Renovate build, dependencies and CI; emit CycloneDX SBOM

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+
+updates:
+  # Keeps the SHA pins in .github/workflows/ current - pinning without this
+  # just means the actions silently rot instead of silently changing.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: "deps"
+    groups:
+      junit:
+        patterns:
+          - "org.junit*"
+      maven-plugins:
+        patterns:
+          - "org.apache.maven.plugins:*"

.github/workflows/build.yml

@@ -0,0 +1,95 @@
+name: Build
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+# Least privilege by default; jobs opt into more where they need it.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build (JDK ${{ matrix.java }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      checks: write
+    strategy:
+      fail-fast: false
+      matrix:
+        java: [ '17', '21' ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up JDK ${{ matrix.java }}
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        with:
+          java-version: ${{ matrix.java }}
+          distribution: 'temurin'
+          cache: 'maven'
+
+      - name: Build, test and generate SBOM
+        run: mvn -B --no-transfer-progress verify
+
+      # Forked PRs get a read-only token, so the check-run API is unavailable there.
+      - name: Test report
+        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
+        if: ${{ (success() || failure()) && github.event.pull_request.head.repo.fork != true }}
+        with:
+          name: Tests (JDK ${{ matrix.java }})
+          path: '**/target/surefire-reports/TEST-*.xml'
+          reporter: java-junit
+
+      - name: Upload SBOM
+        if: matrix.java == '17'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: sbom
+          path: |
+            target/bom.json
+            target/bom.xml
+          if-no-files-found: error
+
+  dependency-track:
+    name: Publish SBOM to DependencyTrack
+    needs: build
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      DTRACK_URL: ${{ secrets.DEPENDENCYTRACK_URL }}
+      DTRACK_API_KEY: ${{ secrets.DEPENDENCYTRACK_API_KEY }}
+
+    steps:
+      - name: Download SBOM
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: sbom
+          path: sbom
+
+      - name: Not configured
+        if: env.DTRACK_URL == ''
+        run: |
+          echo "::notice::DEPENDENCYTRACK_URL is not set - skipping upload." \
+               "Add the DEPENDENCYTRACK_URL and DEPENDENCYTRACK_API_KEY repository secrets to enable it."
+
+      - name: Upload BOM
+        if: env.DTRACK_URL != ''
+        run: |
+          curl --fail-with-body -sS -X POST "${DTRACK_URL%/}/api/v1/bom" \
+            -H "X-Api-Key: ${DTRACK_API_KEY}" \
+            -F "autoCreate=true" \
+            -F "projectName=${{ github.event.repository.name }}" \
+            -F "projectVersion=${{ github.ref_name }}" \
+            -F "bom=@sbom/bom.json"

.github/workflows/linter.yml

@@ -1,23 +1,36 @@
-name: Lint Code Base
+name: Lint
 
-on: 
+on:
   workflow_dispatch:
+  pull_request:
+    branches: [ "master" ]
+
+permissions:
+  contents: read
 
 jobs:
-  build:
-    name: Lint Code Base
+  lint:
+    name: Lint code base
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      statuses: write
 
     steps:
-      - name: Checkout Code
-        uses: actions/checkout@v2
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          # Full git history is needed to get a proper list of changed files within `super-linter`
+          # super-linter needs full history to diff against the base branch.
           fetch-depth: 0
 
-      - name: Lint Code Base
-        uses: github/super-linter@v6
+      - name: Lint
+        uses: github/super-linter@b807e99ddd37e444d189cfd2c2ca1274d8ae8ef1 # v7
         env:
-          VALIDATE_ALL_CODEBASE: false
-          DEFAULT_BRANCH: master
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEFAULT_BRANCH: master
+          VALIDATE_ALL_CODEBASE: false
+          # Scoped deliberately: enabling any VALIDATE_* switch turns the rest off.
+          # The Java sources predate any shared format config, so linting them here
+          # would fail every PR for reasons unrelated to the change under review.
+          VALIDATE_YAML: true
+          VALIDATE_GITHUB_ACTIONS: true

.gitignore

@@ -1,7 +1,5 @@
-/build
 .project
 .classpath
-.gradle
 .settings
 .DS_Store
 .svn

README.md

@@ -1,11 +1,7 @@
-[![Gitpod Ready-to-Code](https://img.shields.io/badge/Gitpod-Ready--to--Code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/rebaze/integrity) 
-
 [<img src="http://www.rebaze.com/assets/Rebaze_icon_colors_tbg.png" align="right" width="100">](http://rebaze.com)
 
-[![OSGi compatible](https://img.shields.io/badge/OSGi-compatible-green.svg)](http://www.osgi.org)
-[![Build Status](https://github.com/rebaze/integrity/workflows/cibuild/badge.svg)](https://github.com/rebaze/integrity/workflows/cibuild/)
-[![Maven Central](https://maven-badges.herokuapp.com/maven-central/org.rebaze.integrity/org.rebaze.integrity.tree/badge.svg)](https://maven-badges.herokuapp.com/maven-central/org.rebaze.integrity/org.rebaze.integrity.tree)
-[![Apache 2.0](https://img.shields.io/github/license/nebula-plugins/nebula-publishing-plugin.svg)](http://www.apache.org/licenses/LICENSE-2.0)
+[![Build](https://github.com/rebaze/integrity/actions/workflows/build.yml/badge.svg)](https://github.com/rebaze/integrity/actions/workflows/build.yml)
+[![Apache 2.0](https://img.shields.io/github/license/rebaze/integrity.svg)](http://www.apache.org/licenses/LICENSE-2.0)
 
 # News
 
@@ -14,7 +10,6 @@
 A small Java library for creating Merkle Trees (https://en.m.wikipedia.org/wiki/Merkle_tree) to be used in blockchain-like technologies.
 
 - Composite hash- tree based java library (DAG)
-- OSGi compatible
 - Embeddable
 - Low footprint 
 
@@ -135,6 +130,33 @@ Tags do not need to be unique.
 
 IndexTree currently does not build indexes for tags, so that is a thing to do..;)
 
+# Building
+
+Requires JDK 17 or newer and Maven 3.9+. The library itself has **no runtime
+dependencies** - it is pure JDK.
+
+````
+mvn verify
+````
+
+## Software Bill of Materials
+
+Every build emits a [CycloneDX](https://cyclonedx.org/) 1.6 SBOM to
+`target/bom.json` and `target/bom.xml`. Because this project's only
+dependencies are test-scope, the BOM is generated with `includeTestScope`
+enabled - otherwise it would come out empty.
+
+CI publishes the SBOM as a workflow artifact, and pushes it to
+[DependencyTrack](https://dependencytrack.org/) when these repository secrets
+are set:
+
+| Secret | Purpose |
+| --- | --- |
+| `DEPENDENCYTRACK_URL` | Base URL of the DependencyTrack API server |
+| `DEPENDENCYTRACK_API_KEY` | API key with `BOM_UPLOAD` permission |
+
+Without them the upload step is skipped and the build still passes.
+
 # LICENSE
 Copyright 2014-2020 rebaze GmbH.