👷 ci: add [email protected] to code quality workflow #1134
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
cc @algomaster99 @LogFlames @monperrus |
Software Supply Chain Report of chains-project/maven-lockfile - 32bbb53Enabled ChecksThe following checks were specifically requested:
How to read the results 📖Dirty-waters has analyzed your project dependencies and found different categories for each of them:
Total packages in the supply chain: 466❗ Packages with no source code URL ( ⛔ Packages with repo URL that is 404 ( 🔧 Packages with inaccessible commit SHA/tag ( 🔒 Packages without code signature ( 🔓 Packages with invalid code signature ( Fine grained information🐬 For further information about software supply chain smells in your project, take a look at the following tables. List of packages with available source code repos but with inaccessible commit SHAs/tags(75)
The package manager (maven) does not support checking for deprecated packages. List of packages without code signature(1)
All packages have valid code signature. The package manager (maven) does not support checking for provenance. The package manager (maven) does not support checking for aliased packages. Call to Action:👻What do I do now?For packages without source code & accessible SHA/release tags:
For deprecated packages:
For packages without code signature:
For packages with invalid code signature:
For packages without provenance:
For packages that are aliased:
NotesOther info:
Report created by dirty-waters. Report created on 2025-05-07 10:02:54
|
|
Same here chains-project/sbom.exe#317 (comment) unless Elias gets here first. |
|
Nice! Looking at the deps with missing repo-urls I will have to hunt those down. For example oro:[email protected] is a transitive dependency of maven-artifact-plugin, but haven't found a way to find where it is exactly yet. |
|
@LogFlames as a glimmer of hope, chains-project/dirty-waters#73 should be merged today and provide you with a lot more detail regarding where each package comes from :) |
6 tasks
|
Nice! Very helpful to identify plugins which have a high number of broken dependencies ^^ Unfortunately oro:[email protected] (and I think some more) are transitive dependencies of maven-artifact-plugin as well :p |
LogFlames
changed the title
|
@randomicecube does the workflow need to be triggered in some special way besides a new commit? Or maybe the cache nedes to be cleared? I merged in main where I had removed When running |
Maybe there's a cache issue, but it doesn't make a lot of sense to me -- between the latest and the second-to-last comment, there are 60 less packages in the supply chain, which I'm assuming are related with the changes coming from main? And maybe those then reflect on the less amount of warnings now?
Regarding this, that hadn't happened to me before (in fact, I vividly remember them being under |
|
Hey @LogFlames I just ran the resolve-plugins goal locally and got the following:
Does the same happen to you? If so, this does seem to indicate that it makes sense for it to be connected to eclipse-plugin |
6 tasks
|
@randomicecube I don't get the same output, did you pull this branch after I merged in main where This is my output:
|
|
@LogFlames you are right, I hadn't pulled, I'll run the tool again on this commit and try to see what may be happening. First thoughts though are that it is probably a cache-related issue: on dependency extraction, we'll see a previously cached dependency, which will come with the extracted parent as well, and just use it; I'll tinker with this |
|
Re-running with debug because I'm scratching my head at this one, doesn't really make sense since because of the pom's hash being the cache key, I don't get where it got that parent from, it should have been reset |
|
@LogFlames fixed, I think! |
|
Awesome! Thanks!
|
|
@LogFlames yes! See https://github.com/chains-project/dirty-waters/?tab=readme-ov-file#configuration Although this doesn't support ignoring packages w/ certain parents, just packages themselves -- I will add support for that! |
|
@LogFlames v1.11.35 now gives the ability to ignore deps w/ certain parents; docs about this still at https://github.com/chains-project/dirty-waters/?tab=readme-ov-file#configuration! |
|
Awesome, now all critical and medium warnings have been added to the ignore and CI passes! 🎉 Before we merge we should add harden-runner to the workflow and pin all actions to sha's instead of tags. I also think it would be nice if the report included the number of suppressed or ignored warnings, for example as footnotes (or some other formatting). Total packages in the supply chain: 427❗ Packages with no source code URL (
|
|
That's an interesting suggestion, I'll add it as an issue! |
LogFlames
changed the title
# Do not sign .sha1,.md5 for sigstore.json files. Automatic for maven > 3.9.2. See https://github.com/sigstore/sigstore-java/tree/main/sigstore-maven-plugin#github-actions-oidc-support
|
@randomicecube I was completely off track, but right now I am discussing this PR with @LogFlames. The ignore list is nice. I was thinking to augment it with URLs of tags that can be manually found. For example, |
LogFlames
changed the title
|
@randomicecube sorry to bother you again! I am trying to figure out why the report is generated for the latest commit in main branch and not the one checked out in this PR. It does find the config file (at least seems like it, from logs): In the print everything in the latest config file (in the So it seems the config is not correctly applied for all deps, but it is applied for some (e.g. a bunch of missing signatures and major warnings with 404 source code urls) 🤔 Any help would be greatly appreciated! |
LogFlames
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Relates to chains-project/dirty-waters#58