ci: check every pull request for dependencies with known CVEs - #1488
Draft
joaodinissf wants to merge 2 commits into
Draft
ci: check every pull request for dependencies with known CVEs#1488joaodinissf wants to merge 2 commits into
joaodinissf wants to merge 2 commits into
Conversation
Add cyclonedx-maven-plugin with the tycho-sbom extension to pluginManagement
so an aggregate SBOM of the full reactor, including the resolved target
platform, can be generated on demand:
mvn -f ddk-parent/pom.xml validate \
org.apache.maven.plugins:maven-dependency-plugin:3.8.1:resolve \
org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeBom \
org.cyclonedx:cyclonedx-maven-plugin:2.9.1:makeAggregateBom
tycho-sbom maps p2 artifacts to their original Maven coordinates using the
GAV properties Tycho records when mirroring bundles, so third-party
dependencies appear as real pkg:maven purls (146 today) rather than
synthetic p2 identifiers. Notes baked into the configuration:
- skipNotDeployed=false is required because the reactor sets
maven.deploy.skip=true globally, which otherwise makes the goal skip
every module,
- tycho.sbom.url must be a project property (tycho-sbom reads project
properties, not -D user properties),
- dependency:resolve must precede the BOM goals: Tycho only injects p2
dependencies into the Maven model under full dependency resolution.
No execution is bound to any lifecycle phase; the default build is
unaffected.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add a fast, blocking cve-scan workflow so vulnerable dependencies surface in minutes on the PR instead of at release time. The check generates the aggregate CycloneDX SBOM (full reactor plus resolved target platform) and queries the OSV.dev batch API with the resulting pkg:maven purls - a single POST, measured ~2s for 146 components, no API key required. Advisories that demonstrably do not affect shipped artifacts are recorded in .github/security/cve-ignores.json, each with a justification and a review date; the ledger starts with the four current findings (Jetty via the xtext.test bundle only, and the assertj XXE advisory, which does ship and is accepted until the target platform picks up a fixed version). The scan is designed to fail loudly rather than pass silently: - a canary purl with well-known advisories is appended to every batch and must come back flagged, otherwise the run aborts, - a minimum-purl floor aborts the run if the SBOM regresses to a shell without the target platform, - OSV API or network errors abort the run. osv-scanner is deliberately not used: its CycloneDX ingestion (2.5.0) drops Maven groupIds, turning every query into a silent miss, and its offline mode reports zero findings without error. The same check runs locally via bash .github/scripts/check-cves.sh (see the new CONTRIBUTING section). The workflow follows the existing verify lanes: restore-only Maven cache keyed to the snapshot producer, pinned actions, and an explicit job timeout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a fast, blocking
cve-scanPR lane that reports dependencies with known vulnerabilities in ~1–2 minutes, instead of these surfacing at release time.How it works:
cyclonedx-maven-plugin+tycho-sbomgenerate an aggregate CycloneDX SBOM of the full reactor including the resolved target platform — tycho-sbom maps p2 bundles back to their original Maven coordinates (146pkg:mavenpurls today), which is the surface Dependabot and GAV-based tooling cannot see..github/scripts/check-cves.shextracts the purls and queries the OSV.dev batch API (one POST, ~2s, no API key; 99.9% availability SLO)..github/security/cve-ignores.json, each with a justification and review date.Fail-loud design — a broken scan can never pass silently:
Current ledger (the four findings present today):
com.avaloq.tools.ddk.xtext.testbundle, not part of the shipped update site,isXmlEqualTo(local vector) — this one is shipped; accepted with a review date until the target platform picks up a fixed version.Notes
pluginManagement-only (no lifecycle binding): the default build is byte-for-byte unaffected; verified with a full reactor compile.WORKSPACEenv. It runs as a fifth parallel lane, adding zero wall-clock to PR feedback; it also introduces the repo's firsttimeout-minutes.bash .github/scripts/check-cves.sh(documented in CONTRIBUTING.md).pkg:p2-only components (Eclipse-native bundles with no Maven identity) are recorded in the scan artifacts as the documented coverage gap; a follow-up PR will add a scheduled OWASP dependency-check lane to cover them via NVD/CPE matching.Verification
--skip-sbom).mvn clean compileof the full reactor unaffected by the pom change.🤖 Generated with Claude Code