Skip to content

Create maven.yml #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
slkgu957-ai wants to merge 1 commit into
base: master
Choose a base branch
from
+35 −0
Open

Create maven.yml #58

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 35 additions & 0 deletions .github/workflows/maven.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-maven

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Java CI with Maven

on:
push:
branches: [ "master" ]
pull_request:
branches: [ "master" ]
Comment on lines +14 to +15
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Scope dependency submission to a push-only job with explicit write permission.

maven-dependency-submission-action needs contents: write, but this job currently has no explicit permissions. Adding write permission to the existing PR build job would expose a write-capable token while Maven executes PR-controlled code. Split dependency submission into a push-only job and keep the build job read-only.

Reference: the action README documents that the default token needs contents: write to update the dependency graph: https://github.com/advanced-security/maven-dependency-submission-action

🔒 Proposed workflow split 
 name: Java CI with Maven
 
 on:
   push:
     branches: [ "master" ]
   pull_request:
     branches: [ "master" ]
 
 jobs:
   build:
+    permissions:
+      contents: read
 
     runs-on: ubuntu-latest
 
     steps:
     - uses: actions/checkout@v4
@@
     - name: Build with Maven
       run: mvn -B package --file pom.xml
 
-    # Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
+  dependency-graph:
+    if: github.event_name == 'push'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up JDK 17
+      uses: actions/setup-java@v4
+      with:
+        java-version: '17'
+        distribution: 'temurin'
+        cache: maven
+
+    # Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
     - name: Update dependency graph
       uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6

Run this read-only check after updating the workflow. Expected result: the build job has only contents: read, and the dependency submission action appears only in a push-gated job with contents: write.

#!/bin/bash
set -euo pipefail

workflow=".github/workflows/maven.yml"

echo "Relevant workflow lines:"
rg -n -C3 'permissions:|contents:|pull_request:|push:|if:|maven-dependency-submission-action' "$workflow"

Also applies to: 33-35

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/maven.yml around lines 14 - 15, The PR workflow currently
runs the maven-dependency-submission-action under pull_request which exposes a
write-capable GITHUB_TOKEN; split that step into a new job triggered only on
push (add a push: trigger) and give that new job job-level permissions:
contents: write, while keeping the existing pull_request build job’s
permissions: contents: read; specifically move the
maven-dependency-submission-action invocation out of the pull_request job into
the new push-only job, add permissions: { contents: write } to the new job and
ensure the original build job (the pull_request job) has permissions: {
contents: read } or no write permission.


jobs:
build:

runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
cache: maven
- name: Build with Maven
run: mvn -B package --file pom.xml

# Optional: Uploads the full dependency graph to GitHub to improve the quality of Dependabot alerts this repository can receive
- name: Update dependency graph
uses: advanced-security/maven-dependency-submission-action@571e99aab1055c2e71a1e2309b9691de18d6b7d6