Add GitHub Actions build/release workflows, bump version to 1.0 - #7
Merged
Conversation
- build.yml: builds jar with Maven on push/PR to main - release.yml: on v* tag push, builds jar and publishes a GitHub Release with it attached - bump pom.xml version from 1.0-SNAPSHOT to 1.0
…ings CI builds with JDK 8 per pom.xml's maven.compiler.source/target, but String.repeat() requires Java 11+. Only compiled locally due to a newer JDK.
- pom.xml: source/target bumped from 1.8 to 17 - CI workflows: JDK 17 instead of JDK 8 - restore String.repeat() usage now that Java 11+ APIs are available - docs updated from Java 8+ to Java 17+
Renames com.contrastsecurity.bomsquad -> com.contrastsecurity.runtimeanalyst, the Maven artifact/jar (bom-squad -> runtime-analyst), and the GitHub repo (Contrast-Security-OSS/bom-squad -> Contrast-Security-OSS/runtime-analyst). Updates CI workflows, README, and CLAUDE.md accordingly.
jason-at-contrast
left a comment
jason-at-contrast
left a comment
Collaborator
There was a problem hiding this comment.
looks like just two minor changes removing eval and replacing it with "your-instance" or something like that.
Addresses PR #7 review comments from jason-at-contrast.
Drives a real, visible Chromium window through the user's own login (including SSO/MFA), then reads their personal API key/service key/org id straight off the User Settings > Your Keys page DOM. The visible browser is used only for login; once the org UUID appears in the post-login URL, its session cookies are exported via storageState() and the visible browser is closed immediately - the account-page navigation and scraping happen in a second, genuinely headless browser reusing those cookies, so nothing past the login screen itself ever renders on screen. Verifies the scraped credentials against a real API call before writing contrast.properties.
Collaborator
|
looks great, and I'll test it out later today :) |
Collaborator
|
For my review to take, I need "write" access hehe but no worries |
…missing, revamp README Playwright bump: 1.49.0 -> 1.62.0 (Chromium 131 -> Chrome for Testing 151). The old pinned version was ~13 minor releases and ~20 Chromium majors behind. AuthCommand now auto-installs the browser binary itself (in a separate JVM process, since Playwright's CLI.main() calls System.exit() internally and would otherwise kill this whole run) the first time it's missing, instead of telling the user to run a separate install command - no extra manual step for a first-time user. Main now runs auth automatically the first time cbom/aibom don't find a contrast.properties (respecting -c), then proceeds with the command actually requested - skipped for -h/--help. README: rewritten from scratch (purpose, --help output, authentication/usage, per-subcommand examples, then reference sections), with Why Contrast moved up near the top.
jason-at-contrast
self-requested a review
September 2, 2026 17:15
jason-at-contrast
approved these changes
Sep 2, 2026
jason-at-contrast
left a comment
jason-at-contrast
left a comment
Collaborator
There was a problem hiding this comment.
After the update of the eval to your-instance, everything looks good.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds two workflows:
build.yml: builds the jar with Maven on push/PR tomainrelease.yml: on push of av*tag, builds the jar and publishes a GitHub Release with it attachedAlso bumps
pom.xmlversion from1.0-SNAPSHOTto1.0(and updates README references to the jar filename) so the first tagged release ships a proper 1.0 build rather than a SNAPSHOT.