ci: JDK 17+21 matrix verification stage - #3
Merged
Conversation
Apply the locked Phase 13 gate 13-02 JDK 21 verification-stage YAML design: add strategy.matrix.java-version: ['17', '21'] with fail-fast: false to the existing verify job. Preserves name, on, and permissions blocks verbatim; uses cache: maven (cross-version warm-cache); both mvn -B test and mvn -B package run on each matrix entry.
📝 WalkthroughWalkthroughThe Maven CI workflow is updated to run the verification job against multiple Java versions (17 and 21) using a matrix strategy. The ChangesMaven CI Multi-Version Testing
Estimated Code Review Effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/maven-ci.yml:
- Around line 22-23: The workflow uses floating action refs and leaves checkout
credentials persisted: replace actions/checkout@v4 with the corresponding full
commit SHA and add a "with: persist-credentials: false" option under the
Checkout step, and likewise pin actions/setup-java@v4 to its full commit SHA;
also update the other workflow (publish.yml) to pin actions/setup-java and
actions/setup-node to full commit SHAs so no floating refs remain.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d812e813-0448-4380-83cc-7b553d6f8772
📒 Files selected for processing (1)
.github/workflows/maven-ci.yml
Comment on lines
22
to
23
| - name: Checkout | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checking GitHub Action refs in workflow files..."
rg -n '^\s*uses:\s*[^@]+@' .github/workflows
echo
echo "Potentially unpinned refs (not 40-hex SHA):"
rg -nP '^\s*uses:\s*[^@]+@(?![a-f0-9]{40}\b).+' .github/workflows || true
echo
echo "Checkout steps missing persist-credentials:false:"
python - <<'PY'
import pathlib, re
for p in pathlib.Path(".github/workflows").glob("*.y*ml"):
s = p.read_text(encoding="utf-8")
for m in re.finditer(r'(?ms)^\s*-\s+name:\s*Checkout\b.*?(?=^\s*-\s+name:|\Z)', s):
block = m.group(0)
if "persist-credentials: false" not in block:
line = s[:m.start()].count("\n") + 1
print(f"{p}:{line}")
PYRepository: UltiKits/UltiLogin
Length of output: 793
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checking GitHub Action refs in workflow files..."
rg -n '^\s*uses:\s*[^@]+@' .github/workflows
echo
echo "Potentially unpinned refs (not 40-hex SHA):"
rg -nP '^\s*uses:\s*[^@]+@(?![a-f0-9]{40}\b).+' .github/workflows || true
echo
echo "Checkout steps missing persist-credentials:false:"
python - <<'PY'
import pathlib, re
for p in pathlib.Path(".github/workflows").glob("*.y*ml"):
s = p.read_text(encoding="utf-8")
for m in re.finditer(r'(?ms)^\s*-\s+name:\s*Checkout\b.*?(?=^\s*-\s+name:|\Z)', s):
block = m.group(0)
if "persist-credentials: false" not in block:
line = s[:m.start()].count("\n") + 1
print(f"{p}:{line}")
PYRepository: UltiKits/UltiLogin
Length of output: 793
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Checking GitHub Action refs in workflow files..."
rg -n '^\s*uses:\s*[^@]+@' .github/workflows
echo
echo "Potentially unpinned refs (not 40-hex SHA):"
rg -nP '^\s*uses:\s*[^@]+@(?![a-f0-9]{40}\b).+' .github/workflows || true
echo
echo "Checkout steps missing persist-credentials:false:"
python - <<'PY'
import pathlib, re
for p in pathlib.Path(".github/workflows").glob("*.y*ml"):
s = p.read_text(encoding="utf-8")
for m in re.finditer(r'(?ms)^\s*-\s+name:\s*Checkout\b.*?(?=^\s*-\s+name:|\Z)', s):
block = m.group(0)
if "persist-credentials: false" not in block:
line = s[:m.start()].count("\n") + 1
print(f"{p}:{line}")
PYRepository: UltiKits/UltiLogin
Length of output: 793
Harden GitHub Actions workflow action security (pin SHAs + disable checkout credential persistence).
.github/workflows/maven-ci.yml: floatingactions/checkout@v4+actions/setup-java@v4; Checkout step (line 22) is missingwith: persist-credentials: false..github/workflows/publish.yml: floatingactions/setup-java@v4andactions/setup-node@v4.
Suggested patch (maven-ci.yml)
- name: Checkout
- uses: actions/checkout@v4
+ uses: actions/checkout@<FULL_LENGTH_COMMIT_SHA>
+ with:
+ persist-credentials: false
- name: Set up JDK ${{ matrix.java-version }}
- uses: actions/setup-java@v4
+ uses: actions/setup-java@<FULL_LENGTH_COMMIT_SHA>
with:
distribution: temurin
java-version: ${{ matrix.java-version }}
cache: mavenPin actions/* in publish.yml to full commit SHAs as well to eliminate floating refs.
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/maven-ci.yml around lines 22 - 23, The workflow uses
floating action refs and leaves checkout credentials persisted: replace
actions/checkout@v4 with the corresponding full commit SHA and add a "with:
persist-credentials: false" option under the Checkout step, and likewise pin
actions/setup-java@v4 to its full commit SHA; also update the other workflow
(publish.yml) to pin actions/setup-java and actions/setup-node to full commit
SHAs so no floating refs remain.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
应用 Phase 13 gate 13-02 定的 JDK 21 verification stage YAML 设计：在已有的 verify job 上加 strategy.matrix.java-version: ['17', '21'] + fail-fast: false。
单文件 diff +7/-2，与已合并的 UltiCleaner #4 (PR merge commit 9324ae92e) 设计一致。
跟踪 gate: approve 13-03-ultilogin-jdk21-stage-impl
Summary by CodeRabbit