Skip to content

Commit e214c85

Browse files
AB-xdevAB-xdev
authored
Merge pull request #400 from xdev-software/develop
Release
2 parents c7e1de7 + e083daa commit e214c85

File tree

8 files changed

+89
-22
lines changed

8 files changed

+89
-22
lines changed

‎.github/workflows/check-build.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,11 @@ jobs:
7373
if-no-files-found: error
7474

7575
# Build docker
76-
- uses: docker/setup-qemu-action@v3
76+
- uses: docker/setup-qemu-action@v4
7777

78-
- uses: docker/setup-buildx-action@v3
78+
- uses: docker/setup-buildx-action@v4
7979

80-
- uses: docker/build-push-action@v6
80+
- uses: docker/build-push-action@v7
8181
with:
8282
context: ./server
8383
push: false
@@ -87,7 +87,7 @@ jobs:
8787
cache-to: type=gha,mode=max,scope=build
8888

8989
# 2 steps required because "failed to build: docker exporter does not currently support exporting manifest lists"
90-
- uses: docker/build-push-action@v6
90+
- uses: docker/build-push-action@v7
9191
with:
9292
context: ./server
9393
push: false
@@ -180,7 +180,7 @@ jobs:
180180
run: ./mvnw -B pmd:aggregate-cpd -P pmd -DskipTests -T2C
181181

182182
- name: Upload report
183-
if: always()
183+
if: ${{ !cancelled() }}
184184
uses: actions/upload-artifact@v7
185185
with:
186186
name: pmd-report

‎.github/workflows/image-vuln-scan.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
- uses: actions/checkout@v6
2121

2222
- name: Scan - Full
23-
uses: aquasecurity/trivy-action@0.34.0
23+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
2424
with:
2525
image-ref: ${{ env.TRIVYY_IMAGE_REF }}
2626

@@ -34,7 +34,7 @@ jobs:
3434
3535
- name: Scan - Relevant
3636
id: scan_relevant
37-
uses: aquasecurity/trivy-action@0.34.0
37+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
3838
with:
3939
trivy-config: trivy.yml
4040
image-ref: ${{ env.TRIVYY_IMAGE_REF }}
@@ -46,7 +46,7 @@ jobs:
4646

4747
- name: Find already existing issue
4848
id: find-issue
49-
if: ${{ always() }}
49+
if: ${{ !cancelled() }}
5050
run: |
5151
echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Trivy Vulnerability Report"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
5252
env:

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ jobs:
8888
8989
- name: Create Release
9090
id: create-release
91-
uses: shogo82148/actions-create-release@559c27ce7eb834825e2b55927c64f6d1bd1db716 # v1
91+
uses: shogo82148/actions-create-release@6a396031bc74c57403da1018fec74d24c6aa03cd # v1
9292
with:
9393
tag_name: v${{ steps.version.outputs.release }}
9494
release_name: v${{ steps.version.outputs.release }}
@@ -213,6 +213,7 @@ jobs:
213213
packages: write
214214
contents: read
215215
attestations: write
216+
artifact-metadata: write
216217
id-token: write
217218
steps:
218219
- uses: actions/checkout@v6
@@ -229,26 +230,26 @@ jobs:
229230
name: server-standalone
230231
path: server/target
231232

232-
- uses: docker/setup-qemu-action@v3
233+
- uses: docker/setup-qemu-action@v4
233234

234-
- uses: docker/setup-buildx-action@v3
235+
- uses: docker/setup-buildx-action@v4
235236

236237
- name: Login to DockerHub
237-
uses: docker/login-action@v3
238+
uses: docker/login-action@v4
238239
with:
239240
username: ${{ secrets.DOCKERHUB_USERNAME }}
240241
password: ${{ secrets.DOCKERHUB_TOKEN }}
241242

242243
- name: Login to ghcr.io
243-
uses: docker/login-action@v3
244+
uses: docker/login-action@v4
244245
with:
245246
registry: ghcr.io
246247
username: ${{ github.actor }}
247248
password: ${{ secrets.GITHUB_TOKEN }}
248249

249250
- name: Extract metadata (tags, labels) for Docker
250251
id: meta
251-
uses: docker/metadata-action@v5
252+
uses: docker/metadata-action@v6
252253
with:
253254
images: |
254255
${{ secrets.DOCKERHUB_USERNAME }}/mockserver
@@ -259,7 +260,7 @@ jobs:
259260
type=semver,pattern={{major}},value=${{ needs.prepare-release.outputs.version }}
260261
latest
261262
262-
- uses: docker/build-push-action@v6
263+
- uses: docker/build-push-action@v7
263264
id: push
264265
with:
265266
context: ./server

‎.github/workflows/report-gha-workflow-security-problems.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Report workflow security problems
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: [ develop ]
7+
paths:
8+
- '.github/workflows/**'
9+
10+
permissions:
11+
issues: write
12+
13+
jobs:
14+
prt:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 15
17+
# Only run this in our repos (Prevent notification spam by forks)
18+
if: ${{ github.repository_owner == 'xdev-software' }}
19+
steps:
20+
- uses: actions/checkout@v6
21+
22+
- name: Check
23+
id: check
24+
run: |
25+
grep -l 'pull_request_target:' --exclude report-gha-workflow-security-problems.yml *.yml > reported.txt && exit 1 || exit 0
26+
working-directory: .github/workflows
27+
28+
- name: Find already existing issue
29+
id: find-issue
30+
if: ${{ !cancelled() }}
31+
run: |
32+
echo "number=$(gh issue list -l 'bug' -l 'automated' -L 1 -S 'in:title "Incorrectly configure GHA workflow (prt)"' -s 'open' --json 'number' --jq '.[].number')" >> $GITHUB_OUTPUT
33+
env:
34+
GH_TOKEN: ${{ github.token }}
35+
36+
- name: Close issue if everything is fine
37+
if: ${{ success() && steps.find-issue.outputs.number != '' }}
38+
run: gh issue close -r 'not planned' ${{ steps.find-issue.outputs.number }}
39+
env:
40+
GH_TOKEN: ${{ github.token }}
41+
42+
- name: Create report
43+
if: ${{ failure() && steps.check.conclusion == 'failure' }}
44+
run: |
45+
echo 'Detected usage of `pull_request_target`. This event is dangerous and MUST NOT BE USED AT ALL COST!' > reported.md
46+
echo '' >> reported.md
47+
echo '/cc @xdev-software/gha-workflow-security' >> reported.md
48+
echo '' >> reported.md
49+
echo '```' >> reported.md
50+
cat .github/workflows/reported.txt >> reported.md
51+
echo '```' >> reported.md
52+
cat reported.md
53+
54+
- name: Create Issue From File
55+
if: ${{ failure() && steps.check.conclusion == 'failure' }}
56+
uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6
57+
with:
58+
issue-number: ${{ steps.find-issue.outputs.number }}
59+
title: 'Incorrectly configure GHA workflow (prt)'
60+
content-filepath: ./reported.md
61+
labels: bug, automated

‎.github/workflows/test-deploy.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ jobs:
6969
packages: write
7070
contents: read
7171
attestations: write
72+
artifact-metadata: write
7273
id-token: write
7374
steps:
7475
- uses: actions/checkout@v6
@@ -79,34 +80,34 @@ jobs:
7980
name: server-standalone
8081
path: server/target
8182

82-
- uses: docker/setup-qemu-action@v3
83+
- uses: docker/setup-qemu-action@v4
8384

84-
- uses: docker/setup-buildx-action@v3
85+
- uses: docker/setup-buildx-action@v4
8586

8687
- name: Login to DockerHub
87-
uses: docker/login-action@v3
88+
uses: docker/login-action@v4
8889
with:
8990
username: ${{ secrets.DOCKERHUB_USERNAME }}
9091
password: ${{ secrets.DOCKERHUB_TOKEN }}
9192

9293
- name: Login to ghcr.io
93-
uses: docker/login-action@v3
94+
uses: docker/login-action@v4
9495
with:
9596
registry: ghcr.io
9697
username: ${{ github.actor }}
9798
password: ${{ secrets.GITHUB_TOKEN }}
9899

99100
- name: Extract metadata (tags, labels) for Docker
100101
id: meta
101-
uses: docker/metadata-action@v5
102+
uses: docker/metadata-action@v6
102103
with:
103104
images: |
104105
${{ secrets.DOCKERHUB_USERNAME }}/mockserver
105106
ghcr.io/${{ github.repository }}
106107
tags: |
107108
experimental
108109
109-
- uses: docker/build-push-action@v6
110+
- uses: docker/build-push-action@v7
110111
id: push
111112
with:
112113
context: ./server

‎.idea/externalDependencies.xml‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.mvn/wrapper/maven-wrapper.properties‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
wrapperVersion=3.3.4
22
distributionType=only-script
3-
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.12/apache-maven-3.9.12-bin.zip
3+
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.14/apache-maven-3.9.14-bin.zip

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
# 2.0.4
2+
* Updated dependencies
3+
14
# 2.0.3
25
* Updated dependencies
36
* `testcontainers` is currently using an outdated versions of `jackson-annotations` which may override the version required by `jackson-databind`, you may be required to manually update this in your project.

0 commit comments

Comments
 (0)