Fix refresh request consumer invocation for web identity credentials #3

	# Ensures dependency-cve-monitor.yml stays in sync when modules are removed.
	name: "Dependency CVE Monitor Verification"

	on:
	pull_request:
	merge_group:

	permissions:
	contents: read

	jobs:
	verify-exclusion-list:
	name: Verify CVE monitor exclusion list
	runs-on: ubuntu-latest
	timeout-minutes: 2
	steps:
	- uses: actions/checkout@v6

	- name: Validate -pl exclusion list against reactor modules
	shell: bash
	run: \|
	set -euo pipefail

	WORKFLOW_FILE=".github/workflows/dependency-cve-monitor.yml"

	# Extract the -pl argument from the workflow file
	PL_LINE=$(grep -oP '(?<=-pl )\S+' "$WORKFLOW_FILE")
	if [ -z "$PL_LINE" ]; then
	echo "Could not find -pl argument in $WORKFLOW_FILE"
	exit 1
	fi

	# Parse individual module exclusions (remove leading '!')
	EXCLUDED_MODULES=$(echo "$PL_LINE" \| tr ',' '\n' \| sed 's/^!//')

	# Collect all reactor modules from root pom.xml (recursive through submodule poms)
	REACTOR_MODULES=$(grep -ohP '(?<=<module>)[^<]+' pom.xml)

	HAS_ERRORS=0
	while IFS= read -r MODULE; do
	if ! echo "$REACTOR_MODULES" \| grep -qx "$MODULE"; then
	echo "::error::Module '$MODULE' is excluded in $WORKFLOW_FILE but does not exist in the Maven reactor (pom.xml)"
	HAS_ERRORS=1
	fi
	done <<< "$EXCLUDED_MODULES"

	if [ $HAS_ERRORS -eq 1 ]; then
	echo ""
	echo "The -pl exclusion list in $WORKFLOW_FILE references modules that are no longer in the reactor."
	echo "Please remove the stale entries from the exclusion list."
	exit 1
	fi

	echo "All excluded modules are valid reactor modules."

Navigation Menu