Skip to content

feat: support direct imageReference for knative deployments#182

Merged
oleksii-donets merged 30 commits intodevelopmentfrom
feat/172-image-reference-knative-sources
Mar 10, 2026
Merged

feat: support direct imageReference for knative deployments#182
oleksii-donets merged 30 commits intodevelopmentfrom
feat/172-image-reference-knative-sources

Conversation

@oleksii-donets
Copy link
Contributor

@oleksii-donets oleksii-donets commented Mar 2, 2026 •
edited
Loading

Applicable issues

Description of changes

  • Unified deployment source handling: moved source from per-type tables (nim_deployment, inference_deployment) and individual columns (image_definition_id, image_definition_type, etc.) into a single source JSON column on the base deployment table.
  • Introduced a Source sealed interface hierarchy (ImageReferenceSource, InternalImageSource, HuggingFaceSource, NgcRegistrySource) in the domain model, replacing scattered fields.
  • Added direct imageReference source support for Knative deployments (MCP, Adapter, Interceptor), allowing deployments without an image definition.
  • Updated request/response DTOs to use typed source objects per deployment type (DeploymentSourceDto, NimDeploymentSourceDto, InferenceDeploymentSourceDto).
  • Refactored DeploymentDtoMapper to use @SubclassMapping with @Mapping(target = "source", ignore = true) on base methods, removing redundant concrete mapper methods. Source mapping handled via @AfterMapping.
  • Removed redundant Lombok annotations from empty subclasses (CreateAdapterDeployment, CreateInterceptorDeployment, AdapterDeploymentEntity, InterceptorDeploymentEntity, AdapterDeployment, InterceptorDeployment).
  • Added isjson check constraint on deployment.source column in MS SQL Server migration.
  • Added DB migrations (H2, Postgres, MSSQL) to unify source data and drop legacy columns.
  • Extended tests to validate direct image reference behavior, source mapping, and deployment validation.

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@oleksii-donets
feat: support direct imageReference for knative deployments
fb4ab2e 
Allow MCP, Adapter, and Interceptor deployments to use either an internal imageDefinitionId or a direct imageReference, reducing deployment friction for pre-built images and preserving backward compatibility.

Made-with: Cursor
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@oleksii-donets oleksii-donets changed the title feat: support direct imageReference for knative deployments Draft: feat: support direct imageReference for knative deployments Mar 2, 2026
@oleksii-donets oleksii-donets changed the title Draft: feat: support direct imageReference for knative deployments feat: support direct imageReference for knative deployments Mar 2, 2026
@oleksii-donets oleksii-donets marked this pull request as draft March 2, 2026 09:16
@oleksii-donets oleksii-donets marked this pull request as ready for review March 2, 2026 09:24
@oleksii-donets
feat: unify image-based deployment API under source object
f544f8e 
Use typed source payloads for MCP/Adapter/Interceptor create and response DTOs so clients use one consistent contract for internal images and direct image references. Move source-to-domain conversion into the mapper to keep request DTOs declarative.

Made-with: Cursor
@oleksii-donets
feat: expose deployment source in deployment info response
e47a82f 
Return image origin via the nested source object in deployment list responses and remove redundant top-level image definition fields from DeploymentInfoDto.

Made-with: Cursor
@oleksii-donets
Merge branch 'development' into feat/172-image-reference-knative-sources
9e79149 
Made-with: Cursor

# Conflicts:
#	src/main/java/com/epam/aidial/deployment/manager/model/deployment/AdapterDeployment.java
#	src/main/java/com/epam/aidial/deployment/manager/model/deployment/InterceptorDeployment.java
#	src/main/java/com/epam/aidial/deployment/manager/web/dto/DeploymentInfoDto.java
#	src/main/java/com/epam/aidial/deployment/manager/web/dto/deployment/CreateImageBasedDeploymentRequestDto.java
#	src/main/java/com/epam/aidial/deployment/manager/web/dto/deployment/ImageBasedDeploymentDto.java
#	src/main/java/com/epam/aidial/deployment/manager/web/mapper/DeploymentDtoMapper.java
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@oleksii-donets
fix: ignore legacy image definition fields in image-based create mapp…
cde978a 
…ings

Prevents MapStruct unmapped-property warnings from failing builds with -Werror after merge-related DTO changes.

Made-with: Cursor
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 2, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 4, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 4, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@Pasichniuk
Copy link
Collaborator

Pasichniuk commented Mar 5, 2026

Please update PR description to reflect fresh changes

@oleksii-donets @claude
fix: remove redundant Lombok annotations and add JSON check constraint
9784456 
Remove redundant Lombok annotations from empty CreateAdapterDeployment
and CreateInterceptorDeployment subclasses. Add isjson check constraint
on deployment.source column in MS SQL Server migration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 5, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

Pasichniuk
Pasichniuk previously approved these changes Mar 5, 2026
View reviewed changes
@Pasichniuk
Copy link
Collaborator

Pasichniuk commented Mar 5, 2026

Make sure FE is ready to support new API changes

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 5, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@oleksii-donets oleksii-donets force-pushed the feat/172-image-reference-knative-sources branch from 1fdd50b to 9784456 Compare March 5, 2026 14:39
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 5, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown

Scanned Files

  • settings.gradle

@oleksii-donets @claude
Merge origin/development into feat/172-image-reference-knative-sources
b37be37 
Resolve conflicts:
- KnativeDeploymentManager: keep PR's resolveImageName + development's getScaling()
- DeploymentInfoDto: add missing imports from development
- DeploymentFunctionalTest: keep PR's source-based assertions, drop old scaling assertions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 9, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.3.1NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.3.1 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 9, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.3.1NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.3.1 UnknownUnknown

Scanned Files

  • settings.gradle

@oleksii-donets @claude
fix: renumber UnifyDeploymentSource migration from V1.47 to V1.49
4b1c30f 
V1.47 and V1.48 are now taken by development branch migrations
(AddScalingToDeploymentTable, CreateDeploymentTopicsTable).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 9, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.3.1NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.3.1 UnknownUnknown

Scanned Files

  • settings.gradle

@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 10, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.3.1NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.3.1 UnknownUnknown

Scanned Files

  • settings.gradle

oleksii-donets and others added 3 commits March 10, 2026 14:34
@oleksii-donets @claude
docs: add unified deployment source spec and update existing specs
b02b2b0 
Add feature spec 003-unified-deployment-source with full speckit artifacts
(spec, plan, research, data-model, contracts, quickstart, tasks, checklists).
Update 7 existing specs to reflect the unified Source sealed interface,
source-based image contract for Knative deployments, renamed source classes
for Inference/NIM, and schema version bump to V1.49.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@oleksii-donets @claude
docs: bump migration version from V1.49 to V1.50 and regenerate db-sc…
6543cad 
…hema

V1.49 already exists in the codebase; the unified deployment source
migration will use V1.50 instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@oleksii-donets
Merge remote-tracking branch 'refs/remotes/origin/003-unified-deploym…
231e477 
…ent-source' into feat/172-image-reference-knative-sources
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 10, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 2 package(s) with unknown licenses.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.3.1NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.3.1 UnknownUnknown

Scanned Files

  • settings.gradle

oleksii-donets and others added 3 commits March 10, 2026 15:13
@oleksii-donets @claude
Merge branch 'development' into feat/172-image-reference-knative-sources
9059813 
Resolve merge conflicts with command/args support (development):
- Removed command/args and source from inference subclasses (both now on base)
- Renumbered UnifyDeploymentSource migrations from V1.49 to V1.50
- Updated KnativeDeploymentManagerTest mocks for new serviceConfig signature
- Updated create_mcp_deployment_request_with_command_args.json to use source format

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@oleksii-donets @claude
chore: regenerate db-schema.md after merge
a329ac4 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@oleksii-donets
chore: remove specs/003-unified-deployment-source/data-model.md
8962a92
@ai-dial-actions
Copy link
Contributor

ai-dial-actions commented Mar 10, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 113 package(s) with unknown licenses.
  • ⚠️ 14 packages with OpenSSF Scorecard issues.
See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.
Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
biz.aQute.bnd:biz.aqute.bnd.annotation7.1.0NullUnknown License
com.fasterxml.jackson.core:jackson-core2.21.1NullUnknown License
com.fasterxml.jackson.core:jackson-databind2.21.1NullUnknown License
com.fasterxml.jackson.dataformat:jackson-dataformat-cbor2.21.1NullUnknown License
com.fasterxml.jackson.dataformat:jackson-dataformat-yaml2.21.1NullUnknown License
com.fasterxml.jackson.datatype:jackson-datatype-jdk82.21.1NullUnknown License
com.fasterxml.jackson.datatype:jackson-datatype-jsr3102.21.1NullUnknown License
com.fasterxml.jackson.module:jackson-module-parameter-names2.21.1NullUnknown License
com.fasterxml.jackson:jackson-bom2.21.1NullUnknown License
com.github.javaparser:javaparser-core3.27.1NullUnknown License
com.github.jnr:jffi1.3.14NullUnknown License
com.github.jnr:jnr-enxio0.32.19NullUnknown License
com.github.jnr:jnr-ffi2.2.18NullUnknown License
com.github.jnr:jnr-posix3.1.21NullUnknown License
com.google.api:api-common2.53.0NullUnknown License
com.google.api:gax2.73.0-rc1NullUnknown License
com.google.auth:google-auth-library-oauth2-http1.42.0-rc1NullUnknown License
com.google.cloud.sql:jdbc-socket-factory-core1.28.0NullUnknown License
com.google.cloud.sql:postgres-socket-factory1.28.0NullUnknown License
com.google.errorprone:error_prone_annotations2.46.0NullUnknown License
com.google.http-client:google-http-client2.1.0-rc1NullUnknown License
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.3.1NullUnknown License
com.zaxxer:hikaricp6.3.3NullUnknown License
io.fabric8.java-generator:io.fabric8.java-generator.gradle.plugin7.5.2NullUnknown License
io.fabric8:generator-annotations7.5.2NullUnknown License
io.fabric8:java-generator-core7.5.2NullUnknown License
io.fabric8:knative-client7.5.2NullUnknown License
io.fabric8:knative-model7.5.2NullUnknown License
io.fabric8:kubernetes-client-api7.5.2NullUnknown License
io.fabric8:kubernetes-httpclient-vertx7.5.2NullUnknown License
io.fabric8:kubernetes-model-admissionregistration7.5.2NullUnknown License
io.fabric8:kubernetes-model-apiextensions7.5.2NullUnknown License
io.fabric8:kubernetes-model-apps7.5.2NullUnknown License
io.fabric8:kubernetes-model-autoscaling7.5.2NullUnknown License
io.fabric8:kubernetes-model-batch7.5.2NullUnknown License
io.fabric8:kubernetes-model-certificates7.5.2NullUnknown License
io.fabric8:kubernetes-model-common7.5.2NullUnknown License
io.fabric8:kubernetes-model-coordination7.5.2NullUnknown License
io.fabric8:kubernetes-model-core7.5.2NullUnknown License
io.fabric8:kubernetes-model-discovery7.5.2NullUnknown License
io.fabric8:kubernetes-model-events7.5.2NullUnknown License
io.fabric8:kubernetes-model-extensions7.5.2NullUnknown License
io.fabric8:kubernetes-model-flowcontrol7.5.2NullUnknown License
io.fabric8:kubernetes-model-gatewayapi7.5.2NullUnknown License
io.fabric8:kubernetes-model-metrics7.5.2NullUnknown License
io.fabric8:kubernetes-model-networking7.5.2NullUnknown License
io.fabric8:kubernetes-model-node7.5.2NullUnknown License
io.fabric8:kubernetes-model-policy7.5.2NullUnknown License
io.fabric8:kubernetes-model-rbac7.5.2NullUnknown License
io.fabric8:kubernetes-model-resource7.5.2NullUnknown License
io.fabric8:kubernetes-model-scheduling7.5.2NullUnknown License
io.fabric8:kubernetes-model-storageclass7.5.2NullUnknown License
io.fabric8:zjsonpatch7.5.2NullUnknown License
io.modelcontextprotocol.sdk:mcp0.15.0NullUnknown License
io.modelcontextprotocol.sdk:mcp-core0.15.0NullUnknown License
io.modelcontextprotocol.sdk:mcp-json0.15.0NullUnknown License
io.modelcontextprotocol.sdk:mcp-json-jackson20.15.0NullUnknown License
io.netty:netty-buffer4.1.130.FinalNullUnknown License
io.netty:netty-codec4.1.130.FinalNullUnknown License
io.netty:netty-codec-compression4.2.8.FinalNullUnknown License
io.netty:netty-codec-dns4.1.130.FinalNullUnknown License
io.netty:netty-codec-http4.1.130.FinalNullUnknown License
io.netty:netty-codec-http24.1.130.FinalNullUnknown License
io.netty:netty-codec-socks4.1.130.FinalNullUnknown License
io.netty:netty-common4.1.130.FinalNullUnknown License
io.netty:netty-handler4.1.130.FinalNullUnknown License
io.netty:netty-handler-proxy4.1.130.FinalNullUnknown License
io.netty:netty-resolver4.1.130.FinalNullUnknown License
io.netty:netty-resolver-dns4.1.130.FinalNullUnknown License
io.netty:netty-resolver-dns-classes-macos4.1.130.FinalNullUnknown License
io.netty:netty-resolver-dns-native-macos4.1.130.FinalNullUnknown License
io.netty:netty-transport4.1.130.FinalNullUnknown License
io.netty:netty-transport-native-epoll4.1.130.FinalNullUnknown License
io.netty:netty-transport-native-unix-common4.1.130.FinalNullUnknown License
io.opentelemetry.contrib:opentelemetry-aws-resources1.42.0-alphaNullUnknown License
io.opentelemetry.contrib:opentelemetry-gcp-resources1.42.0-alphaNullUnknown License
io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom2.12.0NullUnknown License
io.opentelemetry:opentelemetry-bom1.46.0NullUnknown License
io.sundr:builder-annotations0.230.1NullUnknown License
io.sundr:resourcecify-annotations0.230.1NullUnknown License
io.sundr:sundr-adapter-api0.230.1NullUnknown License
io.sundr:sundr-adapter-apt0.230.1NullUnknown License
io.sundr:sundr-adapter-reflect0.230.1NullUnknown License
io.sundr:sundr-core0.230.1NullUnknown License
io.sundr:sundr-model0.230.1NullUnknown License
io.sundr:sundr-model-base0.230.1NullUnknown License
io.sundr:sundr-model-repo0.230.1NullUnknown License
io.sundr:sundr-model-utils0.230.1NullUnknown License
io.vertx:vertx-auth-common4.5.24NullUnknown License
io.vertx:vertx-core4.5.24NullUnknown License
io.vertx:vertx-web-client4.5.24NullUnknown License
io.vertx:vertx-web-common4.5.24NullUnknown License
jakarta.xml.bind:jakarta.xml.bind-api4.0.4NullUnknown License
net.sf.saxon:saxon-he12.5NullUnknown License
org.apache.tomcat.embed:tomcat-embed-el10.1.50NullUnknown License
org.flywaydb:flyway-sqlserver11.14.0NullUnknown License
org.hdrhistogram:hdrhistogram2.2.2NullUnknown License
org.junit:junit-bom5.12.2NullUnknown License
org.latencyutils:latencyutils2.0.3NullUnknown License
org.springframework.boot:spring-boot-buildpack-platform3.5.10NullUnknown License
org.springframework.boot:spring-boot-dependencies3.5.10NullUnknown License
org.springframework.boot:spring-boot-gradle-plugin3.5.10NullUnknown License
org.springframework.boot:spring-boot-loader-tools3.5.10NullUnknown License
org.springframework.boot:spring-boot-testcontainers3.5.10NullUnknown License
org.springframework:spring-aspects6.2.15NullUnknown License
org.springframework:spring-jdbc6.2.15NullUnknown License
org.springframework:spring-orm6.2.15NullUnknown License
org.springframework:spring-test6.2.15NullUnknown License
org.springframework:spring-tx6.2.15NullUnknown License
org.springframework:spring-web6.2.15NullUnknown License
org.springframework:spring-webmvc6.2.15NullUnknown License
org.testcontainers:mssqlserver1.21.4NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
maven/biz.aQute.bnd:biz.aqute.bnd.annotation 7.1.0 UnknownUnknown
maven/com.amazonaws:aws-java-sdk-core 1.12.777 🟢 6.6
Details
CheckScoreReason
Maintained🟢 99 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 9
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
maven/com.amazonaws:aws-java-sdk-sts 1.12.777 🟢 6.6
Details
CheckScoreReason
Maintained🟢 99 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 9
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
maven/com.amazonaws:jmespath-java 1.12.777 🟢 6.6
Details
CheckScoreReason
Maintained🟢 99 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 9
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 8detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
maven/com.azure:azure-core 1.57.1 🟢 8.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 10all last 30 commits are reviewed through GitHub
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10tokens are read-only in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
maven/com.azure:azure-core-http-netty 1.16.3 🟢 8.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 10all last 30 commits are reviewed through GitHub
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10tokens are read-only in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
maven/com.azure:azure-identity 1.18.2 🟢 8.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 10all last 30 commits are reviewed through GitHub
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10tokens are read-only in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
maven/com.azure:azure-identity-extensions 1.2.7 🟢 8.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 10all last 30 commits are reviewed through GitHub
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10tokens are read-only in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
maven/com.azure:azure-json 1.5.1 🟢 8.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) out of 30 and 21 issue activity out of 30 found in the last 90 days -- score normalized to 10
Code-Review🟢 10all last 30 commits are reviewed through GitHub
CII-Best-Practices⚠️ 0no badge detected
Vulnerabilities🟢 10no vulnerabilities detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1no published package detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10tokens are read-only in GitHub workflows
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Binary-Artifacts🟢 9binaries present in source code
maven/com.azure:azure-xml 1.2.1 🟢 6.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 26/27 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Signed-Releases⚠️ -1no releases found
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
maven/com.ethlo.time:itu 1.10.3 UnknownUnknown
maven/com.fasterxml.jackson.core:jackson-annotations 2.21 UnknownUnknown
maven/com.fasterxml.jackson.core:jackson-core 2.21.1 UnknownUnknown
maven/com.fasterxml.jackson.core:jackson-databind 2.21.1 UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.21.1 UnknownUnknown
maven/com.fasterxml.jackson.dataformat:jackson-dataformat-yaml 2.21.1 UnknownUnknown
maven/com.fasterxml.jackson.datatype:jackson-datatype-jdk8 2.21.1 UnknownUnknown
maven/com.fasterxml.jackson.datatype:jackson-datatype-jsr310 2.21.1 UnknownUnknown
maven/com.fasterxml.jackson.module:jackson-module-parameter-names 2.21.1 UnknownUnknown
maven/com.fasterxml.jackson:jackson-bom 2.21.1 UnknownUnknown
maven/com.fasterxml:classmate 1.7.3 UnknownUnknown
maven/com.github.ben-manes.caffeine:caffeine 3.2.3 🟢 9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
CI-Tests⚠️ -1no pull request found
Dependency-Update-Tool🟢 10update tool detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
SAST🟢 10SAST tool detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Vulnerabilities🟢 100 existing vulnerabilities detected
CII-Best-Practices🟢 10badge detected: Gold
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Contributors🟢 10project has 8 contributing companies or organizations
maven/com.github.docker-java:docker-java-api 3.4.2 🟢 3.7
Details
CheckScoreReason
Code-Review⚠️ 2Found 2/9 approved changesets -- score normalized to 2
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.github.docker-java:docker-java-transport 3.4.2 🟢 3.7
Details
CheckScoreReason
Code-Review⚠️ 2Found 2/9 approved changesets -- score normalized to 2
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.github.docker-java:docker-java-transport-zerodep 3.4.2 🟢 3.7
Details
CheckScoreReason
Code-Review⚠️ 2Found 2/9 approved changesets -- score normalized to 2
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.github.javaparser:javaparser-core 3.27.1 🟢 4.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 2/22 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 8binaries present in source code
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 9license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.github.jnr:jffi 1.3.14 UnknownUnknown
maven/com.github.jnr:jnr-a64asm 1.0.0 UnknownUnknown
maven/com.github.jnr:jnr-constants 0.10.4 UnknownUnknown
maven/com.github.jnr:jnr-enxio 0.32.19 UnknownUnknown
maven/com.github.jnr:jnr-ffi 2.2.18 UnknownUnknown
maven/com.github.jnr:jnr-posix 3.1.21 ⚠️ 2.9
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 2Found 4/17 approved changesets -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.github.jnr:jnr-unixsocket 0.38.24 UnknownUnknown
maven/com.github.jnr:jnr-x86asm 1.0.2 ⚠️ 2
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/28 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow⚠️ -1no workflows found
Token-Permissions⚠️ -1No tokens found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.google.api-client:google-api-client 2.8.1 🟢 6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
SAST🟢 4SAST tool is not run on all commits -- score normalized to 4
maven/com.google.api:api-common 2.53.0 UnknownUnknown
maven/com.google.api:gax 2.73.0-rc1 UnknownUnknown
maven/com.google.apis:google-api-services-sqladmin v1beta4-rev20251201-2.0.0 UnknownUnknown
maven/com.google.auth:google-auth-library-credentials 1.42.0-rc1 🟢 7.6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1017 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
maven/com.google.auth:google-auth-library-oauth2-http 1.42.0-rc1 🟢 7.6
Details
CheckScoreReason
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1017 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
maven/com.google.auto.value:auto-value-annotations 1.11.0 🟢 6.8
Details
CheckScoreReason
Code-Review🟢 9Found 29/30 approved changesets -- score normalized to 9
Maintained🟢 1023 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.google.cloud.opentelemetry:detector-resources-support 0.33.0 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Maintained⚠️ 22 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST🟢 9SAST tool detected but not run on all commits
maven/com.google.cloud.sql:jdbc-socket-factory-core 1.28.0 UnknownUnknown
maven/com.google.cloud.sql:postgres-socket-factory 1.28.0 UnknownUnknown
maven/com.google.cloud.tools:jib-build-plan 0.4.0 UnknownUnknown
maven/com.google.cloud.tools:jib-core 0.27.3 UnknownUnknown
maven/com.google.code.findbugs:jsr305 3.0.2 UnknownUnknown
maven/com.google.code.gson:gson 2.8.9 🟢 9.4
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Maintained🟢 1021 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 8Found 20/23 approved changesets -- score normalized to 8
Dependency-Update-Tool🟢 10update tool detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 12 contributing companies or organizations
maven/com.google.errorprone:error_prone_annotations 2.46.0 🟢 6.5
Details
CheckScoreReason
Code-Review⚠️ 2Found 6/29 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.google.errorprone:error_prone_annotations 2.36.0 🟢 6.5
Details
CheckScoreReason
Code-Review⚠️ 2Found 6/29 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 20 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/com.google.guava:failureaccess 1.0.3 🟢 8.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ -1no releases found
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Security-Policy🟢 10security policy file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CI-Tests🟢 927 out of 28 merged PRs checked by a CI test -- score normalized to 9
Contributors🟢 10project has 11 contributing companies or organizations
maven/com.google.guava:failureaccess 1.0.2 🟢 8.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 9binaries present in source code
Pinned-Dependencies🟢 10all dependencies are pinned
Signed-Releases⚠️ -1no releases found
CII-Best-Practices⚠️ 2badge detected: InProgress
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't rea...*[Comment body truncated]*

@oleksii-donets oleksii-donets merged commit ea65ac4 into development Mar 10, 2026
8 checks passed
@oleksii-donets oleksii-donets deleted the feat/172-image-reference-knative-sources branch March 10, 2026 13:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Pasichniuk Pasichniuk Pasichniuk approved these changes

@siarhei-fedziukovich siarhei-fedziukovich Awaiting requested review from siarhei-fedziukovich siarhei-fedziukovich is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[MCP] Allow direct use of external Docker images in Deployment UI (bypass Image Builder)

3 participants

@oleksii-donets @ai-dial-actions @Pasichniuk