Update artifactory-oidc to extract existing settings.xml info - #20
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Missing or failing xmllint can silently erase the configuration this change intends to preserve.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Preserves selected Maven settings when configuring Artifactory OIDC.
Changes:
- Extracts existing servers, profiles, and active profiles.
- Reinjects them into the generated Maven settings.
File summaries
| File | Description |
|---|---|
artifactory-oidc/action.yml |
Extracts and passes existing Maven configuration. |
artifactory-oidc/maven-settings.xml.tmpl |
Adds placeholders for preserved configuration. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![semgrep-code-twilio[bot]](https://avatars.githubusercontent.com/u/109142?s=60&v=4){kind=small}
|
|
||
| def main() -> None: | ||
| path, tag = sys.argv[1], sys.argv[2] | ||
| root = ET.parse(path).getroot() |
There was a problem hiding this comment.
The native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using defusedxml.
🥳 Removed in commit 2e26cfc 🥳
Leveraging the
setup-javaaction to set up your Maven Central server/creds causes an important ~/.m2/settings.xml file to be created. The Artifactory-OIDC actions blows away that file.This PR adds support to Artifactory-OIDC action to pull relevant information from the existing
settings.xmlbefore generating its own. It only pulls out the XML children thatsetup-java, as of today, supports.Code that generates settings.xml in the setup-java action: https://github.com/actions/setup-java/blob/273229181560643261a71a1544c22304f2a40df8/src/auth.ts#L276-L367
Tried it out over here: https://github.com/twilio/twilio-java/actions/runs/33680358222/job/100415155935