From 251594ab78d0182e5240ef7b8880db7572bc2cea Mon Sep 17 00:00:00 2001 From: AB Date: Thu, 28 Aug 2025 11:59:14 +0200 Subject: [PATCH 1/9] Improve caching and remove excessive whitespaces * Add dedicated caching for pmd and checkstyle * Isolate caching between different goals * Do read-only caching in release workflow on NON-CRITICAL steps --- .github/workflows/check-build.yml | 57 ++++++++++++++++++++++++------- .github/workflows/release.yml | 46 +++++++++++++++++-------- .github/workflows/test-deploy.yml | 4 +-- 3 files changed, 78 insertions(+), 29 deletions(-) diff --git a/.github/workflows/check-build.yml b/.github/workflows/check-build.yml index 09b3548..01f0840 100644 --- a/.github/workflows/check-build.yml +++ b/.github/workflows/check-build.yml @@ -26,25 +26,30 @@ jobs: build: runs-on: ubuntu-latest timeout-minutes: 30 - strategy: matrix: java: [17, 21] distribution: [temurin] - steps: - uses: actions/checkout@v5 - + - name: Set up JDK uses: actions/setup-java@v5 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - cache: 'maven' - + + - name: Cache Maven + uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-build- + - name: Build with Maven run: ./mvnw -B clean package - + - name: Check for uncommited changes run: | if [[ "$(git status --porcelain)" != "" ]]; then @@ -74,21 +79,34 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }} timeout-minutes: 15 - strategy: matrix: java: [17] distribution: [temurin] - steps: - uses: actions/checkout@v5 - + - name: Set up JDK uses: actions/setup-java@v5 with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - cache: 'maven' + + - name: Cache Maven + uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-checkstyle-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-checkstyle- + + - name: CheckStyle Cache + uses: actions/cache@v4 + with: + path: '**/target/checkstyle-cachefile' + key: ${{ runner.os }}-checkstyle-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-checkstyle- - name: Run Checkstyle run: ./mvnw -B checkstyle:check -P checkstyle -T2C @@ -97,12 +115,10 @@ jobs: runs-on: ubuntu-latest if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'renovate/') }} timeout-minutes: 15 - strategy: matrix: java: [17] distribution: [temurin] - steps: - uses: actions/checkout@v5 @@ -111,7 +127,22 @@ jobs: with: distribution: ${{ matrix.distribution }} java-version: ${{ matrix.java }} - cache: 'maven' + + - name: Cache Maven + uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-pmd-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-pmd- + + - name: PMD Cache + uses: actions/cache@v4 + with: + path: '**/target/pmd/pmd.cache' + key: ${{ runner.os }}-pmd-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-pmd- - name: Run PMD run: ./mvnw -B test pmd:aggregate-pmd-no-fork pmd:check -P pmd -DskipTests -T2C diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ea4ad2f..0639fc6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,20 +11,30 @@ permissions: contents: write pull-requests: write +# DO NOT RESTORE CACHE for critical release steps to prevent a (extremely unlikely) scenario +# where a supply chain attack could be achieved due to poisoned cache jobs: check-code: runs-on: ubuntu-latest timeout-minutes: 30 steps: - uses: actions/checkout@v5 - + - name: Set up JDK uses: actions/setup-java@v5 with: java-version: '17' distribution: 'temurin' - cache: 'maven' - + + # Try to reuse existing cache from check-build + - name: Try restore Maven Cache + uses: actions/cache/restore@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-build- + - name: Build with Maven run: ./mvnw -B clean package -T2C @@ -54,15 +64,15 @@ jobs: upload_url: ${{ steps.create-release.outputs.upload_url }} steps: - uses: actions/checkout@v5 - + - name: Configure Git run: | git config --global user.email "actions@github.com" git config --global user.name "GitHub Actions" - + - name: Un-SNAP run: ./mvnw -B versions:set -DremoveSnapshot -DprocessAllModules -DgenerateBackupPoms=false - + - name: Get version id: version run: | @@ -70,7 +80,7 @@ jobs: echo "release=$version" >> $GITHUB_OUTPUT echo "releasenumber=${version//[!0-9]/}" >> $GITHUB_OUTPUT working-directory: ${{ env.PRIMARY_MAVEN_MODULE }} - + - name: Commit and Push run: | git add -A @@ -78,7 +88,7 @@ jobs: git push origin git tag v${{ steps.version.outputs.release }} git push origin --tags - + - name: Create Release id: create-release uses: shogo82148/actions-create-release@4661dc54f7b4b564074e9fbf73884d960de569a3 # v1 @@ -106,7 +116,7 @@ jobs: timeout-minutes: 60 steps: - uses: actions/checkout@v5 - + - name: Init Git and pull run: | git config --global user.email "actions@github.com" @@ -122,7 +132,7 @@ jobs: server-password: PACKAGES_CENTRAL_TOKEN gpg-passphrase: MAVEN_GPG_PASSPHRASE gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Only import once - + - name: Publish to GitHub Packages Central run: ../mvnw -B deploy -P publish -DskipTests -DaltDeploymentRepository=github-central::https://maven.pkg.github.com/xdev-software/central working-directory: ${{ env.PRIMARY_MAVEN_MODULE }} @@ -154,7 +164,7 @@ jobs: timeout-minutes: 15 steps: - uses: actions/checkout@v5 - + - name: Init Git and pull run: | git config --global user.email "actions@github.com" @@ -166,7 +176,15 @@ jobs: with: java-version: '17' distribution: 'temurin' - cache: 'maven' + + # Try to reuse existing cache from check-build + - name: Try restore Maven Cache + uses: actions/cache/restore@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-mvn-build-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-mvn-build- - name: Build site run: ../mvnw -B compile site -DskipTests -T2C @@ -185,7 +203,7 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v5 - + - name: Init Git and pull run: | git config --global user.email "actions@github.com" @@ -200,7 +218,7 @@ jobs: git add -A git commit -m "Preparing for next development iteration" git push origin - + - name: pull-request env: GH_TOKEN: ${{ github.token }} diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index cfd79b4..b75a246 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -22,14 +22,14 @@ jobs: server-password: PACKAGES_CENTRAL_TOKEN gpg-passphrase: MAVEN_GPG_PASSPHRASE gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Only import once - + - name: Publish to GitHub Packages Central run: ../mvnw -B deploy -P publish -DskipTests -DaltDeploymentRepository=github-central::https://maven.pkg.github.com/xdev-software/central working-directory: ${{ env.PRIMARY_MAVEN_MODULE }} env: PACKAGES_CENTRAL_TOKEN: ${{ secrets.PACKAGES_CENTRAL_TOKEN }} MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }} - + - name: Set up JDK uses: actions/setup-java@v5 with: # running setup-java again overwrites the settings.xml From 3dfbb547ec4934674a4ec4360ce5cf47107ea4fe Mon Sep 17 00:00:00 2001 From: AB Date: Thu, 28 Aug 2025 12:00:50 +0200 Subject: [PATCH 2/9] Remove excessive white-spaces --- .github/workflows/broken-links.yml | 2 +- .github/workflows/update-from-template.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/broken-links.yml b/.github/workflows/broken-links.yml index 4d8ac3c..9493fb8 100644 --- a/.github/workflows/broken-links.yml +++ b/.github/workflows/broken-links.yml @@ -28,7 +28,7 @@ jobs: echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title \"Link Checker Report\"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT env: GH_TOKEN: ${{ github.token }} - + - name: Close issue if everything is fine if: steps.lychee.outputs.exit_code == 0 && steps.find-issue.outputs.number != '' run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }} diff --git a/.github/workflows/update-from-template.yml b/.github/workflows/update-from-template.yml index 3a7dc91..ebd8220 100644 --- a/.github/workflows/update-from-template.yml +++ b/.github/workflows/update-from-template.yml @@ -42,7 +42,7 @@ jobs: # If no PAT is used the following error occurs on a push: # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - + - name: Init Git run: | git config --global user.email "111048771+xdev-gh-bot@users.noreply.github.com" @@ -188,7 +188,7 @@ jobs: # If no PAT is used the following error occurs on a push: # refusing to allow a GitHub App to create or update workflow `.github/workflows/xxx.yml` without `workflows` permission token: ${{ secrets.UPDATE_FROM_TEMPLATE_PAT }} - + - name: Init Git run: | git config --global user.email "111048771+xdev-gh-bot@users.noreply.github.com" From d820b9eacc7e793cf359835c9568b45b089835a0 Mon Sep 17 00:00:00 2001 From: AB Date: Thu, 28 Aug 2025 12:05:51 +0200 Subject: [PATCH 3/9] Enable pmd analysis cache --- pom.xml | 1 + template-placeholder/pom.xml | 1 + 2 files changed, 2 insertions(+) diff --git a/pom.xml b/pom.xml index c495b40..f778549 100644 --- a/pom.xml +++ b/pom.xml @@ -72,6 +72,7 @@ maven-pmd-plugin 3.27.0 + true true true diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index 15dacb0..aab5f18 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -242,6 +242,7 @@ maven-pmd-plugin 3.27.0 + true true true From 85ec7061c2ae7c76130343512dfb119ef7a8e3ea Mon Sep 17 00:00:00 2001 From: XDEV Renovate Bot Date: Mon, 1 Sep 2025 04:21:34 +0000 Subject: [PATCH 4/9] Update dependency com.puppycrawl.tools:checkstyle to v11.0.1 --- pom.xml | 2 +- template-placeholder/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index f778549..abef334 100644 --- a/pom.xml +++ b/pom.xml @@ -45,7 +45,7 @@ com.puppycrawl.tools checkstyle - 11.0.0 + 11.0.1 diff --git a/template-placeholder/pom.xml b/template-placeholder/pom.xml index aab5f18..e866684 100644 --- a/template-placeholder/pom.xml +++ b/template-placeholder/pom.xml @@ -215,7 +215,7 @@ com.puppycrawl.tools checkstyle - 11.0.0 + 11.0.1 From c41665b0458f1c666bc722214b2b68e883215005 Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 2 Sep 2025 11:21:09 +0200 Subject: [PATCH 5/9] PMD: AvoidUnmanagedThreads --- .config/pmd/java/ruleset.xml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index 02a037f..b52a0f3 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -218,6 +218,28 @@ + + + Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads. + Threads can also not be cancelled properly. + + Use managed Thread services like ``ExecutorService`` and ``CompletableFuture`` instead. + + 3 + + + + + + + + + Date: Tue, 2 Sep 2025 11:26:59 +0200 Subject: [PATCH 6/9] Fix format --- .config/pmd/java/ruleset.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index b52a0f3..c9cf652 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -226,7 +226,7 @@ Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads. Threads can also not be cancelled properly. - Use managed Thread services like ``ExecutorService`` and ``CompletableFuture`` instead. + Use managed Thread services like `ExecutorService` and `CompletableFuture` instead. 3 From ebe579f2592e6c6550531f43182ed92923c8998b Mon Sep 17 00:00:00 2001 From: AB Date: Tue, 2 Sep 2025 15:09:22 +0200 Subject: [PATCH 7/9] PMD: Add PostConstruct and PreDestroy --- .config/pmd/java/ruleset.xml | 43 ++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml index c9cf652..ebdbd83 100644 --- a/.config/pmd/java/ruleset.xml +++ b/.config/pmd/java/ruleset.xml @@ -218,6 +218,49 @@ + + + Using a `@PostConstruct` method is usually only done when field injection is used and initialization needs to be performed after that. + + It's better to do this directly in the constructor with constructor injection, so that all logic will be encapsulated there. + This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PostConstruct` method is no longer possible. + + 3 + + + + + + + + + + + + `@PreDestroy` should be replaced by implementing `AutoCloseable` and overwriting the `close` method instead. + + This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PreDestroy` method is no much more difficult. + + 3 + + + + + + + + + Date: Wed, 3 Sep 2025 09:35:50 +0200 Subject: [PATCH 8/9] Init --- .config/checkstyle/checkstyle.xml | 150 +++++++++ .config/checkstyle/suppressions.xml | 6 + .config/pmd/java/ruleset.xml | 310 +++++++++++++++++++ .gitattributes | 5 + .gitignore | 46 +++ .idea/PMDPlugin.xml | 16 + .idea/checkstyle-idea.xml | 20 ++ .idea/codeStyles/Project.xml | 99 ++++++ .idea/codeStyles/codeStyleConfig.xml | 5 + .idea/externalDependencies.xml | 7 + .idea/inspectionProfiles/Project_Default.xml | 6 + .idea/saveactions_settings.xml | 22 ++ 12 files changed, 692 insertions(+) create mode 100644 .config/checkstyle/checkstyle.xml create mode 100644 .config/checkstyle/suppressions.xml create mode 100644 .config/pmd/java/ruleset.xml create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 .idea/PMDPlugin.xml create mode 100644 .idea/checkstyle-idea.xml create mode 100644 .idea/codeStyles/Project.xml create mode 100644 .idea/codeStyles/codeStyleConfig.xml create mode 100644 .idea/externalDependencies.xml create mode 100644 .idea/inspectionProfiles/Project_Default.xml create mode 100644 .idea/saveactions_settings.xml diff --git a/.config/checkstyle/checkstyle.xml b/.config/checkstyle/checkstyle.xml new file mode 100644 index 0000000..43b5290 --- /dev/null +++ b/.config/checkstyle/checkstyle.xml @@ -0,0 +1,150 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/.config/checkstyle/suppressions.xml b/.config/checkstyle/suppressions.xml new file mode 100644 index 0000000..16d385e --- /dev/null +++ b/.config/checkstyle/suppressions.xml @@ -0,0 +1,6 @@ + + + + diff --git a/.config/pmd/java/ruleset.xml b/.config/pmd/java/ruleset.xml new file mode 100644 index 0000000..ebdbd83 --- /dev/null +++ b/.config/pmd/java/ruleset.xml @@ -0,0 +1,310 @@ + + + + + This ruleset checks the code for discouraged programming constructs. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Calling setters of java.lang.System usually indicates bad design and likely causes unexpected behavior. + For example, it may break when multiple Threads are setting the value. + It may also overwrite user defined options or properties. + + Try to pass the value only to the place where it's really needed and use it there accordingly. + + 3 + + + + + + + + + + + + Using a `@PostConstruct` method is usually only done when field injection is used and initialization needs to be performed after that. + + It's better to do this directly in the constructor with constructor injection, so that all logic will be encapsulated there. + This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PostConstruct` method is no longer possible. + + 3 + + + + + + + + + + + + `@PreDestroy` should be replaced by implementing `AutoCloseable` and overwriting the `close` method instead. + + This also makes using the bean in environments where JavaEE is not present - for example in tests - a lot easier, as forgetting to call the `@PreDestroy` method is no much more difficult. + + 3 + + + + + + + + + + + + Trying to manually manage threads usually gets quickly out of control and may result in various problems like uncontrollable spawning of threads. + Threads can also not be cancelled properly. + + Use managed Thread services like `ExecutorService` and `CompletableFuture` instead. + + 3 + + + + + + + + + + + + Nearly every known usage of (Java) Object Deserialization has resulted in [a security vulnerability](https://cloud.google.com/blog/topics/threat-intelligence/hunting-deserialization-exploits?hl=en). + Vulnerabilities are so common that there are [dedicated projects for exploit payload generation](https://github.com/frohoff/ysoserial). + + Java Object Serialization may also fail to deserialize when the underlying classes are changed. + + Use proven data interchange formats like JSON instead. + + 2 + + + + + + + + + diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..0f9f33e --- /dev/null +++ b/.gitattributes @@ -0,0 +1,5 @@ +# Auto detect text files and perform LF normalization +* text=auto + +# Force sh files to have LF +*.sh text eol=lf diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ea95295 --- /dev/null +++ b/.gitignore @@ -0,0 +1,46 @@ +# Compiled class file +*.class + +# Log file +*.log + +# Package/Binary Files don't belong into a git repo +*.jar +*.war +*.ear +*.zip +*.tar.gz +*.dll +*.exe +*.bin + +# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml +hs_err_pid* + +# Eclipse +.metadata +.settings +.classpath +.project + +# == IntelliJ == +*.iml +*.ipr + +# Some files are user/installation independent and are used for configuring the IDE +# See also https://stackoverflow.com/a/35279076 + +.idea/* +!.idea/saveactions_settings.xml +!.idea/checkstyle-idea.xml +!.idea/externalDependencies.xml +!.idea/PMDPlugin.xml + +!.idea/inspectionProfiles/ +.idea/inspectionProfiles/* +!.idea/inspectionProfiles/Project_Default.xml + +!.idea/codeStyles/ +.idea/codeStyles/* +!.idea/codeStyles/codeStyleConfig.xml +!.idea/codeStyles/Project.xml diff --git a/.idea/PMDPlugin.xml b/.idea/PMDPlugin.xml new file mode 100644 index 0000000..0936e51 --- /dev/null +++ b/.idea/PMDPlugin.xml @@ -0,0 +1,16 @@ + + + + + + + \ No newline at end of file diff --git a/.idea/checkstyle-idea.xml b/.idea/checkstyle-idea.xml new file mode 100644 index 0000000..ec555b5 --- /dev/null +++ b/.idea/checkstyle-idea.xml @@ -0,0 +1,20 @@ + + + + 11.0.0 + JavaOnlyWithTests + true + true + + + + \ No newline at end of file diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml new file mode 100644 index 0000000..19681fa --- /dev/null +++ b/.idea/codeStyles/Project.xml @@ -0,0 +1,99 @@ + + + + diff --git a/.idea/codeStyles/codeStyleConfig.xml b/.idea/codeStyles/codeStyleConfig.xml new file mode 100644 index 0000000..79ee123 --- /dev/null +++ b/.idea/codeStyles/codeStyleConfig.xml @@ -0,0 +1,5 @@ + + + + \ No newline at end of file diff --git a/.idea/externalDependencies.xml b/.idea/externalDependencies.xml new file mode 100644 index 0000000..78be5b8 --- /dev/null +++ b/.idea/externalDependencies.xml @@ -0,0 +1,7 @@ + + + + + + + \ No newline at end of file diff --git a/.idea/inspectionProfiles/Project_Default.xml b/.idea/inspectionProfiles/Project_Default.xml new file mode 100644 index 0000000..6a1691d --- /dev/null +++ b/.idea/inspectionProfiles/Project_Default.xml @@ -0,0 +1,6 @@ + + + + \ No newline at end of file diff --git a/.idea/saveactions_settings.xml b/.idea/saveactions_settings.xml new file mode 100644 index 0000000..12a4f04 --- /dev/null +++ b/.idea/saveactions_settings.xml @@ -0,0 +1,22 @@ + + + + + + \ No newline at end of file From bba9aa6a907b7cd020e9123fdf8f8e87e71db92d Mon Sep 17 00:00:00 2001 From: AB Date: Wed, 3 Sep 2025 16:42:18 +0200 Subject: [PATCH 9/9] No EoL --- .idea/codeStyles/Project.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.idea/codeStyles/Project.xml b/.idea/codeStyles/Project.xml index 19681fa..21e0aff 100644 --- a/.idea/codeStyles/Project.xml +++ b/.idea/codeStyles/Project.xml @@ -96,4 +96,4 @@ - + \ No newline at end of file