gnodet-bot commented on code in PR #13166: URL: https://github.com/apache/maven/pull/13166#discussion_r4042691168
########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' Review Comment: ⚠️ **[REGRESSION] Unpinned action — supply-chain risk.** This was fixed in `9c41c1ad8e` with `actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1`. All other workflows in this repo pin to a full commit SHA. This squash dropped the pin. ```suggestion - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions Review Comment: ⚠️ **[REGRESSION] Unpinned action — supply-chain risk.** Fixed in `9c41c1ad8e` with `actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1`. Same pattern as every other workflow in this repo. ```suggestion - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions + run: | + mvn -B versions:update-properties \ + -Pversions-update \ + -DincludeProperties="version.maven-clean-plugin,version.maven-compiler-plugin,version.maven-deploy-plugin,version.maven-ear-plugin,version.maven-ejb-plugin,version.maven-install-plugin,version.maven-jar-plugin,version.maven-plugin-plugin,version.maven-rar-plugin,version.maven-resources-plugin,version.maven-site-plugin,version.maven-surefire-plugin,version.maven-war-plugin" \ + -pl impl/maven-core + + - name: Check for changes + id: changes + run: | + if git diff --quiet impl/maven-core/pom.xml; then + echo "changed=false" >> $GITHUB_OUTPUT + else + echo "changed=true" >> $GITHUB_OUTPUT + echo "--- Updated properties ---" + git diff impl/maven-core/pom.xml | grep '^[+-].*version\.maven' | grep -v '^---\|^+++' + fi + + - name: Create Pull Request + if: steps.changes.outputs.changed == 'true' + uses: peter-evans/create-pull-request@v7 + with: + token: ${{ secrets.GITHUB_TOKEN }} + branch: update/lifecycle-plugins-${{ matrix.branch }} + base: ${{ matrix.branch }} + commit-message: "chore: update Maven lifecycle plugin versions" + title: "chore: update Maven lifecycle plugin versions (${{ matrix.branch }})" + body: | + Automated update of Maven lifecycle plugin versions via `versions:update-properties`. Review Comment: 🚨 **[REGRESSION] `GITHUB_TOKEN` won't trigger CI on the created PR.** This was fixed in `9c41c1ad8e` by switching to `secrets.GH_TOKEN`. GitHub explicitly blocks `on: pull_request` CI workflows for PRs opened by a workflow using `GITHUB_TOKEN`. The resulting version-bump PRs will show no CI status and cannot be merged safely. ```suggestion token: ${{ secrets.GH_TOKEN }} ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions + run: | + mvn -B versions:update-properties \ + -Pversions-update \ + -DincludeProperties="version.maven-clean-plugin,version.maven-compiler-plugin,version.maven-deploy-plugin,version.maven-ear-plugin,version.maven-ejb-plugin,version.maven-install-plugin,version.maven-jar-plugin,version.maven-plugin-plugin,version.maven-rar-plugin,version.maven-resources-plugin,version.maven-site-plugin,version.maven-surefire-plugin,version.maven-war-plugin" \ + -pl impl/maven-core + + - name: Check for changes + id: changes + run: | + if git diff --quiet impl/maven-core/pom.xml; then + echo "changed=false" >> $GITHUB_OUTPUT + else + echo "changed=true" >> $GITHUB_OUTPUT + echo "--- Updated properties ---" + git diff impl/maven-core/pom.xml | grep '^[+-].*version\.maven' | grep -v '^---\|^+++' + fi + + - name: Create Pull Request + if: steps.changes.outputs.changed == 'true' + uses: peter-evans/create-pull-request@v7 + with: + token: ${{ secrets.GITHUB_TOKEN }} + branch: update/lifecycle-plugins-${{ matrix.branch }} + base: ${{ matrix.branch }} + commit-message: "chore: update Maven lifecycle plugin versions" + title: "chore: update Maven lifecycle plugin versions (${{ matrix.branch }})" Review Comment: ⚠️ **[REGRESSION] Unpinned third-party action with write access — supply-chain risk.** Fixed in `9c41c1ad8e` with `peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.6`. The latest v7 tag is now v7.0.11 (`22a9089034f40e5a961c8808d113e2c98fb63676`), but a SHA pin is mandatory here. This action runs with `contents: write` + `pull-requests: write` — a compromised mutable tag can exfiltrate secrets or push arbitrary code. ```suggestion uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 Review Comment: 💡 **[REGRESSION] Missing `fail-fast: false`.** Fixed in `4a29c56`. With the default `fail-fast: true`, a transient failure on the `master` leg (flaky Central download, etc.) immediately cancels the `maven-4.0.x` leg, potentially leaving one branch un-updated with no signal. ```suggestion strategy: fail-fast: false matrix: branch: [master, maven-4.0.x] ``` ########## pom.xml: ########## @@ -1302,5 +1302,154 @@ under the License. </plugins> </build> </profile> + <profile> + <!-- + This profile is NEVER activated during a normal build. + It configures versions-maven-plugin to map the version.maven-*-plugin + properties (in impl/maven-core/pom.xml) to their corresponding Maven + plugin artifacts, enabling: + + mvn versions:update-properties -Pversions-update \ + -DincludeProperties="version.maven-clean-plugin,..." \ + -pl impl/maven-core + + The GitHub Actions workflow .github/workflows/update-lifecycle-plugins.yml + runs this command weekly and opens a PR when updates are found. + --> Review Comment: 💡 **[REGRESSION] `versions-maven-plugin` 2.18.0 — outdated.** Bumped to 2.22.0 in `9a4db016`. Current latest is 2.22.0. ```suggestion <version>2.22.0</version> ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 Review Comment: 🚨 **[UNRESOLVED] `maven-4.0.x` matrix leg is a no-op.** The `versions-update` profile only exists in master's `pom.xml`. On `maven-4.0.x`, `-Pversions-update` will cause Maven to warn "profile not found" (or hard-fail) and exit without updating anything. `maven-4.0.x` does have `version.maven-*-plugin` properties in `impl/maven-core/pom.xml`, but without the profile the artifact→property mappings are absent. The leg silently produces no PR every week. Fix options: - **Option A (recommended):** Backport the `versions-update` profile to `maven-4.0.x` via a separate commit/PR on that branch. - **Option B:** Make the profile optional with `-P?versions-update` and accept the `maven-4.0.x` leg only works once the profile is backported. Either way, the `maven-4.0.x` leg must not run until this is resolved, or the matrix should be reduced to `[master]` for now. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
