test(supply-chain): require Maven distribution checksum

[seonghobae]

Fixes #265.

Strict fail-first candidate from exact protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4.

Exact RED source

Exact source head 7912822a4cdc23e792c615517ffded1b33064911 adds only MavenWrapperIntegrityTest. The deterministic repository contract requires the existing Maven Wrapper 3.3.4 only-script configuration to keep the exact Maven 3.9.11 Central distribution URL paired with reviewed SHA-256 0d7125e8c91097b36edb990ea5934e6c68b4440eef4ea96510a0f6815e7eeadb.

Protected production currently has no distributionSha256Sum.

Observed fail-first proof

PR-event CI run 31459144999 failed on Ubuntu, macOS, and Windows. macOS job 93678992481 compiled production/tests successfully and ran 277 ETL tests with exactly one failure, zero errors/skips:

MavenWrapperIntegrityTest.bindsMavenDistributionUrlToReviewedSha256 -> Maven Wrapper must verify the downloaded Maven distribution with SHA-256 ==> expected: not <null>.

This reaches the intended repository bootstrap-integrity boundary and is not a path-discovery, parser, compiler, dependency, network, or fixture failure. Dependency Review 31459145022, SAST Semgrep 31459144993, CycloneDX SBOM 31459144976, and Security Scan 31459144985 completed successfully for the same PR event.

However CI checked GitHub synthetic merge eef188b9c8f785d8b892fe60bbc21b6ae2be395d (Merge 7912822... into 942d164...), not literal source 7912822.... Under repository evidence policy this is valid merged-tree compatibility/fail-first diagnostic evidence but not accepted literal-source RED authority.

Next root-cause-changing action

Keep Draft and keep production unchanged until literal-head execution authority is available. Rerunning this PR-event CI cannot fix source identity because the workflow checks pull_request merge refs; the available connector cannot dispatch workflow_dispatch, and an attempted trusted local clone in the automation runtime had no GitHub DNS/network path. Therefore the production GREEN is currently read_only_dependency / defer_until_trigger, not permission to weaken the TDD gate.

Once accepted literal-source RED is available on unchanged exact source head, the narrow GREEN is one property addition to .mvn/wrapper/maven-wrapper.properties binding the existing URL to the reviewed checksum. Do not change Maven/Wrapper versions, distribution type, shared workflow gates, or unrelated build inputs.

Primary Maven Wrapper guidance: https://maven.apache.org/tools/wrapper/#checksum-verification-of-downloaded-binaries

No evidence from predecessor heads transfers after any source or base movement.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4b5e4ae8-bb35-4369-8e70-ef012825326d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #281 on current protected develop@106add38465937f6eb4e4accc185fd30aab4446f. Before closing this stale-base candidate, the current diffs were compared directly: #266 and #281 contain the same two-file unique change (.mvn/wrapper/maven-wrapper.properties plus MavenWrapperIntegrityTest.java) with byte-equivalent patch content. #281 rebuilt the work without rewriting history, reproduced the intended fail-first boundary against the current base (CI #31495724742; synthetic merge 51fadce59c5ca304ed7c85f57586f681c30293d7, exactly one ETL failure from the missing checksum), and now carries the narrow GREEN on its own auditable branch. No review/check evidence from this stale base transfers to #281.