Repository navigation
fix: read CI secrets from repository secrets and align Gson converter - #124
Merged
Merged
Conversation
cernadasjuan
changed the title
The integration-test steps now read their credentials directly from repository secrets, so CI no longer needs a long-lived service token or the third-party CLI action. Each step receives only the four values it uses, and GitHub masks them automatically. PLUGGY_RSA_PUBLIC_KEY is now passed as well. Without it, the encrypted-parameters integration test silently sent plaintext parameters and never exercised EncryptedParametersInterceptor.
converter-gson was left at 2.9.0 when retrofit moved to 2.12.0, and it still declared gson 2.8.5, which is affected by GHSA-4jrv-ppp4-jm57 (CVE-2022-25647). Maven already resolved the direct gson 2.11.0, so the vulnerable version was not on the classpath, but the declared graph kept the alert open and the Retrofit modules were out of sync. Move converter-gson to 2.12.0 and gson to 2.13.1, the version that converter-gson 2.12.0 is built against.
Ships the Retrofit, OkHttp, log4j and Gson dependency updates merged since v1.17.1.
cernadasjuan
force-pushed
the
fix/ci-github-secrets
branch
from
November 5, 2026 23:08
60a5bb4 to
2af1ca3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PLUGGY_CLIENT_ID,PLUGGY_CLIENT_SECRET,PLUGGY_BASE_URLandPLUGGY_RSA_PUBLIC_KEYfrom repository secrets. The third-party CLI action is removed, so every workflow uses only GitHub-owned actions pinned by SHA.PLUGGY_RSA_PUBLIC_KEYsocreateItem_withEncryptedParameters_responseOkactually encrypts the parameters. Without it the test sent them in plaintext and still passed.converter-gson(2.9.0 → 2.12.0) withretrofit2.12.0 and movegsonto 2.13.1, the version that converter is built against.CLAUDE.md: secrets flow, Actions allowlist, removedforcerelease input, User-Agent derived frompom.xml.Test plan
actionlintandzizmor: no findingsmvn dependency:tree:converter-gson2.12.0,gson2.13.1, nogsonbelow 2.8.9mvn -B verifylocally: 97 unit and 41 integration tests pass (the 4 skipped are existing@Disabledtests)masterrun andmaven-publish.ymlforv1.17.2are green