This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-kafka-connector.git
The following commit(s) were added to refs/heads/main by this push:
new 65f88e8b5f Fix #1804: harden CI workflows and pin the build toolchain
(#1816)
65f88e8b5f is described below
commit 65f88e8b5ffd417874d205f46567685ef5b07e7a
Author: Andrea Cosentino <[email protected]>
AuthorDate: Mon Aug 24 15:38:22 2026 +0200
Fix #1804: harden CI workflows and pin the build toolchain (#1816)
Four independent gaps in the build entry points.
Least-privilege token permissions: only depsreview.yaml declared a
permissions
block, so every other workflow ran with the repository-default GITHUB_TOKEN
scope. Declare one per workflow: contents: read for the build-only workflows
(ci-build, daily-java-next, maven-it, asf-snapshots-deploy, which publishes
to
Nexus rather than GitHub), contents: write for the changelog workflow that
pushes to main, and contents+pull-requests: write for the two that open pull
requests.
Immutable action references: every uses: reference was a mutable tag, and
actions/dependency-review-action@v5 was in fact a branch. Pin all six to
full
commit SHAs with the version in a trailing comment, matching what the two
in-repo composite actions already get from SHA-locked submodules. Dependabot
continues to update SHA-pinned actions.
Deploy credential scope: NEXUS_DEPLOY_USERNAME/PASSWORD were job-level env
in
asf-snapshots-deploy.yml, so they were present for every step in the job
including checkout and setup-java. Move them onto the deploy step.
Build toolchain integrity: .mvn/wrapper/maven-wrapper.properties pinned the
distribution URL but had no distributionSha256Sum, so mvnw skipped
verification
("Cannot checksum, no distributionSha256Sum set") on every build path. The
value
was taken from the distribution whose SHA-512 matches the one published
alongside it on repo.maven.apache.org.
Also switch scm/connection in pom.xml from http to https;
developerConnection
next to it already used https.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
.github/workflows/asf-snapshots-deploy.yml | 19 +++++++++++--------
.github/workflows/automatic-changelog-update.yml | 5 ++++-
.github/workflows/automatic-sync-camel-main.yml | 16 ++++++++++------
.github/workflows/backport.yml | 6 +++++-
.github/workflows/ci-build.yml | 9 ++++++---
.github/workflows/daily-java-next.yml | 9 ++++++---
.github/workflows/depsreview.yaml | 4 ++--
.github/workflows/maven-it.yaml | 9 ++++++---
.mvn/wrapper/maven-wrapper.properties | 1 +
pom.xml | 2 +-
10 files changed, 52 insertions(+), 28 deletions(-)
diff --git a/.github/workflows/asf-snapshots-deploy.yml
b/.github/workflows/asf-snapshots-deploy.yml
index 9e4863e33c..41fe7f52a4 100644
--- a/.github/workflows/asf-snapshots-deploy.yml
+++ b/.github/workflows/asf-snapshots-deploy.yml
@@ -25,6 +25,9 @@ on:
- cron: '0 1 * * *'
workflow_dispatch:
+permissions:
+ contents: read
+
jobs:
build:
runs-on: ubuntu-latest
@@ -32,14 +35,14 @@ jobs:
matrix:
java: [ '17' ]
steps:
- - uses: actions/[email protected]
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
- name: Set up JDK ${{ matrix.java }}
- uses: actions/[email protected]
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 #
v5.4.0
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
- name: Cache Maven Repository
- uses: actions/cache@v6
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
with:
path: ~/.m2
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -52,17 +55,17 @@ jobs:
java: [ '17' ]
needs: build
if: github.ref == 'refs/heads/main'
- env:
- NEXUS_DEPLOY_USERNAME: ${{ secrets.NEXUS_USER }}
- NEXUS_DEPLOY_PASSWORD: ${{ secrets.NEXUS_PW }}
steps:
- - uses: actions/[email protected]
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Set up JDK ${{ matrix.java }}
- uses: actions/[email protected]
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 #
v5.4.0
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
- name: Deploy to ASF Snapshots Repository
+ env:
+ NEXUS_DEPLOY_USERNAME: ${{ secrets.NEXUS_USER }}
+ NEXUS_DEPLOY_PASSWORD: ${{ secrets.NEXUS_PW }}
run: |
./mvnw ${MAVEN_ARGS} \
-U -B -e -fae -Dnoassembly -Dmaven.compiler.fork=true -Pdeploy
-Dmaven.test.skip.exec=true \
diff --git a/.github/workflows/automatic-changelog-update.yml
b/.github/workflows/automatic-changelog-update.yml
index f3b28f152a..59d36cb778 100644
--- a/.github/workflows/automatic-changelog-update.yml
+++ b/.github/workflows/automatic-changelog-update.yml
@@ -23,6 +23,9 @@ on:
- cron: '0 3 * * *'
workflow_dispatch:
+permissions:
+ contents: write
+
jobs:
generate_changelog:
runs-on: ubuntu-latest
@@ -30,7 +33,7 @@ jobs:
if: github.ref == 'refs/heads/main' && github.repository ==
'apache/camel-kafka-connector'
steps:
- name: "Checkout camel-kafka-connector"
- uses: actions/[email protected]
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
with:
persist-credentials: false
submodules: recursive
diff --git a/.github/workflows/automatic-sync-camel-main.yml
b/.github/workflows/automatic-sync-camel-main.yml
index 26415ea092..d51f6eccd1 100644
--- a/.github/workflows/automatic-sync-camel-main.yml
+++ b/.github/workflows/automatic-sync-camel-main.yml
@@ -25,6 +25,10 @@ on:
# Run at 2 AM every day
- cron: '0 2 * * *'
workflow_dispatch:
+permissions:
+ contents: write
+ pull-requests: write
+
jobs:
build:
name: Sync Camel Kafka Connector main Branch with latest Camel main
@@ -34,18 +38,18 @@ jobs:
java: [ '17' ]
steps:
- name: Checkout Camel project
- uses: actions/[email protected]
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
with:
repository: apache/camel
ref: main
path: camel
- name: Set up JDK ${{ matrix.java }}
- uses: actions/[email protected]
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 #
v5.4.0
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
- name: Cache local Maven repository
- uses: actions/cache@v6
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -58,7 +62,7 @@ jobs:
clean install
working-directory: ${{ github.workspace }}/camel
- name: Checkout camel-kafka-connector project
- uses: actions/[email protected]
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
with:
ref: main
fetch-depth: 0
@@ -96,13 +100,13 @@ jobs:
-pl '!:camel-kafka-connector-generator-maven-plugin' \
clean test
- name: archive logs
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# v7
if: always()
with:
name: test-logs-java-${{ matrix.java }}
path: tests/**/target/tests.log
- name: Create Pull Request
- uses: peter-evans/[email protected]
+ uses:
peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 #
v8.1.1
with:
base: main
token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index e421214968..d1d0512f49 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -22,13 +22,17 @@ on:
- closed
- labeled
+permissions:
+ contents: write
+ pull-requests: write
+
jobs:
backport:
runs-on: ubuntu-latest
name: Backport
steps:
- name: "Checkout camel-kafka-connector"
- uses: actions/[email protected]
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
with:
persist-credentials: false
submodules: recursive
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
index 1b750475be..acd794b2bc 100644
--- a/.github/workflows/ci-build.yml
+++ b/.github/workflows/ci-build.yml
@@ -34,6 +34,9 @@ on:
- Jenkinsfile.*
- NOTICE.txt
+permissions:
+ contents: read
+
jobs:
build:
runs-on: ubuntu-latest
@@ -46,9 +49,9 @@ jobs:
- java: '21'
experimental: true
steps:
- - uses: actions/[email protected]
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
- name: Set up JDK ${{ matrix.java }}
- uses: actions/[email protected]
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 #
v5.4.0
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
@@ -88,7 +91,7 @@ jobs:
-pl '!:camel-kafka-connector-generator-maven-plugin' \
clean test
- name: Archive logs
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# v7
if: always()
with:
name: test-logs-java-${{ matrix.java }}
diff --git a/.github/workflows/daily-java-next.yml
b/.github/workflows/daily-java-next.yml
index 7dcbe477e9..9e16ba5a94 100644
--- a/.github/workflows/daily-java-next.yml
+++ b/.github/workflows/daily-java-next.yml
@@ -26,6 +26,9 @@ on:
- cron: '0 2 * * *'
workflow_dispatch:
+permissions:
+ contents: read
+
jobs:
build:
runs-on: ubuntu-latest
@@ -33,9 +36,9 @@ jobs:
matrix:
java: [ '21' ]
steps:
- - uses: actions/[email protected]
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
- name: Set up JDK ${{ matrix.java }}
- uses: actions/[email protected]
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 #
v5.4.0
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
@@ -75,7 +78,7 @@ jobs:
-pl '!:camel-kafka-connector-generator-maven-plugin' \
clean test
- name: Archive logs
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# v7
if: always()
with:
name: test-logs-java-${{ matrix.java }}
diff --git a/.github/workflows/depsreview.yaml
b/.github/workflows/depsreview.yaml
index 75428be5cc..6178fb65d0 100644
--- a/.github/workflows/depsreview.yaml
+++ b/.github/workflows/depsreview.yaml
@@ -9,6 +9,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: 'Checkout Repository'
- uses: actions/[email protected]
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
- name: 'Dependency Review'
- uses: actions/dependency-review-action@v5
+ uses:
actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
diff --git a/.github/workflows/maven-it.yaml b/.github/workflows/maven-it.yaml
index c05a6b3595..e024c82888 100644
--- a/.github/workflows/maven-it.yaml
+++ b/.github/workflows/maven-it.yaml
@@ -34,6 +34,9 @@ on:
- NOTICE.txt
workflow_dispatch:
+permissions:
+ contents: read
+
jobs:
build:
runs-on: ubuntu-latest
@@ -46,9 +49,9 @@ jobs:
- java: '21'
experimental: true
steps:
- - uses: actions/[email protected]
+ - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #
v7.0.0
- name: Set up JDK ${{ matrix.java }}
- uses: actions/[email protected]
+ uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 #
v5.4.0
with:
distribution: 'temurin'
java-version: ${{ matrix.java }}
@@ -74,7 +77,7 @@ jobs:
-pl :camel-kafka-connector-generator-maven-plugin \
clean verify
- name: Archive test results
- uses: actions/upload-artifact@v7
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# v7
if: ${{ failure() }}
with:
name: maven-it-java-${{ matrix.java }}
diff --git a/.mvn/wrapper/maven-wrapper.properties
b/.mvn/wrapper/maven-wrapper.properties
index d58dfb70ba..fe9deed0b0 100644
--- a/.mvn/wrapper/maven-wrapper.properties
+++ b/.mvn/wrapper/maven-wrapper.properties
@@ -17,3 +17,4 @@
wrapperVersion=3.3.2
distributionType=only-script
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip
+distributionSha256Sum=4ec3f26fb1a692473aea0235c300bd20f0f9fe741947c82c1234cefd76ac3a3c
diff --git a/pom.xml b/pom.xml
index 8196215e99..cab67e2560 100644
--- a/pom.xml
+++ b/pom.xml
@@ -94,7 +94,7 @@
</mailingLists>
<scm>
-
<connection>scm:git:http://gitbox.apache.org/repos/asf/camel-kafka-connector.git</connection>
+
<connection>scm:git:https://gitbox.apache.org/repos/asf/camel-kafka-connector.git</connection>
<developerConnection>scm:git:https://gitbox.apache.org/repos/asf/camel-kafka-connector.git</developerConnection>
<url>https://gitbox.apache.org/repos/asf?p=camel-kafka-connector.git;a=summary</url>
<tag>HEAD</tag>
