wrongsecrets-binaries/.github/workflows/compile_java.yml at main · OWASP/wrongsecrets-binaries · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
name: "Compile Java"

on:
  workflow_dispatch:
  push:
    paths:
      - 'java/**'
      - '.github/**'
  pull_request:

permissions:
  contents: read

jobs:
  lint:
    name: Lint (Spotless / Google Java Format)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      # google-java-format uses internal javac APIs removed in JDK 26, so run
      # the lint step on Java 26. Our source code has no Java-26-specific syntax.
      - name: Set up Java 26
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
        with:
          distribution: 'temurin'
          java-version: '26'

      - name: Lint plain module
        run: |
          cd java/plain
          ./mvnw spotless:check -q

      - name: Lint obfuscated module
        run: |
          cd java/obfuscated
          ./mvnw spotless:check -q

  compile:
    name: Compile
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Java 26
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
        with:
          distribution: 'temurin'
          java-version: '26'

      - name: Compile plain module
        run: |
          cd java/plain
          ./mvnw compile -q

      - name: Compile obfuscated module
        run: |
          cd java/obfuscated
          ./mvnw compile -q

  test:
    name: Test
    runs-on: ubuntu-latest
    needs: compile
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Java 26
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
        with:
          distribution: 'temurin'
          java-version: '26'

      - name: Test plain module
        run: |
          cd java/plain
          ./mvnw test -q

      - name: Test obfuscated module
        run: |
          cd java/obfuscated
          ./mvnw test -q

  build-java:
    name: Build JARs (Alpine-compatible)
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up Java 26
        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad
        with:
          distribution: 'temurin'
          java-version: '26'

      - name: Build plain Java JAR
        run: |
          mkdir -p target
          cd java/plain
          ./mvnw package -q -DskipTests
          cp target/wrongsecrets-java.jar ../../target/wrongsecrets-java.jar
          cd ../..

      - name: Build obfuscated Java JAR
        run: |
          cd java/obfuscated
          ./mvnw package -q -DskipTests
          cp target/wrongsecrets-java-obfuscated.jar ../../target/wrongsecrets-java-obfuscated.jar
          cd ../..

      - name: Build CTF plain Java JAR
        run: |
          echo "Generating CTF secrets..."
          ./generate_ctf_secrets.sh generate
          cd java/plain
          ./mvnw package -q -DskipTests
          cp target/wrongsecrets-java.jar ../../target/wrongsecrets-java-ctf.jar
          cd ../..
          # Restore original files
          ./generate_ctf_secrets.sh restore

      - name: Build CTF obfuscated Java JAR
        run: |
          echo "Generating CTF secrets..."
          ./generate_ctf_secrets.sh generate
          cd java/obfuscated
          ./mvnw package -q -DskipTests
          cp target/wrongsecrets-java-obfuscated.jar ../../target/wrongsecrets-java-obfuscated-ctf.jar
          cd ../..
          # Restore original files
          ./generate_ctf_secrets.sh restore

      - name: Validate on Alpine (plain)
        run: |
          docker run --rm -v "$(pwd)/target:/target" eclipse-temurin:26-jre-alpine \
            sh -c "
              echo '=== Plain JAR ===' && \
              java -jar /target/wrongsecrets-java.jar && \
              java -jar /target/wrongsecrets-java.jar spoil && \
              java -jar /target/wrongsecrets-java.jar 'This is the secret in Java' && \
              java -jar /target/wrongsecrets-java.jar guess 'This is the secret in Java' && \
              java -jar /target/wrongsecrets-java.jar 'wrongguess'
            "

      - name: Validate on Alpine (obfuscated)
        run: |
          docker run --rm -v "$(pwd)/target:/target" eclipse-temurin:26-jre-alpine \
            sh -c "
              echo '=== Obfuscated JAR ===' && \
              java -jar /target/wrongsecrets-java-obfuscated.jar && \
              java -jar /target/wrongsecrets-java-obfuscated.jar spoil && \
              java -jar /target/wrongsecrets-java-obfuscated.jar 'This is a harder secret in Java' && \
              java -jar /target/wrongsecrets-java-obfuscated.jar guess 'This is a harder secret in Java' && \
              java -jar /target/wrongsecrets-java-obfuscated.jar 'wrongguess'
            "

      - name: Upload Java JAR artifacts
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
        with:
          name: executable-Java-JARs
          path: target/*.jar

  verify-jars:
    name: Download and verify JAR artifacts
    runs-on: ubuntu-latest
    needs: build-java
    steps:
      - name: Download Java JAR artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
        with:
          name: executable-Java-JARs
          path: jars/

      - name: List downloaded JARs
        run: |
          echo "Downloaded JARs:"
          ls -lh jars/*.jar

      - name: Verify all four JARs are present
        run: |
          for jar in \
            wrongsecrets-java.jar \
            wrongsecrets-java-obfuscated.jar \
            wrongsecrets-java-ctf.jar \
            wrongsecrets-java-obfuscated-ctf.jar; do
            if [ ! -f "jars/$jar" ]; then
              echo "ERROR: missing $jar"
              exit 1
            fi
            echo "OK: $jar ($(du -h "jars/$jar" | cut -f1))"
          done