Skip to content

UID2-8298: bake Maven dependencies and compiled tests into the e2e image - #152

Merged
samin-ttd merged 2 commits into
mainfrom
sra-UID2-8298-allow-daily-scan-to-scan-dependencies
Nov 10, 2026
Merged

samin-ttd merged 2 commits into
mainfrom
sra-UID2-8298-allow-daily-scan-to-scan-dependencies

Conversation

@samin-ttd

@samin-ttd samin-ttd commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Adds a build step to the Dockerfile that runs mvn -B test-compile. The Maven repository and the compiled test classes are now part of the image, so container start no longer downloads dependencies or compiles the test sources.

Why

  • Image scans, including the daily vulnerability scan, only see what is inside the image. With dependencies downloaded at container start, they were never part of the scanned image. Baking them in lets the image scans catch dependency CVEs.
  • A Trivy image scan of the image reports 36 CRITICAL/HIGH findings with this change, against 2 before. The 34 additional findings (4 CRITICAL, 30 HIGH) were previously not caught by the daily image scans.
  • Container start is faster, because the dependencies and test classes are already in the image.

Change

  • New RUN mvn -B test-compile after the sources are copied.
  • CMD, ENV and the base image are unchanged, so docker pull and docker run with --env and --network work as before.

Notes

  • The build step runs no test, so it makes no calls to live endpoints.

🤖 Generated with Claude Code

samin-ttd and others added 2 commits November 10, 2026 16:01
Run a Maven test phase at image build time so the local repository and
compiled test classes are part of the image. Container start no longer
downloads dependencies or compiles the test sources before running the
selected suites.

The build step uses a tag filter that matches no test, so surefire and its
JUnit provider are resolved while nothing is executed. BasicTest is selected
because the suite classes fail when a filter excludes all tests.

CMD, ENV and the base image are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Replace the filtered test phase with test-compile. It resolves the project
and compiler dependencies and compiles the test sources without running
JUnit, and does not depend on any particular test class existing.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@samin-ttd
samin-ttd merged commit a9486d7 into main Nov 10, 2026
6 of 8 checks passed
@samin-ttd
samin-ttd deleted the sra-UID2-8298-allow-daily-scan-to-scan-dependencies branch November 10, 2026 05:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants