Merge branch 'main' into enable_semgrep_zizmor

adimoft · web-flow · commit da6ef6992f9e · 2026-07-09T09:02:34.000+03:00
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -46,7 +46,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: audit
 
@@ -55,7 +55,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
+      uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,7 +66,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
+      uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -80,7 +80,7 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
+      uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
     - name: Generate Security Report
       uses: rsdmike/github-security-report-action@a149b24539044c92786ec39af8ba38c93496495d # v3.0.4
       continue-on-error: true
diff --git a/.github/workflows/cypress.yaml b/.github/workflows/cypress.yaml
@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -20,15 +20,15 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Build the Docker image
         run: docker buildx build --platform linux/amd64,linux/arm64 . --file Dockerfile --tag ${{ github.event.inputs.docker_registry }}/${{ github.event.inputs.docker_tag_name }}
       - name: Docker Login
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ github.event.inputs.docker_registry }}
           username: ${{ secrets.DOCKER_USERNAME }}
diff --git a/.github/workflows/nodejs.yaml b/.github/workflows/nodejs.yaml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/projectsSync.yaml b/.github/workflows/projectsSync.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -35,18 +35,18 @@ jobs:
         with:
           node-version: '20.x'
       - name: Docker Setup Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - run: npm ci
       - run: npm run build
       - name: Docker Login
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: vprodemo.azurecr.io
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
           logout: true
       - name: Docker Login DockerHub
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: docker.io
           username: ${{ secrets.INTC_DOCKER_USERNAME }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -72,6 +72,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v2.1.27
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v2.1.27
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml
@@ -15,7 +15,7 @@ jobs:
       security-events: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -34,7 +34,7 @@ jobs:
           vuln-type: 'os,library'
           severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3.29.5
         if: always()
         with:
           sarif_file: 'webui-trivy-results.sarif'
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,12 @@
+## [3.58.2](https://github.com/device-management-toolkit/sample-web-ui/compare/v3.58.1...v3.58.2) (2026-07-06)
+
+
+### Bug Fixes
+
+* **e2e:** update rpc-go v3 CLI flags ([#3407](https://github.com/device-management-toolkit/sample-web-ui/issues/3407)) ([9ccec21](https://github.com/device-management-toolkit/sample-web-ui/commit/9ccec2131ad19b9719dca90caff2595305565f57))
+
+## [3.58.1](https://github.com/device-management-toolkit/sample-web-ui/compare/v3.58.0...v3.58.1) (2026-07-01)
+
 # [3.58.0](https://github.com/device-management-toolkit/sample-web-ui/compare/v3.57.11...v3.58.0) (2026-06-11)
 
 
diff --git a/Dockerfile b/Dockerfile
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #*********************************************************************/
 ### STAGE 1: Build ###
-FROM node:26-bullseye-slim@sha256:813c05451759ee2bfec10e9fc58ee74029259182678858cc19da4d400b421cb0 AS build
+FROM node:26-bullseye-slim@sha256:1c45943998287c82bbb2c9bbe6991b4109454811a046a5fe1735c48f26ad2c62 AS build
 ARG BUILD_CONFIGURATION=production
 
 WORKDIR /usr/src/app
diff --git a/cypress/e2e/integration/rpc/activation.spec.ts b/cypress/e2e/integration/rpc/activation.spec.ts
@@ -74,10 +74,128 @@ export const execWithRetry = (
   return attemptExec(1)
 }
 
+// Runs `rpc amtinfo` and parses the JSON result. Tolerates leading log noise
+// (e.g. logrus-formatted warnings) by locating the first '{' in the output.
+export const getAmtInfo = (
+  infoCommand: string,
+  config: Cypress.ExecOptions = execConfig
+): Cypress.Chainable<AMTInfo> => {
+  return cy.exec(infoCommand, config).then((result) => {
+    const { stdout, stderr, combined } = buildOutput(result)
+    return cy.log(combined).then(() => {
+      const source = stdout.length > 0 ? stdout : stderr
+      const jsonStart = source.indexOf('{')
+      if (jsonStart < 0) {
+        throw new Error(`rpc amtinfo did not return JSON. Output:\n${combined}`)
+      }
+      const jsonOutput = source.substring(jsonStart)
+      return JSON.parse(jsonOutput) as AMTInfo
+    })
+  })
+}
+
+// Extracts the major AMT version (e.g. "16.1.5" -> "16") from an AMTInfo object.
+export const getAmtVersion = (amtInfo: AMTInfo): string => {
+  const versions: string[] = amtInfo.amt.split('.')
+  return versions.length > 1 ? versions[0] : '0'
+}
+
+// rpc-go has reported the not-yet-activated control mode under different
+// strings across versions/builds; treat either as "not activated".
+export const notActivatedControlModes: string[] = ['pre-provisioning state', 'not activated']
+
 // ---- Computed environment flags -------------------------------------------
 
-// Exported so sub-specs can import them directly when run standalone.
-const isCloud: boolean = Cypress.env('CLOUD') === 'true' || Cypress.env('CLOUD') === true
+// Exported so sub-specs (and the builders below) can use it to pick the
+// cloud vs. console command variant.
+export const isCloud: boolean = Cypress.env('CLOUD') === 'true' || Cypress.env('CLOUD') === true
+
+// ---- Shared rpc-go command builders ---------------------------------------
+//
+// rpc-go v3 (Kong CLI) requires --long/-short flag syntax; bare single-dash
+// long flags (e.g. -json, -configv2) are no longer accepted. Commands are run
+// either via Docker (Linux/Mac) or directly via rpc.exe (Windows). Each builder
+// uses `isCloud` to decide between the cloud (RPS/wss) and console (local
+// profile) variant of the command.
+
+export interface RpcCommandOptions {
+  isWin: boolean
+  rpcDockerImage: string
+  volumeMount?: string
+}
+
+const buildRpcCommand = (opts: RpcCommandOptions, winExe: string, args: string): string => {
+  if (opts.isWin) {
+    return `${winExe} ${args}`
+  }
+  const volumeFlag = opts.volumeMount ? ` -v ${opts.volumeMount}` : ''
+  return `docker run --rm --network host --device=/dev/mei0${volumeFlag} ${opts.rpcDockerImage} ${args}`
+}
+
+export const buildInfoCommand = (opts: RpcCommandOptions): string => buildRpcCommand(opts, 'rpc.exe', 'amtinfo --json')
+
+export interface ActivateCommandOptions {
+  isWin: boolean
+  rpcDockerImage: string
+  amtVersion: string
+  // console-only
+  profileYamlFile?: string
+  encryptionKey?: string
+  // cloud-only
+  fqdn?: string
+  profileName?: string
+}
+
+export const buildActivateCommand = (opts: ActivateCommandOptions): string => {
+  const cmd = `activate`
+  const common_flag = `-v --json`
+  if (isCloud) {
+    const flagPart = parseInt(opts.amtVersion) <= 18 ? ' -tls-tunnel' : ''
+    const args = `${cmd} -u wss://${opts.fqdn}/activate --profile ${opts.profileName} -n${flagPart} ${common_flag}`
+    return buildRpcCommand({ isWin: opts.isWin, rpcDockerImage: opts.rpcDockerImage }, 'rpc.exe', args)
+  }
+
+  const profileDir = opts.profileYamlFile
+    ? opts.profileYamlFile.substring(0, opts.profileYamlFile.lastIndexOf('/'))
+    : ''
+  const profileFileName = opts.profileYamlFile
+    ? opts.profileYamlFile.substring(opts.profileYamlFile.lastIndexOf('/') + 1)
+    : ''
+  const profilePath = opts.isWin ? opts.profileYamlFile : `/config/${profileFileName}`
+  const flagPart = parseInt(opts.amtVersion) <= 18 ? '' : ' --skip-amt-cert-check'
+  const args = `${cmd} --profile ${profilePath} --key ${opts.encryptionKey}${flagPart} ${common_flag}`
+  return buildRpcCommand(
+    { isWin: opts.isWin, rpcDockerImage: opts.rpcDockerImage, volumeMount: `${profileDir}:/config` },
+    'rpc.exe',
+    args
+  )
+}
+
+export interface DeactivateCommandOptions {
+  isWin: boolean
+  rpcDockerImage: string
+  password: string
+  amtVersion: string
+  // console-only
+  isAdminControlModeProfile?: boolean
+  // cloud-only
+  fqdn?: string
+}
+
+export const buildDeactivateCommand = (opts: DeactivateCommandOptions): string => {
+  const cmd = `deactivate`
+  const common_flag = `-v -f --json`
+  if (isCloud) {
+    const flagPart = parseInt(opts.amtVersion) <= 18 ? ' -tls-tunnel' : ''
+    const args = `${cmd} -u wss://${opts.fqdn}/activate -n${flagPart} --password ${opts.password} ${common_flag}`
+    return buildRpcCommand({ isWin: opts.isWin, rpcDockerImage: opts.rpcDockerImage }, 'rpc.exe', args)
+  }
+
+  const flagPart = parseInt(opts.amtVersion) <= 18 ? '' : ' --skip-amt-cert-check'
+  const passPart = opts.isAdminControlModeProfile ? ` --password ${opts.password}` : ''
+  const args = `${cmd} --local${flagPart}${passPart} ${common_flag}`
+  return buildRpcCommand({ isWin: opts.isWin, rpcDockerImage: opts.rpcDockerImage }, 'rpc.exe', args)
+}
 
 declare const require: (id: string) => unknown
 
diff --git a/cypress/e2e/integration/rpc/cloud.activation.spec.ts b/cypress/e2e/integration/rpc/cloud.activation.spec.ts
diff --git a/cypress/e2e/integration/rpc/console.activation.spec.ts b/cypress/e2e/integration/rpc/console.activation.spec.ts
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
