Skip to content

Bump actions/setup-java from 4.3.0 to 4.4.0 #19272

Bump actions/setup-java from 4.3.0 to 4.4.0

Bump actions/setup-java from 4.3.0 to 4.4.0 #19272

Workflow file for this run

name: Security
on:
pull_request:
branches:
- "main"
- "release/**"
push:
branches:
- "main"
- "release/**"
tags:
- "v*"
defaults:
run:
shell: bash
permissions:
contents: read
env:
LC_ALL: C.UTF-8
jobs:
dependencies:
name: Dependency Check
runs-on: mirror-node-linux-large
if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Setup Node
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
with:
node-version: 21
- name: Install JDK
uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4.4.0
with:
distribution: temurin
java-version: 21
- name: Setup Gradle
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
with:
gradle-home-cache-includes: |
caches
notifications
jdks
dependency-check-data
# write a cache on all executions to ensure the NVD data stays up-to-date
cache-read-only: false
- name: Vulnerability check
env:
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
run: ./gradlew dependencyCheckAggregate
- name: Upload report
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
if: failure()
with:
name: dependency-check-report
path: build/reports/dependency-check-report.html
gosec:
name: GoSec Code Scan
env:
GO111MODULE: on
runs-on: mirror-node-linux-large
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
path: tmp
- name: Copy hedera-mirror-rosetta to workspace root
working-directory: .
run: |
cp -r tmp/hedera-mirror-rosetta/* .
rm -fr tmp
- name: Setup Node
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
with:
node-version: 21
- name: Setup GoLang
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: 1.22
- name: Run Gosec Security Scanner
uses: securego/gosec@be8bd6e40be105333f2bc783ba8d688154441559 # v2.21.3
with:
args: ./...
sonar:
if: github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
name: SonarCloud
runs-on: mirror-node-linux-large
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
- name: Setup Node
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
with:
node-version: 21
- name: Install JDK
uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4.4.0
with:
distribution: temurin
java-version: 21
- name: Setup Gradle
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
- name: Cache SonarCloud dependencies
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
with:
path: ~/.sonar/cache
key: ${{ runner.os }}-sonar
restore-keys: ${{ runner.os }}-sonar
- name: Execute Gradle
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
run: ./gradlew build sonar -x test
snyk:
if: github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
name: Snyk Open Source
runs-on: mirror-node-linux-large
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Setup Node
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
with:
node-version: 21
- name: Install JDK
uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4.4.0
with:
distribution: temurin
java-version: 21
- name: Setup Gradle
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
- name: Setup Snyk
run: npm install -g snyk-to-html @wcj/html-to-markdown-cli
- name: Execute Snyk Test
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
run: ./gradlew snyk-test
- name: Publish Snyk Results
continue-on-error: true
if: ${{ !cancelled() && always() }}
run: |
report="build/reports/snyk-test"
if [[ -f ${report}.json ]]; then
snyk-to-html -i ${report}.json -o ${report}.html && \
html-to-markdown ${report}.html -o build/reports && \
cat ${report}.html.md >> $GITHUB_STEP_SUMMARY
fi
snyk-code:
if: github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
name: Snyk Code
runs-on: mirror-node-linux-large
steps:
- name: Harden Runner
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
with:
egress-policy: audit
- name: Checkout Code
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Setup Node
uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
with:
node-version: 21
- name: Install JDK
uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4.4.0
with:
distribution: temurin
java-version: 21
- name: Setup Gradle
uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4
- name: Setup Snyk
run: npm install -g snyk-to-html @wcj/html-to-markdown-cli
- name: Execute Snyk Code Test
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
run: ./gradlew snyk-code
- name: Publish Snyk Results
continue-on-error: true
if: ${{ !cancelled() && always() }}
run: |
report="build/reports/snyk-code"
if [[ -f ${report}.json ]]; then
snyk-to-html -i ${report}.json -o ${report}.html && \
html-to-markdown ${report}.html -o build/reports && \
cat ${report}.html.md >> $GITHUB_STEP_SUMMARY
fi