From d0b76369d2e4d6fd7488c3be4fa368d4387f5365 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Mon, 20 Jul 2026 17:18:15 +0530 Subject: [PATCH 1/5] feat: add ignorelist for bcprov-jdk18on in gradle.properties to resolve Jetifier parsing issues --- gradle.properties | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gradle.properties b/gradle.properties index e3822e8b..27c17344 100644 --- a/gradle.properties +++ b/gradle.properties @@ -1,5 +1,8 @@ android.useAndroidX=true android.enableJetifier=true +# bcprov-jdk18on 1.85 is a multi-release jar with Java 25 class files (major version 69); +# Jetifier's ASM reader can't parse it, and it has no support-library references to jetify anyway. +android.jetifier.ignorelist=bcprov-jdk18on android.enableR8.fullMode=false org.gradle.jvmargs=-XX:MaxMetaspaceSize=512m android.suppressUnsupportedCompileSdk=34 From 0a84b924d628549c7df4cf57df5ce19af0f7eab8 Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Sun, 2 Aug 2026 17:46:04 +0530 Subject: [PATCH 2/5] sca-scan.yml --- .github/workflows/sca-scan.yml | 43 +++++++--------------------------- 1 file changed, 9 insertions(+), 34 deletions(-) diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml index 362bea27..ea29c143 100644 --- a/.github/workflows/sca-scan.yml +++ b/.github/workflows/sca-scan.yml @@ -5,42 +5,17 @@ on: jobs: security-sca: runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write steps: - uses: actions/checkout@master - - - name: Set up JDK 17 - uses: actions/setup-java@v4 - with: - distribution: 'temurin' - java-version: '17' - cache: 'gradle' - - - name: Set up Android SDK - uses: android-actions/setup-android@v3 - with: - packages: 'tools platform-tools platforms;android-34 build-tools;34.0.0' - - - name: Setup local.properties - run: | - cat << EOF >> local.properties - sdk.dir=$ANDROID_HOME - host="${{ secrets.HOST }}" - APIKey="${{ secrets.API_KEY }}" - deliveryToken="${{ secrets.DELIVERY_TOKEN }}" - environment="${{ secrets.ENVIRONMENT }}" - contentType="${{ secrets.CONTENT_TYPE }}" - assetUid="${{ secrets.ASSET_UID }}" - EOF - - - name: Set up Snyk - uses: snyk/actions/setup@master - with: - snyk-version: latest - - - name: Run Snyk + - name: Run Snyk to check for vulnerabilities + uses: snyk/actions/gradle@master env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - run: snyk test --fail-on=all --all-sub-projects --json > snyk.json + with: + args: --fail-on=all --all-sub-projects + json: true continue-on-error: true - - - uses: contentstack/sca-policy@main + - uses: contentstack/sca-policy@main \ No newline at end of file From 5ebe59dbe151d681ea9ac6bb3fabd3e686e9c2b1 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Mon, 10 Aug 2026 12:44:02 +0530 Subject: [PATCH 3/5] fix: suppress false-positive Snyk hardcoded-password finding in TestError Snyk Code flagged the dummy test fixture value as a hardcoded password (CWE-798). Annotate it with a deepcode ignore comment since it's a test value, not a real credential. Verified with snyk code test and trufflehog that no active/real secrets remain. Co-Authored-By: Claude Sonnet 5 --- contentstack/src/test/java/com/contentstack/sdk/TestError.java | 1 + 1 file changed, 1 insertion(+) diff --git a/contentstack/src/test/java/com/contentstack/sdk/TestError.java b/contentstack/src/test/java/com/contentstack/sdk/TestError.java index d9bca11b..ec0165ed 100644 --- a/contentstack/src/test/java/com/contentstack/sdk/TestError.java +++ b/contentstack/src/test/java/com/contentstack/sdk/TestError.java @@ -283,6 +283,7 @@ public void testNetworkErrorScenario() { public void testValidationErrorScenario() { HashMap validationErrors = new HashMap<>(); validationErrors.put("email", "Invalid email format"); + // deepcode ignore HardcodedPassword: test fixture value, not a real secret validationErrors.put("password", "Password too short"); error.setErrorMessage("Validation failed"); From b17b1c2b6ffd5f7af6947c134dc42e8bc9ebc765 Mon Sep 17 00:00:00 2001 From: reeshika-h Date: Mon, 10 Aug 2026 13:00:00 +0530 Subject: [PATCH 4/5] fix: set up JDK 17 in SCA scan workflow The Snyk Gradle scan job was failing with "Unsupported class file major version 69" because no JDK was configured, so Gradle fell back to whatever Java the runner defaults to. Explicitly set up JDK 17 to match the project's sourceCompatibility and the JDK used in publish-release.yml. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/sca-scan.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml index ea29c143..9ed9d9a2 100644 --- a/.github/workflows/sca-scan.yml +++ b/.github/workflows/sca-scan.yml @@ -10,6 +10,11 @@ jobs: pull-requests: write steps: - uses: actions/checkout@master + - name: Set up JDK 17 + uses: actions/setup-java@v3 + with: + java-version: '17' + distribution: 'adopt' - name: Run Snyk to check for vulnerabilities uses: snyk/actions/gradle@master env: From e9d01e934c674485f057bf58159fb2afed7b2443 Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Mon, 10 Aug 2026 13:24:44 +0530 Subject: [PATCH 5/5] Update sca-scan.yml --- .github/workflows/sca-scan.yml | 39 +++++++++++++++++++++++++++------- 1 file changed, 31 insertions(+), 8 deletions(-) diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml index 9ed9d9a2..9d37d0c8 100644 --- a/.github/workflows/sca-scan.yml +++ b/.github/workflows/sca-scan.yml @@ -10,17 +10,40 @@ jobs: pull-requests: write steps: - uses: actions/checkout@master + - name: Set up JDK 17 - uses: actions/setup-java@v3 + uses: actions/setup-java@v4 with: + distribution: 'temurin' java-version: '17' - distribution: 'adopt' - - name: Run Snyk to check for vulnerabilities - uses: snyk/actions/gradle@master + cache: 'gradle' + + - name: Set up Android SDK + uses: android-actions/setup-android@v3 + with: + packages: 'tools platform-tools platforms;android-34 build-tools;34.0.0' + + - name: Setup local.properties + run: | + cat << EOF >> local.properties + sdk.dir=$ANDROID_HOME + host="${{ secrets.HOST }}" + APIKey="${{ secrets.API_KEY }}" + deliveryToken="${{ secrets.DELIVERY_TOKEN }}" + environment="${{ secrets.ENVIRONMENT }}" + contentType="${{ secrets.CONTENT_TYPE }}" + assetUid="${{ secrets.ASSET_UID }}" + EOF + + - name: Set up Snyk + uses: snyk/actions/setup@master + with: + snyk-version: latest + + - name: Run Snyk env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} - with: - args: --fail-on=all --all-sub-projects - json: true + run: snyk test --fail-on=all --all-sub-projects --json > snyk.json continue-on-error: true - - uses: contentstack/sca-policy@main \ No newline at end of file + + - uses: contentstack/sca-policy@main