Skip to content

Commit 1e22238

Browse files
AB-xdevAB-xdev
committed
Merge remote-tracking branch 'origin/update-from-template' into develop
2 parents 3b25300 + d820b9e commit 1e22238

File tree

13 files changed

+176
-62
lines changed

13 files changed

+176
-62
lines changed

‎.config/pmd/java/ruleset.xml

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,4 +194,52 @@
194194
</rule>
195195

196196
<rule ref="category/java/security.xml"/>
197+
198+
<rule name="AvoidSystemSetterCall"
199+
language="java"
200+
message="Setters of java.lang.System should not be called unless really needed"
201+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
202+
<description>
203+
Calling setters of java.lang.System usually indicates bad design and likely causes unexpected behavior.
204+
For example, it may break when multiple Threads are setting the value.
205+
It may also overwrite user defined options or properties.
206+
207+
Try to pass the value only to the place where it's really needed and use it there accordingly.
208+
</description>
209+
<priority>3</priority>
210+
<properties>
211+
<property name="xpath">
212+
<value>
213+
<![CDATA[
214+
//MethodCall[starts-with(@MethodName,'set')]/TypeExpression[pmd-java:typeIsExactly('java.lang.System')]
215+
]]>
216+
</value>
217+
</property>
218+
</properties>
219+
</rule>
220+
221+
<rule name="JavaObjectSerializationIsUnsafe"
222+
language="java"
223+
message="Using Java Object (De-)Serialization is unsafe and has led to too many security vulnerabilities"
224+
class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
225+
<description>
226+
Nearly every known usage of (Java) Object Deserialization has resulted in [a security vulnerability](https://cloud.google.com/blog/topics/threat-intelligence/hunting-deserialization-exploits?hl=en).
227+
Vulnerabilities are so common that there are [dedicated projects for exploit payload generation](https://github.com/frohoff/ysoserial).
228+
229+
Java Object Serialization may also fail to deserialize when the underlying classes are changed.
230+
231+
Use proven data interchange formats like JSON instead.
232+
</description>
233+
<priority>2</priority>
234+
<properties>
235+
<property name="xpath">
236+
<value>
237+
<![CDATA[
238+
//ClassDeclaration[@Interface = false()]/ClassBody/FieldDeclaration/VariableDeclarator/VariableId[@Name='serialVersionUID'] |
239+
//ConstructorCall/ClassType[pmd-java:typeIsExactly('java.io.ObjectInputStream') or pmd-java:typeIsExactly('java.io.ObjectOutputStream')]
240+
]]>
241+
</value>
242+
</property>
243+
</properties>
244+
</rule>
197245
</ruleset>

‎.github/workflows/broken-links.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@ jobs:
1313
runs-on: ubuntu-latest
1414
timeout-minutes: 15
1515
steps:
16-
- uses: actions/checkout@v4
16+
- uses: actions/checkout@v5
1717

1818
- run: mv .github/.lycheeignore .lycheeignore
1919

2020
- name: Link Checker
2121
id: lychee
22-
uses: lycheeverse/lychee-action@82202e5e9c2f4ef1a55a3d02563e1cb6041e5332 # v2
22+
uses: lycheeverse/lychee-action@885c65f3dc543b57c898c8099f4e08c8afd178a2 # v2
2323
with:
2424
fail: false # Don't fail on broken links, create an issue instead
2525

@@ -29,7 +29,7 @@ jobs:
2929
echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title \"Link Checker Report\"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
3030
env:
3131
GH_TOKEN: ${{ github.token }}
32-
32+
3333
- name: Close issue if everything is fine
3434
if: steps.lychee.outputs.exit_code == 0 && steps.find-issue.outputs.number != ''
3535
run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }}

‎.github/workflows/check-build.yml

Lines changed: 50 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -19,32 +19,34 @@ on:
1919
- '.idea/**'
2020
- 'assets/**'
2121

22-
env:
23-
PRIMARY_MAVEN_MODULE: ${{ github.event.repository.name }}
24-
2522
jobs:
2623
build:
2724
runs-on: ubuntu-latest
2825
timeout-minutes: 30
29-
3026
strategy:
3127
matrix:
3228
java: [17, 21]
3329
distribution: [temurin]
34-
3530
steps:
36-
- uses: actions/checkout@v4
37-
31+
- uses: actions/checkout@v5
32+
3833
- name: Set up JDK
39-
uses: actions/setup-java@v4
34+
uses: actions/setup-java@v5
4035
with:
4136
distribution: ${{ matrix.distribution }}
4237
java-version: ${{ matrix.java }}
43-
cache: 'maven'
44-
38+
39+
- name: Cache Maven
40+
uses: actions/cache@v4
41+
with:
42+
path: ~/.m2/repository
43+
key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
44+
restore-keys: |
45+
${{ runner.os }}-mvn-build-
46+
4547
- name: Build with Maven
4648
run: ./mvnw -B clean package
47-
49+
4850
- name: Check for uncommited changes
4951
run: |
5052
if [[ "$(git status --porcelain)" != "" ]]; then
@@ -67,21 +69,34 @@ jobs:
6769
runs-on: ubuntu-latest
6870
if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
6971
timeout-minutes: 15
70-
7172
strategy:
7273
matrix:
7374
java: [17]
7475
distribution: [temurin]
75-
7676
steps:
77-
- uses: actions/checkout@v4
78-
77+
- uses: actions/checkout@v5
78+
7979
- name: Set up JDK
80-
uses: actions/setup-java@v4
80+
uses: actions/setup-java@v5
8181
with:
8282
distribution: ${{ matrix.distribution }}
8383
java-version: ${{ matrix.java }}
84-
cache: 'maven'
84+
85+
- name: Cache Maven
86+
uses: actions/cache@v4
87+
with:
88+
path: ~/.m2/repository
89+
key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }}
90+
restore-keys: |
91+
${{ runner.os }}-mvn-checkstyle-
92+
93+
- name: CheckStyle Cache
94+
uses: actions/cache@v4
95+
with:
96+
path: '**/target/checkstyle-cachefile'
97+
key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }}
98+
restore-keys: |
99+
${{ runner.os }}-checkstyle-
85100
86101
- name: Run Checkstyle
87102
run: ./mvnw -B checkstyle:check -P checkstyle -T2C
@@ -90,21 +105,34 @@ jobs:
90105
runs-on: ubuntu-latest
91106
if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }}
92107
timeout-minutes: 15
93-
94108
strategy:
95109
matrix:
96110
java: [17]
97111
distribution: [temurin]
98-
99112
steps:
100-
- uses: actions/checkout@v4
113+
- uses: actions/checkout@v5
101114

102115
- name: Set up JDK
103-
uses: actions/setup-java@v4
116+
uses: actions/setup-java@v5
104117
with:
105118
distribution: ${{ matrix.distribution }}
106119
java-version: ${{ matrix.java }}
107-
cache: 'maven'
120+
121+
- name: Cache Maven
122+
uses: actions/cache@v4
123+
with:
124+
path: ~/.m2/repository
125+
key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }}
126+
restore-keys: |
127+
${{ runner.os }}-mvn-pmd-
128+
129+
- name: PMD Cache
130+
uses: actions/cache@v4
131+
with:
132+
path: '**/target/pmd/pmd.cache'
133+
key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }}
134+
restore-keys: |
135+
${{ runner.os }}-pmd-
108136
109137
- name: Run PMD
110138
run: ./mvnw -B test pmd:aggregate-pmd-no-fork pmd:check -P pmd -DskipTests -T2C

‎.github/workflows/release.yml

Lines changed: 41 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,30 @@ permissions:
1111
contents: write
1212
pull-requests: write
1313

14+
# DO NOT RESTORE CACHE for critical release steps to prevent a (extremely unlikely) scenario
15+
# where a supply chain attack could be achieved due to poisoned cache
1416
jobs:
1517
check-code:
1618
runs-on: ubuntu-latest
1719
timeout-minutes: 30
1820
steps:
19-
- uses: actions/checkout@v4
20-
21+
- uses: actions/checkout@v5
22+
2123
- name: Set up JDK
22-
uses: actions/setup-java@v4
24+
uses: actions/setup-java@v5
2325
with:
2426
java-version: '17'
2527
distribution: 'temurin'
26-
cache: 'maven'
27-
28+
29+
# Try to reuse existing cache from check-build
30+
- name: Try restore Maven Cache
31+
uses: actions/cache/restore@v4
32+
with:
33+
path: ~/.m2/repository
34+
key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
35+
restore-keys: |
36+
${{ runner.os }}-mvn-build-
37+
2838
- name: Build with Maven
2939
run: ./mvnw -B clean package -T2C
3040

@@ -53,32 +63,32 @@ jobs:
5363
outputs:
5464
upload_url: ${{ steps.create-release.outputs.upload_url }}
5565
steps:
56-
- uses: actions/checkout@v4
57-
66+
- uses: actions/checkout@v5
67+
5868
- name: Configure Git
5969
run: |
6070
git config --global user.email "[email protected]"
6171
git config --global user.name "GitHub Actions"
62-
72+
6373
- name: Un-SNAP
6474
run: ./mvnw -B versions:set -DremoveSnapshot -DprocessAllModules -DgenerateBackupPoms=false
65-
75+
6676
- name: Get version
6777
id: version
6878
run: |
6979
version=$(../mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)
7080
echo "release=$version" >> $GITHUB_OUTPUT
7181
echo "releasenumber=${version//[!0-9]/}" >> $GITHUB_OUTPUT
7282
working-directory: ${{ env.PRIMARY_MAVEN_MODULE }}
73-
83+
7484
- name: Commit and Push
7585
run: |
7686
git add -A
7787
git commit -m "Release ${{ steps.version.outputs.release }}"
7888
git push origin
7989
git tag v${{ steps.version.outputs.release }}
8090
git push origin --tags
81-
91+
8292
- name: Create Release
8393
id: create-release
8494
uses: shogo82148/actions-create-release@4661dc54f7b4b564074e9fbf73884d960de569a3 # v1
@@ -105,24 +115,24 @@ jobs:
105115
needs: [prepare-release]
106116
timeout-minutes: 60
107117
steps:
108-
- uses: actions/checkout@v4
109-
118+
- uses: actions/checkout@v5
119+
110120
- name: Init Git and pull
111121
run: |
112122
git config --global user.email "[email protected]"
113123
git config --global user.name "GitHub Actions"
114124
git pull
115125
116126
- name: Set up JDK
117-
uses: actions/setup-java@v4
127+
uses: actions/setup-java@v5
118128
with: # running setup-java overwrites the settings.xml
119129
distribution: 'temurin'
120130
java-version: '17'
121131
server-id: github-central
122132
server-password: PACKAGES_CENTRAL_TOKEN
123133
gpg-passphrase: MAVEN_GPG_PASSPHRASE
124134
gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Only import once
125-
135+
126136
- name: Publish to GitHub Packages Central
127137
run: ../mvnw -B deploy -P publish -DskipTests -DaltDeploymentRepository=github-central::https://maven.pkg.github.com/xdev-software/central
128138
working-directory: ${{ env.PRIMARY_MAVEN_MODULE }}
@@ -131,7 +141,7 @@ jobs:
131141
MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
132142

133143
- name: Set up JDK
134-
uses: actions/setup-java@v4
144+
uses: actions/setup-java@v5
135145
with: # running setup-java again overwrites the settings.xml
136146
distribution: 'temurin'
137147
java-version: '17'
@@ -153,20 +163,28 @@ jobs:
153163
needs: [prepare-release]
154164
timeout-minutes: 15
155165
steps:
156-
- uses: actions/checkout@v4
157-
166+
- uses: actions/checkout@v5
167+
158168
- name: Init Git and pull
159169
run: |
160170
git config --global user.email "[email protected]"
161171
git config --global user.name "GitHub Actions"
162172
git pull
163173
164174
- name: Setup - Java
165-
uses: actions/setup-java@v4
175+
uses: actions/setup-java@v5
166176
with:
167177
java-version: '17'
168178
distribution: 'temurin'
169-
cache: 'maven'
179+
180+
# Try to reuse existing cache from check-build
181+
- name: Try restore Maven Cache
182+
uses: actions/cache/restore@v4
183+
with:
184+
path: ~/.m2/repository
185+
key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }}
186+
restore-keys: |
187+
${{ runner.os }}-mvn-build-
170188
171189
- name: Build site
172190
run: ../mvnw -B compile site -DskipTests -T2C
@@ -184,8 +202,8 @@ jobs:
184202
needs: [publish-maven]
185203
timeout-minutes: 10
186204
steps:
187-
- uses: actions/checkout@v4
188-
205+
- uses: actions/checkout@v5
206+
189207
- name: Init Git and pull
190208
run: |
191209
git config --global user.email "[email protected]"
@@ -200,7 +218,7 @@ jobs:
200218
git add -A
201219
git commit -m "Preparing for next development iteration"
202220
git push origin
203-
221+
204222
- name: pull-request
205223
env:
206224
GH_TOKEN: ${{ github.token }}

‎.github/workflows/sync-labels.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
runs-on: ubuntu-latest
1717
timeout-minutes: 10
1818
steps:
19-
- uses: actions/checkout@v4
19+
- uses: actions/checkout@v5
2020
with:
2121
sparse-checkout: .github/labels.yml
2222

0 commit comments

Comments
 (0)