Skip to content

chore(build): bind spotbugs:check + dependency-check:check to mvn verify (RAN-24) #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
aksOps wants to merge 2 commits into from
Closed

chore(build): bind spotbugs:check + dependency-check:check to mvn verify (RAN-24) #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
15b5e6c
chore(build): bind spotbugs:check + dependency-check:check to mvn ver…
aksOps Apr 24, 2026
12ba177
chore(build): drop dependency-check binding from verify (RAN-24 review)
aksOps Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/ci-java.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ jobs:
distribution: 'temurin'
java-version: '25'
cache: 'maven'
# `verify` is the enforced quality gate: it runs unit + integration tests
# AND the spotbugs:check execution bound in pom.xml. Any of those
# failing breaks the build.
- run: mvn clean verify -B
- uses: actions/upload-artifact@v4
if: always()
Expand Down
13 changes: 13 additions & 0 deletions dependency-check-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
OWASP dependency-check suppressions for codeiq.

Policy: every entry MUST have a CVE id, a date, and a one-line rationale
explaining why the finding is not exploitable here (or what the mitigation
is). Suppressions are reviewed when CVE bumps drop into the lockfile.

Schema: https://jeremylong.github.io/DependencyCheck/general/suppression.html
-->
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<!-- intentionally empty - add suppressions here when triaged -->
</suppressions>
7 changes: 7 additions & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -402,6 +402,13 @@
<configuration>
<excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
</configuration>
<executions>
<execution>
<id>spotbugs-verify</id>
<phase>verify</phase>
<goals><goal>check</goal></goals>
Comment on lines +405 to +409
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Bind dependency-check check goal to verify

This change only adds a verify execution for SpotBugs, but .github/workflows/ci-java.yml runs mvn clean verify -B as the sole gate and the dependency-check-maven plugin still has no <executions> block, so OWASP dependency scanning is never invoked in CI. That means high-CVSS dependency vulnerabilities can still merge undetected even though this commit is intended to enforce that gate.

Useful? React with 👍 / 👎.

</execution>
</executions>
</plugin>

<plugin>
Expand Down
Loading