Merge branch 'master' into feature/add-script-listener

Author: daniel-beck

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @jenkinsci/script-security-plugin-developers

.github/dependabot.yml

@@ -4,10 +4,6 @@ updates:
  directory: "/"
  schedule:
  interval: "daily"
- ignore:
- # Caffeine 3.x requires Java 11, so we cannot update until Jenkins requires Java 11
- - dependency-name: "com.github.ben-manes.caffeine:caffeine"
- versions: ["[3.0.0,)"]
  - package-ecosystem: github-actions
  directory: /
  schedule:

.github/release-drafter.yml

@@ -8,52 +8,8 @@ on:
  - completed
 
 jobs:
- validate:
- runs-on: ubuntu-latest
- outputs:
- should_release: ${{ steps.verify-ci-status.outputs.result == 'success' && steps.interesting-categories.outputs.interesting == 'true' }}
- steps:
- - name: Verify CI status
- uses: jenkins-infra/verify-ci-status-action@v1.2.0
- id: verify-ci-status
- with:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- output_result: true
-
- - name: Release Drafter
- uses: release-drafter/release-drafter@v5
- if: steps.verify-ci-status.outputs.result == 'success'
- with:
- name: next
- tag: next
- version: next
- env:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
- - name: Check interesting categories
- uses: jenkins-infra/interesting-category-action@v1.0.0
- id: interesting-categories
- if: steps.verify-ci-status.outputs.result == 'success'
- with:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
- release:
- runs-on: ubuntu-latest
- needs: [validate]
- if: needs.validate.outputs.should_release == 'true'
- steps:
- - name: Check out
- uses: actions/checkout@v3
- with:
- fetch-depth: 0
- - name: Set up JDK 8
- uses: actions/setup-java@v3
- with:
- distribution: 'temurin'
- java-version: 8
- - name: Release
- uses: jenkins-infra/jenkins-maven-cd-action@v1.2.0
- with:
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
- MAVEN_TOKEN: ${{ secrets.MAVEN_TOKEN }}
+ maven-cd:
+ uses: jenkins-infra/github-reusable-workflows/.github/workflows/maven-cd.yml@v1
+ secrets:
+ MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
+ MAVEN_TOKEN: ${{ secrets.MAVEN_TOKEN }}

.github/workflows/cd.yaml

@@ -0,0 +1,21 @@
+name: Jenkins Security Scan
+
+on:
+ push:
+ branches:
+ - master
+ pull_request:
+ types: [ opened, synchronize, reopened ]
+ workflow_dispatch:
+
+permissions:
+ security-events: write
+ contents: read
+ actions: read
+
+jobs:
+ security-scan:
+ uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
+ with:
+ java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate.
+ # java-version: 21 # Optionally specify what version of Java to set up for the build, or remove to use a recent default.

.github/workflows/jenkins-security-scan.yml

@@ -1,6 +1,8 @@
 target
 work
-
+/.classpath
+/.project
+/.settings/
 .idea
 *.iml
 .*.sw*

.gitignore

@@ -2,6 +2,6 @@
  <extension>
  <groupId>io.jenkins.tools.incrementals</groupId>
  <artifactId>git-changelist-maven-extension</artifactId>
- <version>1.3</version>
+ <version>1.8</version>
  </extension>
 </extensions>