This is an automated email from the ASF dual-hosted git repository.
jbonofre pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-karaf.git
The following commit(s) were added to refs/heads/main by this push:
new 683e5f7a4 ci(#731): pin the third-party action and activate wrapper
checksum verification (#736)
683e5f7a4 is described below
commit 683e5f7a43607a5bf3cf6d9c73c2620e4a58f15c
Author: Andrea Cosentino <[email protected]>
AuthorDate: Tue Aug 25 16:30:43 2026 +0200
ci(#731): pin the third-party action and activate wrapper checksum
verification (#736)
Two build-integrity gaps from #731. The third item in that issue, removing
the root <repositories> block, is deliberately not done here: see the
issue for why it would break the build.
Pin EnricoMi/publish-unit-test-result-action to the commit SHA that v2
currently resolves to (v2.24.0). It is a non-GitHub-authored action running
with checks:write, on push and pull_request, around the shared Maven cache.
A mutable tag can be force-moved without any change landing here, and
Dependabot cannot see that happen. Dependabot can still bump the pinned SHA.
Set distributionSha256Sum and wrapperSha256Sum. Both mvnw and the wrapper
jar already implement SHA-256 verification, but the code was dormant because
neither property was set. Note wrapperSha256Sum also covers the
maven-wrapper.jar committed to the repository, whose bytes cannot be
reviewed in a diff.
Values verified before pinning:
- the committed maven-wrapper.jar is byte identical to
maven-wrapper-3.2.0.jar on Maven Central
- apache-maven-3.9.6-bin.zip on Central matches the SHA-512 published at
downloads.apache.org
Both checks confirmed live by corrupting each sum in turn: the wrapper
refuses with "Failed to validate Maven wrapper SHA-256", and a forced
re-download refuses with "Failed to validate Maven distribution SHA-256".
---
.github/workflows/main.yml | 2 +-
.mvn/wrapper/maven-wrapper.properties | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 907ee0b31..156e3f3c1 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -98,7 +98,7 @@ jobs:
- run: ./mvnw -V --no-transfer-progress install
-Ddump.logs.on.failure=true
- name: Publish test results
if: always()
- uses: EnricoMi/publish-unit-test-result-action@v2
+ uses:
EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3
# v2.24.0
with:
files: '**/target/surefire-reports/*.xml'
check_name: Test Results (Java ${{ matrix.java-version }})
diff --git a/.mvn/wrapper/maven-wrapper.properties
b/.mvn/wrapper/maven-wrapper.properties
index 346d645fd..0a4095a73 100644
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -16,3 +16,5 @@
# under the License.
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.6/apache-maven-3.9.6-bin.zip
wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.2.0/maven-wrapper-3.2.0.jar
+distributionSha256Sum=83aaf914c785c9faed661f223000a92d1de9553f5c82d3b4362e66d9c031625f
+wrapperSha256Sum=e63a53cfb9c4d291ebe3c2b0edacb7622bbc480326beaa5a0456e412f52f066a
