-
Notifications
You must be signed in to change notification settings - Fork 2
Description
The Java documentation is incomplete. I strongly doubt anyone outside of contrast would be able to use this to successfully run the CLI tool on a Java build.
There are two commands listed.
npm install -g @contrast/contrast-cli
which installs the cli
and
contrast-cli --yamlPath scan.yaml
Which does, nothing...
Before this there is no reference to a scan.yaml file, or what it should contain.
This page should contain step by step instructions on how you setup the cli to generate a scan/sbom. With the only thing you need is to drop in your api key/auth token. And there should be instructions on how you get those.
Also example Java application, such as https://github.com/Contrast-Security-OSS/vulnerable-spring-boot-application with an example of the build integration would also be very useful. With examples for gradle and maven.