Skip to content

Adding new stuff for the bootcamp.#41

Open
WritingPanda wants to merge 3 commits into
mainfrom
new-bootcamp
Open

Adding new stuff for the bootcamp.#41
WritingPanda wants to merge 3 commits into
mainfrom
new-bootcamp

Conversation

@WritingPanda
Copy link
Copy Markdown

Recreating bootcamp resources for an agentic future including Code Quality.

@github-actions
Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:
  • ❌ 2 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 7 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a28be91.
Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

Vulnerabilities

pom.xml

NameVersionVulnerabilitySeverity
org.apache.commons:commons-text1.9Arbitrary code execution in Apache Commons Textcritical
commons-io:commons-io2.6Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderhigh
Path Traversal and Improper Input Validation in Apache Commons IOmoderate
Only included vulnerabilities with severity moderate or higher.

License Issues

.github/workflows/coverage.yml

PackageVersionLicenseIssue Type
actions/checkout4.*.*NullUnknown License
actions/download-artifact4.*.*NullUnknown License
actions/setup-java4.*.*NullUnknown License
actions/upload-artifact4.*.*NullUnknown License
code-quality-org/upload-code-coverage-actionmainNullUnknown License

pom.xml

PackageVersionLicenseIssue Type
com.h2database:h2NullUnknown License
org.springframework.boot:spring-boot-starter-jdbcNullUnknown License
Denied Licenses: GPL-1.0-or-later, LGPL-2.0-or-later

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
actions/actions/checkout 4.*.* 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 01 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/download-artifact 4.*.* 🟢 6.1
Details
CheckScoreReason
Maintained🟢 1013 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
actions/actions/setup-java 4.*.* 🟢 5.4
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 45 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
actions/actions/upload-artifact 4.*.* 🟢 5.6
Details
CheckScoreReason
Maintained🟢 66 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 6
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 8Found 8/9 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
actions/code-quality-org/upload-code-coverage-action main UnknownUnknown
actions/danielpalme/ReportGenerator-GitHub-Action 5.3.11 🟢 3.5
Details
CheckScoreReason
Dangerous-Workflow⚠️ -1no workflows found
Token-Permissions⚠️ -1No tokens found
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1016 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 2/28 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.apache.commons:commons-text 1.9 UnknownUnknown
maven/commons-io:commons-io 2.6 UnknownUnknown
maven/com.h2database:h2 UnknownUnknown
maven/org.jacoco:jacoco-maven-plugin 0.8.12 🟢 5.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.springframework.boot:spring-boot-starter-jdbc UnknownUnknown

Scanned Files

  • .github/workflows/coverage.yml
  • pom.xml


public String alwaysNullLabel() {
String label = null;
return label.trim();
}

public void synchronizedReport() {
synchronized (SHARED_LOCK) {

public int impossibleIndex() {
int[] counts = new int[2];
return counts[4];
private static final String SHARED_LOCK = "training-report-lock";

public QualityExamples(String owner) {
owner = owner;
}

public int selfAssignment(int publishedCount) {
publishedCount = publishedCount;
return false;
}
Integer expected = 200;
return expected == Integer.valueOf(200);
}

public boolean tenantMatches(String tenant) {
if (tenant == tenant) {
if (courses.size() == 0) {
return false;
}
Integer expected = 200;

public int countPublishedWithResourceLeak() throws SQLException {
Connection connection = dataSource.getConnection();
Statement statement = connection.createStatement();

public String normalizeTitle(String title) {
String copy = new String(title);
return copy.toString();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants