Fix CVEs (dapr#1529)

* chore: Read test certs from resources folder

This will avoid importing bouncy castle library just for tests

Signed-off-by: Javier Aliaga <[email protected]>

* ci: Split unit test and integration tests

Signed-off-by: Javier Aliaga <[email protected]>

---------

Signed-off-by: Javier Aliaga <[email protected]>

Author: javier-aliaga

.github/workflows/build.yml

@@ -15,6 +15,35 @@ on:
     - release-*
 
 jobs:
+  test:
+    name: "Unit tests"
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    continue-on-error: false
+    env:
+      JDK_VER: 17
+    steps:
+      - uses: actions/checkout@v5
+      - name: Set up OpenJDK ${{ env.JDK_VER }}
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: ${{ env.JDK_VER }}
+      - name: Run tests
+        run: ./mvnw clean install -B -q
+      - name: Codecov
+        uses: codecov/[email protected]
+      - name: Upload test report for sdk
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-dapr-java-sdk-jdk${{ env.JDK_VER }}
+          path: sdk/target/jacoco-report/
+      - name: Upload test report for sdk-actors
+        uses: actions/upload-artifact@v4
+        with:
+          name: report-dapr-java-sdk-actors-jdk${{ env.JDK_VER }}
+          path: sdk-actors/target/jacoco-report/
+
   build:
     name: "Build jdk:${{ matrix.java }} sb:${{ matrix.spring-boot-display-version }} exp:${{ matrix.experimental }}"
     runs-on: ubuntu-latest
@@ -114,27 +143,11 @@ jobs:
         /home/runner/.local/bin/toxiproxy-server --version
     - name: Clean up and install sdk
       run: ./mvnw clean install -B -q -DskipTests
-    - name: Unit tests
-      run: ./mvnw test # making it temporarily verbose.
-      env:
-          DOCKER_HOST: ${{steps.setup_docker.outputs.sock}}
-    - name: Codecov
-      uses: codecov/[email protected]
     - name: Integration tests using spring boot version ${{ matrix.spring-boot-version }}
       id: integration_tests
       run: PRODUCT_SPRING_BOOT_VERSION=${{ matrix.spring-boot-version }} ./mvnw -B -Pintegration-tests verify
       env:
           DOCKER_HOST: ${{steps.setup_docker.outputs.sock}}
-    - name: Upload test report for sdk
-      uses: actions/upload-artifact@v4
-      with:
-        name: report-dapr-java-sdk-jdk${{ matrix.java }}-sb${{ matrix.spring-boot-version }}
-        path: sdk/target/jacoco-report/
-    - name: Upload test report for sdk-actors
-      uses: actions/upload-artifact@v4
-      with:
-        name: report-dapr-java-sdk-actors-jdk${{ matrix.java }}-sb${{ matrix.spring-boot-version }}
-        path: sdk-actors/target/jacoco-report/
     - name: Upload failsafe test report for sdk-tests on failure
       if: ${{ failure() && steps.integration_tests.conclusion == 'failure' }}
       uses: actions/upload-artifact@v4
@@ -150,7 +163,7 @@ jobs:
 
   publish:
     runs-on: ubuntu-latest
-    needs: build
+    needs: [ build, test ]
     timeout-minutes: 30
     env:
       JDK_VER: 17

sdk/pom.xml

@@ -132,18 +132,6 @@
       <artifactId>assertj-core</artifactId>
       <version>${assertj.version}</version>
     </dependency>
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bcprov-jdk15on</artifactId>
-      <version>1.70</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bcpkix-jdk15on</artifactId>
-      <version>1.70</version>
-      <scope>test</scope>
-    </dependency>
     <dependency>
       <groupId>io.grpc</groupId>
       <artifactId>grpc-netty-shaded</artifactId>