Add JDK 21 setup to Sonar analysis workflow and update the deprecated… - #369
Add JDK 21 setup to Sonar analysis workflow and update the deprecated…#369Mahesh-Binayak wants to merge 1 commit into
Conversation
… sonar.login variable. Signed-off-by: Mahesh-Binayak <76687012+Mahesh-Binayak@users.noreply.github.com>
WalkthroughThe SonarCloud workflow now sets up Temurin JDK 21 and passes the existing secret through ChangesSonarCloud workflow
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/npm-sonar-analysis.yml:
- Line 134: Update the workflow’s Sonar analysis step to remove the ad hoc `npm
install sonar-scanner` command. Add `sonar-scanner` as a pinned dependency in
package.json, commit the corresponding lockfile update, run `npm ci`, and then
invoke the existing `npm run sonar` command using the locked dependency.
- Line 134: Update the sonar execution step containing `npm run sonar` to stop
interpolating `inputs.SONAR_ARGS` directly in the shell command. Expose the
input through the step environment, then reference the environment variable in a
safely quoted argument while preserving the existing SONAR_TOKEN, ORG_KEY, and
sonar argument behavior.
- Around line 64-68: Update the “Set up JDK 21” workflow step to use the
repository-approved supported `actions/setup-java` version pinned to its
immutable commit SHA instead of `actions/setup-java@v3`, while preserving the
existing Temurin distribution and Java 21 configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 73a5409e-a48a-45cb-99e8-eee7b0894d4c
📒 Files selected for processing (1)
.github/workflows/npm-sonar-analysis.yml
| - name: Set up JDK 21 | ||
| uses: actions/setup-java@v3 | ||
| with: | ||
| distribution: 'temurin' | ||
| java-version: '21' |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/npm-sonar-analysis.yml ]; then
sed -n '1,180p' .github/workflows/npm-sonar-analysis.yml | cat -n
else
echo "workflow not found"
fi
echo "== action version refs nearby =="
rg -n "actions/setup-java|setup-java|actionlint|allowed|policy|approved" .github/workflows -S || true
echo "== available tools =="
command -v actionlint || true
actionlint --version 2>&1 || true
if command -v gh >/dev/null 2>/dev/null; then
gh api /repos/actions/setup-java/git/ref/tags/v3 --jq '{tag_ref_sha:.object.sha,type:.object.type}' || true
ref=$(gh api /repos/actions/setup-java/git/ref/tags/v3 --jq '.object.sha')
tag_obj=$(gh api repos/actions/setup-java/git/tags/$ref --jq '{type:.object.type,sha:.object.sha,tag:.tag}' 2>/dev/null || true)
echo "ref sha=$ref tag object=$tag_obj"
else
echo "gh not on path"
fiRepository: mosip/kattu
Length of output: 6846
🌐 Web query:
actions/setup-java v3 latest v3 tag 2023 2024
💡 Result:
As of July 27, 2026, the actions/setup-java v3 major version is considered deprecated and superseded by newer major versions, specifically v4 and v5 [1][2]. The latest release within the v3 major series was v3.14.1 [3]. The v3 branch reached this point through ongoing maintenance throughout 2023 and 2024 to support various distributions and Java versions, but it has since been replaced by V4 and V5 to accommodate newer Node.js runtime requirements (such as Node 20 and Node 24) and updated internal dependencies [4][5][6]. Key points regarding the status of v3: - Deprecation: Users are strongly encouraged to migrate from v3 to v5 to ensure compatibility with modern GitHub Actions runners and improved performance [4][6]. - Node.js Runtime: V5 of the action utilizes Node 24, whereas older versions like v3 relied on outdated Node.js runtimes that are being phased out [4][5][1]. - Maintenance: Official development and security updates have shifted to the current major versions [3][6]. For projects still using actions/setup-java@v3, it is recommended to update to the latest major version (currently v5.x.x) to avoid potential workflow failures related to deprecated runtime support [4][1][2].
Citations:
- 1: Bump deprecated GitHub Actions to v4 rapiddweller/rapiddweller-benerator-ce#464
- 2: pact-foundation/pact-jvm@a796b1c
- 3: https://github.com/actions/setup-java/releases
- 4: https://github.com/actions/setup-java?tab=readme-ov-file
- 5: https://github.com/actions/setup-java/blob/main/README.md
- 6: https://github.com/actions/setup-java
Upgrade and pin actions/setup-java.
actions/setup-java@v3 has reached its final support end and relies on deprecated Node.js runtime maintenance; also pin workflow actions to immutable commit SHAs to reduce supply-chain risk. Use the repository-approved supported version and SHA.
Proposed fix
- name: Set up JDK 21
- uses: actions/setup-java@v3
+ uses: actions/setup-java@v5 # pin to an approved commit SHA🧰 Tools
🪛 actionlint (1.7.12)
[error] 65-65: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.26.1)
[error] 65-65: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/npm-sonar-analysis.yml around lines 64 - 68, Update the
“Set up JDK 21” workflow step to use the repository-approved supported
`actions/setup-java` version pinned to its immutable commit SHA instead of
`actions/setup-java@v3`, while preserving the existing Temurin distribution and
Java 21 configuration.
Source: Linters/SAST tools
| run: | | ||
| cd "./${{inputs.SERVICE_LOCATION}}" | ||
| npm install sonar-scanner && npm run sonar -- -Dsonar.login=${{ env.SONAR_TOKEN }} -Dsonar.organization=${{ env.ORG_KEY }} ${{ inputs.SONAR_ARGS }} | ||
| npm install sonar-scanner && npm run sonar -- -Dsonar.token=${{ env.SONAR_TOKEN }} -Dsonar.organization=${{ env.ORG_KEY }} ${{ inputs.SONAR_ARGS }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Avoid installing sonar-scanner outside the lockfile.
npm install sonar-scanner resolves and executes an unpinned package during every workflow run. Declare it in package.json, commit the lockfile, and use npm ci before invoking the scanner.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 134-134: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile
(adhoc-packages)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/npm-sonar-analysis.yml at line 134, Update the workflow’s
Sonar analysis step to remove the ad hoc `npm install sonar-scanner` command.
Add `sonar-scanner` as a pinned dependency in package.json, commit the
corresponding lockfile update, run `npm ci`, and then invoke the existing `npm
run sonar` command using the locked dependency.
Source: Linters/SAST tools
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files '.github/workflows/*' || true
echo
echo "== target workflow context =="
if [ -f .github/workflows/npm-sonar-analysis.yml ]; then
nl -ba .github/workflows/npm-sonar-analysis.yml | sed -n '1,180p'
else
echo "target file not found"
fi
echo
echo "== SONAR_ARGS references =="
rg -n "SONAR_ARGS|inputs\.|npm run sonar|sonar.token|sonar\.organization" .github/workflows || true
echo
echo "== workflow inputs and permissions =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/npm-sonar-analysis.yml')
if p.exists():
text=p.read_text()
for i,line in enumerate(text.splitlines(),1):
if 'permissions:' in line or 'sonar-token' in line.lower() or 'SONAR_TOKEN' in line:
print(f"{i}: {line}")
PYRepository: mosip/kattu
Length of output: 1435
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target workflow context =="
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/npm-sonar-analysis.yml | sed -n '1,200p'
echo
echo "== SONAR_ARGS and related references =="
grep -n -E 'SONAR_ARGS|SONAR_TOKEN|ORG_KEY|inputs\.|npm run sonar|permissions:|env:' .github/workflows/npm-sonar-analysis.yml || true
echo
echo "== trigger workflow inputs =="
grep -n -E 'inputs:|description:|required:|type:' .github/workflows/npm-sonar-analysis.yml || true
echo
echo "== repository-wide SONAR_ARGS references =="
grep -RInE 'SONAR_ARGS|sonar\.args|SONAR_ARGS:' . | head -200 || trueRepository: mosip/kattu
Length of output: 8655
🌐 Web query:
GitHub Actions workflow_call input type string shell context untrusted expression injection
💡 Result:
In GitHub Actions, using input values from a workflow_call trigger directly within a run: block is susceptible to shell expression injection [1][2][3]. This occurs because the ${{ inputs.input_name }} syntax performs macro-substitution, injecting the raw string directly into the shell script before it executes, which allows an attacker to break out of the intended command context using shell metacharacters [1][4][3]. The primary defensive strategy is to avoid using the ${{ }} expression syntax directly inside shell commands [3][5]. Instead, you should pass the input via an intermediate environment variable and reference that variable using standard shell syntax (e.g., "$VARIABLE") [1][3][6]. Correct Pattern (Using Environment Variables): #.github/workflows/reusable.yml on: workflow_call: inputs: user_input: type: string required: true jobs: job: runs-on: ubuntu-latest steps: - env: # Safely assign the input to an environment variable SAFE_INPUT: ${{ inputs.user_input }} run: | # Use shell syntax to reference the variable, preventing injection echo "Processing:
Citations:
- 1: fix(codeql): mitigate shell injection in build-command input Mininglamp-OSS/.github#59
- 2: https://sisaku-security.github.io/lint/docs/rules/reusableworkflowtaint/
- 3: https://github.blog/security/supply-chain-security/four-tips-to-keep-your-github-actions-workflows-secure/
- 4: https://docs.github.com/en/actions/concepts/security/script-injections
- 5: https://docs.github.com/en/actions/reference/security/secure-use
- 6: https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-094/CodeInjectionMedium.md
- 7: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md
- 8: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/
- 9: Feature Request: checking workflow inputs for Untrusted input rhysd/actionlint#385
Prevent shell injection through SONAR_ARGS.
${{ inputs.SONAR_ARGS }} is expanded directly inside the run script. Because workflow_call inputs accept GitHub token holders such as secrets.*, an untrusted caller can inject shell metacharacters, leading to runner compromise and affecting MOSIP compliance.
Pass the input through the environment and quote arguments instead of interpolating the raw input.
Proposed fix
+ read -r -a extra_args <<< "$SONAR_ARGS"
- npm install sonar-scanner && npm run sonar -- -Dsonar.token=${{ env.SONAR_TOKEN }} -Dsonar.organization=${{ env.ORG_KEY }} ${{ inputs.SONAR_ARGS }}
+ npm install sonar-scanner && npm run sonar -- "-Dsonar.token=$SONAR_TOKEN" "-Dsonar.organization=$ORG_KEY" "${extra_args[@]}"
+ env:
+ SONAR_ARGS: ${{ inputs.SONAR_ARGS }}🧰 Tools
🪛 zizmor (1.26.1)
[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 134-134: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile
(adhoc-packages)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/npm-sonar-analysis.yml at line 134, Update the sonar
execution step containing `npm run sonar` to stop interpolating
`inputs.SONAR_ARGS` directly in the shell command. Expose the input through the
step environment, then reference the environment variable in a safely quoted
argument while preserving the existing SONAR_TOKEN, ORG_KEY, and sonar argument
behavior.
Source: Linters/SAST tools
1 participant
… sonar.login variable.
Summary by CodeRabbit