Fix Commons IO management and run non-deployment CI tests

.github/workflows/ci.yml

@@ -9,7 +9,7 @@
 #   - 3.0.x ~ 3.5.x : JDK 17
 #   - 4.0.x / 4.1.x : JDK 17 / 21
 #
-# Runs `mvn -B clean verify` with dependency convergence checks.
+# Stops at test: package binds Docker build/tag and must not run in CI.
 name: CI
 
 on:
@@ -24,7 +24,7 @@ permissions:
 
 jobs:
   build:
-    name: JDK ${{ matrix.java }} Build & Verify
+    name: JDK ${{ matrix.java }} Compile & Test
     runs-on: ubuntu-latest
     timeout-minutes: 30
     strategy:
@@ -42,13 +42,24 @@ jobs:
           java-version: ${{ matrix.java }}
           cache: maven
 
-      - name: Build and verify
-        run: mvn -B --no-transfer-progress clean verify
+      # Never advance this lifecycle to package/verify: Docker goals bind to package.
+      - name: Compile and run controller regressions (no images)
+        run: mvn -B --no-transfer-progress clean test
+
+      - name: Record effective dependency management and actual dependency trees
+        run: |
+          mvn -B --no-transfer-progress help:effective-pom -Doutput=target/effective-pom.xml
+          mvn -B --no-transfer-progress dependency:tree -DoutputFile=target/dependency-tree.txt
+          python3 scripts/check-dependency-management.py
+
 
       - name: Upload surefire reports
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: surefire-reports-jdk${{ matrix.java }}
-          path: target/surefire-reports
+          path: |
+            **/target/surefire-reports
+            **/target/effective-pom.xml
+            **/target/dependency-tree.txt
           retention-days: 14

VALIDATION.md

@@ -0,0 +1,27 @@
+# Non-deployment validation
+
+The parent manages Commons IO 2.22.0, which Apache documents as Java 8 compatible:
+https://commons.apache.org/proper/commons-io/changes.html
+https://commons.apache.org/proper/commons-io/security.html
+
+The effective POM previously managed 2.5. The actual dependency trees contain no
+Commons IO dependency in any of the three reactor projects. This is preventive
+version-management maintenance, not evidence of runtime exploitability.
+
+Run from the repository root:
+
+```sh
+mvn -B --no-transfer-progress clean test
+mvn -B --no-transfer-progress help:effective-pom -Doutput=target/effective-pom.xml
+mvn -B --no-transfer-progress dependency:tree -DoutputFile=target/dependency-tree.txt
+python3 scripts/check-dependency-management.py
+```
+
+Do not substitute `package`, `verify`, `install`, or `deploy`: the Docker module
+binds image build/tag to package and push to deploy. The test lifecycle stops
+before those phases. The controller tests use standalone MockMvc and do not
+start the application, connect to a Docker daemon, or deploy services.
+
+CI executes the four route regressions on Java 8, 17, and 21 and archives Maven
+evidence. Boot 2.1.4, public production sources, JMX, and deployment settings are
+unchanged. No claim is made that all other old dependencies are secure.

pom.xml

@@ -96,7 +96,7 @@
 		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<commons-lang3.version>3.6</commons-lang3.version>
-		<commons-io.version>2.5</commons-io.version>
+		<commons-io.version>2.22.0</commons-io.version>
 		<commons-logging.version>1.2</commons-logging.version>
 		<commons-text.version>1.1</commons-text.version>
 		<!--docker build、push地址-->
@@ -188,9 +188,9 @@
 					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-surefire-plugin</artifactId>
 					<configuration>
-						<!-- 跳过单元测试 -->
-						<skip>true</skip>
-						<skipTests>true</skipTests>
+						<!-- 运行单元测试 -->
+						<skip>false</skip>
+						<skipTests>false</skipTests>
 						<!-- forkMode 可设置值有 “never”， “once”， “always” 和 “pertest”。 pretest： 
 							每一个测试创建一个新进程，为每个测试创建新的JVM是单独测试的最彻底方式，但也是最慢的，不适合hudson上持续回归。 once：在一个进程中进行所有测试。once为默认设置，在Hudson上持续回归时建议使用默认设置。 
 							always：在一个进程中并行的运行脚本，Junit4.7以上版本才可以使用，surefire的版本要在2.6以上提供这个功能，其中 threadCount：执行时，指定可分配的线程数量。只和参数parallel配合使用有效。默认：5。 -->

scripts/check-dependency-management.py

@@ -0,0 +1,19 @@
+"""Check Maven evidence without running packaging or deploying anything."""
+from pathlib import Path
+import xml.etree.ElementTree as ET
+
+ns = {"m": "http://maven.apache.org/POM/4.0.0"}
+root = ET.parse("target/effective-pom.xml").getroot()
+# Aggregator help output wraps all three projects in <projects>.
+projects = root.findall("m:project", ns)
+assert len(projects) == 3, "Missing reactor effective POMs"
+for project in projects:
+    dependencies = project.findall("m:dependencyManagement/m:dependencies/m:dependency", ns)
+    versions = [d.findtext("m:version", namespaces=ns) for d in dependencies
+                if d.findtext("m:groupId", namespaces=ns) == "commons-io"
+                and d.findtext("m:artifactId", namespaces=ns) == "commons-io"]
+    assert versions == ["2.22.0"], versions
+for directory in (Path("."), Path("spring-boot-deployment-app"), Path("spring-boot-deployment-docker")):
+    tree = (directory / "target/dependency-tree.txt").read_text()
+    assert "commons-io:commons-io:" not in tree, tree
+    print(str(directory) + ": manages Commons IO 2.22.0; no actual Commons IO dependency")

spring-boot-deployment-app/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java

@@ -0,0 +1,22 @@
+package com.github.vindell.deployment.web;
+
+import org.junit.Test;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+public class HelloWorldControllerTest {
+    private final MockMvc mvc = MockMvcBuilders.standaloneSetup(new HelloWorldController()).build();
+
+    @Test
+    public void rootGetPreservesResponse() throws Exception {
+        mvc.perform(get("/")).andExpect(status().isOk()).andExpect(content().string("Hello App ."));
+    }
+
+    @Test
+    public void rootPostIsRejected() throws Exception {
+        mvc.perform(post("/")).andExpect(status().isMethodNotAllowed());
+    }
+}

spring-boot-deployment-docker/src/test/java/com/github/vindell/deployment/web/HelloWorldControllerTest.java

@@ -0,0 +1,22 @@
+package com.github.vindell.deployment.web;
+
+import org.junit.Test;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+public class HelloWorldControllerTest {
+    private final MockMvc mvc = MockMvcBuilders.standaloneSetup(new HelloWorldController()).build();
+
+    @Test
+    public void rootGetPreservesResponse() throws Exception {
+        mvc.perform(get("/")).andExpect(status().isOk()).andExpect(content().string("Hello App ."));
+    }
+
+    @Test
+    public void rootPostIsRejected() throws Exception {
+        mvc.perform(post("/")).andExpect(status().isMethodNotAllowed());
+    }
+}