From a261dd4fbca6b29eb591244eec6d7e37c304abb9 Mon Sep 17 00:00:00 2001 From: Esta Nagy Date: Fri, 3 Jun 2022 22:47:16 +0200 Subject: [PATCH] Pin Jar/POM dependencies using checksums (#99) - Sets up new workflow to update pinned dependencies - Avoid unnecessary builds in case of partial Renovate updates - Pin Gradle dependencies - Fix JUnit-BOM 5.8.0 sha - Set Renovate to sign-off commits and use assignee Resolves #98 {minor} Signed-off-by: Esta Nagy --- .github/workflows/gradle-ci.yml | 1 + .github/workflows/gradle-test-main.yml | 1 + .github/workflows/gradle.yml | 1 + .github/workflows/release-trigger.yml | 1 + .../workflows/update-dependency-checksums.yml | 41 + build.gradle | 16 +- gradle.properties | 1 + gradle/verification-metadata-clean.xml | 20 + gradle/verification-metadata.xml | 2308 +++++++++++++++++ renovate.json | 6 +- 10 files changed, 2393 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/update-dependency-checksums.yml create mode 100644 gradle/verification-metadata-clean.xml create mode 100644 gradle/verification-metadata.xml diff --git a/.github/workflows/gradle-ci.yml b/.github/workflows/gradle-ci.yml index 0b30a2bd..6c7da8fd 100644 --- a/.github/workflows/gradle-ci.yml +++ b/.github/workflows/gradle-ci.yml @@ -21,6 +21,7 @@ on: - '.github/workflows/**' - 'renovate.json' - '.whitesource' + - 'gradle/libs.versions.toml' permissions: read-all diff --git a/.github/workflows/gradle-test-main.yml b/.github/workflows/gradle-test-main.yml index bd6dfe8c..084fb9e2 100644 --- a/.github/workflows/gradle-test-main.yml +++ b/.github/workflows/gradle-test-main.yml @@ -9,6 +9,7 @@ on: branches: [ main ] paths: - 'gradle/libs.versions.toml' + - 'gradle/verification-metadata.xml' - 'gradle/wrapper/gradle-wrapper.properties' permissions: read-all diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index da329ca1..d063cae9 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -23,6 +23,7 @@ on: - 'renovate.json' - '.whitesource' - 'gradle/libs.versions.toml' + - 'gradle/verification-metadata.xml' - 'gradle/wrapper/gradle-wrapper.properties' permissions: read-all diff --git a/.github/workflows/release-trigger.yml b/.github/workflows/release-trigger.yml index 7b1ae0ab..42a39991 100644 --- a/.github/workflows/release-trigger.yml +++ b/.github/workflows/release-trigger.yml @@ -49,6 +49,7 @@ jobs: - uses: actions/github-script@9ac08808f993958e9de277fe43a64532a609130e # tag=v6.0.0 if: ${{ steps.check.outputs.has_tag == 0 || github.event.inputs.execution == 'Manual' }} with: + github-token: ${{ secrets.PUBLISH_KEY }} script: | github.rest.pulls.create({ owner: "${{ github.repository_owner }}", diff --git a/.github/workflows/update-dependency-checksums.yml b/.github/workflows/update-dependency-checksums.yml new file mode 100644 index 00000000..2564be95 --- /dev/null +++ b/.github/workflows/update-dependency-checksums.yml @@ -0,0 +1,41 @@ +name: UpdateChecksums +on: + push: + branches: [ renovate/** ] + paths: + - 'gradle/libs.versions.toml' + +permissions: read-all + +jobs: + build: + name: Dependency checksum pin action + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # tag=v2.4.0 + with: + fetch-depth: 0 + token: ${{ secrets.PUBLISH_KEY }} + - name: Set up JDK 11 + uses: actions/setup-java@f0bb91606209742fe3ea40199be2f3ef195ecabf # tag=v2.5.0 + with: + distribution: temurin + java-version: 11 + - uses: actions/cache@937d24475381cd9c75ae6db12cb4e79714b926ed # tag=v2.1.7 + with: + path: | + ~/.gradle/wrapper + key: ${{ runner.os }}-gradle-wrapper-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }} + restore-keys: | + ${{ runner.os }}-gradle-wrapper- + - name: "Remove previous version" + run: cp gradle/verification-metadata-clean.xml gradle/verification-metadata.xml + - name: "Update checksums" + run: ./gradlew --write-verification-metadata sha256 + - name: "Git commit" + run: | + git config --global user.name 'Esta Nagy' + git config --global user.email 'nagyesta@gmail.com' + git add gradle/verification-metadata.xml + git commit -asm "Pinning dependency checksums {patch}" + git push -f --set-upstream origin ${{ github.ref_name }} diff --git a/build.gradle b/build.gradle index dd7b0260..dab51eb5 100644 --- a/build.gradle +++ b/build.gradle @@ -69,7 +69,13 @@ configure(subprojects.findAll({ //noinspection GroovyUnusedAssignment sourceCompatibility = '11' repositories { - mavenCentral() + mavenCentral { + metadataSources { + mavenPom() + artifact() + ignoreGradleMetadataRedirection() + } + } } java { @@ -209,6 +215,12 @@ ossIndexAudit { } repositories { - mavenCentral() + mavenCentral { + metadataSources { + mavenPom() + artifact() + ignoreGradleMetadataRedirection() + } + } } diff --git a/gradle.properties b/gradle.properties index 4ec34f6a..9b849da0 100644 --- a/gradle.properties +++ b/gradle.properties @@ -5,3 +5,4 @@ org.gradle.warning.mode=all org.gradle.daemon=true org.gradle.caching=true org.gradle.jvmargs=-Xmx1g -XX:MaxMetaspaceSize=256m -XX:+HeapDumpOnOutOfMemoryError +org.gradle.dependency.verification.console=verbose diff --git a/gradle/verification-metadata-clean.xml b/gradle/verification-metadata-clean.xml new file mode 100644 index 00000000..0f87b04c --- /dev/null +++ b/gradle/verification-metadata-clean.xml @@ -0,0 +1,20 @@ + + + + true + false + + + + + + + + + + + + + + diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml new file mode 100644 index 00000000..a75a937a --- /dev/null +++ b/gradle/verification-metadata.xml @@ -0,0 +1,2308 @@ + + + + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/renovate.json b/renovate.json index 2b85bf02..591abf85 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,10 @@ { "extends": [ - "config:base" + "config:base", + ":gitSignOff" + ], + "assignees": [ + "nagyesta" ], "commitMessageSuffix": "{patch}", "github-actions": {