[RORDEV-1474] Bump dependency-check plugin version #1128
Conversation
📝 WalkthroughWalkthroughThis set of changes updates dependency management and security scanning configurations. The Azure Pipeline YAML introduces variables and Cache@2 tasks to cache the CVE database, restoring it before and saving it after the CVE check, and passes the NVD API key and data directory as environment variables to the scan. The OWASP Dependency Check Gradle plugin is upgraded to version 12.1.3 and configured to use these environment variables. Dependencies like Sequence Diagram(s)sequenceDiagram
participant AzurePipeline
participant GradleBuild
participant DependencyCheckPlugin
participant NVD_API
AzurePipeline->>AzurePipeline: Set variables (currentDate, dependencyCheckCacheKey, dependencyCheckDataDir)
AzurePipeline->>AzurePipeline: Restore CVE DB cache using Cache@2 with cacheKey
AzurePipeline->>GradleBuild: Run CVE check with DEPENDENCY_CHECK_DATA_DIR and NVD_API_KEY env vars
GradleBuild->>DependencyCheckPlugin: Configure with dataDir and apiKey
DependencyCheckPlugin->>NVD_API: Fetch CVE data using API key
DependencyCheckPlugin-->>GradleBuild: Report scan results
AzurePipeline->>AzurePipeline: Save updated CVE DB cache using Cache@2 if job succeeds
sequenceDiagram
participant Developer
participant BuildScript
participant DependencyCheckPlugin
Developer->>BuildScript: Update OWASP Dependency Check plugin version to 12.1.3
BuildScript->>DependencyCheckPlugin: Configure plugin with environment variables (dataDir, apiKey)
DependencyCheckPlugin-->>BuildScript: Use updated configuration for scanning
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (1)
✨ Finishing Touches🧪 Generate Unit Tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
build-base/src/main/groovy/readonlyrest.base-common-conventions.gradle (1)
58-59: Validate NVD API key presence
Plugin may skip NVD updates silently ifNVD_API_KEYis unset. Consider failing the build or emitting a warning when the key is missing.suppressions_cve.xml (2)
84-97: Consolidate suppressions for bcpkix-fips-1.0.7.jar
There are two separate<suppress>blocks for the same artifact with distinct CVEs. Consider merging them into a single entry listing both<cve>elements to reduce duplication.
98-111: Consolidate suppressions for bctls-fips-1.0.19.jar
Two blocks suppress CVE-2020-26939 and CVE-2023-33202 forbctls-fips-1.0.19.jar. Merging them into one<suppress>entry will keep the file DRY.azure-pipelines.yml (1)
76-79: Remove trailing whitespace
Lines contain trailing spaces that should be removed to satisfy YAML lint rules.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 79-79: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
azure-pipelines.yml(2 hunks)build-base/build.gradle(1 hunks)build-base/src/main/groovy/readonlyrest.base-common-conventions.gradle(1 hunks)core/build.gradle(1 hunks)gradle.properties(1 hunks)gradle/wrapper/gradle-wrapper.properties(1 hunks)suppressions_cve.xml(2 hunks)tests-utils/build.gradle(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
azure-pipelines.yml
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 79-79: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (11)
- GitHub Check: ror (Run all tests IT_es67x)
- GitHub Check: ror (Run all tests IT_es80x)
- GitHub Check: ror (Run all tests IT_es70x)
- GitHub Check: ror (Run all tests IT_es810x)
- GitHub Check: ror (Run all tests IT_es710x)
- GitHub Check: ror (Run all tests IT_es818x)
- GitHub Check: ror (CVE check Job)
- GitHub Check: ror (Run all tests IT_es717x)
- GitHub Check: ror (Run all tests UNIT)
- GitHub Check: ror (Run all tests IT_es90x)
- GitHub Check: ror (Run all tests LICENSE)
🔇 Additional comments (11)
core/build.gradle (1)
98-98: Confirm refined_3 version bump to 0.11.3
Theeu.timepit:refined_3dependency was updated from 0.11.2 to 0.11.3, matching the PR’s consistency goal.tests-utils/build.gradle (1)
69-69: Validate refined_3 version alignment
Theeu.timepit:refined_3library was bumped to 0.11.3 here as well, keeping it in sync with the core module.gradle/wrapper/gradle-wrapper.properties (1)
5-5: Upgrade Gradle wrapper distribution to 8.14.2
ThedistributionUrlwas updated to use Gradle 8.14.2. Verify that all plugins and toolchains remain compatible with this version.gradle.properties (1)
2-2: Review publishedPluginVersion consistency
pluginVersionwas bumped to 1.65.0-pre5, butpublishedPluginVersionremains at 1.64.2. Confirm whetherpublishedPluginVersionneeds to be updated to match.build-base/build.gradle (1)
29-29: Update OWASP Dependency Check plugin coordinates
The plugin dependency was changed toorg.owasp.dependencycheck:org.owasp.dependencycheck.gradle.plugin:12.1.3. Ensure this new artifact ID and version resolve correctly and preserve expected task behavior.build-base/src/main/groovy/readonlyrest.base-common-conventions.gradle (2)
51-52: Disable assembly analyzer as intended
Disables scanning ofexe/dllassemblies to reduce unnecessary analysis overhead.
53-57: Externalize data directory for caching
Correctly readsDEPENDENCY_CHECK_DATA_DIRenv var to allow pipeline cache reuse while falling back to defaults for local builds.suppressions_cve.xml (1)
12-16: Verify refined-3 suppression SHA1
Suppression updated torefined_3-0.11.3.jarpending bump to 0.11.3. Please verify that the SHA1 matches the actual artifact.azure-pipelines.yml (3)
7-8: Introduce CVE DB cache variables
DefinesdependencyCheckDataDiranddependencyCheckCacheKeyto configure cache directory and key for CVE DB caching.
59-67: Cache restore step for CVE database
Restores the CVE DB from previous runs using the defined key and path, with prefix fallback and cache hit logging.
87-92: Cache save step for CVE database
Saves the updated CVE DB back to the cache on successful execution, using the same monthly cache key.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
azure-pipelines.yml (1)
77-78: Ensure variable substitution in script
Using$dependencyCheckDataDirin Bash will not expand the Azure DevOps variable. Replace with$(dependencyCheckDataDir)or map it viaenv:to pass the variable into the script, and uncomment theexport DEPENDENCY_CHECK_DATA_DIRline.
🧹 Nitpick comments (3)
azure-pipelines.yml (3)
7-8: Include plugin version in cache key
Without the plugin version, cached CVE data may become invalid after upgrading the Dependency Check plugin. Consider appending the plugin version (e.g.,12.1.3) todependencyCheckCacheKey.
59-67: Decide on caching strategy for the CVE DB
The commented-outCache@2tasks for restoring and saving the CVE database suggest you intend to cache the CVE data. If caching is desired, uncomment these steps and verify thekey,restoreKeys, andpathsettings; otherwise, remove the commented blocks to clean up the pipeline.Also applies to: 86-93
76-76: Remove trailing spaces
YAMLlint has flagged trailing spaces on these lines. Removing them will clean up the YAML and satisfy the linter.Also applies to: 79-79
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 76-76: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
azure-pipelines.yml(2 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
azure-pipelines.yml
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 79-79: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (11)
- GitHub Check: ror (Run all tests IT_es67x)
- GitHub Check: ror (Run all tests IT_es80x)
- GitHub Check: ror (Run all tests IT_es70x)
- GitHub Check: ror (Run all tests IT_es810x)
- GitHub Check: ror (Run all tests IT_es710x)
- GitHub Check: ror (Run all tests IT_es818x)
- GitHub Check: ror (Run all tests IT_es717x)
- GitHub Check: ror (Run all tests UNIT)
- GitHub Check: ror (Run all tests LICENSE)
- GitHub Check: ror (CVE check Job)
- GitHub Check: ror (Run all tests IT_es90x)
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
azure-pipelines.yml (1)
59-73: Clean up or enable CVE DB caching stepsThe commented-out
Cache@2tasks and log steps introduce dead code. Once caching is confirmed working with the bumped plugin version, uncomment and test these blocks. If caching is not yet in scope, consider moving them to a shared template or removing them to reduce noise.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
azure-pipelines.yml(2 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
azure-pipelines.yml
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 79-79: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (11)
- GitHub Check: ror (Run all tests IT_es67x)
- GitHub Check: ror (Run all tests IT_es70x)
- GitHub Check: ror (Run all tests IT_es710x)
- GitHub Check: ror (Run all tests IT_es717x)
- GitHub Check: ror (Run all tests IT_es80x)
- GitHub Check: ror (Run all tests IT_es810x)
- GitHub Check: ror (Run all tests UNIT)
- GitHub Check: ror (Run all tests IT_es818x)
- GitHub Check: ror (CVE check Job)
- GitHub Check: ror (Run all tests LICENSE)
- GitHub Check: ror (Run all tests IT_es90x)
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (2)
azure-pipelines.yml (2)
7-8: 🛠️ Refactor suggestionReplace unsupported date macro for cache key
Azure Pipelines doesn’t support the$(Date:yyyyMM)macro. Define a variable that formats the pipeline start time, then use it:variables: + currentDate: $[format('{0:yyyyMM}', pipeline.startTime)] dependencyCheckDataDir: '$(Pipeline.Workspace)/dependency-check-data/v1' - dependencyCheckCacheKey: 'dependency-check-v1-$(Date:yyyyMM)' + dependencyCheckCacheKey: 'dependency-check-v1-$(currentDate)'
77-84:⚠️ Potential issueFix environment variable expansion and mapping
Bash won’t expand$dependencyCheckDataDirhere—use the Azure macro$(dependencyCheckDataDir)by mapping it underenv:instead of exporting it in-script. For example:- export DEPENDENCY_CHECK_DATA_DIR=$dependencyCheckDataDir + # removed in-script export, moved under env- env: - ROR_TASK: cve_check - NVD_API_KEY: $(nvd_api_key) + env: + ROR_TASK: cve_check + DEPENDENCY_CHECK_DATA_DIR: $(dependencyCheckDataDir) + NVD_API_KEY: $(nvd_api_key)This ensures variables are correctly substituted and available to the dependency check plugin.
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 78-78: trailing spaces
(trailing-spaces)
🧹 Nitpick comments (1)
azure-pipelines.yml (1)
76-78: Remove trailing whitespace
Lines 76 and 78 contain unnecessary spaces which trigger linter warnings. Please remove them.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 78-78: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
azure-pipelines.yml(2 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
azure-pipelines.yml
[error] 76-76: trailing spaces
(trailing-spaces)
[error] 78-78: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (11)
- GitHub Check: ror (Run all tests IT_es67x)
- GitHub Check: ror (Run all tests IT_es80x)
- GitHub Check: ror (Run all tests IT_es70x)
- GitHub Check: ror (Run all tests IT_es710x)
- GitHub Check: ror (Run all tests IT_es810x)
- GitHub Check: ror (Run all tests UNIT)
- GitHub Check: ror (Run all tests IT_es818x)
- GitHub Check: ror (Run all tests IT_es717x)
- GitHub Check: ror (Run all tests LICENSE)
- GitHub Check: ror (Run all tests IT_es90x)
- GitHub Check: ror (CVE check Job)
🔇 Additional comments (3)
azure-pipelines.yml (3)
59-66: Cache restore task configuration looks correct
TheCache@2step is properly set up to restore the CVE DB using the defined key and data directory.
67-73: Logging the cache hit is informational and implemented correctly.
85-91: Cache save task configuration is correct
TheCache@2save step uses the same key and path, conditioned on success, which aligns with best practices for immutable caches.
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
azure-pipelines.yml(2 hunks)
🔇 Additional comments (5)
azure-pipelines.yml (5)
7-9: Leverage date-based cache keys
The new variablescurrentDate,dependencyCheckCacheKey, anddependencyCheckDataDircorrectly parameterize cache paths usingpipeline.startTime. This aligns with best practices for predictable, per-month cache keys.
53-54: Verify variable group inclusion
You’ve added a variable groupTEST_GROUPat the CVE stage—please confirm it exists in Azure DevOps and that it provides all required secrets (e.g.,nvd_api_key_v2).
79-85: Confirm NVD API key variable
You switched to$(nvd_api_key_v2)forNVD_API_KEY. Ensure that this variable is defined (viaTEST_GROUPor pipeline) so the plugin can authenticate with the NVD API.
87-93: Save cache step setup is correct
The Cache@2 save task reuses the samekeyandpath, ensuring immutability and proper cache writes. This matches the restore configuration.
99-99: Intentional TEST stage disable?
The literalfalseat the top of the TEST stage condition will permanently skip that stage. If this is temporary, please add a comment explaining why; otherwise remove or adjust the condition.
| - script: | | ||
| if [ '$(CACHE_HIT)' = 'true' ]; then | ||
| echo "Restored cache." | ||
| else | ||
| echo "No cache found" | ||
| fi | ||
| displayName: 'Log cache hit' |
There was a problem hiding this comment.
Fix cache hit check quoting
Using single quotes around $(CACHE_HIT) prevents environment variable expansion. Update to double quotes:
if [ "$(CACHE_HIT)" = "true" ]; then
…
fi🤖 Prompt for AI Agents
In azure-pipelines.yml lines 71 to 77, the if condition uses single quotes
around $(CACHE_HIT), which prevents environment variable expansion. Change the
single quotes to double quotes around $(CACHE_HIT) and "true" in the if
statement to ensure the variable is properly expanded and compared.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
azure-pipelines.yml (2)
78-84: Correct cache hit check quoting
Single quotes prevent$(CACHE_HIT)from expanding, so the condition never matches. Switch to double quotes:- if [ '$(CACHE_HIT)' = 'true' ]; then + if [ "$(CACHE_HIT)" = "true" ]; then
69-77: Fix invalid restoreKeys placeholder
TherestoreKeysfield still has the literaldependency-check-v1- todo, which breaks cache fallback. Update it to a valid prefix or parameterize it. For example:- restoreKeys: | - dependency-check-v1- todo + restoreKeys: | + dependency-check-v1-
🧹 Nitpick comments (1)
azure-pipelines.yml (1)
2-18: Clean up YAML formatting
In thevariableslist, the entry on line 5 usesvalue :(extra space before colon). Remove the extra space so it readsvalue:. Also consider unifying variable naming (e.g. consistently use snake_case or camelCase) for readability.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
azure-pipelines.yml(2 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
azure-pipelines.yml
[warning] 5-5: too many spaces before colon
(colons)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: ror (CVE check Job)
🔇 Additional comments (1)
azure-pipelines.yml (1)
91-92: Verify NVD API key variable name
The step exportsNVD_API_KEY: $(nvd_api_key_v2). Ensure thatnvd_api_key_v2is defined in the linked variable group. If the intended variable isnvd_api_key, update this mapping accordingly.
|
|
||
| - stage: TEST | ||
| displayName: 'Run all tests' | ||
| dependsOn: [ ] | ||
| condition: | ||
| and( | ||
| false, |
There was a problem hiding this comment.
TEST stage has been disabled
The and() condition starts with false, disabling the entire TEST stage. Confirm this is intentional—otherwise remove the false literal to re-enable testing.
🤖 Prompt for AI Agents
In azure-pipelines.yml at line 106, the TEST stage is disabled because the
`and()` condition begins with a `false` literal, which causes the entire
condition to evaluate to false. To re-enable the TEST stage, remove the `false`
literal from the condition so that it can evaluate based on the intended
criteria.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (3)
azure-pipelines.yml (3)
70-74: Ensure proper quoting for cache hit check
Using single quotes around$(CACHE_HIT)andtrueprevents variable expansion. Update to double quotes:- if [ '$(CACHE_HIT)' = 'true' ]; then + if [ "$(CACHE_HIT)" = "true" ]; then
60-68: Invalid restoreKeys placeholder
TherestoreKeysentry still containsdependency-check-v1- todo, which will break cache fallback. Replace it with a valid prefix or parameterized key, for example:- restoreKeys: | - dependency-check-v1- todo + restoreKeys: | + dependency-check-v1-$(currentDate)
79-86: Fix environment variable handling in CVE check script
$dependencyCheckDataDirisn’t exported or expanded—use$(dependencyCheckDataDir)in the script or map it underenv.- The script sets
NVD_API_KEYfrom$var_nvd_api_key, but the env mappingvar_nvd_api_key: $(NVD_API_KEY)is confusing. MapNVD_API_KEYdirectly underenv, e.g.:- env: - ROR_TASK: cve_check - var_nvd_api_key: $(NVD_API_KEY) + env: + ROR_TASK: cve_check + DEPENDENCY_CHECK_DATA_DIR: $(dependencyCheckDataDir) + NVD_API_KEY: $(nvd_api_key)And remove the manual
exportlines in the script.
🧹 Nitpick comments (1)
azure-pipelines.yml (1)
78-78: Remove trailing whitespace
Blank lines 78 and 81 contain trailing spaces. Remove them to satisfy YAML lint and avoid subtle parsing issues.Also applies to: 81-81
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
azure-pipelines.yml(2 hunks)build-base/src/main/groovy/readonlyrest.base-common-conventions.gradle(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- build-base/src/main/groovy/readonlyrest.base-common-conventions.gradle
🧰 Additional context used
🪛 YAMLlint (1.37.1)
azure-pipelines.yml
[error] 78-78: trailing spaces
(trailing-spaces)
[error] 81-81: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: ror (CVE check Job)
🔇 Additional comments (3)
azure-pipelines.yml (3)
7-9: New caching variables look good
IntroducingcurrentDate,dependencyCheckCacheKey, anddependencyCheckDataDiraligns the pipeline with the updated dependency-check plugin configuration.
87-93: Save CVE DB cache configuration is correct
TheSave updated CVE DBCache@2 task correctly uses the same key and path. This ensures that the dependency-check data directory is cached for subsequent runs.
100-100: TEST stage is disabled by design or error?
Thefalseliteral in the TEST stage condition (line 100) disables the entire stage. If this is unintended, remove thefalse,entry so tests can run as expected.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
azure-pipelines.yml (1)
78-85: Fix variable mapping for cache directory and NVD API key
export DEPENDENCY_CHECK_DATA_DIR=$dependencyCheckDataDirwill not pick up the pipeline variable; use$(dependencyCheckDataDir)or map it underenv:.- Avoid the unnecessary
var_nvd_api_keyindirection; mapNVD_API_KEYdirectly.Apply this diff:
- export DEPENDENCY_CHECK_DATA_DIR=$dependencyCheckDataDir - export NVD_API_KEY=$var_nvd_api_key env: ROR_TASK: cve_check - var_nvd_api_key: $(NVD_API_KEY) + DEPENDENCY_CHECK_DATA_DIR: $(dependencyCheckDataDir) + NVD_API_KEY: $(NVD_API_KEY)
🧹 Nitpick comments (1)
azure-pipelines.yml (1)
77-80: Remove trailing whitespace
Lines 77 and 80 include trailing spaces that trigger YAML lint errors. Please trim them.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
azure-pipelines.yml(2 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
azure-pipelines.yml
[error] 77-77: trailing spaces
(trailing-spaces)
[error] 80-80: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: ror (CVE check Job)
🔇 Additional comments (4)
azure-pipelines.yml (4)
7-9: Cache key and directory variables added
Well-structured use ofcurrentDate,dependencyCheckCacheKey, anddependencyCheckDataDirto parameterize the cache.
60-67: Cache restore task looks solid
The Cache@2 step correctly restores the CVE DB using the defined key and fallback prefix.
68-74: Log cache hit outcome
The script conditionally logs the restore status based onCACHE_HIT, providing clear visibility.
99-99: Disabled TEST stage
Thefalseliteral at the start of theand()condition blocks the TEST stage entirely. Confirm this is intentional, or removefalseto re-enable tests.
Summary by CodeRabbit
New Features
Bug Fixes
refined_3and the OWASP Dependency Check Gradle plugin.Chores