[WP12] CI/CD supply-chain & gating: unpinned actions, auto-merge without in-repo build gate, dead branch guard #197

此內容由 AI 產生（specification-mapper 全庫審查 2026-07-16．執行圖）。

Work package WP12 · findings: DEP-02, TEST-01, COR-02 · worst severity: medium · effort: S

From the 2026-07-16 whole-codebase review of branch jakarta (snapshot 7de4a33; modules mapper/ + starter/). Every finding below is CONFIRMED by independent adversarial verification. File:line coordinates are from the snapshot and may have drifted.

Findings

DEP-02 — Third-party actions pinned to mutable tags in a workflow wielding a repo-write token that auto-merges its own PRs (dependencies, medium)

• File: .github/workflows/bump-spring.yml:42
• Evidence: madhead/semver-utils@latest (and other third-party actions on mutable tags) run in a workflow that holds a repo-write App token and auto-merges the PRs it creates — a compromised tag is a supply-chain write path into the repo.

TEST-01 — Dependency-bump PRs auto-merge while the only in-repo PR-triggered check is commitlint (testing, medium)

• File: .github/workflows/bump-spring.yml:91
• Evidence: build/test gating for auto-merged bump PRs depends entirely on out-of-repo Jenkins branch protection.

COR-02 — Jenkins failure notification gated on BRANCH_NAME == 'main', never true on the active jakarta branch (correctness, medium)

• File: Jenkinsfile:157
• Failure scenario: build failures on the active line never notify anyone.

Plan

1. SHA-pin every third-party action in the workflows (full commit SHA with a version comment), including madhead/semver-utils (DEP-02).
2. Add an in-repo PR-triggered build gate: a GitHub Actions workflow running mvn verify on pull requests, so auto-merge has an in-repo status to require (TEST-01). Note for the maintainer: mark the new check required in branch protection (settings change is outside this PR's scope).
3. Fix the Jenkinsfile notification guard to the active primary branch (jakarta, or parameterize on the repository default branch) so failures alert again (COR-02).

Acceptance criteria

• No third-party action remains on a mutable tag.
• A bump PR gets an in-repo build/test status before merge.
• A failing build on jakarta produces the notification.
• Regression: workflows pass on a test PR; make test green.