stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

semi implemented and features implemented save checkpoint

Browse Source
This commit is contained in:
master
2026-02-08 18:00:49 +02:00
parent 04360dff63
commit 1bf6bbf395
20895 changed files with 716795 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
docs/features/unchecked/scanner/java-lockfile-collector-and-cli-validator.md Normal file
View File

@@ -0,0 +1,23 @@
# Java Lockfile Collector and CLI Validator
## Module
Scanner
## Status
IMPLEMENTED
## Description
Collects and validates Java dependency lockfiles (Gradle lockfile, Maven dependency:tree output) providing a CLI-accessible integrity check for pinned dependency versions.
## Implementation Details
- **Lockfile Collection**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/Internal/JavaLockFileCollector.cs` - `JavaLockFileCollector` collects and validates Gradle lockfiles and Maven dependency:tree outputs for pinned dependency versions
- **Language Analyzer Integration**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/JavaLanguageAnalyzer.cs` - `JavaLanguageAnalyzer` integrates lockfile collection into the analysis pipeline
## E2E Test Plan
- [ ] Scan a container image with a Gradle project containing `gradle.lockfile` and verify pinned dependency versions are collected
- [ ] Scan a Maven project with `dependency:tree` output and verify the lockfile collector parses resolved versions
- [ ] Verify lockfile integrity validation detects tampered or inconsistent lockfile entries
- [ ] Verify lockfile-collected versions take precedence over declared versions when both are available
- [ ] Verify missing lockfile scenarios are handled gracefully with appropriate warnings