You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@streampipes.apache.org by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org> on 2023/03/22 06:56:49 UTC
[PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Kshitiz-Mhto opened a new pull request, #1438:
URL: https://github.com/apache/streampipes/pull/1438
<!--
~ Licensed to the Apache Software Foundation (ASF) under one or more
~ contributor license agreements. See the NOTICE file distributed with
~ this work for additional information regarding copyright ownership.
~ The ASF licenses this file to You under the Apache License, Version 2.0
~ (the "License"); you may not use this file except in compliance with
~ the License. You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing, software
~ distributed under the License is distributed on an "AS IS" BASIS,
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
~ See the License for the specific language governing permissions and
~ limitations under the License.
~
-->
<!--
Thanks for contributing! Here are some tips you can follow to help us incorporate your contribution quickly and easily:
1. If this is your first time, please read our contributor guidelines:
- https://streampipes.apache.org/getinvolved.html
- https://cwiki.apache.org/confluence/display/STREAMPIPES/Getting+Started
2. Make sure the PR title is formatted like: `[#<GitHub issue id>] PR title ...`
3. If the PR is unfinished, add '[WIP]' in your PR title, e.g., `[WIP][#<GitHub issue id>] PR title ...`.
4. Please write your PR title to summarize what this PR proposes/fixes.
5. Link the PR to the corresponding GitHub issue (if present) in the `Development` section in the right menu bar.
6. Be sure to keep the PR description updated to reflect all changes.
7. If possible, provide a concise example to reproduce the issue for a faster review.
8. Make sure tests pass via `mvn clean install`.
9. (Optional) If the contribution is large, please file an Apache ICLA
- http://apache.org/licenses/icla.pdf
-->
### Purpose
<!--
Please clarify what changes you are proposing and describe how those changes will address the issue.
Furthermore, describe potential consequences the changes might have.
-->
### Remarks
<!--
Is there anything left we need to pay attention on?
Are there some references that might be important? E.g. links to Confluence, or discussions
on the mailing list or GitHub.
-->
PR introduces (a) breaking change(s): No
PR introduces (a) deprecation(s): No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1155506616
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
Review Comment:
> why should I need to install osv-scanner when using ghcr.io/google/osv-scanner:latest?
Actually i was talking about being inside of an container and doing all steps inside it.
My bad, i get it wrong
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
Review Comment:
> why should I need to install osv-scanner when using ghcr.io/google/osv-scanner:latest?
Actually i was talking about being inside of an container and doing all steps inside it.
My bad, i get it wrong
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1158775198
##########
.github/workflows/osv-scanner.yml:
##########
@@ -21,15 +21,23 @@ on:
jobs:
run-osv-scanner:
+
name: Run OSV Scanner
runs-on: ubuntu-latest
+
steps:
+
- name: Checkout
uses: actions/checkout@v3
+
+ - name: Pull OSV Scanner Docker image
+ run: docker pull ghcr.io/google/osv-scanner:latest
Review Comment:
i did try it in my repo, with this approach bt i am having trouble generating the `VULNERABILITY.md` file that will contain the results. I implemented as:
```
- name: Scan for vulnerabilities
id: osv_scan
uses: docker://ghcr.io/google/osv-scanner:latest
with:
args: --format markdown -r .
continue-on-error: true
```
- i cannot place ` grep -vE '^Scanned.*packages$' > VULNERABILITY.md` in args
- i tried with ${{ steps.osv_scan.outputs.stdout }}, ${{ steps.osv_scan.outputs.result }} in another step but didnot work
```
- name: Save scan output to file
run: echo "${{ steps.osv_scan.outputs.stderr }}" | grep -vE '^((Scanning|Scanned).*)$' > VULNERABILITY.md
```
- we use 3rd party action related to artifacts.
- if we use `outputs:` to define the output of the osv-scanner job then we will need to create another job to use that output
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1145416931
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
+ continue-on-error: true
+ - name: Create Pull Request
+ id: cpr
+ uses: peter-evans/create-pull-request@v4
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ committer: ${{ github.actor }} <no...@gmail.com>
+ author: ${{ github.actor }} <${{ github.actor }}@github.com>
+ signoff: true
+ title: Add vulnerability report
+ commit-message: Added vulnerability report
+ body: |
+ Update *Vulnerablity* report
+ delete-branch: true
+ labels: |
+ documentation
+ gh-action
+ reviewers: bossenti
Review Comment:
Reviewers should be: "apache/streampipes-committers"
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160650431
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
when i run osv-scanner for scanning our repo initially in my local machine, these are the errors it was throwing:
```
Failed to resolve version of io.nats:jnats: property "nats.version" could not be foundScanned /home/ibergx00/Documents/oss/streampipes/streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml file and found 18 packages
Failed to resolve version of com.google.inject:guice: property "guice.version" could not be foundScanned /home/ibergx00/Documents/oss/streampipes/streampipes-maven-plugin/pom.xml file and found 18 packages
Failed to resolve version of org.apache.flink:flink-connector-kafka_2.11: property "flink.version" could not be found
Failed to resolve version of org.apache.flink:flink-java: property "flink.version" could not be found
Failed to resolve version of org.apache.flink:flink-streaming-java_2.11: property "flink.version" could not be found
Failed to resolve version of org.apache.flink:flink-clients_2.11: property "flink.version" could not be found Scanned /home/ibergx00/Documents/oss/streampipes/streampipes-wrapper-flink/pom.xml file and found 9 packages
```
after i made those changes in `pom.xml`, error get resolved
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1145873793
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
Review Comment:
we gonna need checkout step for the PR automation if not it will throw error on command `/usr/bin/git config --local --get remote.origin.url`.
Further, if we use container of osv-scanner image, inside this container we need to manually install osv-scanner.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1147790281
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
+ continue-on-error: true
+ - name: Create Pull Request
+ id: cpr
+ uses: peter-evans/create-pull-request@v4
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ committer: ${{ github.actor }} <no...@gmail.com>
+ author: ${{ github.actor }} <${{ github.actor }}@github.com>
+ signoff: true
+ title: Add vulnerability report
+ commit-message: Added vulnerability report
+ body: |
+ Update *Vulnerablity* report
+ delete-branch: true
+ labels: |
+ documentation
+ gh-action
+ reviewers: bossenti
Review Comment:
Exactly, this is a group handle
If there is an extra parameter for that then we should use it 🙂
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1145829363
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
+ continue-on-error: true
+ - name: Create Pull Request
+ id: cpr
+ uses: peter-evans/create-pull-request@v4
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ committer: ${{ github.actor }} <no...@gmail.com>
+ author: ${{ github.actor }} <${{ github.actor }}@github.com>
+ signoff: true
+ title: Add vulnerability report
+ commit-message: Added vulnerability report
+ body: |
+ Update *Vulnerablity* report
+ delete-branch: true
+ labels: |
+ documentation
+ gh-action
+ reviewers: bossenti
Review Comment:
`apache/streampipes-committers` is group of team member, am right? if so, then we should use `team-reviewers` rather than `reviewers`.
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
+ continue-on-error: true
+ - name: Create Pull Request
+ id: cpr
+ uses: peter-evans/create-pull-request@v4
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ committer: ${{ github.actor }} <no...@gmail.com>
+ author: ${{ github.actor }} <${{ github.actor }}@github.com>
+ signoff: true
+ title: Add vulnerability report
+ commit-message: Added vulnerability report
+ body: |
+ Update *Vulnerablity* report
+ delete-branch: true
+ labels: |
+ documentation
+ gh-action
+ reviewers: bossenti
Review Comment:
`apache/streampipes-committers` is group of team member, am i right? if so, then we should use `team-reviewers` rather than `reviewers`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1156129632
##########
.github/workflows/osv-scanner.yml:
##########
@@ -21,15 +21,23 @@ on:
jobs:
run-osv-scanner:
+
name: Run OSV Scanner
runs-on: ubuntu-latest
+
steps:
+
- name: Checkout
uses: actions/checkout@v3
+
+ - name: Pull OSV Scanner Docker image
+ run: docker pull ghcr.io/google/osv-scanner:latest
Review Comment:
You can replace this with `uses: ghcr.io/google/osv-scanner:latest`
Then you don't need to pull the docker image by hand and can include the commands from the next step into this one
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1158775198
##########
.github/workflows/osv-scanner.yml:
##########
@@ -21,15 +21,23 @@ on:
jobs:
run-osv-scanner:
+
name: Run OSV Scanner
runs-on: ubuntu-latest
+
steps:
+
- name: Checkout
uses: actions/checkout@v3
+
+ - name: Pull OSV Scanner Docker image
+ run: docker pull ghcr.io/google/osv-scanner:latest
Review Comment:
i did try it in my repo, with this approach bt i am having trouble generating the `VULNERABILITY.md` file that will contain the results. I implemented as:
```
- name: Scan for vulnerabilities
id: osv_scan
uses: docker://ghcr.io/google/osv-scanner:latest
with:
args: --format markdown -r .
continue-on-error: true
```
- i cannot place ` grep -vE '^Scanned.*packages$' > VULNERABILITY.md` in args
- i tried with ${{ steps.osv_scan.outputs.stdout }}, ${{ steps.osv_scan.outputs.result }} in another step but didnot work
```
- name: Save scan output to file
run: echo "${{ steps.osv_scan.outputs.stderr }}" | grep -vE '^((Scanning|Scanned).*)$' > VULNERABILITY.md
```
- if we use `outputs:` to define the output of the osv-scanner job then we will need to create another job to use that output
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1158775198
##########
.github/workflows/osv-scanner.yml:
##########
@@ -21,15 +21,23 @@ on:
jobs:
run-osv-scanner:
+
name: Run OSV Scanner
runs-on: ubuntu-latest
+
steps:
+
- name: Checkout
uses: actions/checkout@v3
+
+ - name: Pull OSV Scanner Docker image
+ run: docker pull ghcr.io/google/osv-scanner:latest
Review Comment:
i did try it in my repo, with this approach bt i am having trouble generating the `VULNERABILITY.md` file that will contain the results. I implemented as:
```
- name: Scan for vulnerabilities
id: osv_scan
uses: docker://ghcr.io/google/osv-scanner:latest
with:
args: --format markdown -r .
continue-on-error: true
```
- i cannot place ` grep -vE '^Scanned.*packages$' > VULNERABILITY.md` in args
- i tried with ${{ steps.osv_scan.outputs.stdout }}, ${{ steps.osv_scan.outputs.result }} in another step but didnot work
- if we use 3rd party action related to artifacts, it will just make it more complex
- if we use `outputs:` to define the output of the osv-scanner job then we will need to create another job to use that output
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160862523
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
Hm I see
can you rebase your branch with the current dev branch and try it again?
After this, the maven build should go through without any issues
At least we have neither a problem in the CI runs nor on my local machine (just verified it)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160653439
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
after i made changes to pom.xml, i ran `mvn clean package` it was successfully build.
But the `report` of the osv-scanner remains same before and after changing the `pom.xml`. should i undo the changes in pom.xml?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1145829363
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
+ continue-on-error: true
+ - name: Create Pull Request
+ id: cpr
+ uses: peter-evans/create-pull-request@v4
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ committer: ${{ github.actor }} <no...@gmail.com>
+ author: ${{ github.actor }} <${{ github.actor }}@github.com>
+ signoff: true
+ title: Add vulnerability report
+ commit-message: Added vulnerability report
+ body: |
+ Update *Vulnerablity* report
+ delete-branch: true
+ labels: |
+ documentation
+ gh-action
+ reviewers: bossenti
Review Comment:
`apache/streampipes-committers` is group of team member, am i right? if so, then we should use `team-reviewers` rather than `reviewers` acc. to official guide.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160561617
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
I assume the changes to the POM files are comitted by accident, right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160650431
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
when i run osv-scanner for scanning our repo initially in my local machine, these are the errors it was throwing:
```
Failed to resolve version of io.nats:jnats: property "nats.version" could not be foundScanned /home/ibergx00/Documents/oss/streampipes/streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml file and found 18 packages
Failed to resolve version of com.google.inject:guice: property "guice.version" could not be foundScanned /home/ibergx00/Documents/oss/streampipes/streampipes-maven-plugin/pom.xml file and found 18 packages
Failed to resolve version of org.apache.flink:flink-connector-kafka_2.11: property "flink.version" could not be found
Failed to resolve version of org.apache.flink:flink-java: property "flink.version" could not be found
Failed to resolve version of org.apache.flink:flink-streaming-java_2.11: property "flink.version" could not be found
Failed to resolve version of org.apache.flink:flink-clients_2.11: property "flink.version" could not be found Scanned /home/ibergx00/Documents/oss/streampipes/streampipes-wrapper-flink/pom.xml file and found 9 packages
```
after i made those changes in `pom.xml`, error get resolved
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1145415904
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
Review Comment:
Why do you do this in the checkout step? You can simply create a new one and specify the docker image there
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160653439
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
after i made changes to pom.xml, i ran `mvn clean package` it was successfully build.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1158775198
##########
.github/workflows/osv-scanner.yml:
##########
@@ -21,15 +21,23 @@ on:
jobs:
run-osv-scanner:
+
name: Run OSV Scanner
runs-on: ubuntu-latest
+
steps:
+
- name: Checkout
uses: actions/checkout@v3
+
+ - name: Pull OSV Scanner Docker image
+ run: docker pull ghcr.io/google/osv-scanner:latest
Review Comment:
i did try it in my repo, with this approach bt i am having trouble generating the `VULNERABILITY.md` file that will contain the results. I implemented as:
```
- name: Scan for vulnerabilities
id: osv_scan
uses: docker://ghcr.io/google/osv-scanner:latest
with:
args: --format markdown -r .
continue-on-error: true
```
- i cannot place ` grep -vE '^Scanned.*packages$' > VULNERABILITY.md` in args
- i tried with ${{ steps.osv_scan.outputs.stdout }}, ${{ steps.osv_scan.outputs.result }} but didnot work
- if we use 3rd party action related to artifacts, it will just make it more complex
- if we use `outputs:` to define the output of the osv-scanner job then we will need to create another job to use that output
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1161113731
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
Done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti merged PR #1438:
URL: https://github.com/apache/streampipes/pull/1438
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1158775198
##########
.github/workflows/osv-scanner.yml:
##########
@@ -21,15 +21,23 @@ on:
jobs:
run-osv-scanner:
+
name: Run OSV Scanner
runs-on: ubuntu-latest
+
steps:
+
- name: Checkout
uses: actions/checkout@v3
+
+ - name: Pull OSV Scanner Docker image
+ run: docker pull ghcr.io/google/osv-scanner:latest
Review Comment:
i did try it in my repo, with this approach bt i am having trouble generating the `VULNERABILITY.md` file that will contain the results. I implemented as:
```
- name: Scan for vulnerabilities
id: osv_scan
uses: docker://ghcr.io/google/osv-scanner:latest
with:
args: --format markdown -r .
continue-on-error: true
```
- i cannot place ` grep -vE '^Scanned.*packages$' > VULNERABILITY.md` in args
- i tried with ${{ steps.osv_scan.outputs.stdout }}, ${{ steps.osv_scan.outputs.result }} in another step but didnot work
```
- name: Save scan output to file
run: echo "${{ steps.osv_scan.outputs.stderr }}" | grep -vE '^((Scanning|Scanned).*)$' > VULNERABILITY.md
```
- if we use 3rd party action related to artifacts, it will just make it more complex
- if we use `outputs:` to define the output of the osv-scanner job then we will need to create another job to use that output
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160566054
##########
.github/workflows/osv-scanner.yml:
##########
@@ -21,15 +21,23 @@ on:
jobs:
run-osv-scanner:
+
name: Run OSV Scanner
runs-on: ubuntu-latest
+
steps:
+
- name: Checkout
uses: actions/checkout@v3
+
+ - name: Pull OSV Scanner Docker image
+ run: docker pull ghcr.io/google/osv-scanner:latest
Review Comment:
Alright, then let us keep the current version
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#issuecomment-1480271535
Thanks for your PR @Kshitiz-Mhto 🙏🏼
In general it looks good I think, only two minor issues I'd like to have changes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1161113731
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
i rebased my branch with current dev and sucessfully build it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1161118508
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
Great, in this case we can remove the changes to the POM files from this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#issuecomment-1500902403
Great, in this case we can remove the changes to the POM files from this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1161135949
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
Done :+1:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "bossenti (via GitHub)" <gi...@apache.org>.
bossenti commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1155364517
##########
.github/workflows/osv-scanner.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV Scanner
+
+on:
+ schedule:
+ - cron: '0 0 1 * *'
+
+jobs:
+ run-osv-scanner:
+ name: Run OSV Scanner
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v3
+ - name: Scan for vulnerabilities
+ run: |
+ docker run --rm -v $PWD:/repo -w /repo ghcr.io/google/osv-scanner:latest --format markdown -r . | grep -vE '^Scanned.*packages$' > VULNERABILITY.md
Review Comment:
Sure you need to do the checkout step, but you should do it as a separate step for the sake of clarity
Maybe I get you wrong, but why should I need to install `osv-scanner` when using `ghcr.io/google/osv-scanner:latest`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] #1107 Implementation of `OSV-scanner` with `gh-action` (streampipes)
Posted by "Kshitiz-Mhto (via GitHub)" <gi...@apache.org>.
Kshitiz-Mhto commented on code in PR #1438:
URL: https://github.com/apache/streampipes/pull/1438#discussion_r1160653439
##########
streampipes-extensions/streampipes-sinks-brokers-jvm/pom.xml:
##########
@@ -86,7 +86,6 @@
<dependency>
<groupId>io.nats</groupId>
<artifactId>jnats</artifactId>
- <version>${nats.version}</version>
Review Comment:
after i made changes to pom.xml, i ran `mvn clean package` it was successfully build.
But the `report` of the osv-scanner remains same before and after changing the `pom.xml`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@streampipes.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org