From 71d293101fb46c38a3f4a917e5f409271214f2e0 Mon Sep 17 00:00:00 2001 From: loong10k <20489781+loong10k@users.noreply.github.com> Date: Wed, 4 Nov 2026 08:52:39 +0800 Subject: [PATCH] fix: refresh Commons IO management and validate without image builds --- .github/workflows/ci.yml | 21 +++++++++++---- VALIDATION.md | 27 +++++++++++++++++++ pom.xml | 8 +++--- scripts/check-dependency-management.py | 19 +++++++++++++ .../web/HelloWorldControllerTest.java | 22 +++++++++++++++ .../web/HelloWorldControllerTest.java | 22 +++++++++++++++ 6 files changed, 110 insertions(+), 9 deletions(-) create mode 100644 VALIDATION.md create mode 100644 scripts/check-dependency-management.py create mode 100644 spring-boot-deployment-app/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java create mode 100644 spring-boot-deployment-docker/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9663666..22d4561 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,7 +9,7 @@ # - 3.0.x ~ 3.5.x : JDK 17 # - 4.0.x / 4.1.x : JDK 17 / 21 # -# Runs `mvn -B clean verify` with dependency convergence checks. +# Stops at test: package binds Docker build/tag and must not run in CI. name: CI on: @@ -24,7 +24,7 @@ permissions: jobs: build: - name: JDK ${{ matrix.java }} Build & Verify + name: JDK ${{ matrix.java }} Compile & Test runs-on: ubuntu-latest timeout-minutes: 30 strategy: @@ -42,13 +42,24 @@ jobs: java-version: ${{ matrix.java }} cache: maven - - name: Build and verify - run: mvn -B --no-transfer-progress clean verify + # Never advance this lifecycle to package/verify: Docker goals bind to package. + - name: Compile and run controller regressions (no images) + run: mvn -B --no-transfer-progress clean test + + - name: Record effective dependency management and actual dependency trees + run: | + mvn -B --no-transfer-progress help:effective-pom -Doutput=target/effective-pom.xml + mvn -B --no-transfer-progress dependency:tree -DoutputFile=target/dependency-tree.txt + python3 scripts/check-dependency-management.py + - name: Upload surefire reports if: always() uses: actions/upload-artifact@v4 with: name: surefire-reports-jdk${{ matrix.java }} - path: target/surefire-reports + path: | + **/target/surefire-reports + **/target/effective-pom.xml + **/target/dependency-tree.txt retention-days: 14 diff --git a/VALIDATION.md b/VALIDATION.md new file mode 100644 index 0000000..0c1ea5d --- /dev/null +++ b/VALIDATION.md @@ -0,0 +1,27 @@ +# Non-deployment validation + +The parent manages Commons IO 2.22.0, which Apache documents as Java 8 compatible: +https://commons.apache.org/proper/commons-io/changes.html +https://commons.apache.org/proper/commons-io/security.html + +The effective POM previously managed 2.5. The actual dependency trees contain no +Commons IO dependency in any of the three reactor projects. This is preventive +version-management maintenance, not evidence of runtime exploitability. + +Run from the repository root: + +```sh +mvn -B --no-transfer-progress clean test +mvn -B --no-transfer-progress help:effective-pom -Doutput=target/effective-pom.xml +mvn -B --no-transfer-progress dependency:tree -DoutputFile=target/dependency-tree.txt +python3 scripts/check-dependency-management.py +``` + +Do not substitute `package`, `verify`, `install`, or `deploy`: the Docker module +binds image build/tag to package and push to deploy. The test lifecycle stops +before those phases. The controller tests use standalone MockMvc and do not +start the application, connect to a Docker daemon, or deploy services. + +CI executes the four route regressions on Java 8, 17, and 21 and archives Maven +evidence. Boot 2.1.4, public production sources, JMX, and deployment settings are +unchanged. No claim is made that all other old dependencies are secure. diff --git a/pom.xml b/pom.xml index e0eca86..e485628 100644 --- a/pom.xml +++ b/pom.xml @@ -96,7 +96,7 @@ UTF-8 UTF-8 3.6 - 2.5 + 2.22.0 1.2 1.1 @@ -188,9 +188,9 @@ org.apache.maven.plugins maven-surefire-plugin - - true - true + + false + false diff --git a/scripts/check-dependency-management.py b/scripts/check-dependency-management.py new file mode 100644 index 0000000..0e6b703 --- /dev/null +++ b/scripts/check-dependency-management.py @@ -0,0 +1,19 @@ +"""Check Maven evidence without running packaging or deploying anything.""" +from pathlib import Path +import xml.etree.ElementTree as ET + +ns = {"m": "http://maven.apache.org/POM/4.0.0"} +root = ET.parse("target/effective-pom.xml").getroot() +# Aggregator help output wraps all three projects in . +projects = root.findall("m:project", ns) +assert len(projects) == 3, "Missing reactor effective POMs" +for project in projects: + dependencies = project.findall("m:dependencyManagement/m:dependencies/m:dependency", ns) + versions = [d.findtext("m:version", namespaces=ns) for d in dependencies + if d.findtext("m:groupId", namespaces=ns) == "commons-io" + and d.findtext("m:artifactId", namespaces=ns) == "commons-io"] + assert versions == ["2.22.0"], versions +for directory in (Path("."), Path("spring-boot-deployment-app"), Path("spring-boot-deployment-docker")): + tree = (directory / "target/dependency-tree.txt").read_text() + assert "commons-io:commons-io:" not in tree, tree + print(str(directory) + ": manages Commons IO 2.22.0; no actual Commons IO dependency") diff --git a/spring-boot-deployment-app/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java b/spring-boot-deployment-app/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java new file mode 100644 index 0000000..f879f03 --- /dev/null +++ b/spring-boot-deployment-app/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java @@ -0,0 +1,22 @@ +package com.github.vindell.deployment.web; + +import org.junit.Test; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; + +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; + +public class HelloWorldControllerTest { + private final MockMvc mvc = MockMvcBuilders.standaloneSetup(new HelloWorldController()).build(); + + @Test + public void rootGetPreservesResponse() throws Exception { + mvc.perform(get("/")).andExpect(status().isOk()).andExpect(content().string("Hello App .")); + } + + @Test + public void rootPostIsRejected() throws Exception { + mvc.perform(post("/")).andExpect(status().isMethodNotAllowed()); + } +} diff --git a/spring-boot-deployment-docker/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java b/spring-boot-deployment-docker/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java new file mode 100644 index 0000000..f879f03 --- /dev/null +++ b/spring-boot-deployment-docker/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java @@ -0,0 +1,22 @@ +package com.github.vindell.deployment.web; + +import org.junit.Test; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.test.web.servlet.setup.MockMvcBuilders; + +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*; + +public class HelloWorldControllerTest { + private final MockMvc mvc = MockMvcBuilders.standaloneSetup(new HelloWorldController()).build(); + + @Test + public void rootGetPreservesResponse() throws Exception { + mvc.perform(get("/")).andExpect(status().isOk()).andExpect(content().string("Hello App .")); + } + + @Test + public void rootPostIsRejected() throws Exception { + mvc.perform(post("/")).andExpect(status().isMethodNotAllowed()); + } +}