feat: put packet writing behind debug env var, pin workflow steps, rename api->dashboard

coopernetes · coopernetes · commit e20814758a9a · 2026-03-29T23:47:36.000-04:00
- instead of writing push request bodies to files based on logging level set to DEBUG (we want
  to continue using debug logs for troubleshooting separately), expose an env var (`GITPROXY_DEBUG_PACKET`)
  to enable writing request bodies to disk. This was useful during early iteration but in general is
  discouraged from use unless necessary for tracing network problems or inspecting payloads for
  development purposes.
- enhance the client test scripts to pass in the git repo, git user &amp; password (don't assume my local
  setup) so that the tests can be ran on any arbitrary repo &amp; credentials
- rename the jgit-proxy-api module to "jgit-proxy-dashboard" to align more with what its used for
- update hard-coded commitconfig with generic example.com git user email instead of my personal
  ones
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # ratchet:actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 21
@@ -23,7 +23,7 @@ jobs:
 
       - name: Publish test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # ratchet:actions/upload-artifact@v7
         with:
           name: test-reports
           path: "**/build/reports/tests/test/"
@@ -39,9 +39,9 @@ jobs:
       github.event_name == 'pull_request'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # ratchet:actions/setup-java@v5
         with:
           distribution: temurin
           java-version: 21
@@ -52,7 +52,7 @@ jobs:
 
       - name: Publish e2e test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # ratchet:actions/upload-artifact@v7
         with:
           name: e2e-test-reports
           path: "jgit-proxy-server/build/reports/tests/e2eTest/"
diff --git a/.github/workflows/cve.yml b/.github/workflows/cve.yml
@@ -0,0 +1,33 @@
+name: CVE Scanning
+
+on:
+  push:
+
+jobs:
+  depcheck:
+    runs-on: ubuntu-latest
+    name: depecheck
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+      - name: Build project with Gradle
+        run: ./gradlew clean build
+      - name: Depcheck
+        uses: dependency-check/Dependency-Check_Action@1e54355a8b4c8abaa8cc7d0b70aa655a3bb15a6c
+        id: Depcheck
+        with:
+          project: 'jgit-proxy'
+          path: '.'
+          format: 'HTML'
+          out: 'reports' # this is the default, no need to specify unless you wish to override it
+          args: >
+            --suppression ./gradle/allow-list.xml
+            --failOnCVSS 5
+            --enableRetired
+
+      - name: Upload Test results
+        if: ${{ always() }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # ratchet:actions/upload-artifact@v7
+        with:
+          name: Depcheck report
+          path: ${{ github.workspace }}/reports
diff --git a/jgit-proxy-core/src/main/java/org/finos/gitproxy/servlet/filter/ParseGitRequestFilter.java b/jgit-proxy-core/src/main/java/org/finos/gitproxy/servlet/filter/ParseGitRequestFilter.java
@@ -99,7 +99,7 @@ public GitRequestDetails parse(RequestBodyWrapper request) {
                 gr.setCommitFrom(pushInfo.getOldCommit());
                 gr.setCommitTo(pushInfo.getNewCommit());
 
-                if (log.isDebugEnabled()) {
+                if (null != System.getenv("GITPROXY_DEBUG_PACKET")) {
                     logPushDetails(gr.getId(), packetLine, packData);
                 }
             } catch (IOException e) {
diff --git a/jgit-proxy-dashboard/build.gradle b/jgit-proxy-dashboard/build.gradle
@@ -16,7 +16,7 @@ java {
 }
 
 application {
-    mainClass = 'org.finos.gitproxy.api.GitProxyWithDashboardApplication'
+    mainClass = 'org.finos.gitproxy.dashboard.GitProxyWithDashboardApplication'
     applicationDefaultJvmArgs = ["-Djgitproxy.pidfile=${buildDir}/jgit-proxy.pid"]
 }
 
diff --git a/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/GitProxyWithDashboardApplication.java b/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/GitProxyWithDashboardApplication.java
@@ -1,4 +1,4 @@
-package org.finos.gitproxy.api;
+package org.finos.gitproxy.dashboard;
 
 import java.nio.file.Files;
 import java.util.List;
@@ -41,7 +41,7 @@ public static void main(String[] args) throws Exception {
         var configBuilder = new JettyConfigurationBuilder(configLoader);
 
         var threadPool = new QueuedThreadPool();
-        threadPool.setName("jgit-proxy-api");
+        threadPool.setName("jgit-proxy-dashboard");
 
         var server = new Server(threadPool);
         var connector = new ServerConnector(server);
diff --git a/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/SpringWebConfig.java b/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/SpringWebConfig.java
@@ -1,4 +1,4 @@
-package org.finos.gitproxy.api;
+package org.finos.gitproxy.dashboard;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.databind.SerializationFeature;
@@ -17,7 +17,7 @@
 
 @Configuration
 @EnableWebMvc
-@ComponentScan("org.finos.gitproxy.api.controller")
+@ComponentScan("org.finos.gitproxy.dashboard.controller")
 public class SpringWebConfig implements WebMvcConfigurer {
 
     @Override
diff --git a/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/controller/HealthController.java b/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/controller/HealthController.java
@@ -1,4 +1,4 @@
-package org.finos.gitproxy.api.controller;
+package org.finos.gitproxy.dashboard.controller;
 
 import java.time.Instant;
 import java.util.Map;
diff --git a/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/controller/ProviderController.java b/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/controller/ProviderController.java
@@ -1,10 +1,8 @@
-package org.finos.gitproxy.api.controller;
+package org.finos.gitproxy.dashboard.controller;
 
 import jakarta.annotation.Resource;
 import java.util.List;
-
 import org.finos.gitproxy.config.ProviderConfigurationSource;
-import org.finos.gitproxy.provider.GitProxyProvider;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -26,6 +24,5 @@ public List<ProviderInfo> list() {
                 .toList();
     }
 
-    public record ProviderInfo(
-            String name, String uri, String host, String pushPath, String proxyPath) {}
+    public record ProviderInfo(String name, String uri, String host, String pushPath, String proxyPath) {}
 }
diff --git a/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/controller/PushController.java b/jgit-proxy-dashboard/src/main/java/org/finos/gitproxy/dashboard/controller/PushController.java
@@ -1,4 +1,4 @@
-package org.finos.gitproxy.api.controller;
+package org.finos.gitproxy.dashboard.controller;
 
 import java.util.List;
 import java.util.Map;
diff --git a/jgit-proxy-dashboard/src/main/resources/static/index.html b/jgit-proxy-dashboard/src/main/resources/static/index.html
diff --git a/settings.gradle b/settings.gradle
@@ -2,4 +2,4 @@ rootProject.name = 'gitproxy'
 
 include 'jgit-proxy-core'
 include 'jgit-proxy-server'
-include 'jgit-proxy-api'
+include 'jgit-proxy-dashboard'
diff --git a/test-proxy-fail.sh b/test-proxy-fail.sh
@@ -4,8 +4,9 @@
 # Each test clones fresh to avoid leftover state from failed pushes
 set -uo pipefail
 
-PAT=$(cat ~/.github-pat)
-PROXY_URL="http://coopernetes:${PAT}@localhost:8080/proxy/github.com/coopernetes/test-repo.git"
+GIT_USERNAME=${GIT_USERNAME:-"me"}
+GIT_REPO=${GIT_REPO:-"github.com/coopernetes/test-repo.git"}
+PROXY_URL="http://${GIT_USERNAME}:${GIT_PASSWORD}@localhost:8080/proxy/${GIT_REPO}"
 PASS=0
 FAIL=0
 
@@ -115,7 +116,7 @@ test_token_in_message() {
 
 echo "=========================================================="
 echo "  PROXY FILTER FAILURE TEST SUITE"
-echo "  Proxy URL: ${PROXY_URL//${PAT}/***}"
+echo "  Proxy URL: ${PROXY_URL//${GIT_PASSWORD}/***}"
 echo "=========================================================="
 
 # Author email failures
diff --git a/test-proxy-pass.sh b/test-proxy-pass.sh
@@ -4,16 +4,17 @@
 set -euo pipefail
 
 REPO_DIR=$(mktemp -d /tmp/proxy-test-pass-XXXX)
-PAT=$(cat ~/.github-pat)
-PROXY_URL="http://coopernetes:${PAT}@localhost:8080/proxy/github.com/coopernetes/test-repo.git"
+GIT_USERNAME=${GIT_USERNAME:-"me"}
+GIT_REPO=${GIT_REPO:-"github.com/coopernetes/test-repo.git"}
+PROXY_URL="http://${GIT_USERNAME}:${GIT_PASSWORD}@localhost:8080/proxy/${GIT_REPO}"
 
 echo "=== SETUP: Cloning to ${REPO_DIR} ==="
 git clone "${PROXY_URL}" "${REPO_DIR}" 2>&1
 cd "${REPO_DIR}"
 
-# Use a valid author email (proton.me domain is in the allow list)
-git config user.name "Thomas Cooper"
-git config user.email "coopernetes@proton.me"
+# Use a valid author email (example.com domain is in the allow list)
+git config user.name "Jane Developer"
+git config user.email "jane.developer@example.com"
 
 echo ""
 echo "============================================="
diff --git a/test-push-fail.sh b/test-push-fail.sh
@@ -4,8 +4,9 @@
 # Each test clones fresh to avoid leftover state from failed pushes
 set -uo pipefail
 
-PAT=$(cat ~/.github-pat)
-PUSH_URL="http://coopernetes:${PAT}@localhost:8080/push/github.com/coopernetes/test-repo.git"
+GIT_USERNAME=${GIT_USERNAME:-"me"}
+GIT_REPO=${GIT_REPO:-"github.com/coopernetes/test-repo.git"}
+PUSH_URL="http://${GIT_USERNAME}:${GIT_PASSWORD}@localhost:8080/push/${GIT_REPO}"
 PASS=0
 FAIL=0
 
@@ -127,7 +128,7 @@ test_multi_failure() {
 
 echo "=========================================================="
 echo "  STORE-AND-FORWARD VALIDATION FAILURE TEST SUITE"
-echo "  Push URL: ${PUSH_URL//${PAT}/***}"
+echo "  Push URL: ${PUSH_URL//${GIT_PASSWORD}/***}"
 echo "=========================================================="
 
 # Author email failures
diff --git a/test-push-pass.sh b/test-push-pass.sh
@@ -4,16 +4,17 @@
 set -euo pipefail
 
 REPO_DIR=$(mktemp -d /tmp/push-test-pass-XXXX)
-PAT=$(cat ~/.github-pat)
-PUSH_URL="http://coopernetes:${PAT}@localhost:8080/push/github.com/coopernetes/test-repo.git"
+GIT_USERNAME=${GIT_USERNAME:-"me"}
+GIT_REPO=${GIT_REPO:-"github.com/coopernetes/test-repo.git"}
+PUSH_URL="http://${GIT_USERNAME}:${GIT_PASSWORD}@localhost:8080/push/${GIT_REPO}"
 
 echo "=== SETUP: Cloning to ${REPO_DIR} ==="
 git clone "${PUSH_URL}" "${REPO_DIR}"
 cd "${REPO_DIR}"
 
-# Use a valid author email (proton.me domain is in the allow list)
-git config user.name "Thomas Cooper"
-git config user.email "coopernetes@proton.me"
+# Use a valid author email (example.com domain is in the allow list)
+git config user.name "John Developer"
+git config user.email "john.developer@example.com"
 
 echo ""
 echo "============================================="

Original file line number	Diff line number	Diff line change
`@@ -99,7 +99,7 @@ public GitRequestDetails parse(RequestBodyWrapper request) {`
`99`	`99`	`gr.setCommitFrom(pushInfo.getOldCommit());`
`100`	`100`	`gr.setCommitTo(pushInfo.getNewCommit());`
`101`	`101`
`102`		`- if (log.isDebugEnabled()) {`
	`102`	`+ if (null != System.getenv("GITPROXY_DEBUG_PACKET")) {`
`103`	`103`	`logPushDetails(gr.getId(), packetLine, packData);`
`104`	`104`	`}`
`105`	`105`	`} catch (IOException e) {`
Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@ java {`
`16`	`16`	`}`
`17`	`17`
`18`	`18`	`application {`
`19`		`- mainClass = 'org.finos.gitproxy.api.GitProxyWithDashboardApplication'`
	`19`	`+ mainClass = 'org.finos.gitproxy.dashboard.GitProxyWithDashboardApplication'`
`20`	`20`	`applicationDefaultJvmArgs = ["-Djgitproxy.pidfile=${buildDir}/jgit-proxy.pid"]`
`21`	`21`	`}`
`22`	`22`
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-package org.finos.gitproxy.api.controller;`
	`1`	`+package org.finos.gitproxy.dashboard.controller;`
`2`	`2`
`3`	`3`	`import java.time.Instant;`
`4`	`4`	`import java.util.Map;`