Skip to content

Fold groovy-sandbox into script-security-plugin - #926

Draft
gbhat618 wants to merge 271 commits into
jenkinsci:masterfrom
gbhat618:fold-groovy-sandbox
Draft

Fold groovy-sandbox into script-security-plugin#926
gbhat618 wants to merge 271 commits into
jenkinsci:masterfrom
gbhat618:fold-groovy-sandbox

Conversation

@gbhat618

@gbhat618 gbhat618 commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

This PR merges the https://github.com/jenkinsci/groovy-sandbox into script-security-plugin (here) as this is the single consumer(*) and the sole way of shipping any changes in groovy-sandbox. Keeping the groovy-sandbox added friction in delivering bug fixes. Especially security fixes needed very careful attention to stage the groovy-sandbox release, and then consume it in script-security-plugin and stage script-security-plugin release.

This PR folds the groovy-sandbox library into a folder here with the same name groovy-sandbox/. The existing script-security-plugin source code is moved to plugin/

(*) Though there is workflow-cps/lib/ which is one other (optional) user for groovy-sandbox this change still publishes groovy-sandbox so it should be no changes to consumer.
https://github.com/jenkinsci/workflow-cps-plugin/blob/30c8c00684a37764a1083dd40b496ccdccc90dd7/lib/pom.xml#L58-L63

Procedure

The following 3 commits are the important, below are details of how they are produced.

  • commit1 182212e : moved the script-security-plugin source code into plugin/ folder, introduced the parent pom.xml and adjusted the relationship between plugin/pom.xml. mvn clean package works.
     mkdir plugin
     git mv src       plugin/src
     git mv pom.xml   plugin/pom.xml
     git mv README.md plugin/README.md
    
     # adjust the pom.xml
    
     git add .
     git commit -m "Restructure into a multi-module project"
    
  • commit2 8d0f97c : prepares by coping the groovy-sandbox repo history into groovy-sandbox/ doesn't fix the module yet.
    git remote add groovy-sandbox-upstream https://github.com/jenkinsci/groovy-sandbox.git
    git fetch groovy-sandbox-upstream
    git merge -s ours --no-commit --allow-unrelated-histories groovy-sandbox-upstream/master
    git read-tree --prefix=groovy-sandbox/ -u groovy-sandbox-upstream/master
    git commit -m "Merge groovy-sandbox history into groovy-sandbox/ subdirectory"
    
  • commit3 1f81ac0 : removes unneded files from groovy-sandbox/ and adjusts all 3 pom.xml to make it locally built, and consumed.
    git rm -r groovy-sandbox/.mvn
    git rm -r groovy-sandbox/.github
    git rm groovy-sandbox/Jenkinsfile
    git rm groovy-sandbox/.gitignore
    
    # fix all 3 pom
    
    git add .
    git commit -m "Integrate groovy-sandbox as a module of script-security-plugin"
    

Checklist

  • Verify this PR is actually preserving history and commits correctly
  • jenkins-infra/repository-permissions-updater PR
  • jenkinsci/groovy-sandbox remove source code and update README
  • Verify PCT test run passes
  • Push old groovy-sandbox version tags into this repo
  • Archive jenkinsci/groovy-sandbox on GitHub

Testing done

mvn clean verify passes, all tests of both groovy-sandbox and plugin are executed.

Submitter checklist

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests that demonstrate the feature works or the issue is fixed

kohsuke and others added 30 commits June 9, 2012 11:29
Looks like Groovy is failing to handle var arg correctly if the actual
arguments that match the vararg is a single null value.

Instead of creating [null], it just passes in null.
Groovy being dynamic language means it cannot properly handle the situation when a single Object[] argument is given where a function expects var arg

    int foo(Object... args) { return args.length }

In Java,

    foo(new Object[3])==3
    foo((Object)new Object[3])==1

but Groovy naturally cannot do this. The use of var-args in Checker.checkedCall method was triggering this issue.
I removed var args from these methods to avoid the problem. Unfortunately Groovy doesn't support literal array syntax of
new Object[]{1,2,3}, so this involves creating a list only to convert to an array.
I'm resolving this issue by not passing such calls to interceptors.
While internally I discovered that Groovy handles null.foo() as if
NullObject.INSTANCE.foo(), but I don't think there's value in making
interceptors aware of this weird case.

as null LHS is unlikely to require any protection, this should be safe.
dwnusbaum and others added 30 commits October 25, 2022 16:31
…closures

Fix interception of return statements in closures
Co-authored-by: Carroll Chiou <cchiou@cloudbees.com>
Bumps [git-changelist-maven-extension](https://github.com/jenkinsci/incrementals-tools) from 1.4 to 1.6.
- [Release notes](https://github.com/jenkinsci/incrementals-tools/releases)
- [Commits](jenkinsci/incrementals-tools@parent-1.4...parent-1.6)

---
updated-dependencies:
- dependency-name: io.jenkins.tools.incrementals:git-changelist-maven-extension
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…jenkinsci#60)

* Declare closure parameters when visiting closures

Fixes jenkinsci#59

* Avoid calling super on types where that results in expressions being visited twice

* Revert unnecessary changes to make the PR more focused
[JENKINS-70080] Do not generate invalid bytecode for field assignments that use compound operators
…enkins.tools.incrementals-git-changelist-maven-extension-1.6

Bump git-changelist-maven-extension from 1.4 to 1.6
Co-authored-by: Devin Nusbaum <dwnusbaum@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.