👷 ci: add [email protected] to code quality workflow

.github/workflows/code-qualitiy.yml

@@ -99,3 +99,36 @@ jobs:
 
       - name: Run reproducibility check
         run: mvn clean install
+  dirty-waters:
+    runs-on:
+        ubuntu-latest
+    permissions:
+      pull-requests: write # To comment on a Pull Request
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          submodules: true
+
+      - name: Verify action checksums
+        uses: ./.github/actions/ghasum
+
+      - name: Setup JDK17
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+
+      - name: Dirty Waters Analysis
+        uses: chains-project/dirty-waters-action@30bc4ef96e9c59f85efb05affc2992353d65870b # v1.11.52
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          package_manager: maven
+          gradual_report: false
+          debug: true
+          config: dirty-waters.json
+

.github/workflows/gha.sum

@@ -1,16 +1,22 @@
 version 1
 
 actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 xizZh3f6SQipDN8OULmHn5pM+d2g1xWEP+rD7K+KVVA=
+actions/[email protected] A/Paejdu47oer1Zf9zbtOgbMTG3OmOiXsgB6oodFIOU=
 actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 aYx2ZNrV/U9daVa5XJLnuR3depD7lQqzkyRhH4E9bOU=
+actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 g2V9DAwkHBbZHaTOx4M2g/r9wI49KupzyARL47t/rEQ=
 actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a 2QKI0zLFRGnJvQ+VnEy9S/uUZpHbCV6s0LS72Xc0TpI=
 actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 0qLZUqMcil7hZ8idJYYxI/LgdETqnWR0T02izCncHy4=
 actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 XE1eqHfEOlHsHx+3cUQA1OGC3jxGBnmx7eTIdEzwSoI=
+actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 cKZQn6p38RgADB4MCMpbFp94sScgm/u3B7rEDB9QS5I=
 actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 Cn0rDfuNlsG0naRPXRAUwU3fAQ9P+sxzfPvU5EcNOQ8=
+actions/[email protected] MTHBGEHwb+MeIw3xRLiVuM/uyRfuK8hlVXL+Z/yEA8c=
 actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 ZTERhL1FNPaoitPyTgsnA9lbOffV5BJ3FsNYFciQmGU=
+chains-project/dirty-waters-action@30bc4ef96e9c59f85efb05affc2992353d65870b JTXn8ep3K5YnkSpNVyVVe85RAxg2eQ2X+TKP5A6JgyA=
 chains-project/maven-lockfile@723132de2c6095048129f6eaf5e6b30f13c5b2ca IuzZe5N+X3qZs6O5saBYlSViPrWdcwjcfmVMdpncgUw=
 github/codeql-action@0499de31b99561a6d14a36a5f662c2a54f91beee uBZRqSyNk1SohDHUS5Iqm86o5tkInfY5gtmI6LMiNMU=
 google/osv-scanner-action@9bb69575e74019c2ad085a1860787043adf47ccb 02gWjvvjKDLqqYT/YzdTI3aKQ3oO8uKPE39z353BQbA=
 jreleaser/release-action@ad73772277e63d9f2bbf4f24a7bb1300388334d7 uCAaYYuyjM4iq8qflqOt5SzivqVnl3ZXt7vI9BWpHAo=
 ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a oHo5wLG0ePY4IIiiNfo0MU1uYrDKDkeV7MpBTJ39dQg=
 stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 g4PCgPHeeaVpSPTRcoBKth4QnrZGGQXwBEoEAsAXivs=
+step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 rG/FhhPP4VlsNB/2lKudn7rieQAYYNLIRb34q19qmFU=
 step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a fJwkMDFdylV4NgARDISD6NU03D0clX66qStzE3+HeJQ=

dirty-waters.json

@@ -0,0 +1,123 @@
+{
+    "ignore": {
+        "aopalliance:[email protected]": ["code_signature"],
+        "com.diffplug.durian:[email protected]": ["source_code_sha"],
+        "com.diffplug.durian:[email protected]": ["source_code_sha"],
+        "com.diffplug.durian:[email protected]": ["source_code_sha"],
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "com.google.code.gson:[email protected]": ["source_code_sha"],
+        "com.google.code.gson:[email protected]": ["source_code_sha"],
+        "com.google.collections:[email protected]": ["code_signature"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.guava:[email protected]": ["source_code_sha"],
+        "com.google.protobuf:[email protected]": ["source_code_sha"],
+        "com.google.protobuf:[email protected]": ["source_code_sha"],
+        "com.kohlschutter.junixsocket:[email protected]": ["code_signature"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "com.soebes.itf.jupiter.extension:[email protected]": ["source_code_sha"],
+        "commons-beanutils:[email protected]": ["source_code", "code_signature"],
+        "commons-chain:[email protected]": ["code_signature"],
+        "commons-cli:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-codec:[email protected]": ["source_code_sha"],
+        "commons-digester:[email protected]": ["code_signature"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "commons-io:[email protected]": ["source_code_sha"],
+        "dev.equo.ide:[email protected]": ["source_code_sha"],
+        "dom4j:[email protected]": ["source_code", "code_signature"],
+        "io.github.crac:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "io.vertx:[email protected]": ["source_code_sha"],
+        "jakarta.el:[email protected]": ["source_code_sha"],
+        "jakarta.interceptor:[email protected]": ["source_code_sha"],
+        "jakarta.json:[email protected]": ["source_code_sha"],
+        "javax.inject:javax.inject@1": ["code_signature"],
+        "om.kohlschutter.junixsocket:[email protected]": ["code_signature"],
+        "org.aesh:[email protected]": ["code_signature", "source_code_sha"],
+        "org.aesh:[email protected]": ["code_signature"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.commons:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.httpcomponents:[email protected]": ["source_code_sha"],
+        "org.apache.logging.log4j:[email protected]": ["source_code_sha"],
+        "org.apache.logging.log4j:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.apache.maven.doxia:[email protected]": ["source_code_sha"],
+        "org.assertj:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.bouncycastle:[email protected]": ["source_code_sha"],
+        "org.codehaus.plexus:[email protected]": ["code_signature"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.jetty:[email protected]": ["source_code_sha"],
+        "org.eclipse.platform:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.eclipse.sisu:[email protected]": ["source_code_sha"],
+        "org.instancio:[email protected]": ["source_code_sha"],
+        "org.instancio:[email protected]": ["source_code_sha"],
+        "org.iq80.snappy:[email protected]": ["source_code"],
+        "org.jboss.logging:[email protected]": ["code_signature"],
+        "org.jboss.logging:[email protected]": ["code_signature"],
+        "org.jboss.logging:[email protected]": ["code_signature"],
+        "org.jboss.logmanager:[email protected]": ["code_signature"],
+        "org.jboss.marshalling:[email protected]": ["source_code_sha"],
+        "org.jboss.slf4j:[email protected]": ["code_signature", "source_code_sha"],
+        "org.jboss.threads:[email protected]": ["code_signature"],
+        "org.jdom:[email protected]": ["source_code_sha"],
+        "org.jetbrains:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.junit.platform:[email protected]": ["source_code_sha"],
+        "org.sonatype.plexus:[email protected]": ["source_code"],
+        "org.sonatype.plexus:[email protected]": ["source_code"],
+        "org.twdata.maven:[email protected]": ["source_code_sha"],
+        "org.wildfly.common:[email protected]": ["code_signature"],
+        "oro:[email protected]": ["source_code", "code_signature"]
+    },
+    "ignore-if-parent": {
+        "com.diffplug.spotless:[email protected]": ["source_code_sha"],
+        "org.apache.maven.plugins:[email protected]": ["source_code_sha"],
+        "org.apache.maven.plugins:[email protected]": ["source_code_sha"]
+    }
+}