oscerd opened a new issue, #731: URL: https://github.com/apache/camel-karaf/issues/731
## Description Three independent build-integrity gaps, grouped because they are all one-line build hygiene fixes. ### 1. Third-party GitHub Action referenced by a mutable tag `.github/workflows/main.yml:101` ```yaml uses: EnricoMi/publish-unit-test-result-action@v2 ``` `v2` is a mutable tag on a non-GitHub-authored action. It runs with `if: always()` on `push` and `pull_request`, under `contents: read` + `checks: write`, after the shared Maven cache is restored and before its post-step saves it. A force-moved tag changes what executes without any change landing in this repository, and Dependabot cannot detect a tag that moves under it. Apache infra policy is to pin third-party actions to a full commit SHA. ### 2. Redundant third-party repository in the root POM `pom.xml:862-874` declares the Atlassian `maven-external` repository at the root, so it is inherited by every module in the reactor. The identical block already exists, correctly scoped, at `components/camel-jira/pom.xml:45-57` -- which covers the only artifacts that actually need it. The root declaration widens the set of coordinates that can be resolved from a non-Central repository across the whole build for no benefit. ### 3. Maven wrapper distribution is downloaded unverified `.mvn/wrapper/maven-wrapper.properties` sets neither `wrapperSha256Sum` nor `distributionSha256Sum`: ``` distributionUrl=https://repo.maven.apache.org/maven2/.../apache-maven-3.9.6-bin.zip wrapperUrl=https://repo.maven.apache.org/maven2/.../maven-wrapper-3.2.0.jar ``` The shipped `mvnw` already implements SHA-256 verification (`mvnw:254-278`), but the code is dormant because neither property is set. A 62 KB `maven-wrapper.jar` is also committed to the repository, where its contents cannot be reviewed in a diff. ## Expected Behavior - Non-GitHub-authored actions pinned to a full commit SHA, with Dependabot managing the bumps. - The root `<repositories>` block removed; `camel-jira` keeps its own. - `wrapperSha256Sum` and `distributionSha256Sum` set so the existing verification in `mvnw` becomes active. ## Actual Behavior All three are currently unpinned/unscoped as described above. ## Additional Context - Item 3 can optionally go further by switching to the `only-script` wrapper distribution, so no jar needs to be committed at all. That is a larger change and can be split out if preferred. --- _Claude Code on behalf of Andrea Cosentino_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
