert.getFile().contains("/test/") ||
alert.getMessage().contains("known false positive");
}
}
Conclusion
This comprehensive LGTM integration provides:
- Automated code analysis with LGTM.com
- CI/CD integration with GitHub Actions and Jenkins
- Pull request analysis with automatic comments
- Custom query development for project-specific patterns
- Comprehensive reporting with statistics and trends
- SARIF export for tool integration
- REST API for programmatic access
Key benefits:
- Continuous code quality monitoring
- Security vulnerability detection
- Developer workflow integration
- Customizable analysis with project-specific queries
- Comprehensive reporting and trend analysis
This setup ensures code quality and security are maintained throughout the development lifecycle, with immediate feedback to developers and comprehensive reporting for teams.
Secure Java Dependency Management, Vulnerability Scanning & Software Supply Chain Protection (SBOM, SCA, CI Security & License Compliance)
https://macronepal.com/blog/github-code-scanning-in-java-complete-guide/
Explains GitHub Code Scanning for Java using tools like CodeQL to automatically analyze source code and detect security vulnerabilities directly inside CI/CD pipelines before deployment.
https://macronepal.com/blog/license-compliance-in-java-comprehensive-guide/
Explains software license compliance in Java projects, ensuring dependencies follow legal requirements (MIT, Apache, GPL, etc.) and preventing license violations in enterprise software.
https://macronepal.com/blog/container-security-for-java-uncovering-vulnerabilities-with-grype/
Explains using Grype to scan Java container images and filesystems for known CVEs in OS packages and application dependencies to improve container security.
https://macronepal.com/blog/syft-sbom-generation-in-java-comprehensive-software-bill-of-materials-for-jvm-applications/
Explains using Syft to generate SBOMs (Software Bill of Materials) for Java applications, listing all dependencies, libraries, and components for supply chain transparency.
https://macronepal.com/blog/comprehensive-dependency-analysis-generating-and-scanning-sboms-with-trivy-for-java/
Explains using Trivy to generate SBOMs and scan Java dependencies and container images for vulnerabilities, integrating security checks into CI/CD pipelines.
https://macronepal.com/blog/dependabot-for-java-in-java/
Explains GitHub Dependabot for Java projects, which automatically detects vulnerable dependencies and creates pull requests to update them securely.
https://macronepal.com/blog/parasoft-jtest-in-java-comprehensive-guide-to-code-analysis-and-testing/
Explains Parasoft Jtest, a static analysis and testing tool for Java that helps detect bugs, security issues, and code quality problems early in development.
https://macronepal.com/blog/snyk-open-source-in-java-comprehensive-dependency-vulnerability-management-2/
Explains Snyk Open Source for Java, which continuously scans dependencies for vulnerabilities and provides automated fix suggestions and monitoring.
https://macronepal.com/blog/owasp-dependency-check-in-java-complete-vulnerability-scanning-guide/
Explains OWASP Dependency-Check, which scans Java dependencies against the National Vulnerability Database (NVD) to detect known security vulnerabilities.
https://macronepal.com/blog/securing-your-dependencies-a-java-developers-guide-to-whitesource-mend-bolt/
Explains Mend (WhiteSource) Bolt for Java, a dependency management and SCA tool that provides vulnerability detection, license compliance, and security policy enforcement in enterprise environments.