👷 ci: add [email protected] to code quality workflow #1134
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
cc @algomaster99 @LogFlames @monperrus |
|
Currently, this project does not break CI via Software Supply Chain Report of chains-project/maven-lockfileSoftware Supply Chain Report of chains-project/maven-lockfile - a4bf2b1📚 Table of Contents
Enabled ChecksThe following checks were requested project-wide:
Ignore Configuration SummaryIgnored Checks Per Dependency 🔧These dependencies had specific checks excluded based on the configuration file.
Ignored Checks If Dependency is a Parent 📦➡️👶Checks will be ignored if the listed dependency is a parent of another package.
Summary of FindingsHow to read the results 📖Dirty-waters has analyzed your project dependencies and found different categories for each of them:
Total packages in the supply chain: 372❗ Packages with no source code URL ( ⛔ Packages with repo URL that is 404 ( 🔧 Packages with inaccessible commit SHA/tag ( 🔒 Packages without code signature ( 🔓 Packages with invalid code signature ( Fine grained information🐬 For further information about software supply chain smells in your project, take a look at the following tables. All analyzed packages have a source code repo. List of packages with available source code repos but with inaccessible commit SHAs/tags (12)The package manager (maven) does not support checking for deprecated packages. All packages have code signature. All packages have valid code signature. The package manager (maven) does not support checking for provenance. The package manager (maven) does not support checking for aliased packages. Ignored SmellsThe following smells were configured to be ignored in this project: Source code links that could not be found (1)
List of packages with available source code repos but with inaccessible commit SHAs/tags (63)List of packages without code signature (10)
Call to Action:👻What do I do now?For packages without source code & accessible SHA/release tags:
NotesOther info:
Glossary
Report created by dirty-waters on 2025-08-20 12:08:43.
|
|
Same here chains-project/sbom.exe#317 (comment) unless Elias gets here first. |
|
Nice! Looking at the deps with missing repo-urls I will have to hunt those down. For example oro:[email protected] is a transitive dependency of maven-artifact-plugin, but haven't found a way to find where it is exactly yet. |
|
@LogFlames as a glimmer of hope, chains-project/dirty-waters#73 should be merged today and provide you with a lot more detail regarding where each package comes from :) |
6 tasks
|
Nice! Very helpful to identify plugins which have a high number of broken dependencies ^^ Unfortunately oro:[email protected] (and I think some more) are transitive dependencies of maven-artifact-plugin as well :p |
LogFlames
changed the title
|
@randomicecube does the workflow need to be triggered in some special way besides a new commit? Or maybe the cache nedes to be cleared? I merged in main where I had removed When running |
Maybe there's a cache issue, but it doesn't make a lot of sense to me -- between the latest and the second-to-last comment, there are 60 less packages in the supply chain, which I'm assuming are related with the changes coming from main? And maybe those then reflect on the less amount of warnings now?
Regarding this, that hadn't happened to me before (in fact, I vividly remember them being under |
|
Hey @LogFlames I just ran the resolve-plugins goal locally and got the following:
Does the same happen to you? If so, this does seem to indicate that it makes sense for it to be connected to eclipse-plugin |
6 tasks
|
@randomicecube I don't get the same output, did you pull this branch after I merged in main where This is my output:
|
|
@LogFlames you are right, I hadn't pulled, I'll run the tool again on this commit and try to see what may be happening. First thoughts though are that it is probably a cache-related issue: on dependency extraction, we'll see a previously cached dependency, which will come with the extracted parent as well, and just use it; I'll tinker with this |
|
Re-running with debug because I'm scratching my head at this one, doesn't really make sense since because of the pom's hash being the cache key, I don't get where it got that parent from, it should have been reset |
|
@LogFlames fixed, I think! |
|
Awesome! Thanks!
|
|
@LogFlames yes! See https://github.com/chains-project/dirty-waters/?tab=readme-ov-file#configuration Although this doesn't support ignoring packages w/ certain parents, just packages themselves -- I will add support for that! |
|
@LogFlames v1.11.35 now gives the ability to ignore deps w/ certain parents; docs about this still at https://github.com/chains-project/dirty-waters/?tab=readme-ov-file#configuration! |
|
Awesome! I'm guessing "provenance" is the check that checks source code url? Would like to disable as few checks as possible. Are the available options documented somewhere? (maybe the report could make it more obvious what each check is called in code?) EDIT: Changed to "source_code" and "source_code_sha" |
LogFlames
changed the title
|
I've tried to add the config but it doesn't find the file. When adding the option I also tried The file I thought it was because it checked against the main branch, but changing @randomicecube Do you know/have an example of how to configure the action to use a config-file? |
|
Fixed the config file part, found another bug related with ignored-per-dep checks after being cached :) fixing that as well |
|
Okay right, this is still happening because checking for source_code_sha leads to source_code being activated; if you do the checks via CLI this would be disallowed, however in the config ignore checks it is allowed, I'll fix it so it isn't anymore |
|
Awesome, now all critical and medium warnings have been added to the ignore and CI passes! 🎉 Before we merge we should add harden-runner to the workflow and pin all actions to sha's instead of tags. I also think it would be nice if the report included the number of suppressed or ignored warnings, for example as footnotes (or some other formatting). Total packages in the supply chain: 427❗ Packages with no source code URL (
|
|
That's an interesting suggestion, I'll add it as an issue! |
…y were shown, even if ignored
…nstead of breaking
LogFlames
force-pushed
the
diogo/add-dirty-waters-action
branch
from
4b82bdb to
a4bf2b1
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Relates to chains-project/dirty-waters#58