From fe146a4490c0c0490efde7ab786e8b7da0e17c24 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Wed, 12 Nov 2025 18:13:28 +0100 Subject: [PATCH 1/4] [rewrite] add `JavaSecurityBestPractices` Signed-off-by: Vincent Potucek --- .github/workflows/ci.yml | 3 +++ boms/pom.xml | 24 ++++++++++++++++++++++++ pom.xml | 19 +++++++++++++++++++ rewrite.yml | 8 ++++++++ 4 files changed, 54 insertions(+) create mode 100644 rewrite.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ada5dd74f089..22a0ebc84c9d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -117,6 +117,9 @@ jobs: run: | ./mvnw test -am -pl "$(.github/scripts/find-modules-with-unit-tests.sh)" + - name: Sanity Check + run: ./mvnw rewrite:dryRun + base-integration-tests: name: Base IT needs: build diff --git a/boms/pom.xml b/boms/pom.xml index a9f5de04ddb8..9f615be03ced 100644 --- a/boms/pom.xml +++ b/boms/pom.xml @@ -82,6 +82,30 @@ com.diffplug.spotless spotless-maven-plugin ${spotless-plugin.version} + + + + + + + + org.openrewrite.maven + rewrite-maven-plugin + 6.23.0 + + + org.keycloak.openrewrite.SanityCheck + + true + true + + + + org.openrewrite.recipe + rewrite-rewrite + 0.15.0 + + diff --git a/pom.xml b/pom.xml index d3cabd03cb9f..efd145e344fc 100644 --- a/pom.xml +++ b/pom.xml @@ -1557,6 +1557,25 @@ + + org.openrewrite.maven + rewrite-maven-plugin + 6.23.0 + + + org.keycloak.openrewrite.SanityCheck + + true + true + + + + org.openrewrite.recipe + rewrite-rewrite + 0.15.0 + + + diff --git a/rewrite.yml b/rewrite.yml new file mode 100644 index 000000000000..2374e51540b2 --- /dev/null +++ b/rewrite.yml @@ -0,0 +1,8 @@ +--- +type: specs.openrewrite.org/v1beta/recipe +name: org.keycloak.openrewrite.SanityCheck +displayName: Apply Java & Maven best practices +description: Comprehensive code quality recipe combining modernization, security, and best practices. +recipeList: + - org.openrewrite.java.security.JavaSecurityBestPractices +--- From 80ebc4c051d93dcbc6deac6e4cdbbf62a86512fa Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 10:55:41 +0100 Subject: [PATCH 2/4] [trivy] fix `vulnType: os,library` Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index ce9d38e8dae6..f8a2d0e0cc12 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -33,6 +33,7 @@ jobs: format: sarif output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH + vulnType: os,library ignore-unfixed: true version: v0.57.1 timeout: 15m From 026e7b568ebc70760ee6bd3ca9818910c8310367 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 10:57:28 +0100 Subject: [PATCH 3/4] [trivy] fix `vulnType: os,library` Signed-off-by: Vincent Potucek --- .github/workflows/ci.yml | 3 --- boms/pom.xml | 24 ------------------------ pom.xml | 19 ------------------- rewrite.yml | 8 -------- 4 files changed, 54 deletions(-) delete mode 100644 rewrite.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 22a0ebc84c9d..ada5dd74f089 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -117,9 +117,6 @@ jobs: run: | ./mvnw test -am -pl "$(.github/scripts/find-modules-with-unit-tests.sh)" - - name: Sanity Check - run: ./mvnw rewrite:dryRun - base-integration-tests: name: Base IT needs: build diff --git a/boms/pom.xml b/boms/pom.xml index 9f615be03ced..a9f5de04ddb8 100644 --- a/boms/pom.xml +++ b/boms/pom.xml @@ -82,30 +82,6 @@ com.diffplug.spotless spotless-maven-plugin ${spotless-plugin.version} - - - - - - - - org.openrewrite.maven - rewrite-maven-plugin - 6.23.0 - - - org.keycloak.openrewrite.SanityCheck - - true - true - - - - org.openrewrite.recipe - rewrite-rewrite - 0.15.0 - - diff --git a/pom.xml b/pom.xml index efd145e344fc..d3cabd03cb9f 100644 --- a/pom.xml +++ b/pom.xml @@ -1557,25 +1557,6 @@ - - org.openrewrite.maven - rewrite-maven-plugin - 6.23.0 - - - org.keycloak.openrewrite.SanityCheck - - true - true - - - - org.openrewrite.recipe - rewrite-rewrite - 0.15.0 - - - diff --git a/rewrite.yml b/rewrite.yml deleted file mode 100644 index 2374e51540b2..000000000000 --- a/rewrite.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -type: specs.openrewrite.org/v1beta/recipe -name: org.keycloak.openrewrite.SanityCheck -displayName: Apply Java & Maven best practices -description: Comprehensive code quality recipe combining modernization, security, and best practices. -recipeList: - - org.openrewrite.java.security.JavaSecurityBestPractices ---- From 59afcbe853181725fe6119f5f27747badd5bfbc3 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 10:58:03 +0100 Subject: [PATCH 4/4] [trivy] fix `vulnType: os,library` Signed-off-by: Vincent Potucek --- .trivyignore | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000000..bc372c40a69c --- /dev/null +++ b/.trivyignore @@ -0,0 +1,7 @@ +CVE-2015-7501 +CVE-2019-17571 +CVE-2022-23305 +CVE-2022-23307 +CVE-2022-4492 +CVE-2022-45047 +CVE-2024-52046 \ No newline at end of file