test

.github/workflows/cloud_code_scan.yml

@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: codeScan
-        uses: layotto/alipay-cloud-devops-codescan@main
+        uses: huqiuxiang/alipay-cloud-devops-codescan@main
         with:
           parent_uid: ${{ secrets.ALI_PID }}
           private_key: ${{ secrets.ALI_PK }}
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: codeScan
-        uses: layotto/alipay-cloud-devops-codescan@main
+        uses: huqiuxiang/alipay-cloud-devops-codescan@main
         with:
           parent_uid: ${{ secrets.ALI_PID }}
           private_key: ${{ secrets.ALI_PK }}

.github/workflows/fossa_scan.yml

@@ -0,0 +1,22 @@
+name: FOSSA Scan
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  fossa:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout Code
+      uses: actions/checkout@v3
+
+    - name: Run FOSSA Scan
+      uses: fossa-contrib/fossa-action@v1
+      with:
+        fossa-api-key: ${{ secrets.FOSSA_API_KEY }}
+        # 可选：指定FOSSA命令行参数，例如目录、排除等
+        # args: '--exclude=**/node_modules,**/vendor'

.github/workflows/sonarqube_scan.yml

@@ -0,0 +1,20 @@
+name: sonarqube scan
+on:
+  push:
+      branches: [ master ]
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up JDK 17
+      uses: actions/setup-java@v2
+      with:
+        java-version: '17'
+        distribution: 'adopt'
+
+    # 如果是Maven
+    - name: Build and analyze with Maven
+      run: mvn clean verify sonar:sonar -Dmaven.test.skip=true -Dsonar.projectKey=${{ github.event.repository.name }} -Dsonar.host.url=${{ secrets.SONARQUBE_HOST }} -Dsonar.login=${{ secrets.SONARQUBE_TOKEN }}

.github/workflows/soos_scan.yml

@@ -0,0 +1,31 @@
+# This is a basic workflow to help you get started with Actions
+name: SOOS SCA SARIF Example CI
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v3
+
+      # Runs a single command using the runners shell
+      - name: SOOS SCA Analysis
+        uses: soos-io/soos-sca-github-action@v2
+        with:
+          project_name: "<repository_owner>/<repository_name>" # Also you can use the var ${{ github.repository }}
+          output_format: "sarif"
+          client_id: ${{ secrets.SOOS_CLIENT_ID }}
+          api_key: ${{ secrets.SOOS_API_KEY }}

pom.xml

@@ -51,6 +51,19 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+
+            <dependency>
+                <groupId>javax.xml.bind</groupId>
+                <artifactId>jaxb-api</artifactId>
+                <version>2.3.1</version>
+            </dependency>
+
+            <dependency>
+                <groupId>jakarta.annotation</groupId>
+                <artifactId>jakarta.annotation-api</artifactId>
+                <version>2.0.0</version>
+                <scope>provided</scope>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 

registry/registry-local/pom.xml

@@ -13,6 +13,10 @@
     <artifactId>sofa-rpc-registry-local</artifactId>
 
     <dependencies>
+        <dependency>
+            <groupId>javax.xml.bind</groupId>
+            <artifactId>jaxb-api</artifactId>
+        </dependency>
         <dependency>
             <groupId>com.alipay.sofa</groupId>
             <artifactId>sofa-rpc-log</artifactId>

remoting/remoting-triple/pom.xml

@@ -16,6 +16,11 @@
             <groupId>com.alipay.sofa</groupId>
             <artifactId>sofa-rpc-log</artifactId>
         </dependency>
+        <dependency>
+            <groupId>javax.annotation</groupId>
+            <artifactId>javax.annotation-api</artifactId>
+            <version>1.3.2</version>
+        </dependency>
         <dependency>
             <groupId>com.alipay.sofa</groupId>
             <artifactId>sofa-rpc-api</artifactId>

test_hqx

@@ -0,0 +1 @@
+test