👷 ci: add [email protected] to code quality workflow

.github/workflows/code-qualitiy.yml

@@ -99,3 +99,36 @@ jobs:
 
       - name: Run reproducibility check
         run: mvn clean install
+  dirty-waters:
+    runs-on:
+        ubuntu-latest
+    permissions:
+      pull-requests: write # To comment on a Pull Request
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: true
+
+      - name: Verify action checksums
+        uses: ./.github/actions/ghasum
+
+      - name: Setup JDK17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+
+      - name: Dirty Waters Analysis
+        uses: chains-project/dirty-waters-action@30bc4ef96e9c59f85efb05affc2992353d65870b # v1.11.52
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          package_manager: maven
+          gradual_report: false
+          debug: true
+          config: dirty-waters.json
+

.github/workflows/gha.sum

@@ -1,12 +1,16 @@
 version 1
 
 actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 Wn6UGuh8/0fkcOLI8uEQmhssKaMEfnm77brXOpwKe7A=
+actions/[email protected] A/Paejdu47oer1Zf9zbtOgbMTG3OmOiXsgB6oodFIOU=
 actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 aYx2ZNrV/U9daVa5XJLnuR3depD7lQqzkyRhH4E9bOU=
+actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 g2V9DAwkHBbZHaTOx4M2g/r9wI49KupzyARL47t/rEQ=
 actions/dependency-review-action@bc41886e18ea39df68b1b1245f4184881938e050 Gd1O6ZG0JtkpyKVsxOwIuNtshdlcYheIADUYdNOIOjo=
 actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 vSiNC7HetrtPF3QhZDzPHWyJ1e8pFltzruLjcw65Sok=
 actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 XE1eqHfEOlHsHx+3cUQA1OGC3jxGBnmx7eTIdEzwSoI=
 actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 cKZQn6p38RgADB4MCMpbFp94sScgm/u3B7rEDB9QS5I=
+actions/[email protected] MTHBGEHwb+MeIw3xRLiVuM/uyRfuK8hlVXL+Z/yEA8c=
 actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 kZHHfo2NsxevBRTKrZnUpDu0Cxgtj5Vooe4x4rylvg8=
+chains-project/dirty-waters-action@30bc4ef96e9c59f85efb05affc2992353d65870b JTXn8ep3K5YnkSpNVyVVe85RAxg2eQ2X+TKP5A6JgyA=
 github/codeql-action@96f518a34f7a870018057716cc4d7a5c014bd61c h0CGAC50uRuMQV8hj6pLuc5zMsaXvXYE/35vEhbnEbs=
 jreleaser/release-action@f69e545b05f149483cecb2fb81866247992694b8 Ixc/05XDYYHGUvtC6Jt9gB/mpHPIwBX7PR8At1yEWSs=
 ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde NlVzVIaycy3fhYp7tgiwvpWvzSsPa48uTVejF6tHEog=

dirty-waters.json

@@ -0,0 +1,123 @@
+{
+    "ignore": {
+        "aopalliance:[email protected]": ["code_signature"],
+        "com.diffplug.durian:[email protected]": ["source_code_sha"],
+        "com.diffplug.durian:[email protected]": ["source_code_sha"],
+        "com.diffplug.durian:[email protected]": ["source_code_sha"],
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "com.google.code.gson:[email protected]": ["source_code_sha"],
+        "com.google.code.gson:[email protected]": ["source_code_sha"],
+        "com.google.collections:[email protected]": ["code_signature"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.protobuf:[email protected]": ["source_code_sha"],
+        "com.google.protobuf:[email protected]": ["source_code_sha"],
+        "com.kohlschutter.junixsocket:[email protected]": ["code_signature"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "commons-beanutils:[email protected]": ["source_code", "code_signature"],
+        "commons-chain:[email protected]": ["code_signature"],
+        "commons-cli:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-digester:[email protected]": ["code_signature"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "dev.equo.ide:[email protected]": ["source_code_sha"],
+        "dom4j:[email protected]": ["source_code", "code_signature"],
+        "io.github.crac:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "jakarta.el:[email protected]": ["source_code_sha"],
+        "jakarta.interceptor:[email protected]": ["source_code_sha"],
+        "jakarta.json:[email protected]": ["source_code_sha"],
+        "javax.inject:javax.inject@1": ["code_signature"],
+        "om.kohlschutter.junixsocket:[email protected]": ["code_signature"],
+        "org.aesh:[email protected]": ["code_signature", "source_code_sha"],
+        "org.aesh:[email protected]": ["code_signature"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.logging.log4j:[email protected]": ["source_code_sha"],
+        "org.apache.logging.log4j:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.assertj:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.codehaus.plexus:[email protected]": ["code_signature"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.platform:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.instancio:[email protected]": ["source_code_sha"],
+        "org.instancio:[email protected]": ["source_code_sha"],
+        "org.iq80.snappy:[email protected]": ["source_code"],
+        "org.jboss.logging:[email protected]": ["code_signature"],
+        "org.jboss.logging:[email protected]": ["code_signature"],
+        "org.jboss.logging:[email protected]": ["code_signature"],
+        "org.jboss.logmanager:[email protected]": ["code_signature"],
+        "org.jboss.marshalling:[email protected]": ["source_code_sha"],
+        "org.jboss.slf4j:[email protected]": ["code_signature", "source_code_sha"],
+        "org.jboss.threads:[email protected]": ["code_signature"],
+        "org.jdom:[email protected]": ["source_code_sha"],
+        "org.jetbrains:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.sonatype.plexus:[email protected]": ["source_code"],
+        "org.sonatype.plexus:[email protected]": ["source_code"],
+        "org.twdata.maven:[email protected]": ["source_code_sha"],
+        "org.wildfly.common:[email protected]": ["code_signature"],
+        "oro:[email protected]": ["source_code", "code_signature"]
+    },
+    "ignore-if-parent": {
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "org.apache.maven.plugins:[email protected]": ["source_code_sha"],
+        "org.apache.maven.plugins:[email protected]": ["source_code_sha"]
+    }
+}