Maven Fortify Plugin

Fortify provides the source code to create a plugin for Maven. The GAV co-ordinates for maven fortify plugin are

<groupId>com.fortify.ps.maven.plugin</groupId>
<artifactId>sca-maven-plugin</artifactId>
<version>3.90</version>

To install Fortify maven plugin and run Fortify SCA in a Maven build, perform the following

1. Copy the folder %FORTIFY_INSTALLATION_DIRECTORY%\HP_FORTIFY\HP_Fortify_SCA_and_Apps_3.90\Samples\advanced\maven-plugin to c:\temp
2. Open a cmd prompt and change directory to c:\temp\maven-plugin
3. Execute the following command. This compiles the maven-plugin and adds maven plugin to local repository

mvn clean package install

4. Change directory to your project folder on which you want to run Fortify 5. Execute the following commands

mvn com.fortify.ps.maven.plugin:sca-maven-plugin:3.90:clean
mvn com.fortify.ps.maven.plugin:sca-maven-plugin:3.90:translate -Dfortify.sca.verbose=true -Dfortify.sca.debug=true
mvn com.fortify.ps.maven.plugin:sca-maven-plugin:3.90:scan -Dfortify.sca.verbose=true -Dfortify.sca.debug=true

6. Search for .fpr in the project directory for Fortify SCA report