jamesfredley commented on code in PR #16025:
URL: https://github.com/apache/grails-core/pull/16025#discussion_r3677924784
##########
.github/workflows/gradle.yml:
##########
@@ -242,7 +242,7 @@ jobs:
distribution: 'liberica'
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -193,7 +193,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -143,7 +143,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -81,7 +81,7 @@ jobs:
distribution: liberica
java-version: ${{ matrix.java }}
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/gradle.yml:
##########
@@ -37,7 +37,7 @@ jobs:
distribution: liberica
java-version: 21
- name: "🗄️ Restore dependency jar cache"
- uses: actions/cache@v4
+ uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/codeanalysis.yml:
##########
@@ -60,6 +60,24 @@ jobs:
file="build/reports/violations/$report"
[ -f "$file" ] && cat "$file" >> $GITHUB_STEP_SUMMARY || true
done
+ - name: "🔎 Run Core SpotBugs Advisory"
+ if: always()
+ continue-on-error: true
+ run: |
+ rm -f build/reports/violations/SPOTBUGS_VIOLATIONS.md
+ ./gradlew aggregateAnalysisViolations --continue
"-Pgrails.code-analysis.enabled.pmd.projects="
-Pgrails.code-analysis.enabled.spotbugs=true
-Pgrails.code-analysis.ignoreFailures=true
+ - name: "📤 Upload SpotBugs Advisory Reports"
+ if: always()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# v7.0.1
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/codeanalysis.yml:
##########
@@ -95,3 +113,22 @@ jobs:
file="grails-gradle/build/reports/violations/$report"
[ -f "$file" ] && cat "$file" >> $GITHUB_STEP_SUMMARY || true
done
+ - name: "🔎 Run Gradle Plugin SpotBugs Advisory"
+ if: always()
+ continue-on-error: true
+ working-directory: grails-gradle
+ run: |
+ rm -f build/reports/violations/SPOTBUGS_VIOLATIONS.md
+ ./gradlew aggregateAnalysisViolations --continue
-Pgrails.code-analysis.enabled.spotbugs=true
-Pgrails.code-analysis.ignoreFailures=true
+ - name: "📤 Upload Gradle Plugin SpotBugs Advisory Reports"
+ if: always()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
# v7.0.1
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
.github/workflows/vulnerability-scan.yml:
##########
@@ -36,9 +36,9 @@ jobs:
contents: read
steps:
- name: "📥 Checkout repository"
- uses: actions/checkout@v6
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #
v6.0.2
- name: "☕️ Setup JDK"
- uses: actions/setup-java@v4
+ uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 #
v5.2.0
Review Comment:
Addressed in `7a0aceb5ff`. Workflows for `actions/*` and project actions use
version/branch refs again so they track ASF-approved upstreams; third-party
actions remain SHA-pinned.
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -170,16 +178,25 @@ class GrailsCodeAnalysisPlugin implements Plugin<Project>
{
def xmlReport = spotBugsReports.maybeCreate('xml')
xmlReport.required.set(true)
xmlReport.outputLocation.set(
- project.extensions.getByType(GrailsCodeAnalysisExtension)
- .reportsDirectory.get()
- .dir('spotbugs')
- .file("${project.name}-${it.name}.xml")
+
project.extensions.getByType(GrailsCodeAnalysisExtension)
+ .reportsDirectory
+ .file("spotbugs/${GradleUtils.reportFileName(project,
it.name)}")
Review Comment:
Addressed in `7a0aceb5ff` with restored layout/report path construction and
formatting cleanups in the aggregation/analysis plugins.
##########
build-logic/plugins/src/main/groovy/org/apache/grails/buildsrc/GrailsCodeAnalysisPlugin.groovy:
##########
@@ -170,16 +178,25 @@ class GrailsCodeAnalysisPlugin implements Plugin<Project>
{
def xmlReport = spotBugsReports.maybeCreate('xml')
xmlReport.required.set(true)
xmlReport.outputLocation.set(
- project.extensions.getByType(GrailsCodeAnalysisExtension)
- .reportsDirectory.get()
- .dir('spotbugs')
- .file("${project.name}-${it.name}.xml")
+
project.extensions.getByType(GrailsCodeAnalysisExtension)
Review Comment:
Addressed in `7a0aceb5ff` with restored layout/report path construction and
formatting cleanups in the aggregation/analysis plugins.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
