Stop executing fork-controlled Maven in the privileged fork Sonar workflow (#232)

[AndreasIgel]

Summary

Fixes the SonarCloud S7631 finding on .github/workflows/fork-sonar.yml (new-code Security rating C) by removing every execution of fork-controlled content from the privileged workflow_run job, while keeping the fork-ci required-reviewer gate and the artifact-based design unchanged.

Analysis (issue #232, step 1)

The finding is real, not a false positive: the old workflow checked out refs/pull/N/head and ran mvn ... sonar-maven-plugin:sonar --file pom.xml with SONAR_TOKEN in the environment. Even with -DskipTests, Maven on a fork tree executes code the fork controls:

• .mvn/extensions.xml / <build><extensions> — arbitrary jars loaded into the Maven process
• .mvn/maven.config / .mvn/jvm.config — arbitrary flags, e.g. -javaagent:
• pom.xml plugin bindings — any plugin/execution bound to phases run by the Sonar goal (it forks a build), or <pluginRepositories> pointing at attacker-hosted plugins
• mvnw wrapper scripts (not used today, but trivially added by a PR)

The required-reviewer gate reduces likelihood but not impact: a maintainer approving a plausible-looking PR cannot review .mvn/ config or plugin coordinates for exfiltration intent. The rule flags the pattern for exactly that reason.

Options considered (step 2)

Option	Verdict
(a) Ship sources in the artifact, no checkout at all	Sonar PR analysis needs SCM data to compute changed lines / blame; without .git it warns SCM provider autodetection failed and reports 0 new lines, so PR decoration and the new-code gate become meaningless. Also duplicates data already present in refs/pull/N/head. Rejected.
(b) Standalone scanner, no Maven on the fork pom	Eliminates all code-execution vectors above; keeps SCM info; fits the "restore, don't rebuild" design. Chosen.
(c) Mark "safe" in SonarCloud	Would leave a genuine pwn-request path in place and depend on the human gate alone. Rejected.

Key insight: the problem was never checking out the fork tree (that only writes files), it was running a build tool on it. The fix therefore separates the two.

Implementation (step 3)

fork-sonar.yml now:

checkout            → base repo default branch (trusted), fetch-depth 0
mvn (trusted pom)   → -pl core install; -pl processor dependency:build-classpath
                      (excludes io.github.java-helpers so no stale/self jars)
git fetch           → refs/pull/N/head ; assert FETCH_HEAD == pr_head_sha from artifact
git checkout        → --detach FETCH_HEAD  (files + SCM history only, nothing run)
restore             → classes, test-classes, jacoco xml from artifact
write               → $RUNNER_TEMP/sonar-project.properties (mirrors pom <properties>)
sonarqube-scan-action → -Dproject.settings=$RUNNER_TEMP/... -Dsonar.pullrequest.*

Why each piece matters:

• Maven only ever sees the trusted pom.xml: it runs before the fork tree exists in the workspace. The classpath it produces is what gives the Java analyzer full type resolution; a dependency added by the fork PR is simply unresolved (analysis degrades, nothing is downloaded on the fork's behalf).
• pr_head_sha is now validated (^[0-9a-f]{40}$) and asserted against refs/pull/N/head, so the analysed sources match the artifact's bytecode even if the PR was force-pushed between the CI run and the approval.
• project.settings outside the workspace — with it set, the scanner ignores any sonar-project.properties in the fork tree. This matters because that file can set sonar.scanner.javaExePath (i.e. "run this binary"), which would otherwise be a new fork-controlled execution vector.
• maven.yml additionally ships core/processor target/test-classes so the standalone scanner gets sonar.java.test.binaries (previously provided implicitly by the Maven plugin).

Sonar properties duplicated from the root pom.xml are called out in a comment and in docs/CONTRIBUTING.md; the docs section now records the security model and this decision.

Validation

• actionlint clean on both workflows.
• Classpath resolution command verified locally against main (30 jars, no simple-builders-* self-references).
• Not yet validated against a real fork PR run — that requires a PR from a fork after this lands on main (workflow_run uses the base-branch workflow file) plus a maintainer approval in the fork-ci environment. Please check the SonarCloud PR decoration shows changed lines and coverage on the first such run.

Closes #232.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 65704a7.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/fork-sonar.yml

Package	Version	License	Issue Type
SonarSource/sonarqube-scan-action	22918119ff8e1ca75a623e15c8296b6ea4fbe28f	LGPL-3.0	Incompatible License

Allowed Licenses:

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0

OpenSSF Scorecard

Package	Version	Score	Details
actions/SonarSource/sonarqube-scan-action	22918119ff8e1ca75a623e15c8296b6ea4fbe28f	🟢 6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 5 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST 🟢 8 SAST tool is not run on all commits -- score normalized to 8

Scanned Files

• .github/workflows/fork-sonar.yml