Skip to content

Add JDK 21 setup to Sonar analysis workflow and update the deprecated… #369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mahesh-Binayak wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add JDK 21 setup to Sonar analysis workflow and update the deprecated… #369

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .github/workflows/npm-sonar-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,11 @@ jobs:
- uses: actions/setup-node@v3
with:
node-version: ${{ inputs.NODE_VERSION }}
- name: Set up JDK 21
uses: actions/setup-java@v3
with:
distribution: 'temurin'
java-version: '21'
Comment on lines +64 to +68

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow excerpt =="
if [ -f .github/workflows/npm-sonar-analysis.yml ]; then
  sed -n '1,180p' .github/workflows/npm-sonar-analysis.yml | cat -n
else
  echo "workflow not found"
fi

echo "== action version refs nearby =="
rg -n "actions/setup-java|setup-java|actionlint|allowed|policy|approved" .github/workflows -S || true

echo "== available tools =="
command -v actionlint || true
actionlint --version 2>&1 || true
if command -v gh >/dev/null 2>/dev/null; then
  gh api /repos/actions/setup-java/git/ref/tags/v3 --jq '{tag_ref_sha:.object.sha,type:.object.type}' || true
  ref=$(gh api /repos/actions/setup-java/git/ref/tags/v3 --jq '.object.sha')
  tag_obj=$(gh api repos/actions/setup-java/git/tags/$ref --jq '{type:.object.type,sha:.object.sha,tag:.tag}' 2>/dev/null || true)
  echo "ref sha=$ref tag object=$tag_obj"
else
  echo "gh not on path"
fi

Repository: mosip/kattu

Length of output: 6846

🌐 Web query:

actions/setup-java v3 latest v3 tag 2023 2024

💡 Result:

As of July 27, 2026, the actions/setup-java v3 major version is considered deprecated and superseded by newer major versions, specifically v4 and v5 [1][2]. The latest release within the v3 major series was v3.14.1 [3]. The v3 branch reached this point through ongoing maintenance throughout 2023 and 2024 to support various distributions and Java versions, but it has since been replaced by V4 and V5 to accommodate newer Node.js runtime requirements (such as Node 20 and Node 24) and updated internal dependencies [4][5][6]. Key points regarding the status of v3: - Deprecation: Users are strongly encouraged to migrate from v3 to v5 to ensure compatibility with modern GitHub Actions runners and improved performance [4][6]. - Node.js Runtime: V5 of the action utilizes Node 24, whereas older versions like v3 relied on outdated Node.js runtimes that are being phased out [4][5][1]. - Maintenance: Official development and security updates have shifted to the current major versions [3][6]. For projects still using actions/setup-java@v3, it is recommended to update to the latest major version (currently v5.x.x) to avoid potential workflow failures related to deprecated runtime support [4][1][2].

Citations:

Upgrade and pin actions/setup-java.

actions/setup-java@v3 has reached its final support end and relies on deprecated Node.js runtime maintenance; also pin workflow actions to immutable commit SHAs to reduce supply-chain risk. Use the repository-approved supported version and SHA.

Proposed fix 
     - name: Set up JDK 21
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v5 # pin to an approved commit SHA
🧰 Tools
🪛 actionlint (1.7.12)

[error] 65-65: the runner of "actions/setup-java@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue

(action)

🪛 zizmor (1.26.1)

[error] 65-65: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/npm-sonar-analysis.yml around lines 64 - 68, Update the
“Set up JDK 21” workflow step to use the repository-approved supported
`actions/setup-java` version pinned to its immutable commit SHA instead of
`actions/setup-java@v3`, while preserving the existing Temurin distribution and
Java 21 configuration.

Source: Linters/SAST tools

- name: Cache npm dependencies
uses: actions/cache@v4
with:
Expand Down Expand Up @@ -126,7 +131,7 @@ jobs:
- name: run sonar analysis
run: |
cd "./${{inputs.SERVICE_LOCATION}}"
npm install sonar-scanner && npm run sonar -- -Dsonar.login=${{ env.SONAR_TOKEN }} -Dsonar.organization=${{ env.ORG_KEY }} ${{ inputs.SONAR_ARGS }}
npm install sonar-scanner && npm run sonar -- -Dsonar.token=${{ env.SONAR_TOKEN }} -Dsonar.organization=${{ env.ORG_KEY }} ${{ inputs.SONAR_ARGS }}

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Avoid installing sonar-scanner outside the lockfile.

npm install sonar-scanner resolves and executes an unpinned package during every workflow run. Declare it in package.json, commit the lockfile, and use npm ci before invoking the scanner.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 134-134: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile

(adhoc-packages)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/npm-sonar-analysis.yml at line 134, Update the workflow’s
Sonar analysis step to remove the ad hoc `npm install sonar-scanner` command.
Add `sonar-scanner` as a pinned dependency in package.json, commit the
corresponding lockfile update, run `npm ci`, and then invoke the existing `npm
run sonar` command using the locked dependency.

Source: Linters/SAST tools

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files '.github/workflows/*' || true

echo
echo "== target workflow context =="
if [ -f .github/workflows/npm-sonar-analysis.yml ]; then
  nl -ba .github/workflows/npm-sonar-analysis.yml | sed -n '1,180p'
else
  echo "target file not found"
fi

echo
echo "== SONAR_ARGS references =="
rg -n "SONAR_ARGS|inputs\.|npm run sonar|sonar.token|sonar\.organization" .github/workflows || true

echo
echo "== workflow inputs and permissions =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/npm-sonar-analysis.yml')
if p.exists():
    text=p.read_text()
    for i,line in enumerate(text.splitlines(),1):
        if 'permissions:' in line or 'sonar-token' in line.lower() or 'SONAR_TOKEN' in line:
            print(f"{i}: {line}")
PY

Repository: mosip/kattu

Length of output: 1435

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== target workflow context =="
awk '{printf "%6d  %s\n", NR, $0}' .github/workflows/npm-sonar-analysis.yml | sed -n '1,200p'

echo
echo "== SONAR_ARGS and related references =="
grep -n -E 'SONAR_ARGS|SONAR_TOKEN|ORG_KEY|inputs\.|npm run sonar|permissions:|env:' .github/workflows/npm-sonar-analysis.yml || true

echo
echo "== trigger workflow inputs =="
grep -n -E 'inputs:|description:|required:|type:' .github/workflows/npm-sonar-analysis.yml || true

echo
echo "== repository-wide SONAR_ARGS references =="
grep -RInE 'SONAR_ARGS|sonar\.args|SONAR_ARGS:' . | head -200 || true

Repository: mosip/kattu

Length of output: 8655

🌐 Web query:

GitHub Actions workflow_call input type string shell context untrusted expression injection

💡 Result:

In GitHub Actions, using input values from a workflow_call trigger directly within a run: block is susceptible to shell expression injection [1][2][3]. This occurs because the ${{ inputs.input_name }} syntax performs macro-substitution, injecting the raw string directly into the shell script before it executes, which allows an attacker to break out of the intended command context using shell metacharacters [1][4][3]. The primary defensive strategy is to avoid using the ${{ }} expression syntax directly inside shell commands [3][5]. Instead, you should pass the input via an intermediate environment variable and reference that variable using standard shell syntax (e.g., "$VARIABLE") [1][3][6]. Correct Pattern (Using Environment Variables): #.github/workflows/reusable.yml on: workflow_call: inputs: user_input: type: string required: true jobs: job: runs-on: ubuntu-latest steps: - env: # Safely assign the input to an environment variable SAFE_INPUT: ${{ inputs.user_input }} run: | # Use shell syntax to reference the variable, preventing injection echo "Processing: $SAFE_INPUT" Security Best Practices: 1. Intermediate Environment Variables: Always use the env block to bridge inputs into your shell environment [6][5][7]. This ensures the value is treated as data, not as part of the script's structure [3][5]. 2. Avoid Expression Syntax in Scripts: Never use ${{ inputs.X }} or ${{ github.event.X }} inside the run: block itself [4][3]. The injection occurs during the template evaluation phase, which precedes shell execution [1][4]. 3. Input Validation: For high-risk workflows, implement runtime validation for your string inputs (e.g., allowlists or regex) using shell conditionals or script logic to ensure the data conforms to expected formats [8]. 4. Use CodeQL and Linting: Enable GitHub Actions code scanning and use tools like actionlint to automatically detect unsafe expression usage [2][3][9]. Note that while this mitigation prevents shell injection, the contents of the variable remain untrusted; if your script performs further operations (such as concatenating the variable into a secondary command), ensure those downstream operations are also secured [3][5].

Citations:

Prevent shell injection through SONAR_ARGS.

${{ inputs.SONAR_ARGS }} is expanded directly inside the run script. Because workflow_call inputs accept GitHub token holders such as secrets.*, an untrusted caller can inject shell metacharacters, leading to runner compromise and affecting MOSIP compliance.

Pass the input through the environment and quote arguments instead of interpolating the raw input.

Proposed fix 
+        read -r -a extra_args <<< "$SONAR_ARGS"
-        npm install sonar-scanner && npm run sonar -- -Dsonar.token=${{ env.SONAR_TOKEN }} -Dsonar.organization=${{ env.ORG_KEY }} ${{ inputs.SONAR_ARGS }}
+        npm install sonar-scanner && npm run sonar -- "-Dsonar.token=$SONAR_TOKEN" "-Dsonar.organization=$ORG_KEY" "${extra_args[@]}"
+      env:
+        SONAR_ARGS: ${{ inputs.SONAR_ARGS }}
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 134-134: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[warning] 134-134: ad-hoc installation of packages (adhoc-packages): installs a package outside of a lockfile

(adhoc-packages)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/npm-sonar-analysis.yml at line 134, Update the sonar
execution step containing `npm run sonar` to stop interpolating
`inputs.SONAR_ARGS` directly in the shell command. Expose the input through the
step environment, then reference the environment variable in a safely quoted
argument while preserving the existing SONAR_TOKEN, ORG_KEY, and sonar argument
behavior.

Source: Linters/SAST tools

env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Expand Down