- name
- java-supply-chain-security
- description
- Use when reviewing Maven or Gradle dependency risk, SBOM coverage, vulnerability findings, or Java release provenance. Covers compatible remediation and CI trust boundaries; container runtime configuration belongs to the deployment skill.
Java Supply Chain Security
Version boundary
Target Spring Boot 3 with Spring Framework 6 and Spring Security 6. Resolve the actual Boot BOM and dependency graph first. Do not transplant Boot 4 coordinates or unmanaged framework versions into Boot 3. The offline Python helper is version-independent and requires Python 3.10+.
Inspect before executing
A build can execute plugins, annotation processors, wrapper downloads and tests. Review an unfamiliar repository's build and CI configuration before running it in an isolated environment without secrets. Do not run untrusted pull-request code in privileged release jobs. Obtain approval for dependency changes, publishing, external uploads or other actions outside the requested review.
Dependency and release workflow
- Record commit, wrapper/build-tool version, JDK, Boot BOM and resolved dependency graph. Distinguish application runtime, test, build-plugin and container OS dependencies.
- Use the project's pinned CycloneDX Maven/Gradle integration to generate an SBOM for the packaged artifact. For Maven reactors, review makeAggregateBom configuration, included scopes and skipped modules. Check shaded/bundled libraries and final images separately; a source dependency list alone may miss shipped content.
- Correlate scanner findings to package coordinates, installed versions, advisory source, affected ranges, scanner/database timestamp and deployed artifact digest. Check upstream advisories. Record reachability and exploitability as unknown unless supported.
- Prefer a supported Boot patch/BOM update over isolated Spring dependency overrides. If an override is necessary, document compatibility constraints, an owner and expiry, and test the affected integration. Do not suppress an alert merely to make CI green.
- Compare before/after resolved graphs and SBOMs. Compile, test and scan the rebuilt artifact. A successful build alone does not prove that a vulnerable transitive dependency was removed.
- Review least-privilege CI tokens, immutable action references, protected publishing jobs, provenance and artifact-signature verification against a trusted identity/issuer policy. Generating a signature without checking the expected signer is not verification.
- For accepted risks, record scope, rationale, compensating controls, accountable owner and review deadline. Do not promise zero vulnerabilities or treat an SBOM as a scan result.