Skip to content

Commit 25cdd63

Browse files
AB-xdevAB-xdev
authored
Merge pull request #298 from xdev-software/develop
Release
2 parents 4342ac1 + 01a0a89 commit 25cdd63

26 files changed

Lines changed: 288 additions & 122 deletions

File tree

‎.config/pmd/java/ruleset.xml‎

Lines changed: 71 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -196,9 +196,9 @@
196196
<rule ref="category/java/security.xml"/>
197197

198198
<rule name="AvoidSystemSetterCall"
199-
language="java"
200-
message="Setters of java.lang.System should not be called unless really needed"
201-
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
199+
language="java"
200+
message="Setters of java.lang.System should not be called unless really needed"
201+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
202202
<description>
203203
Calling setters of java.lang.System usually indicates bad design and likely causes unexpected behavior.
204204
For example, it may break when multiple Threads are setting the value.
@@ -218,10 +218,75 @@
218218
</properties>
219219
</rule>
220220

221+
<rule name="AvoidPostConstruct"
222+
language="java"
223+
message="Avoid @PostConstruct"
224+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
225+
<description>
226+
Using a `@PostConstruct` method is usually only done when field injection is used and initialization needs to be performed after that.
227+
228+
It's better to do this directly in the constructor with constructor injection, so that all logic will be encapsulated there.
229+
This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PostConstruct` method is no longer possible.
230+
</description>
231+
<priority>3</priority>
232+
<properties>
233+
<property name="xpath">
234+
<value>
235+
<![CDATA[
236+
//MethodDeclaration[pmd-java:hasAnnotation('jakarta.annotation.PostConstruct')]
237+
]]>
238+
</value>
239+
</property>
240+
</properties>
241+
</rule>
242+
243+
<rule name="AvoidPreDestroy"
244+
language="java"
245+
message="Avoid @PreDestroy"
246+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
247+
<description>
248+
`@PreDestroy` should be replaced by implementing `AutoCloseable` and overwriting the `close` method instead.
249+
250+
This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PreDestroy` method is no much more difficult.
251+
</description>
252+
<priority>3</priority>
253+
<properties>
254+
<property name="xpath">
255+
<value>
256+
<![CDATA[
257+
//MethodDeclaration[pmd-java:hasAnnotation('jakarta.annotation.PreDestroy')]
258+
]]>
259+
</value>
260+
</property>
261+
</properties>
262+
</rule>
263+
264+
<rule name="AvoidUnmanagedThreads"
265+
language="java"
266+
message="Avoid unmanaged threads"
267+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
268+
<description>
269+
Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads.
270+
Threads can also not be cancelled properly.
271+
272+
Use managed Thread services like `ExecutorService` and `CompletableFuture` instead.
273+
</description>
274+
<priority>3</priority>
275+
<properties>
276+
<property name="xpath">
277+
<value>
278+
<![CDATA[
279+
//MethodCall[pmd-java:matchesSig('java.lang.Thread#start()') or pmd-java:matchesSig('java.lang.Thread#startVirtualThread(java.lang.Runnable)') or pmd-java:matchesSig('java.lang.Thread$Builder#start(java.lang.Runnable)')]
280+
]]>
281+
</value>
282+
</property>
283+
</properties>
284+
</rule>
285+
221286
<rule name="JavaObjectSerializationIsUnsafe"
222-
language="java"
223-
message="Using Java Object (De-)Serialization is unsafe and has led to too many security vulnerabilities"
224-
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
287+
language="java"
288+
message="Using Java Object (De-)Serialization is unsafe and has led to too many security vulnerabilities"
289+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
225290
<description>
226291
Nearly every known usage of (Java) Object Deserialization has resulted in [a security vulnerability](https://cloud.google.com/blog/topics/threat-intelligence/hunting-deserialization-exploits?hl=en).
227292
Vulnerabilities are so common that there are [dedicated projects for exploit payload generation](https://github.com/frohoff/ysoserial).

‎.github/workflows/broken-links.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919

2020
- name: Link Checker
2121
id: lychee
22-
uses: lycheeverse/lychee-action@01a5c94d8e012550040658854b90a7a7301e75ca # v2
22+
uses: lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2 # v2
2323
with:
2424
fail: false # Don't fail on broken links, create an issue instead
2525

@@ -29,7 +29,7 @@ jobs:
2929
echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title \"Link Checker Report\"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
3030
env:
3131
GH_TOKEN: ${{ github.token }}
32-
32+
3333
- name: Close issue if everything is fine
3434
if: steps.lychee.outputs.exit_code == 0 && steps.find-issue.outputs.number != ''
3535
run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }}

‎.github/workflows/check-build.yml‎

Lines changed: 44 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -23,25 +23,30 @@ jobs:
2323
build:
2424
runs-on: ubuntu-latest
2525
timeout-minutes: 30
26-
2726
strategy:
2827
matrix:
2928
java: [17, 21]
3029
distribution: [temurin]
31-
3230
steps:
3331
- uses: actions/checkout@v5
34-
32+
3533
- name: Set up JDK
3634
uses: actions/setup-java@v5
3735
with:
3836
distribution: ${{ matrix.distribution }}
3937
java-version: ${{ matrix.java }}
40-
cache: 'maven'
41-
38+
39+
- name: Cache Maven
40+
uses: actions/cache@v4
41+
with:
42+
path: ~/.m2/repository
43+
key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
44+
restore-keys: |
45+
${{ runner.os }}-mvn-build-
46+
4247
- name: Build with Maven
4348
run: ./mvnw -B clean package -P run-integration-tests
44-
49+
4550
- name: Check for uncommited changes
4651
run: |
4752
if [[ "$(git status --porcelain)" != "" ]]; then
@@ -85,21 +90,34 @@ jobs:
8590
runs-on: ubuntu-latest
8691
if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
8792
timeout-minutes: 15
88-
8993
strategy:
9094
matrix:
9195
java: [17]
9296
distribution: [temurin]
93-
9497
steps:
9598
- uses: actions/checkout@v5
96-
99+
97100
- name: Set up JDK
98101
uses: actions/setup-java@v5
99102
with:
100103
distribution: ${{ matrix.distribution }}
101104
java-version: ${{ matrix.java }}
102-
cache: 'maven'
105+
106+
- name: Cache Maven
107+
uses: actions/cache@v4
108+
with:
109+
path: ~/.m2/repository
110+
key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }}
111+
restore-keys: |
112+
${{ runner.os }}-mvn-checkstyle-
113+
114+
- name: CheckStyle Cache
115+
uses: actions/cache@v4
116+
with:
117+
path: '**/target/checkstyle-cachefile'
118+
key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }}
119+
restore-keys: |
120+
${{ runner.os }}-checkstyle-
103121
104122
- name: Run Checkstyle
105123
run: ./mvnw -B checkstyle:check -P checkstyle -T2C
@@ -108,12 +126,10 @@ jobs:
108126
runs-on: ubuntu-latest
109127
if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
110128
timeout-minutes: 15
111-
112129
strategy:
113130
matrix:
114131
java: [17]
115132
distribution: [temurin]
116-
117133
steps:
118134
- uses: actions/checkout@v5
119135

@@ -122,7 +138,22 @@ jobs:
122138
with:
123139
distribution: ${{ matrix.distribution }}
124140
java-version: ${{ matrix.java }}
125-
cache: 'maven'
141+
142+
- name: Cache Maven
143+
uses: actions/cache@v4
144+
with:
145+
path: ~/.m2/repository
146+
key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }}
147+
restore-keys: |
148+
${{ runner.os }}-mvn-pmd-
149+
150+
- name: PMD Cache
151+
uses: actions/cache@v4
152+
with:
153+
path: '**/target/pmd/pmd.cache'
154+
key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }}
155+
restore-keys: |
156+
${{ runner.os }}-pmd-
126157
127158
- name: Run PMD
128159
run: ./mvnw -B test pmd:aggregate-pmd-no-fork pmd:check -P pmd -DskipTests -T2C

‎.github/workflows/image-vuln-scan.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,13 @@ jobs:
2020
- uses: actions/checkout@v5
2121

2222
- name: Scan - Full
23-
uses: aquasecurity/trivy-action@0.32.0
23+
uses: aquasecurity/trivy-action@0.33.1
2424
with:
2525
image-ref: ${{ env.TRIVYY_IMAGE_REF }}
2626

2727
- name: Scan - Relevant
2828
id: scan_relevant
29-
uses: aquasecurity/trivy-action@0.32.0
29+
uses: aquasecurity/trivy-action@0.33.1
3030
with:
3131
image-ref: ${{ env.TRIVYY_IMAGE_REF }}
3232
exit-code: 1

‎.github/workflows/release.yml‎

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,30 @@ permissions:
88
contents: write
99
pull-requests: write
1010

11+
# DO NOT RESTORE CACHE for critical release steps to prevent a (extremely unlikely) scenario
12+
# where a supply chain attack could be achieved due to poisoned cache
1113
jobs:
1214
check-code:
1315
runs-on: ubuntu-latest
1416
timeout-minutes: 30
1517
steps:
1618
- uses: actions/checkout@v5
17-
19+
1820
- name: Set up JDK
1921
uses: actions/setup-java@v5
2022
with:
2123
java-version: '17'
2224
distribution: 'temurin'
23-
cache: 'maven'
24-
25+
26+
# Try to reuse existing cache from check-build
27+
- name: Try restore Maven Cache
28+
uses: actions/cache/restore@v4
29+
with:
30+
path: ~/.m2/repository
31+
key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
32+
restore-keys: |
33+
${{ runner.os }}-mvn-build-
34+
2535
- name: Build with Maven
2636
run: ./mvnw -B clean package -T2C
2737

@@ -52,30 +62,30 @@ jobs:
5262
version: ${{ steps.version.outputs.release }}
5363
steps:
5464
- uses: actions/checkout@v5
55-
65+
5666
- name: Configure Git
5767
run: |
5868
git config --global user.email "actions@github.com"
5969
git config --global user.name "GitHub Actions"
60-
70+
6171
- name: Un-SNAP
6272
run: ./mvnw -B versions:set -DremoveSnapshot -DprocessAllModules -DgenerateBackupPoms=false
63-
73+
6474
- name: Get version
6575
id: version
6676
run: |
6777
version=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)
6878
echo "release=$version" >> $GITHUB_OUTPUT
6979
echo "releasenumber=${version//[!0-9]/}" >> $GITHUB_OUTPUT
70-
80+
7181
- name: Commit and Push
7282
run: |
7383
git add -A
7484
git commit -m "Release ${{ steps.version.outputs.release }}"
7585
git push origin
7686
git tag v${{ steps.version.outputs.release }}
7787
git push origin --tags
78-
88+
7989
- name: Create Release
8090
id: create-release
8191
uses: shogo82148/actions-create-release@4661dc54f7b4b564074e9fbf73884d960de569a3 # v1
@@ -130,7 +140,7 @@ jobs:
130140
timeout-minutes: 60
131141
steps:
132142
- uses: actions/checkout@v5
133-
143+
134144
- name: Init Git and pull
135145
run: |
136146
git config --global user.email "actions@github.com"
@@ -260,7 +270,7 @@ jobs:
260270
outputs: type=image,compression=zstd,force-compression=true
261271

262272
- name: Generate artifact attestation (ghcr.io)
263-
uses: actions/attest-build-provenance@v2
273+
uses: actions/attest-build-provenance@v3
264274
with:
265275
subject-name: ghcr.io/${{ github.repository }}
266276
subject-digest: ${{ steps.push.outputs.digest }}
@@ -272,7 +282,7 @@ jobs:
272282
timeout-minutes: 15
273283
steps:
274284
- uses: actions/checkout@v5
275-
285+
276286
- name: Init Git and pull
277287
run: |
278288
git config --global user.email "actions@github.com"
@@ -284,7 +294,15 @@ jobs:
284294
with:
285295
java-version: '17'
286296
distribution: 'temurin'
287-
cache: 'maven'
297+
298+
# Try to reuse existing cache from check-build
299+
- name: Try restore Maven Cache
300+
uses: actions/cache/restore@v4
301+
with:
302+
path: ~/.m2/repository
303+
key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
304+
restore-keys: |
305+
${{ runner.os }}-mvn-build-
288306
289307
- name: Build site
290308
run: ./mvnw -B compile site -DskipTests -T2C
@@ -311,7 +329,7 @@ jobs:
311329
timeout-minutes: 10
312330
steps:
313331
- uses: actions/checkout@v5
314-
332+
315333
- name: Init Git and pull
316334
run: |
317335
git config --global user.email "actions@github.com"
@@ -326,7 +344,7 @@ jobs:
326344
git add -A
327345
git commit -m "Preparing for next development iteration"
328346
git push origin
329-
347+
330348
- name: pull-request
331349
env:
332350
GH_TOKEN: ${{ github.token }}

‎.github/workflows/test-deploy.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
env:
3232
PACKAGES_CENTRAL_TOKEN: ${{ secrets.PACKAGES_CENTRAL_TOKEN }}
3333
MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
34-
34+
3535
- name: Set up JDK
3636
uses: actions/setup-java@v5
3737
with: # running setup-java again overwrites the settings.xml
@@ -117,7 +117,7 @@ jobs:
117117
outputs: type=image,compression=zstd,force-compression=true
118118

119119
- name: Generate artifact attestation (ghcr.io)
120-
uses: actions/attest-build-provenance@v2
120+
uses: actions/attest-build-provenance@v3
121121
with:
122122
subject-name: ghcr.io/${{ github.repository }}
123123
subject-digest: ${{ steps.push.outputs.digest }}

0 commit comments

Comments
 (0)