[DonOmalVindula]

Purpose

Every pull request build on 4.12.x has failed since the ubuntu-latest runner image moved from Maven 3.9.16 to Maven 3.10.0 (image 20261002.596, release notes ubuntu24/20261004.327). The build stops at Maven startup, before anything is compiled:

[WARNING] Error injecting: org.eclipse.tycho.p2resolver.DefaultTargetPlatformFactory
com.google.inject.ProvisionException: Unable to provision, see the following errors:
1) No implementation for MavenTargetLocationFactory was bound.

The feature modules declare carbon-p2-plugin as a build extension, and the Tycho 4.0.6 it brings in does not wire under Maven 3.10.0. Runs on the previous image (20260901.588) pass; runs on the new image fail, for example https://github.com/wso2/carbon-kernel/actions/runs/37621622019 (7 October) and https://github.com/wso2/carbon-kernel/actions/runs/38350088181 (13 October). The same mvn validate on this branch passes with Maven 3.9.15 and fails with the identical error with Maven 3.10.0 on a developer machine.

Goals

Make the PR builder independent of the Maven version that happens to ship on the runner image.

Approach

Add a step after the JDK setup that downloads Apache Maven 3.9.11 from the Apache archive, verifies its SHA-512 against the published checksum, and puts it first on PATH. This is the same step wso2/product-is added to its GitHub-hosted workflows on 11 October (wso2/product-is@33d5a2fc99 and wso2/product-is@4a04c64c7a).

User stories

N/A

Developer Checklist (Mandatory)

• Complete the Developer Checklist in the related product-is issue to track any behavioral change or migration impact.

Release note

N/A, build workflow only.

Documentation

N/A, build workflow only.

Training

N/A

Certification

N/A, no product change.

Marketing

N/A

Automation tests

• Unit tests

  N/A

• Integration tests

  N/A

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A, no Java change
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes (the SHA-512 is the published checksum of the Maven archive)

Samples

N/A

Related PRs

• Add paginated role name listing to the JDBC user store #4645 (first PR to hit the failure on this branch)

Migrations (if applicable)

N/A

Test environment

• The workflow change runs on the PR builder itself.
• Locally, JDK 21 on macOS: mvn -B validate on 4.12.x passes with Maven 3.9.15 and fails at startup with Maven 3.10.0 with the error above.

Learning

Tycho 4.0.6, which carbon-p2-plugin 5.5.1 brings in as a build extension, does not load under Apache Maven 3.10.0; pinning the Maven version on the runner keeps the build off the image's Maven until the plugin side catches up.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: wso2/carbon-kernel/.coderabbit.yml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0c309975-36b9-4f0e-8136-42b31b5dbf53

📥 Commits

Reviewing files that changed from the base of the PR and between 0b09e4a and 2831024.

📒 Files selected for processing (1)

• .github/workflows/pr-builder.yml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Summary

Summary by CodeRabbit

• Chores
  • Pull request builds now use Maven 3.9.11, verify the downloaded archive, and report the Maven version before building.

The PR workflow documents its use of Maven 3.9.11 and installs that version before the build. It verifies the downloaded archive with a SHA-512 checksum, adds Maven to the runner’s path, and prints its version.

Changes: PR workflow

Layer / File(s)	Summary
Document and install Maven 3.9.11 .github/workflows/pr-builder.yml	The workflow explains that Maven 3.10.0 cannot load the Tycho-based carbon-p2-plugin. It downloads and verifies Maven 3.9.11, extracts it, adds its bin directory to GITHUB_PATH, and prints its version.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 28310

The workflow now verifies and selects Maven 3.9.11 for the build, addressing the reported runner-version incompatibility. Exact-version plugin compatibility was not demonstrated here; the normal PR workflow run should confirm it.

Security architecture risk: 🔵 Low · up to 28310

The change is confined to the PR build runner. A fixed checksum gates extraction, and provisioning failures stop the build. No new credentials, permissions or deployment operations are introduced. The checksum’s release provenance and a successful build with the selected version remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — A malicious runtime passing the integrity gate would execute with the build job’s existing authority and could affect its filesystem, build output and reachable credentials or services. The workflow comparison does not expand declared authority. Effective inherited credentials and repository-level permission settings were not supplied.

Trust Boundaries and Controls

• inferred — Downloaded bytes cross from an external archive service into CI execution. With the reviewed digest unchanged, archive substitution fails verification before extraction. Control of both URL and digest implies control of executable workflow code, which already allowed commands to run in the base workflow; their co-location alone is not a new authority-expansion finding.

Resilience and Maintainability Implications

• inferred — Fail-stop setup prevents normal partial provisioning from reaching the build. Repetition or cancellation does not restore the runtime from the dependency cache. Safe disposal of interrupted extraction remains a hosted-runner assumption rather than a cleanup invariant enforced by this workflow.

Pre-merge checks · 5

Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the primary change: pinning Maven 3.9.11 in the PR builder.
Description check		The description covers the template sections, explains the Maven 3.10.0 failure, states the goals and implementation, identifies testing and security checks, and records documentation and release-note…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}