From da9fbe40426fc529412154b71895c8a030fee89e Mon Sep 17 00:00:00 2001 From: Carsten Hammer Date: Tue, 14 Oct 2025 22:06:33 +0200 Subject: [PATCH 01/25] Tempmaster2 (#31) * Bump codacy/codacy-analysis-cli-action from 1.1.0 to 4.4.0 (#19) * Formaster3 (#20) * Update maven.yml (#9) * Formaster4 (#8) * Create dependabot.yml * Update dependabot.yml * Update dependabot.yml * Update dependabot.yml * Create codacy.yml * Update pom.xml * Bump tycho.version from 2.3.0 to 2.7.3 Bumps `tycho.version` from 2.3.0 to 2.7.3. Updates `tycho-surefire-plugin` from 2.3.0 to 2.7.3 Updates `tycho-source-plugin` from 2.3.0 to 2.7.3 - [Release notes](https://github.com/eclipse/tycho/releases) - [Changelog](https://github.com/eclipse/tycho/blob/master/RELEASE_NOTES.md) - [Commits](https://github.com/eclipse/tycho/compare/tycho-2.3.0...tycho-2.7.3) Updates `tycho-p2-plugin` from 2.3.0 to 2.7.3 --- updated-dependencies: - dependency-name: org.eclipse.tycho:tycho-surefire-plugin dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.eclipse.tycho:tycho-source-plugin dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: org.eclipse.tycho:tycho-p2-plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] * Create codeql.yml * Create maven.yml * Update README.md * Update README.md * Update README.md * Bump tycho.version from 2.7.3 to 2.7.4 Bumps `tycho.version` from 2.7.3 to 2.7.4. Updates `tycho-surefire-plugin` from 2.7.3 to 2.7.4 Updates `tycho-source-plugin` from 2.7.3 to 2.7.4 - [Release notes](https://github.com/eclipse/tycho/releases) - [Changelog](https://github.com/eclipse/tycho/blob/tycho-2.7.4/RELEASE_NOTES.md) - [Commits](https://github.com/eclipse/tycho/compare/tycho-2.7.3...tycho-2.7.4) Updates `tycho-p2-plugin` from 2.7.3 to 2.7.4 --- updated-dependencies: - dependency-name: org.eclipse.tycho:tycho-surefire-plugin dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.eclipse.tycho:tycho-source-plugin dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.eclipse.tycho:tycho-p2-plugin dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] * Bump tycho.version from 2.7.4 to 2.7.5 Bumps `tycho.version` from 2.7.4 to 2.7.5. Updates `tycho-surefire-plugin` from 2.7.4 to 2.7.5 Updates `tycho-source-plugin` from 2.7.4 to 2.7.5 - [Release notes](https://github.com/eclipse/tycho/releases) - [Changelog](https://github.com/eclipse-tycho/tycho/blob/tycho-2.7.5/RELEASE_NOTES.md) - [Commits](https://github.com/eclipse/tycho/compare/tycho-2.7.4...tycho-2.7.5) Updates `tycho-p2-plugin` from 2.7.4 to 2.7.5 --- updated-dependencies: - dependency-name: org.eclipse.tycho:tycho-surefire-plugin dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.eclipse.tycho:tycho-source-plugin dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.eclipse.tycho:tycho-p2-plugin dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] * Update README.md * Update maven.yml * Update codeql.yml * Update README.md * Update README.md * Update README.md * Update README.md * Update dependabot.yml Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update maven.yml * Update maven.yml (#10) * Update maven.yml for java 20 (#11) * Update codeql.yml (#12) * Update maven.yml * Update codeql.yml * Update codeql.yml * Bump actions/setup-java from 2 to 4 (#17) Bumps [actions/setup-java](https://github.com/actions/setup-java) from 2 to 4. - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](https://github.com/actions/setup-java/compare/v2...v4) --- updated-dependencies: - dependency-name: actions/setup-java dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github/codeql-action from 2 to 3 (#16) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2 to 3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v2...v3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump codacy/codacy-analysis-cli-action from 1.1.0 to 4.3.0 (#15) Bumps [codacy/codacy-analysis-cli-action](https://github.com/codacy/codacy-analysis-cli-action) from 1.1.0 to 4.3.0. - [Release notes](https://github.com/codacy/codacy-analysis-cli-action/releases) - [Commits](https://github.com/codacy/codacy-analysis-cli-action/compare/d840f886c4bd4edc059706d09c6a1586111c540b...5cc54a75f9ad88159bb54046196d920e40e367a5) --- updated-dependencies: - dependency-name: codacy/codacy-analysis-cli-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump cirrus-actions/rebase from 1.7 to 1.8 (#14) Bumps [cirrus-actions/rebase](https://github.com/cirrus-actions/rebase) from 1.7 to 1.8. - [Release notes](https://github.com/cirrus-actions/rebase/releases) - [Commits](https://github.com/cirrus-actions/rebase/compare/1.7...1.8) --- updated-dependencies: - dependency-name: cirrus-actions/rebase dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update codeql.yml * Update codacy.yml * Bump actions/checkout from 3 to 4 (#13) * Update codacy.yml --------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump stCarolas/setup-maven from 4.5 to 5 (#22) --------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/dependabot.yml | 15 +++++++ .github/workflows/codacy.yml | 67 +++++++++++++++++++++++++++++ .github/workflows/codeql.yml | 81 ++++++++++++++++++++++++++++++++++-- .github/workflows/maven.yml | 31 ++++++++++++++ .github/workflows/rebase.yml | 4 +- README.md | 11 +++++ pom.xml | 1 - 7 files changed, 203 insertions(+), 7 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codacy.yml create mode 100644 .github/workflows/maven.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000000..3dc9076105c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,15 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "maven" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "daily" + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: daily diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml new file mode 100644 index 00000000000..649e970f935 --- /dev/null +++ b/.github/workflows/codacy.yml @@ -0,0 +1,67 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow checks out code, performs a Codacy security scan +# and integrates the results with the +# GitHub Advanced Security code scanning feature. For more information on +# the Codacy security scan action usage and parameters, see +# https://github.com/codacy/codacy-analysis-cli-action. +# For more information on Codacy Analysis CLI in general, see +# https://github.com/codacy/codacy-analysis-cli. + +name: Codacy Security Scan + +on: + push: + branches: [ master ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ master ] + schedule: + - cron: '24 8 * * 2' + +permissions: + contents: read + +jobs: + codacy-security-scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Codacy Security Scan + runs-on: ubuntu-latest + steps: + # Checkout the repository to the GitHub Actions runner + - name: Checkout code + uses: actions/checkout@v4 + + # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis + - name: Run Codacy Analysis CLI + uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b +# uses: codacy/codacy-analysis-cli-action@33d455949345bddfdb845fba76b57b70cc83754b + env: + CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"interpret-results":["--max-paths", 1]}}' + + with: + # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository + # You can also omit the token and run the tools that support default configurations + project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} + verbose: true + output: results.sarif + format: sarif + # Adjust severity of non-security issues + gh-code-scanning-compat: true + # Force 0 exit code to allow SARIF file generation + # This will handover control about PR rejection to the GitHub side + max-allowed-issues: 2147483647 + + + + + # Upload the SARIF file generated in the previous step + - name: Upload SARIF results file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 46f3230490a..9ef299ef30d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,13 +1,86 @@ -name: CodeQL call + +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" on: push: - branches: [ "master" ] + branches: [ master ] pull_request: - branches: [ "master" ] + # The branches below must be a subset of the branches above + branches: [ master ] schedule: - - cron: '15 8 * * 1' + - cron: '20 9 * * 2' jobs: callCodeQLworkflow: uses: eclipse-platform/eclipse.platform.releng.aggregator/.github/workflows/codeQLworkflow.yml@master + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'java' ] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + - name: Set up Maven + uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 + with: + maven-version: 3.9.5 + - name: Setup Java JDK + uses: actions/setup-java@v4 + with: + distribution: 'adopt' # See 'Supported distributions' for available options + java-version: '20' + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + # ℹ️ Command-line programs to run using the OS shell. + # πŸ“š See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + env: + CODEQL_ACTION_EXTRA_OPTIONS: '{"database":{"interpret-results":["--max-paths", 1]}}' diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml new file mode 100644 index 00000000000..2d39d8fc1fe --- /dev/null +++ b/.github/workflows/maven.yml @@ -0,0 +1,31 @@ +# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time +# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven + +name: Java CI with Maven + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +jobs: + build: + + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + - name: Set up JDK 20 + uses: actions/setup-java@v4 + with: + java-version: '20' + distribution: 'adopt' + cache: maven + - name: Set up Maven + uses: stCarolas/setup-maven@d6af6abeda15e98926a57b5aa970a96bb37f97d1 # v5 + with: + maven-version: 3.9.5 + - name: Build with Maven +# run: mvn -B package -Dmaven.resolver.transport=wagon -Pbuild-individual-bundles --file pom.xml + run: mvn -B package -Pbuild-individual-bundles --file pom.xml diff --git a/.github/workflows/rebase.yml b/.github/workflows/rebase.yml index f817d6f6009..01e06cb1806 100644 --- a/.github/workflows/rebase.yml +++ b/.github/workflows/rebase.yml @@ -9,11 +9,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout the latest code - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: token: ${{ secrets.GITHUB_TOKEN }} fetch-depth: 0 # otherwise, you will fail to push refs to dest repo - name: Automatic Rebase - uses: cirrus-actions/rebase@1.7 + uses: cirrus-actions/rebase@1.8 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/README.md b/README.md index 3d78a6c4753..b14394c3a42 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,19 @@ # JDT UI +[![Java CI with Maven](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/maven.yml/badge.svg)](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/maven.yml) + +[![Check Code Freeze Period](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/verifyFreezePeriod.yml/badge.svg)](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/verifyFreezePeriod.yml) + +[![CodeQL](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/codeql.yml/badge.svg)](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/codeql.yml) + +[![Codacy Security Scan](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/codacy.yml/badge.svg)](https://github.com/carstenartur/eclipse.jdt.ui/actions/workflows/codacy.yml) + +Thanks for your interest in this project. + This is the UI part of Eclipse's Java development tools, the user interface for the Java IDE. This includes views like Package Explorer and JUnit, the Java and properties files editors, Java search, and refactorings. + For more information and important links, refer to the [JDT wiki page](https://github.com/eclipse-jdt/eclipse.jdt.core/wiki) or the [JDT project overview page](https://projects.eclipse.org/projects/eclipse.jdt). diff --git a/pom.xml b/pom.xml index 12ca70c989a..2224ccc91a3 100644 --- a/pom.xml +++ b/pom.xml @@ -25,7 +25,6 @@ scm:git:https://github.com/eclipse-jdt/eclipse.jdt.ui.git -