From 5ebe59dbe151d681ea9ac6bb3fabd3e686e9c2b1 Mon Sep 17 00:00:00 2001
From: reeshika-h <reeshika.hosmani@contentstack.com>
Date: Mon, 10 Aug 2026 12:44:02 +0530
Subject: [PATCH 1/3] fix: suppress false-positive Snyk hardcoded-password
 finding in TestError

Snyk Code flagged the dummy test fixture value as a hardcoded password
(CWE-798). Annotate it with a deepcode ignore comment since it's a test
value, not a real credential. Verified with snyk code test and
trufflehog that no active/real secrets remain.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 contentstack/src/test/java/com/contentstack/sdk/TestError.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contentstack/src/test/java/com/contentstack/sdk/TestError.java b/contentstack/src/test/java/com/contentstack/sdk/TestError.java
index d9bca11b..ec0165ed 100644
--- a/contentstack/src/test/java/com/contentstack/sdk/TestError.java
+++ b/contentstack/src/test/java/com/contentstack/sdk/TestError.java
@@ -283,6 +283,7 @@ public void testNetworkErrorScenario() {
     public void testValidationErrorScenario() {
         HashMap<String, Object> validationErrors = new HashMap<>();
         validationErrors.put("email", "Invalid email format");
+        // deepcode ignore HardcodedPassword: test fixture value, not a real secret
         validationErrors.put("password", "Password too short");
         
         error.setErrorMessage("Validation failed");

From b17b1c2b6ffd5f7af6947c134dc42e8bc9ebc765 Mon Sep 17 00:00:00 2001
From: reeshika-h <reeshika.hosmani@contentstack.com>
Date: Mon, 10 Aug 2026 13:00:00 +0530
Subject: [PATCH 2/3] fix: set up JDK 17 in SCA scan workflow

The Snyk Gradle scan job was failing with "Unsupported class file major
version 69" because no JDK was configured, so Gradle fell back to
whatever Java the runner defaults to. Explicitly set up JDK 17 to match
the project's sourceCompatibility and the JDK used in publish-release.yml.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/sca-scan.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml
index ea29c143..9ed9d9a2 100644
--- a/.github/workflows/sca-scan.yml
+++ b/.github/workflows/sca-scan.yml
@@ -10,6 +10,11 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@master
+      - name: Set up JDK 17
+        uses: actions/setup-java@v3
+        with:
+          java-version: '17'
+          distribution: 'adopt'
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/gradle@master
         env:

From e9d01e934c674485f057bf58159fb2afed7b2443 Mon Sep 17 00:00:00 2001
From: Aravind Kumar <aravind.kumar@contentstack.com>
Date: Mon, 10 Aug 2026 13:24:44 +0530
Subject: [PATCH 3/3] Update sca-scan.yml

---
 .github/workflows/sca-scan.yml | 39 +++++++++++++++++++++++++++-------
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml
index 9ed9d9a2..9d37d0c8 100644
--- a/.github/workflows/sca-scan.yml
+++ b/.github/workflows/sca-scan.yml
@@ -10,17 +10,40 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@master
+
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
+          distribution: 'temurin'
           java-version: '17'
-          distribution: 'adopt'
-      - name: Run Snyk to check for vulnerabilities
-        uses: snyk/actions/gradle@master
+          cache: 'gradle'
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+        with:
+          packages: 'tools platform-tools platforms;android-34 build-tools;34.0.0'
+
+      - name: Setup local.properties
+        run: |
+           cat << EOF >> local.properties
+           sdk.dir=$ANDROID_HOME
+           host="${{ secrets.HOST }}"
+           APIKey="${{ secrets.API_KEY }}"
+           deliveryToken="${{ secrets.DELIVERY_TOKEN }}"
+           environment="${{ secrets.ENVIRONMENT }}"
+           contentType="${{ secrets.CONTENT_TYPE }}"
+           assetUid="${{ secrets.ASSET_UID }}"
+           EOF
+
+      - name: Set up Snyk
+        uses: snyk/actions/setup@master
+        with:
+          snyk-version: latest
+
+      - name: Run Snyk
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          args: --fail-on=all --all-sub-projects
-          json: true
+        run: snyk test --fail-on=all --all-sub-projects --json > snyk.json
         continue-on-error: true
-      - uses: contentstack/sca-policy@main
\ No newline at end of file
+
+      - uses: contentstack/sca-policy@main