Renovate build, dependencies and CI; emit CycloneDX SBOM

[tonit]

Describe your changes

Modernises the toolchain for CVE hygiene and makes the project usable as a DependencyTrack input.

Dependencies

	From	To
junit	4.12	6.1.3 (via junit-bom)	resolves CVE-2020-15250
slf4j-simple	1.6.1	2.0.18	2010-era release
Java target	1.8	17	source/target 1.8 is deprecated on current JDKs
compiler plugin	3.8.1	3.15.0
surefire	2.22.2	3.5.6
enforcer	—	3.6.3	Maven 3.9+/JDK 17+, dependency convergence, no SNAPSHOTs

project.build.outputTimestamp is now set, so the jar is reproducible — two clean builds produce byte-identical output.

SBOM

cyclonedx-maven-plugin emits CycloneDX 1.6 to target/bom.json and target/bom.xml on every package.

includeTestScope is enabled deliberately. Every dependency in this project is test-scope, so the default configuration would emit a BOM with zero components. With it enabled the BOM carries 12 components with valid PURLs.

CI publishes the SBOM as a workflow artifact and pushes it to DependencyTrack when DEPENDENCYTRACK_URL and DEPENDENCYTRACK_API_KEY are set as repository secrets. Without them the step is skipped and the build still passes, so this merges safely before the secrets exist.

Test migration

All 8 test classes moved to JUnit Jupiter: imports, 2× @Ignore→@Disabled, 3× @Test(expected=)→assertThrows, and 19 assertion messages moved to the trailing argument.

That last part is the only place worth a careful look. JUnit 5 moved the message from the first argument to the last, and this codebase contains both forms:

assertEquals( "Should be identical", sn1, sn2 );                    // message first  -> must move
assertEquals( "fe05bc", union.select(...).fingerprint().sub(0,6) ); // expected value -> must NOT move

A regex would have silently inverted the second kind into a passing-but-meaningless assertion. The rewrite used an argument parser that only touches the three-argument form; the 14 two-argument hash assertions in UnionTreeCombinerTest are untouched.

Test counts are unchanged: @Test methods match the previous revision exactly per file (32 total), and @Ignore/@Disabled counts both remain 2.

CI

• maven.yml and maven-build.yml were near-duplicates both firing on every push and PR — one still pinned to JDK 1.8 and setup-java@v1 (Node 16). Replaced by a single build.yml with a JDK 17/21 matrix.
• linter.yml was workflow_dispatch-only, so it never actually ran. It now triggers on PRs.
• Every action is pinned to a full commit SHA, with dependabot.yml added to keep those pins current — pinning without Dependabot just means actions rot silently instead of changing silently.
• Least-privilege permissions: on all jobs.

Removals

build.gradle (published to Bintray, shut down 2021) · gradle/wrapper/gradle-wrapper.jar (orphaned binary — no gradlew or wrapper properties, so an unverifiable jar was sitting in the repo) · .travis.yml · .gitpod.* · bnd.bnd

Two things worth calling out

The OSGi badge is gone. bnd.bnd was never wired into the Maven build, so the jar has not carried OSGi headers since the Gradle→Maven switch — the README's "OSGi compatible" badge and bullet have been inaccurate since then. Both are removed rather than left standing. Two other badges were already broken and are fixed: the Maven Central badge pointed at coordinates that do not exist, and the Apache license badge pointed at nebula-plugins/nebula-publishing-plugin.

super-linter is scoped to YAML and workflow files. Turning it loose on the Java sources would fail every PR on formatting unrelated to the change under review. Widening it is a separate task: pick a style, reformat once, then enforce.

Issue ticket number and link

n/a

Checklist before requesting a review

• I have performed a self-review of my code

• If it is a core feature, I have added thorough tests.

  No behaviour changes — library sources are untouched. Verified mvn clean verify green on JDK 17, 21 and 25 (32 tests, 0 failures), actionlint clean on both workflows, all 7 action SHAs verified against their tags via the API, and reproducible-build output confirmed identical across runs.

• Do we need to implement analytics?

• Will this be part of a product update? If yes, please write one phrase about this update.

[Copilot]

Pull request overview

This PR modernizes the project’s Maven/CI toolchain for improved dependency hygiene, upgrades tests to JUnit Jupiter, and adds automatic CycloneDX SBOM generation + publication plumbing for DependencyTrack.

Changes:

• Upgrade build to Java 17+, modern Maven plugins, and JUnit Jupiter; migrate test sources accordingly.
• Generate CycloneDX 1.6 SBOM on every Maven package and upload it as a CI artifact.
• Simplify/modernize GitHub Actions workflows (matrix build, SHA-pinned actions, Dependabot for pins, lint-on-PR), and remove legacy/unused build/CI files.

Reviewed changes

Copilot reviewed 19 out of 22 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/test/java/org/rebaze/integrity/tree/internal/operators/UnionTreeCombinerTest.java	Migrates JUnit 4 annotations/assertions to JUnit Jupiter and replaces expected= with assertThrows.
src/test/java/org/rebaze/integrity/tree/internal/operators/DiffTreeCombinatorTest.java	Migrates assertions to JUnit Jupiter and reorders assertion message arguments.
src/test/java/org/rebaze/integrity/tree/internal/operators/CombinatorIntegrityTest.java	Migrates JUnit 4 @Ignore/asserts to JUnit Jupiter equivalents.
src/test/java/org/rebaze/integrity/tree/internal/InMemoryTreeImplTest.java	Migrates static assertions/imports to JUnit Jupiter.
src/test/java/org/rebaze/integrity/tree/internal/DefaultHashTest.java	Migrates to JUnit Jupiter, converts expected= tests to assertThrows, adjusts assertion message placement.
src/test/java/org/rebaze/integrity/tree/core/TreeIndexTest.java	Migrates assertions/imports to JUnit Jupiter and updates assert message ordering.
src/test/java/org/rebaze/integrity/tree/core/SimpleHashTest.java	Migrates assertions to JUnit Jupiter and updates assert message ordering.
src/test/java/org/rebaze/integrity/tree/core/BranchHashTest.java	Migrates JUnit 4 @Test/assertions to JUnit Jupiter.
README.md	Updates badges, removes inaccurate OSGi claims, and documents JDK17+/SBOM/DependencyTrack behavior.
pom.xml	Moves to Java 17, upgrades plugins/deps, adds enforcer rules, and configures CycloneDX SBOM generation.
build.gradle	Removes legacy Gradle/Bintray build configuration.
bnd.bnd	Removes unused OSGi/bnd metadata file.
.travis.yml	Removes legacy Travis CI config.
.gitpod.yml	Removes legacy Gitpod config.
.gitpod.Dockerfile	Removes legacy Gitpod Dockerfile.
.gitignore	Removes Gradle-specific ignore entries now that Gradle is removed.
.github/workflows/maven.yml	Removes duplicate legacy Maven workflow (JDK 1.8-era).
.github/workflows/maven-build.yml	Removes duplicate Maven workflow (replaced by matrix build).
.github/workflows/linter.yml	Enables lint workflow on PRs and pins actions to SHAs with scoped validation.
.github/workflows/build.yml	Adds consolidated matrix build, SBOM artifact upload, and DependencyTrack upload job.
.github/dependabot.yml	Adds Dependabot config to keep GitHub Actions SHA pins and Maven deps updated.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.