gnodet-bot commented on code in PR #13166: URL: https://github.com/apache/maven/pull/13166#discussion_r4042762967
########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' Review Comment: ⚠️ **[STILL OPEN] Unpinned action — supply-chain risk.** Every other workflow in this repo pins to a full commit SHA. With `contents: write` + `pull-requests: write` at the top level, a compromised mutable tag can exfiltrate secrets or push arbitrary code. ```suggestion - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions Review Comment: ⚠️ **[STILL OPEN] Unpinned action — supply-chain risk.** ```suggestion - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions + run: | + mvn -B versions:update-properties \ + -Pversions-update \ + -DincludeProperties="lifecycle.clean-plugin,lifecycle.compiler-plugin,lifecycle.deploy-plugin,lifecycle.ear-plugin,lifecycle.ejb-plugin,lifecycle.install-plugin,lifecycle.jar-plugin,lifecycle.plugin-plugin,lifecycle.rar-plugin,lifecycle.resources-plugin,lifecycle.site-plugin,lifecycle.surefire-plugin,lifecycle.war-plugin" \ + -pl impl/maven-core + + - name: Check for changes + id: changes + run: | + if git diff --quiet impl/maven-core/pom.xml; then + echo "changed=false" >> $GITHUB_OUTPUT + else + echo "changed=true" >> $GITHUB_OUTPUT + echo "--- Updated properties ---" + git diff impl/maven-core/pom.xml | grep '^[+-].*version\.maven' | grep -v '^---\|^+++' + fi + + - name: Create Pull Request + if: steps.changes.outputs.changed == 'true' + uses: peter-evans/create-pull-request@v7 + with: + token: ${{ secrets.GITHUB_TOKEN }} + branch: update/lifecycle-plugins-${{ matrix.branch }} + base: ${{ matrix.branch }} + commit-message: "chore: update Maven lifecycle plugin versions" + title: "chore: update Maven lifecycle plugin versions (${{ matrix.branch }})" + body: | + Automated update of Maven lifecycle plugin versions via `versions:update-properties`. Review Comment: 🚨 **[STILL OPEN] `GITHUB_TOKEN` → CI won't trigger on created PRs.** GitHub explicitly blocks `on: pull_request` CI for PRs opened by a workflow using `GITHUB_TOKEN`. The resulting version-bump PRs will show no CI status and cannot be safely merged. ```suggestion token: ${{ secrets.GH_TOKEN }} ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 Review Comment: 💡 **[STILL OPEN] Missing `fail-fast: false`.** With the default `fail-fast: true`, a transient failure on one leg immediately cancels the other, leaving one branch un-updated with no signal. ```suggestion strategy: fail-fast: false matrix: branch: [master, maven-4.0.x] ``` ########## .github/workflows/update-lifecycle-plugins.yml: ########## @@ -0,0 +1,83 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +name: Update lifecycle plugin versions + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: '0 8 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + update-lifecycle-plugins: + runs-on: ubuntu-latest + strategy: + matrix: + branch: [master, maven-4.0.x] + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ matrix.branch }} + + - uses: actions/setup-java@v4 + with: + java-version: '21' + distribution: 'temurin' + cache: maven + + - name: Update lifecycle plugin versions + run: | + mvn -B versions:update-properties \ + -Pversions-update \ + -DincludeProperties="lifecycle.clean-plugin,lifecycle.compiler-plugin,lifecycle.deploy-plugin,lifecycle.ear-plugin,lifecycle.ejb-plugin,lifecycle.install-plugin,lifecycle.jar-plugin,lifecycle.plugin-plugin,lifecycle.rar-plugin,lifecycle.resources-plugin,lifecycle.site-plugin,lifecycle.surefire-plugin,lifecycle.war-plugin" \ + -pl impl/maven-core + + - name: Check for changes + id: changes + run: | + if git diff --quiet impl/maven-core/pom.xml; then + echo "changed=false" >> $GITHUB_OUTPUT + else + echo "changed=true" >> $GITHUB_OUTPUT + echo "--- Updated properties ---" + git diff impl/maven-core/pom.xml | grep '^[+-].*version\.maven' | grep -v '^---\|^+++' + fi + + - name: Create Pull Request + if: steps.changes.outputs.changed == 'true' + uses: peter-evans/create-pull-request@v7 + with: + token: ${{ secrets.GITHUB_TOKEN }} + branch: update/lifecycle-plugins-${{ matrix.branch }} + base: ${{ matrix.branch }} + commit-message: "chore: update Maven lifecycle plugin versions" + title: "chore: update Maven lifecycle plugin versions (${{ matrix.branch }})" Review Comment: ⚠️ **[STILL OPEN] Unpinned third-party action with write access — supply-chain risk.** Runs with `contents: write` + `pull-requests: write`. A SHA pin is mandatory. Latest v7 is v7.0.11: ```suggestion uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11 ``` ########## pom.xml: ########## @@ -1302,5 +1302,154 @@ under the License. </plugins> </build> </profile> + <profile> + <!-- + This profile is NEVER activated during a normal build. + It configures versions-maven-plugin to map the lifecycle.*-plugin + properties (in impl/maven-core/pom.xml) to their corresponding Maven + plugin artifacts, enabling: + + mvn versions:update-properties -Pversions-update \ + DincludeProperties="lifecycle.clean-plugin,..." \ + -pl impl/maven-core + + The GitHub Actions workflow .github/workflows/update-lifecycle-plugins.yml + runs this command weekly and opens a PR when updates are found. + --> + <id>versions-update</id> + <build> + <plugins> + <plugin> + <groupId>org.codehaus.mojo</groupId> + <artifactId>versions-maven-plugin</artifactId> + <version>2.18.0</version> Review Comment: 💡 **[STILL OPEN] `versions-maven-plugin` 2.18.0 — current latest is 2.22.0.** ```suggestion <version>2.22.0</version> ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
