release: 发布 0.5.2 版本.

CVE-2022-42004 漏洞报告指出, 由于 jackson-databind 的有关错误, 导致对象序列化过程可能存在数据错误的问题,
目前 jackson-databind 已发布 2.13.4.2 版本以解决该问题, 由于引入 jackson-databind 的 telegrambots 库尚未发布针对该问题的修复版本,
故在本项目中引入新版依赖项, 以确保用户不受该问题影响.
该版本已在 TelegramBots 项目(版本 6.1.0)中进行测试, 测试通过.
------------------------------------------
https://devhub.checkmarx.com/cve-details/CVE-2022-42004/

.dockerignore

@@ -0,0 +1,2 @@
+**/
+!scalabot-app/build/install/

.github/workflows/build-and-test.yml

@@ -18,17 +18,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up JDK 11
-      uses: actions/setup-java@v3
-      with:
-        java-version: '11'
-        distribution: 'adopt-hotspot'
-        cache: 'gradle'
-    - name: Grant execute permission for gradlew
-      run: chmod +x gradlew
-    - name: Build and test
-      uses: gradle/gradle-build-action@v2.2.1
-      with:
-        gradle-version: 'wrapper'
-        arguments: test
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build and test
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: test

.github/workflows/create-release.yml

@@ -0,0 +1,65 @@
+name: Create release draft
+
+on:
+  push:
+    tags:
+      - 'v[0-9]+.[0-9]+.[0-9]+*'
+
+# 该 Action 有以下步骤：
+# 1. 拉取并构建代码, 然后生成 Application 发行包;
+# 2. 创建 Release, 并标记为 Draft(草稿);
+# 3. 上传 Application 发行包;
+
+permissions:
+  contents: write
+
+jobs:
+  create-release:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      # 创建更新日志.
+      - name: 'Get Previous tag'
+        id: previous-tag
+        uses: younited/get-previous-tag-action@v1.0.0
+        with:
+          match: "v*.*.*"
+      - name: Set up Python 3
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
+      - name: Install Commitizen
+        run: pip install -U commitizen
+      - name: Create Change log
+        run: cz ch --start-rev ${{ steps.previous-tag.outputs.previous-tag }} --file-name ${{ github.workspace }}/CURRENT_CHANGELOG.md
+
+      # 开始构建项目.
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build and test
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: clean test assembleDist
+
+      # 创建新的发行版本
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          draft: true
+          body_path: ${{ github.workspace }}/CURRENT_CHANGELOG.md
+          files: |
+            */build/distributions/*
+            */build/libs/*

.github/workflows/gradle-wrapper-validation.yml

@@ -1,10 +0,0 @@
-name: "Validate Gradle Wrapper"
-on: [push, pull_request]
-
-jobs:
-  validation:
-    name: "Validation"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - uses: gradle/wrapper-validation-action@v1

.github/workflows/publish-artifacts.yml

@@ -0,0 +1,49 @@
+name: Publish artifacts
+
+on:
+  release:
+    types:
+      - published
+
+env:
+  IMAGE_NAME: lamgc/scalabot
+
+jobs:
+  publish-container-image:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build and test
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: clean test installDist
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker BuildX
+        uses: docker/setup-buildx-action@v2
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push container image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          tags: ${{ env.IMAGE_NAME }}:latest, ${{ env.IMAGE_NAME }}:${{ github.ref_name }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/release-dev-container-image.yml

@@ -0,0 +1,49 @@
+name: Build development version container image
+
+on:
+  push:
+    branches:
+      - "main"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'adopt-hotspot'
+          cache: 'gradle'
+      - uses: gradle/wrapper-validation-action@v1
+      - name: Grant execute permission for gradlew
+        run: chmod +x gradlew
+      - name: Build project and install Distribution package
+        uses: gradle/gradle-build-action@v2.2.1
+        with:
+          gradle-version: 'wrapper'
+          arguments: installDist
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker BuildX
+        uses: docker/setup-buildx-action@v2
+      - name: Login to DockerHub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Build and push container image
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          push: true
+          tags: lamgc/scalabot:dev
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Dockerfile

@@ -0,0 +1,8 @@
+FROM openjdk:18
+
+ENV BOT_DATA_PATH /scalabot/data/
+WORKDIR /scalabot/run/
+
+CMD ["/scalabot/app/bin/scalabot-app"]
+
+COPY scalabot-app/build/install/scalabot-app/ /scalabot/app/

build.gradle.kts

@@ -12,5 +12,5 @@ allprojects {
 
     }
     group = "net.lamgc"
-    version = "0.5.0"
+    version = "0.5.2"
 }

scalabot-app/build.gradle.kts

@@ -10,9 +10,9 @@ dependencies {
     implementation(project(":scalabot-meta"))
     implementation(project(":scalabot-extension"))
 
-    implementation("org.slf4j:slf4j-api:1.7.36")
+    implementation("org.slf4j:slf4j-api:2.0.0")
     implementation("io.github.microutils:kotlin-logging:2.1.23")
-    implementation("ch.qos.logback:logback-classic:1.2.11")
+    implementation("ch.qos.logback:logback-classic:1.4.0")
 
     val aetherVersion = "1.1.0"
     implementation("org.eclipse.aether:aether-api:$aetherVersion")
@@ -23,7 +23,7 @@ dependencies {
     implementation("org.eclipse.aether:aether-connector-basic:$aetherVersion")
     implementation("org.apache.maven:maven-aether-provider:3.3.9")
 
-    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.2")
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.4")
     implementation("org.jetbrains.kotlin:kotlin-reflect:1.6.20")
     implementation("com.google.code.gson:gson:2.9.0")
 
@@ -32,11 +32,15 @@ dependencies {
     implementation("org.telegram:telegrambots-abilities:6.1.0")
     implementation("org.telegram:telegrambots:6.1.0")
 
-    implementation("io.prometheus:simpleclient:0.15.0")
-    implementation("io.prometheus:simpleclient_httpserver:0.15.0")
+    // Added as a mitigation measure for vulnerabilities.
+    // When the relevant reference dependency updates it, it will be removed.
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.13.4.2")
+
+    implementation("io.prometheus:simpleclient:0.16.0")
+    implementation("io.prometheus:simpleclient_httpserver:0.16.0")
 
     testImplementation(kotlin("test"))
-    testImplementation("io.mockk:mockk:1.12.4")
+    testImplementation("io.mockk:mockk:1.12.7")
     testImplementation("com.github.stefanbirkner:system-lambda:1.2.1")
 }
 

scalabot-app/src/main/kotlin/AppConfigs.kt

@@ -1,7 +1,6 @@
 package net.lamgc.scalabot
 
 import ch.qos.logback.core.PropertyDefinerBase
-import com.google.common.net.InternetDomainName
 import com.google.gson.Gson
 import com.google.gson.GsonBuilder
 import com.google.gson.JsonArray
@@ -16,9 +15,9 @@ import org.eclipse.aether.repository.RepositoryPolicy
 import org.telegram.telegrambots.bots.DefaultBotOptions
 import java.io.File
 import java.net.URL
-import java.net.URLEncoder
 import java.nio.charset.StandardCharsets
 import java.util.concurrent.atomic.AtomicBoolean
+import java.util.concurrent.atomic.AtomicInteger
 import java.util.function.Supplier
 import kotlin.reflect.KProperty
 
@@ -45,7 +44,7 @@ internal fun ProxyConfig.toAetherProxy(): Proxy? {
 
 internal fun MavenRepositoryConfig.toRemoteRepository(proxyConfig: ProxyConfig? = null): RemoteRepository {
     val repositoryId = if (id == null) {
-        val generatedRepoId = createDefaultRepositoryId(url)
+        val generatedRepoId = createDefaultRepositoryId()
         log.debug { "仓库 Url `$url` 未设置仓库 Id, 已分配缺省 Id: $generatedRepoId" }
         generatedRepoId
     } else {
@@ -93,11 +92,10 @@ private fun checkRepositoryLayout(layoutType: String): String {
     return type
 }
 
-private fun createDefaultRepositoryId(url: URL): String {
-    val topPrivateDomain = InternetDomainName.from(url.host).topPrivateDomain().toString()
-    return "Repository-${URLEncoder.encode(topPrivateDomain, StandardCharsets.UTF_8)}-${
-        url.toString().hashCode().toString(16)
-    }"
+private val repoNumberGenerator = AtomicInteger(1)
+
+private fun createDefaultRepositoryId(): String {
+    return "Repository-${repoNumberGenerator.getAndIncrement()}"
 }
 
 /**

scalabot-ext-example/build.gradle.kts

@@ -5,7 +5,7 @@ plugins {
 dependencies {
     compileOnly(project(":scalabot-extension"))
 
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.2")
+    testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.0")
     testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
 }
 

scalabot-extension/build.gradle.kts

@@ -4,14 +4,20 @@ plugins {
     jacoco
     `maven-publish`
     signing
+    id("org.jetbrains.kotlinx.binary-compatibility-validator") version "0.11.1"
 }
 
 dependencies {
+    implementation("commons-codec:commons-codec:1.15")
     api("org.telegram:telegrambots-abilities:6.1.0")
-    api("org.slf4j:slf4j-api:1.7.36")
+    api("org.slf4j:slf4j-api:2.0.0")
 
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.2")
-    testImplementation("org.mockito:mockito-core:4.6.1")
+    // Added as a mitigation measure for vulnerabilities.
+    // When the relevant reference dependency updates it, it will be removed.
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.13.4.2")
+
+    testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.0")
+    testImplementation("org.mockito:mockito-core:4.7.0")
     testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
 }
 

scalabot-meta/build.gradle.kts

@@ -4,6 +4,7 @@ plugins {
     id("org.jetbrains.dokka") version "1.7.0"
     `maven-publish`
     signing
+    id("org.jetbrains.kotlinx.binary-compatibility-validator") version "0.11.1"
 }
 
 dependencies {
@@ -13,14 +14,18 @@ dependencies {
 
     implementation("org.telegram:telegrambots-meta:6.1.0")
 
+    // Added as a mitigation measure for vulnerabilities.
+    // When the relevant reference dependency updates it, it will be removed.
+    implementation("com.fasterxml.jackson.core:jackson-databind:2.13.4.2")
+
     api("com.google.code.gson:gson:2.9.0")
 
     testImplementation(kotlin("test"))
-    testImplementation("io.mockk:mockk:1.12.4")
-    testImplementation("org.junit.jupiter:junit-jupiter-api:5.8.2")
-    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:5.8.2")
+    testImplementation("io.mockk:mockk:1.12.7")
+    testImplementation("org.junit.jupiter:junit-jupiter-api:5.9.0")
+    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine:5.9.0")
 
-    dokkaHtmlPlugin("org.jetbrains.dokka:javadoc-plugin:1.7.0")
+    dokkaHtmlPlugin("org.jetbrains.dokka:javadoc-plugin:1.7.10")
 }
 
 tasks.withType<org.jetbrains.kotlin.gradle.tasks.KotlinCompile>().configureEach {