Skip to content

chore: adds document section about toolset's auth settings#1300

Open
DmytroZaichenkoDev wants to merge 2 commits intodevelopmentfrom
toolsets-auth-documentation
Open

chore: adds document section about toolset's auth settings#1300
DmytroZaichenkoDev wants to merge 2 commits intodevelopmentfrom
toolsets-auth-documentation

Conversation

@DmytroZaichenkoDev
Copy link
Copy Markdown
Contributor

@DmytroZaichenkoDev DmytroZaichenkoDev commented Dec 24, 2025

Applicable issues

  • fixes #

Description of changes

Checklist

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@ai-dial-actions
Copy link
Copy Markdown
Contributor

ai-dial-actions commented Dec 24, 2025

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 22 package(s) with unknown licenses.
  • ⚠️ 3 packages with OpenSSF Scorecard issues.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License
org.apache.jclouds.api:atmos2.7.3NullUnknown License
org.apache.jclouds.api:filesystem2.7.3NullUnknown License
org.apache.jclouds.api:glacier2.7.3NullUnknown License
org.apache.jclouds.api:oauth2.7.3NullUnknown License
org.apache.jclouds.api:openstack-keystone2.7.3NullUnknown License
org.apache.jclouds.api:openstack-swift2.7.3NullUnknown License
org.apache.jclouds.api:rackspace-cloudfiles2.7.3NullUnknown License
org.apache.jclouds.api:rackspace-cloudidentity2.7.3NullUnknown License
org.apache.jclouds.api:s32.7.3NullUnknown License
org.apache.jclouds.api:sts2.7.3NullUnknown License
org.apache.jclouds.common:googlecloud2.7.3NullUnknown License
org.apache.jclouds.provider:aws-s32.7.3NullUnknown License
org.apache.jclouds.provider:azureblob2.7.3NullUnknown License
org.apache.jclouds.provider:b22.7.3NullUnknown License
org.apache.jclouds.provider:google-cloud-storage2.7.3NullUnknown License
org.apache.jclouds.provider:rackspace-cloudfiles-uk2.7.3NullUnknown License
org.apache.jclouds.provider:rackspace-cloudfiles-us2.7.3NullUnknown License
org.apache.jclouds:jclouds-allblobstore2.7.3NullUnknown License
org.apache.jclouds:jclouds-blobstore2.7.3NullUnknown License
org.apache.jclouds:jclouds-core2.7.3NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
maven/aopalliance:aopalliance 1.0 UnknownUnknown
maven/com.google.inject.extensions:guice-assistedinject 7.0.0 🟢 5.3
Details
CheckScoreReason
Code-Review⚠️ 1Found 5/29 approved changesets -- score normalized to 1
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Pinned-Dependencies🟢 10all dependencies are pinned
Fuzzing🟢 10project is fuzzed
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 28 existing vulnerabilities detected
maven/com.google.inject:guice 7.0.0 🟢 5.3
Details
CheckScoreReason
Code-Review⚠️ 1Found 5/29 approved changesets -- score normalized to 1
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Pinned-Dependencies🟢 10all dependencies are pinned
Fuzzing🟢 10project is fuzzed
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 28 existing vulnerabilities detected
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown
maven/com.sun.istack:istack-commons-runtime 4.1.2 🟢 5.5
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/jakarta.activation:jakarta.activation-api 2.1.3 UnknownUnknown
maven/jakarta.annotation:jakarta.annotation-api 2.0.0 UnknownUnknown
maven/jakarta.inject:jakarta.inject-api 2.0.1 UnknownUnknown
maven/jakarta.ws.rs:jakarta.ws.rs-api 3.0.0 UnknownUnknown
maven/jakarta.xml.bind:jakarta.xml.bind-api 4.0.2 UnknownUnknown
maven/org.apache.jclouds.api:atmos 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:filesystem 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:glacier 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:oauth 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:openstack-keystone 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:openstack-swift 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:rackspace-cloudfiles 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:rackspace-cloudidentity 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:s3 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:sts 2.7.3 UnknownUnknown
maven/org.apache.jclouds.common:googlecloud 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:aws-s3 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:azureblob 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:b2 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:google-cloud-storage 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:rackspace-cloudfiles-uk 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:rackspace-cloudfiles-us 2.7.3 UnknownUnknown
maven/org.apache.jclouds:jclouds-allblobstore 2.7.3 ⚠️ 1.3
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 0project is archived
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ -1no dependencies found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 038 existing vulnerabilities detected
maven/org.apache.jclouds:jclouds-blobstore 2.7.3 ⚠️ 1.3
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 0project is archived
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ -1no dependencies found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 038 existing vulnerabilities detected
maven/org.apache.jclouds:jclouds-core 2.7.3 ⚠️ 1.3
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 0project is archived
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ -1no dependencies found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 038 existing vulnerabilities detected
maven/org.checkerframework:checker-qual 3.43.0 🟢 3.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 6/22 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ -1No tokens found
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts⚠️ -1internal error: failure checking for Gradle wrapper validating Action: failure listing workflow runs: internal error: ListWorkflowRunsByFileName: GET https://api.github.com/repos/typetools/checker-framework/actions/workflows/gradle-wrapper-validation.yml-DISABLED/runs?status=success: 404 Not Found []
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/org.eclipse.angus:angus-activation 2.0.2 🟢 3.3
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/22 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities⚠️ 022 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.glassfish.jaxb:jaxb-core 4.0.5 🟢 5.7
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 6Found 17/25 approved changesets -- score normalized to 6
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/org.glassfish.jaxb:jaxb-runtime 4.0.5 🟢 5.7
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 6Found 17/25 approved changesets -- score normalized to 6
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/org.glassfish.jaxb:txw2 4.0.5 🟢 5.7
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 6Found 17/25 approved changesets -- score normalized to 6
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected

Scanned Files

  • settings.gradle

@DmytroZaichenkoDev DmytroZaichenkoDev marked this pull request as ready for review December 24, 2025 11:49
@ai-dial-actions
Copy link
Copy Markdown
Contributor

ai-dial-actions commented Dec 24, 2025

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 22 package(s) with unknown licenses.
  • ⚠️ 3 packages with OpenSSF Scorecard issues.
See the Details below.

License Issues

settings.gradle

PackageVersionLicenseIssue Type
com.gradle:common-custom-user-data-gradle-plugin2.1NullUnknown License
com.gradle:develocity-gradle-plugin4.2NullUnknown License
org.apache.jclouds.api:atmos2.7.3NullUnknown License
org.apache.jclouds.api:filesystem2.7.3NullUnknown License
org.apache.jclouds.api:glacier2.7.3NullUnknown License
org.apache.jclouds.api:oauth2.7.3NullUnknown License
org.apache.jclouds.api:openstack-keystone2.7.3NullUnknown License
org.apache.jclouds.api:openstack-swift2.7.3NullUnknown License
org.apache.jclouds.api:rackspace-cloudfiles2.7.3NullUnknown License
org.apache.jclouds.api:rackspace-cloudidentity2.7.3NullUnknown License
org.apache.jclouds.api:s32.7.3NullUnknown License
org.apache.jclouds.api:sts2.7.3NullUnknown License
org.apache.jclouds.common:googlecloud2.7.3NullUnknown License
org.apache.jclouds.provider:aws-s32.7.3NullUnknown License
org.apache.jclouds.provider:azureblob2.7.3NullUnknown License
org.apache.jclouds.provider:b22.7.3NullUnknown License
org.apache.jclouds.provider:google-cloud-storage2.7.3NullUnknown License
org.apache.jclouds.provider:rackspace-cloudfiles-uk2.7.3NullUnknown License
org.apache.jclouds.provider:rackspace-cloudfiles-us2.7.3NullUnknown License
org.apache.jclouds:jclouds-allblobstore2.7.3NullUnknown License
org.apache.jclouds:jclouds-blobstore2.7.3NullUnknown License
org.apache.jclouds:jclouds-core2.7.3NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
maven/aopalliance:aopalliance 1.0 UnknownUnknown
maven/com.google.inject.extensions:guice-assistedinject 7.0.0 🟢 5.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 1Found 5/29 approved changesets -- score normalized to 1
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 10all dependencies are pinned
Fuzzing🟢 10project is fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 28 existing vulnerabilities detected
maven/com.google.inject:guice 7.0.0 🟢 5.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 1Found 5/29 approved changesets -- score normalized to 1
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 10all dependencies are pinned
Fuzzing🟢 10project is fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 28 existing vulnerabilities detected
maven/com.gradle:common-custom-user-data-gradle-plugin 2.1 UnknownUnknown
maven/com.gradle:develocity-gradle-plugin 4.2 UnknownUnknown
maven/com.sun.istack:istack-commons-runtime 4.1.2 🟢 5.5
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/jakarta.activation:jakarta.activation-api 2.1.3 UnknownUnknown
maven/jakarta.annotation:jakarta.annotation-api 2.0.0 UnknownUnknown
maven/jakarta.inject:jakarta.inject-api 2.0.1 UnknownUnknown
maven/jakarta.ws.rs:jakarta.ws.rs-api 3.0.0 UnknownUnknown
maven/jakarta.xml.bind:jakarta.xml.bind-api 4.0.2 UnknownUnknown
maven/org.apache.jclouds.api:atmos 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:filesystem 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:glacier 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:oauth 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:openstack-keystone 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:openstack-swift 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:rackspace-cloudfiles 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:rackspace-cloudidentity 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:s3 2.7.3 UnknownUnknown
maven/org.apache.jclouds.api:sts 2.7.3 UnknownUnknown
maven/org.apache.jclouds.common:googlecloud 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:aws-s3 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:azureblob 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:b2 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:google-cloud-storage 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:rackspace-cloudfiles-uk 2.7.3 UnknownUnknown
maven/org.apache.jclouds.provider:rackspace-cloudfiles-us 2.7.3 UnknownUnknown
maven/org.apache.jclouds:jclouds-allblobstore 2.7.3 ⚠️ 1.3
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 0project is archived
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ -1no dependencies found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 038 existing vulnerabilities detected
maven/org.apache.jclouds:jclouds-blobstore 2.7.3 ⚠️ 1.3
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 0project is archived
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ -1no dependencies found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 038 existing vulnerabilities detected
maven/org.apache.jclouds:jclouds-core 2.7.3 ⚠️ 1.3
Details
CheckScoreReason
Code-Review⚠️ 0Found 2/30 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 0project is archived
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ -1no dependencies found
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities⚠️ 038 existing vulnerabilities detected
maven/org.checkerframework:checker-qual 3.43.0 🟢 3.4
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 2Found 6/22 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow⚠️ -1no workflows found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ -1No tokens found
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts⚠️ -1internal error: failure checking for Gradle wrapper validating Action: failure listing workflow runs: internal error: ListWorkflowRunsByFileName: GET https://api.github.com/repos/typetools/checker-framework/actions/workflows/gradle-wrapper-validation.yml-DISABLED/runs?status=success: 404 Not Found []
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/org.eclipse.angus:angus-activation 2.0.2 🟢 3.3
Details
CheckScoreReason
Code-Review⚠️ 2Found 5/22 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Vulnerabilities⚠️ 022 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
maven/org.glassfish.jaxb:jaxb-core 4.0.5 🟢 5.7
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 6Found 17/25 approved changesets -- score normalized to 6
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/org.glassfish.jaxb:jaxb-runtime 4.0.5 🟢 5.7
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 6Found 17/25 approved changesets -- score normalized to 6
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected
maven/org.glassfish.jaxb:txw2 4.0.5 🟢 5.7
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Code-Review🟢 6Found 17/25 approved changesets -- score normalized to 6
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities🟢 100 existing vulnerabilities detected

Scanned Files

  • settings.gradle

@taa-epam
Copy link
Copy Markdown

taa-epam commented Mar 24, 2026 •
edited by ai-dial-actions
Loading

/deploy-review

GitHub actions run: 23482468376

Stage Status
deploy-review Success ✅
chat Failed ❌

@tataranovich
Copy link
Copy Markdown
Contributor

tataranovich commented Mar 31, 2026 •
edited by ai-dial-actions
Loading

/deploy-review

GitHub actions run: 23797590368

Stage Status
deploy-review Success ✅
chat Success ✅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@astsiapanay astsiapanay astsiapanay approved these changes

@artsiomkorzun artsiomkorzun Awaiting requested review from artsiomkorzun

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@DmytroZaichenkoDev @ai-dial-actions @taa-epam @tataranovich @astsiapanay