Skip to content

Commit 968c146

Browse files
a-orena-oren
authored
Merge branch 'main' into TC-4707
2 parents e87366f + 0cce5c0 commit 968c146

6 files changed

Lines changed: 106 additions & 7 deletions

File tree

‎.github/workflows/pr.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ jobs:
1313
permissions:
1414
checks: write
1515
pull-requests: write
16+
id-token: write
1617
env:
1718
MAIN_JAVA_VER: 21
1819
RUN_PYTHON_BIN: ${{ vars.RUN_PYTHON_BIN }}
@@ -66,9 +67,10 @@ jobs:
6667
./target/surefire-reports/*.xml
6768
./target/junit-platform/TEST-junit-jupiter.xml
6869
69-
- name: Upload coverage reports
70+
- name: Upload coverage to Codecov
7071
if: ${{ matrix.java == env.MAIN_JAVA_VER }}
71-
uses: actions/upload-artifact@v7
72+
uses: codecov/codecov-action@v5
7273
with:
73-
name: coverage-${{ matrix.java }}
74-
path: ./target/site/jacoco/jacoco.xml
74+
use_oidc: true
75+
flags: integration-tests
76+
files: ./target/site/jacoco/jacoco.xml

‎codecov.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
codecov:
2+
require_ci_to_pass: false
3+
4+
comment:
5+
layout: "reach,diff,flags,components"
6+
behavior: default
7+
require_changes: false
8+
require_base: false
9+
require_head: true
10+
hide_project_coverage: false
11+
12+
coverage:
13+
status:
14+
project:
15+
default:
16+
informational: true
17+
patch:
18+
default:
19+
informational: true
20+
21+
flags:
22+
integration-tests:
23+
paths:
24+
- src/main/java/
25+
carryforward: true
26+
27+
ignore:
28+
- "src/test/"
29+
- "src/main/resources/"
30+
- "target/"
31+
- "docs/"

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
1919
<maven.compiler.release>21</maven.compiler.release>
2020
<!-- Dependencies -->
21-
<trustify-da-api-model.version>2.0.7</trustify-da-api-model.version>
21+
<trustify-da-api-model.version>2.0.8</trustify-da-api-model.version>
2222
<jackson.version>2.21.3</jackson.version>
2323
<jackson-annotations.version>2.21</jackson-annotations.version>
2424
<jakarta.annotation-api.version>3.0.0</jakarta.annotation-api.version>

‎src/test/resources/dummy_responses/maven/analysis-report.json‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -230,5 +230,53 @@
230230
"remediations": {},
231231
"recommendation": null
232232
}
233-
]
233+
],
234+
"providers": {
235+
"snyk": {
236+
"status": {
237+
"ok": true,
238+
"name": "snyk",
239+
"code": 200,
240+
"message": "OK"
241+
},
242+
"sources": {
243+
"snyk": {
244+
"summary": {
245+
"direct": 1,
246+
"transitive": 0,
247+
"total": 7,
248+
"dependencies": 1,
249+
"critical": 1,
250+
"high": 3,
251+
"medium": 2,
252+
"low": 1,
253+
"remediations": 0,
254+
"recommendations": 1,
255+
"unscanned": 0
256+
},
257+
"dependencies": [
258+
{
259+
"ref": "pkg:maven/log4j/log4j@1.2.17",
260+
"issues": [],
261+
"recommendation": null
262+
}
263+
]
264+
}
265+
},
266+
"recommendations": {
267+
"trusted-content": {
268+
"status": "ok",
269+
"summary": {
270+
"total": 1
271+
},
272+
"dependencies": [
273+
{
274+
"ref": "pkg:maven/log4j/log4j@1.2.17",
275+
"recommendation": "pkg:maven/log4j/log4j@1.2.17-redhat-00001?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F"
276+
}
277+
]
278+
}
279+
}
280+
}
281+
}
234282
}

‎src/test/resources/dummy_responses/maven/analysis-report.mixed‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Content-Type: application/json
33
Content-Transfer-Encoding: binary
44

5-
{"summary":{"dependencies":{"scanned":1,"transitive":0},"vulnerabilities":{"total":7,"direct":1,"critical":1,"high":3,"medium":2,"low":1},"providerStatuses":[{"ok":true,"provider":"snyk","status":200,"message":"OK"}]},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","highestVulnerability":{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false},"issues":[{"id":"SNYK-JAVA-LOG4J-572732","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"Low","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":9.8,"severity":"CRITICAL","cves":["CVE-2019-17571"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342645","title":"SQL Injection","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23305"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342646","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23307"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342647","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23302"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2316893","title":"Arbitrary Code Execution","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"High","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":6.6,"severity":"MEDIUM","cves":["CVE-2021-4104"],"unique":false},{"id":"SNYK-JAVA-LOG4J-3358774","title":"Denial of Service (DoS)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"None","integrityImpact":"None","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssScore":5.9,"severity":"MEDIUM","cves":["CVE-2023-26464"],"unique":false},{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false}],"transitive":[],"remediations":{},"recommendation":null}]}
5+
{"summary":{"dependencies":{"scanned":1,"transitive":0},"vulnerabilities":{"total":7,"direct":1,"critical":1,"high":3,"medium":2,"low":1},"providerStatuses":[{"ok":true,"provider":"snyk","status":200,"message":"OK"}]},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","highestVulnerability":{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false},"issues":[{"id":"SNYK-JAVA-LOG4J-572732","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"Low","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":9.8,"severity":"CRITICAL","cves":["CVE-2019-17571"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342645","title":"SQL Injection","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23305"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342646","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23307"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2342647","title":"Deserialization of Untrusted Data","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssScore":8.1,"severity":"HIGH","cves":["CVE-2022-23302"],"unique":false},{"id":"SNYK-JAVA-LOG4J-2316893","title":"Arbitrary Code Execution","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"High","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"High","integrityImpact":"High","availabilityImpact":"High","exploitCodeMaturity":"Proof of concept code","remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P"},"cvssScore":6.6,"severity":"MEDIUM","cves":["CVE-2021-4104"],"unique":false},{"id":"SNYK-JAVA-LOG4J-3358774","title":"Denial of Service (DoS)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"None","integrityImpact":"None","availabilityImpact":"High","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cvssScore":5.9,"severity":"MEDIUM","cves":["CVE-2023-26464"],"unique":false},{"id":"SNYK-JAVA-LOG4J-1300176","title":"Man-in-the-Middle (MitM)","source":"snyk","cvss":{"attackVector":"Network","attackComplexity":"High","privilegesRequired":"None","userInteraction":"None","scope":"Unchanged","confidentialityImpact":"Low","integrityImpact":"None","availabilityImpact":"None","exploitCodeMaturity":null,"remediationLevel":null,"reportConfidence":null,"cvss":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"},"cvssScore":3.7,"severity":"LOW","cves":["CVE-2020-9488"],"unique":false}],"transitive":[],"remediations":{},"recommendation":null}],"providers":{"snyk":{"status":{"ok":true,"name":"snyk","code":200,"message":"OK"},"sources":{"snyk":{"summary":{"direct":1,"transitive":0,"total":7,"dependencies":1,"critical":1,"high":3,"medium":2,"low":1,"remediations":0,"recommendations":1,"unscanned":0},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","issues":[],"recommendation":null}]}},"recommendations":{"trusted-content":{"status":"ok","summary":{"total":1},"dependencies":[{"ref":"pkg:maven/log4j/log4j@1.2.17","recommendation":"pkg:maven/log4j/log4j@1.2.17-redhat-00001?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F"}]}}}}}
66
------=_Part_32_249990646.1688049072578
77
Content-Type: text/html
88
Content-Transfer-Encoding: 8bit

‎src/test/resources/msc/image/image_reports.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,24 @@
177177
}
178178
]
179179
}
180+
},
181+
"recommendations": {
182+
"trusted-content": {
183+
"status": "ok",
184+
"summary": {
185+
"total": 2
186+
},
187+
"dependencies": [
188+
{
189+
"ref": "pkg:maven/io.quarkus/quarkus-hibernate-orm@2.13.5.Final?type=jar",
190+
"recommendation": "pkg:maven/io.quarkus/quarkus-hibernate-orm@2.13.8.Final-redhat-00006?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar"
191+
},
192+
{
193+
"ref": "pkg:oci/ubi@sha256:f5983f7c7878cc9b26a3962be7756e3c810e9831b0b9f9613e6f6b445f884e74?repository_url=registry.access.redhat.com/ubi9/ubi&tag=9.3-1552&arch=amd64",
194+
"recommendation": "pkg:maven/io.quarkus/quarkus-jdbc-postgresql@2.13.8.Final-redhat-00006?repository_url=https%3A%2F%2Fmaven.repository.redhat.com%2Fga%2F&type=jar"
195+
}
196+
]
197+
}
180198
}
181199
},
182200
"trusted-content": {

0 commit comments

Comments
 (0)