gnodet-bot commented on code in PR #13166: URL: https://github.com/apache/maven/pull/13166#discussion_r4040398101
########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 Review Comment: ⚠️ **[NOT ADDRESSED] Unpinned action — supply-chain risk.** Same issue as `actions/checkout`. ```suggestion - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 Review Comment: ⚠️ **[NOT ADDRESSED] Unpinned action — supply-chain risk.** All other workflows in this repo pin actions to a full commit SHA with a version comment (`@<sha> # vN`). Using `@v4` means a compromised or accidentally-moved tag can execute with `contents: write` + `pull-requests: write` permissions. Match the pattern from `maven.yml`: ```suggestion - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions + run: | + mvn -B versions:update-properties \ + -Pversions-update \ + -DallowMajorUpdates=false \ + -DincludeProperties="version.maven-clean-plugin,version.maven-compiler-plugin,version.maven-deploy-plugin,version.maven-ear-plugin,version.maven-ejb-plugin,version.maven-install-plugin,version.maven-jar-plugin,version.maven-plugin-plugin,version.maven-rar-plugin,version.maven-resources-plugin,version.maven-site-plugin,version.maven-surefire-plugin,version.maven-war-plugin" \ + -pl impl/maven-core + + - name: Check for changes + id: changes + run: | + if git diff --quiet impl/maven-core/pom.xml; then + echo "changed=false" >> $GITHUB_OUTPUT + else + echo "changed=true" >> $GITHUB_OUTPUT + echo "--- Updated properties ---" + git diff impl/maven-core/pom.xml | grep '^[+-].*version\.maven' | grep -v '^---\|^+++' + fi + + - name: Create Pull Request + if: steps.changes.outputs.changed == 'true' + uses: peter-evans/create-pull-request@v7 Review Comment: ⚠️ **[NOT ADDRESSED] Unpinned action — supply-chain risk.** Same issue. `peter-evans/create-pull-request@v7` is a mutable tag on a third-party action that has write access to your repo. ```suggestion uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.6 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions + run: | + mvn -B versions:update-properties \ + -Pversions-update \ + -DallowMajorUpdates=false \ + -DincludeProperties="version.maven-clean-plugin,version.maven-compiler-plugin,version.maven-deploy-plugin,version.maven-ear-plugin,version.maven-ejb-plugin,version.maven-install-plugin,version.maven-jar-plugin,version.maven-plugin-plugin,version.maven-rar-plugin,version.maven-resources-plugin,version.maven-site-plugin,version.maven-surefire-plugin,version.maven-war-plugin" \ + -pl impl/maven-core + + - name: Check for changes + id: changes + run: | + if git diff --quiet impl/maven-core/pom.xml; then + echo "changed=false" >> $GITHUB_OUTPUT + else + echo "changed=true" >> $GITHUB_OUTPUT + echo "--- Updated properties ---" + git diff impl/maven-core/pom.xml | grep '^[+-].*version\.maven' | grep -v '^---\|^+++' + fi + + - name: Create Pull Request + if: steps.changes.outputs.changed == 'true' + uses: peter-evans/create-pull-request@v7 + with: + token: ${{ secrets.GITHUB_TOKEN }} Review Comment: ⚠️ **[NOT ADDRESSED] `GITHUB_TOKEN` won't trigger CI on the created PR.** GitHub explicitly blocks `on: pull_request` events for PRs opened by `GITHUB_TOKEN`. The resulting update PRs will have no CI checks, requiring a maintainer to manually push a commit or close/reopen to trigger the `Java CI` workflow. Use a PAT stored as a repository secret (the ASF infra team can provision one): ```suggestion token: ${{ secrets.GH_TOKEN }} ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] Review Comment: 💡 **[NOT ADDRESSED] Missing `fail-fast: false`.** With the default `fail-fast: true`, a transient failure on the `master` branch run (e.g. flaky Central download) immediately cancels the `maven-4.0.x` run — even though the two branches are completely independent operations. ```suggestion fail-fast: false matrix: branch: [master, maven-4.0.x] ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write Review Comment: 💡 **[NOT ADDRESSED] Permissions over-privileged at workflow level.** Declaring `contents: write` + `pull-requests: write` at the top level means every step in the job — including `checkout` and `setup-java` — runs with write access. Best practice is `contents: read` at the workflow level and elevated permissions scoped to the job: ```suggestion permissions: contents: read ``` Then add to the `update-lifecycle-plugins` job: ```yaml permissions: contents: write pull-requests: write ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
