oscerd opened a new issue, #1804: URL: https://github.com/apache/camel-kafka-connector/issues/1804
## Description A sweep of `.github/workflows/` and the build entry points turned up four related gaps. They are independent of one another but small enough to be worth doing together. **1. No `permissions:` block in 7 of 8 workflows** Only `depsreview.yaml` declares `permissions:`. Every other workflow runs with the repository-default `GITHUB_TOKEN` scope, which is write-capable — `automatic-changelog-update.yml` pushes to `main` with `secrets.GITHUB_TOKEN`. Declaring an explicit least-privilege `permissions:` block (top-level `contents: read`, widened per job only where a job actually needs to write) makes the intent explicit and shrinks the blast radius of any step in those jobs. Affected: `asf-snapshots-deploy.yml`, `automatic-changelog-update.yml`, `automatic-sync-camel-main.yml`, `backport.yml`, `ci-build.yml`, `daily-java-next.yml`, `maven-it.yaml`. **2. Actions referenced by mutable tag rather than commit SHA** All `uses:` references are tags — `actions/[email protected]`, `actions/[email protected]`, `actions/cache@v6`, `actions/upload-artifact@v7`, `peter-evans/[email protected]`. Git tags can be re-pointed by whoever controls the source repository, so the code that runs is not pinned to what was reviewed. The two in-repo composite actions are already SHA-locked through git submodules, which is the behaviour to match. Pinning to full commit SHAs (with the version in a trailing comment) keeps Dependabot updates working. **3. Deploy credentials are job-level rather than step-level** `asf-snapshots-deploy.yml` puts `NEXUS_DEPLOY_USERNAME` / `NEXUS_DEPLOY_PASSWORD` in the `deploy` job's `env:`, so they are present in the environment of every step in that job, including `actions/checkout` and `actions/setup-java`. Only the `Deploy to ASF Snapshots Repository` step needs them. **4. The Maven wrapper has no distribution checksum** `.mvn/wrapper/maven-wrapper.properties` pins `distributionUrl` but has no `distributionSha256Sum`. `mvnw` implements SHA-256 verification and skips it when the property is absent (`Cannot checksum, no distributionSha256Sum set`). Every build path goes through `./mvnw` — all eight workflows, the Jenkinsfiles, and `release-utils/release.sh`. `mvn wrapper:wrapper` generates the property. Related one-liner while in `pom.xml`: `<scm><connection>` still uses `scm:git:http://gitbox.apache.org/...` while `developerConnection` alongside it already uses `https`. ## Expected Behavior Workflows declare the permissions they need, third-party actions are pinned to reviewed commits, credentials are scoped to the step that uses them, and the build toolchain download is verified against a checksum. ## Actual Behavior As described above. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
