[
https://issues.apache.org/jira/browse/CAMEL-24502?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24502:
-------------------------------------
Fix Version/s: 4.23.0
> Build and CI hardening - workflow token scope, job separation and Maven
> wrapper checksums
> -----------------------------------------------------------------------------------------
>
> Key: CAMEL-24502
> URL: https://issues.apache.org/jira/browse/CAMEL-24502
> Project: Camel
> Issue Type: Improvement
> Components: build system
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> Three build-infrastructure items, none affecting shipped artifacts.
> *1. No permissions block on the sync workflows*
> {{.github/workflows/automatic-sync-main.yml}} and {{generate-sbom-main.yml}}
> declare no {{permissions:}} block, so their jobs run with the repository
> default {{GITHUB_TOKEN}} grants rather than the minimum they need
> ({{contents: write}}, {{pull-requests: write}}).
> *2. Build of another repository shares a job with the PR-creation step*
> {code:yaml}
> - name: Checkout Camel project
> uses: actions/checkout@v7
> with:
> repository: apache/camel
> ...
> - name: Build Camel Project
> run: ./mvnw -V --no-transfer-progress -Dquickly clean install
> working-directory: ${{ github.workspace }}/camel
> ...
> - name: Create Pull Request
> uses: peter-evans/[email protected]
> with:
> token: ${{ secrets.GITHUB_TOKEN }}
> {code}
> The job builds {{apache/camel}} - running that repository's wrapper and build
> plugins - and then uses the token in the same job. {{persist-credentials:
> false}} is already set on both checkouts, which helps, but the grants still
> apply for the whole job.
> Splitting into a build job with {{contents: read}} that uploads the
> regenerated tree as an artifact, and a separate job holding the write grants,
> would keep the two apart. {{uses:}} references pinned to a full commit SHA
> rather than a tag would let the existing github-actions dependabot ecosystem
> bump them.
> *3. Maven wrapper downloads are unpinned*
> {code:properties}
> wrapperVersion=3.3.4
> distributionType=bin
> distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.11/apache-maven-3.9.11-bin.zip
> wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.4/maven-wrapper-3.3.4.jar
> {code}
> No {{distributionSha256Sum}} or {{wrapperSha256Sum}}. {{mvnw}} enforces the
> latter when present. A {{maven-wrapper.jar}} is also checked in, which the
> wrapper's script-only mode would remove in favour of a checksum-verified
> download.
> *Proposal*: add the least-privilege {{permissions:}} blocks, split the sync
> jobs, add both checksums, and consider script-only wrapper mode.
> ----
> _This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
