Add test coverage and fix real bugs in grails-datamapping-core's services package #197
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Licensed to the Apache Software Foundation (ASF) under one or more | |
| # contributor license agreements. See the NOTICE file distributed with | |
| # this work for additional information regarding copyright ownership. | |
| # The ASF licenses this file to You under the Apache License, Version 2.0 | |
| # (the "License"); you may not use this file except in compliance with | |
| # the License. You may obtain a copy of the License at | |
| # | |
| # https://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, software | |
| # distributed under the License is distributed on an "AS IS" BASIS, | |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| # See the License for the specific language governing permissions and | |
| # limitations under the License. | |
| name: "Vulnerability Scan" | |
| on: | |
| schedule: | |
| # Run every Monday at 03:00 UTC | |
| - cron: '0 3 * * 1' | |
| workflow_dispatch: | |
| # Opt in per pull request by applying the "vulnerability scan" label. Applying a label | |
| # requires write access, so only a committer can start a scan. | |
| pull_request: | |
| types: [labeled, synchronize, reopened] | |
| # Used only to tell a fork pull request that it cannot be scanned. A `pull_request` run | |
| # raised from a fork gets neither the Sonatype credentials nor a token that can comment, | |
| # so the notice has to come from `pull_request_target`. That job checks out the base | |
| # branch and never runs anything from the pull request. | |
| pull_request_target: | |
| types: [labeled, synchronize, reopened] | |
| # Do not scan concurrently; OSS Index has per-account rate limits. | |
| # The event name is part of the group so the `pull_request` scan and the `pull_request_target` | |
| # notice for the same pull request cannot cancel one another. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }} | |
| jobs: | |
| scan-grails-core: | |
| name: "OSS Index Scan - grails-core" | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: "📥 Checkout repository" | |
| uses: actions/checkout@v6 | |
| - name: "☕️ Setup JDK" | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: liberica | |
| java-version: 17 | |
| - name: "🐘 Setup Gradle" | |
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 | |
| with: | |
| develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} | |
| - name: "🔍 Run OSS Index Vulnerability Scan" | |
| env: | |
| SONATYPE_GUIDE_USERNAME: ${{ secrets.SONATYPE_GUIDE_USERNAME }} | |
| SONATYPE_GUIDE_TOKEN: ${{ secrets.SONATYPE_GUIDE_TOKEN }} | |
| continue-on-error: true | |
| id: scan | |
| run: ./gradlew ossIndexAudit --continue --info 2>&1 | tee /tmp/ossindex-scan.log; exit ${PIPESTATUS[0]} | |
| - name: "📋 Publish Vulnerability Summary" | |
| if: always() | |
| run: > | |
| .github/scripts/ossIndexReport.sh | |
| /tmp/ossindex-scan.log | |
| '${{ steps.scan.outcome }}' | |
| '🔍 OSS Index Vulnerability Scan — grails-core' | |
| >> $GITHUB_STEP_SUMMARY | |
| scan-pull-request: | |
| name: "OSS Index Scan - pull request" | |
| # `synchronize` and `reopened` re-scan a pull request that already carries the label. | |
| if: >- | |
| github.event_name == 'pull_request' | |
| && contains(github.event.pull_request.labels.*.name, 'vulnerability scan') | |
| && github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: "📥 Checkout pull request" | |
| uses: actions/checkout@v6 | |
| - name: "☕️ Setup JDK" | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: liberica | |
| java-version: 17 | |
| - name: "🐘 Setup Gradle" | |
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 | |
| with: | |
| develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} | |
| - name: "🔍 Run OSS Index Vulnerability Scan" | |
| env: | |
| SONATYPE_GUIDE_USERNAME: ${{ secrets.SONATYPE_GUIDE_USERNAME }} | |
| SONATYPE_GUIDE_TOKEN: ${{ secrets.SONATYPE_GUIDE_TOKEN }} | |
| continue-on-error: true | |
| id: scan | |
| run: ./gradlew ossIndexAudit --continue --info 2>&1 | tee /tmp/ossindex-scan.log; exit ${PIPESTATUS[0]} | |
| - name: "📋 Build Vulnerability Report" | |
| if: always() | |
| # 60000 bytes keeps the listing clear of GitHub's 65536 character comment limit. | |
| run: > | |
| .github/scripts/ossIndexReport.sh | |
| /tmp/ossindex-scan.log | |
| '${{ steps.scan.outcome }}' | |
| '🔍 OSS Index Vulnerability Scan — pull request' | |
| 60000 | |
| > /tmp/ossindex-report.md | |
| - name: "📝 Publish Vulnerability Summary" | |
| if: always() | |
| run: cat /tmp/ossindex-report.md >> $GITHUB_STEP_SUMMARY | |
| - name: "💬 Comment Vulnerability Report" | |
| if: always() | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: > | |
| .github/scripts/postStickyComment.sh | |
| '${{ github.event.pull_request.number }}' | |
| '<!-- grails-vulnerability-scan -->' | |
| /tmp/ossindex-report.md | |
| notify-fork-pull-request: | |
| name: "OSS Index Scan - unavailable" | |
| # A fork pull request cannot reach the Sonatype credentials, so say so instead of | |
| # leaving the label looking as though a scan ran. | |
| if: >- | |
| github.event_name == 'pull_request_target' | |
| && contains(github.event.pull_request.labels.*.name, 'vulnerability scan') | |
| && github.event.pull_request.head.repo.full_name != github.repository | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| pull-requests: write | |
| steps: | |
| # Checks out the base branch, not the pull request; nothing from the fork is executed. | |
| - name: "📥 Checkout base branch" | |
| uses: actions/checkout@v6 | |
| - name: "📋 Build Notice" | |
| run: | | |
| { | |
| echo "## 🔍 OSS Index Vulnerability Scan — pull request" | |
| echo "⚠️ Vulnerability scanning is not available because this branch is not on \`${{ github.repository }}\`." | |
| echo | |
| echo "The scan needs Sonatype Guide credentials, which GitHub withholds from workflow runs raised by a fork. Push the branch to \`${{ github.repository }}\` and open a pull request from there to have it scanned." | |
| } > /tmp/ossindex-report.md | |
| - name: "💬 Comment Notice" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: > | |
| .github/scripts/postStickyComment.sh | |
| '${{ github.event.pull_request.number }}' | |
| '<!-- grails-vulnerability-scan -->' | |
| /tmp/ossindex-report.md |