Skip to content

Commit fb76ffe

Browse files
TimCsakyTimCsaky
authored
Merge pull request #34 from bcgov/SC3520
Security updates
2 parents 8388bf2 + dc7594b commit fb76ffe

File tree

23 files changed

+19652
-34611
lines changed

23 files changed

+19652
-34611
lines changed

‎.github/actions/build-push-container/action.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ runs:
3030
using: composite
3131
steps:
3232
- name: Checkout repository
33-
uses: actions/checkout@v3
33+
uses: actions/checkout@v4
3434

3535
- name: Parse Input Values
3636
shell: bash
@@ -39,23 +39,23 @@ runs:
3939
echo "HAS_DOCKERHUB=${{ fromJson(inputs.dockerhub_username != '' && inputs.dockerhub_token != '') }}" >> $GITHUB_ENV
4040
4141
- name: Login to Github Container Registry
42-
uses: docker/login-action@v2
42+
uses: docker/login-action@v3
4343
with:
4444
registry: ghcr.io
4545
username: ${{ env.GH_USERNAME }}
4646
password: ${{ inputs.github_token }}
4747

4848
- name: Login to Dockerhub Container Registry
4949
if: env.HAS_DOCKERHUB == 'true'
50-
uses: docker/login-action@v2
50+
uses: docker/login-action@v3
5151
with:
5252
registry: docker.io
5353
username: ${{ inputs.dockerhub_username }}
5454
password: ${{ inputs.dockerhub_token }}
5555

5656
- name: Prepare Container Metadata tags
5757
id: meta
58-
uses: docker/metadata-action@v4
58+
uses: docker/metadata-action@v5
5959
with:
6060
images: |
6161
ghcr.io/${{ env.GH_USERNAME }}/${{ inputs.image_name }}
@@ -74,7 +74,7 @@ runs:
7474
7575
- name: Build and Push to Container Registry
7676
id: builder
77-
uses: docker/build-push-action@v3
77+
uses: docker/build-push-action@v5
7878
with:
7979
context: ${{ inputs.context }}
8080
push: true

‎.github/actions/deploy-to-environment/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ runs:
3030
using: composite
3131
steps:
3232
- name: Checkout repository
33-
uses: actions/checkout@v3
33+
uses: actions/checkout@v4
3434

3535
- name: Login to OpenShift Cluster
3636
uses: redhat-actions/oc-login@v1

‎.github/workflows/charts-release.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Checkout
15-
uses: actions/checkout@v3
15+
uses: actions/checkout@v4
1616
with:
1717
fetch-depth: 0
1818

‎.github/workflows/codeql-analysis.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,11 +42,11 @@ jobs:
4242

4343
steps:
4444
- name: Checkout repository
45-
uses: actions/checkout@v3
45+
uses: actions/checkout@v4
4646

4747
# Initializes the CodeQL tools for scanning.
4848
- name: Initialize CodeQL
49-
uses: github/codeql-action/init@v2
49+
uses: github/codeql-action/init@v3
5050
with:
5151
languages: ${{ matrix.language }}
5252
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
5757
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5858
# If this step fails, then you should remove it and run the build manually (see below)
5959
- name: Autobuild
60-
uses: github/codeql-action/autobuild@v2
60+
uses: github/codeql-action/autobuild@v3
6161

6262
# ℹ️ Command-line programs to run using the OS shell.
6363
# 📚 https://git.io/JvXDl
@@ -71,4 +71,4 @@ jobs:
7171
# make release
7272

7373
- name: Perform CodeQL Analysis
74-
uses: github/codeql-action/analyze@v2
74+
uses: github/codeql-action/analyze@v3

‎.github/workflows/on-pr-closed.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
timeout-minutes: 12
2828
steps:
2929
- name: Checkout
30-
uses: actions/checkout@v3
30+
uses: actions/checkout@v4
3131
- name: Login to OpenShift Cluster
3232
uses: redhat-actions/oc-login@v1
3333
with:
@@ -41,12 +41,12 @@ jobs:
4141
helm uninstall --namespace ${{ env.NAMESPACE_PREFIX }}-dev pr-${{ github.event.number }} --timeout 10m --wait
4242
oc delete --namespace ${{ env.NAMESPACE_PREFIX }}-dev cm,secret --selector app.kubernetes.io/instance=pr-${{ github.event.number }}
4343
- name: Remove Release Comment on PR
44-
uses: marocchino/sticky-pull-request-comment@v2
44+
uses: marocchino/sticky-pull-request-comment@v2.9.0
4545
with:
4646
header: release
4747
delete: true
4848
- name: Remove Github Deployment Environment
49-
uses: strumwolf/delete-deployment-environment@v2
49+
uses: strumwolf/delete-deployment-environment@v3
5050
with:
5151
environment: pr
5252
onlyRemoveDeployments: true

‎.github/workflows/on-pr-opened.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
timeout-minutes: 10
2727
steps:
2828
- name: Checkout
29-
uses: actions/checkout@v3
29+
uses: actions/checkout@v4
3030
- name: Build & Push
3131
uses: ./.github/actions/build-push-container
3232
with:
@@ -45,7 +45,7 @@ jobs:
4545
timeout-minutes: 12
4646
steps:
4747
- name: Checkout
48-
uses: actions/checkout@v3
48+
uses: actions/checkout@v4
4949
- name: Deploy to Dev
5050
uses: ./.github/actions/deploy-to-environment
5151
with:
@@ -58,7 +58,7 @@ jobs:
5858
openshift_server: ${{ secrets.OPENSHIFT_SERVER }}
5959
openshift_token: ${{ secrets.OPENSHIFT_TOKEN }}
6060
- name: Release Comment on PR
61-
uses: marocchino/sticky-pull-request-comment@v2
61+
uses: marocchino/sticky-pull-request-comment@v2.9.0
6262
if: success()
6363
with:
6464
header: release

‎.github/workflows/on-push.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
timeout-minutes: 10
2424
steps:
2525
- name: Checkout
26-
uses: actions/checkout@v3
26+
uses: actions/checkout@v4
2727
- name: Build & Push
2828
uses: ./.github/actions/build-push-container
2929
with:
@@ -44,7 +44,7 @@ jobs:
4444
timeout-minutes: 12
4545
steps:
4646
- name: Checkout
47-
uses: actions/checkout@v3
47+
uses: actions/checkout@v4
4848
- name: Deploy to Dev
4949
uses: ./.github/actions/deploy-to-environment
5050
with:
@@ -69,7 +69,7 @@ jobs:
6969
timeout-minutes: 12
7070
steps:
7171
- name: Checkout
72-
uses: actions/checkout@v3
72+
uses: actions/checkout@v4
7373
- name: Deploy to Test
7474
uses: ./.github/actions/deploy-to-environment
7575
with:
@@ -95,7 +95,7 @@ jobs:
9595
timeout-minutes: 12
9696
steps:
9797
- name: Checkout
98-
uses: actions/checkout@v3
98+
uses: actions/checkout@v4
9999
- name: Deploy to Prod
100100
uses: ./.github/actions/deploy-to-environment
101101
with:

‎.github/workflows/unit-tests.yaml

Lines changed: 53 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -5,29 +5,34 @@ on:
55
- pull_request
66
jobs:
77
test-app:
8+
name: Unit Tests (App)
89
runs-on: ubuntu-latest
910
defaults:
1011
run:
1112
working-directory: app
13+
outputs:
14+
HAS_CC_SECRETS: ${{ steps.check-secrets.outputs.HAS_CC_SECRETS }}
1215
timeout-minutes: 10
1316
strategy:
1417
fail-fast: true
1518
matrix:
1619
node-version:
17-
- 14.x
1820
- 16.x
1921
- 18.x
22+
- 20.x
2023
steps:
2124
- name: Checkout Repository
22-
uses: actions/checkout@v2
23-
with:
24-
fetch-depth: 0
25+
uses: actions/checkout@v4
26+
- name: Check CodeClimate Secrets
27+
id: check-secrets
28+
run: |
29+
echo "HAS_CC_SECRETS=${{ secrets.CC_TEST_REPORTER_ID != '' }}" >> $GITHUB_OUTPUT
2530
- name: Use Node.js ${{ matrix.node-version }}
26-
uses: actions/setup-node@v1
31+
uses: actions/setup-node@v4
2732
with:
2833
node-version: ${{ matrix.node-version }}
2934
- name: Cache node modules
30-
uses: actions/cache@v2
35+
uses: actions/cache@v4
3136
id: cache-app
3237
env:
3338
cache-name: cache-node-modules
@@ -46,36 +51,52 @@ jobs:
4651
env:
4752
CI: true
4853
- name: Save Coverage Results
49-
if: matrix.node-version == '18.x'
50-
uses: actions/upload-artifact@v2
54+
if: matrix.node-version == '20.x'
55+
uses: actions/upload-artifact@v4
5156
with:
5257
name: coverage-app
5358
path: ${{ github.workspace }}/app/coverage
5459
retention-days: 1
60+
- name: Monitor Coverage
61+
if: "matrix.node-version == '20.x' && ! github.event.pull_request.head.repo.fork"
62+
uses: slavcodev/coverage-monitor-action@v1
63+
with:
64+
comment_mode: update
65+
comment_footer: false
66+
comment_context: Coverage Report (Application)
67+
coverage_path: app/coverage/clover.xml
68+
github_token: ${{ secrets.GITHUB_TOKEN }}
69+
threshold_alert: 50
70+
threshold_warning: 80
5571
test-frontend:
72+
name: Unit Tests (Frontend)
5673
runs-on: ubuntu-latest
5774
defaults:
5875
run:
5976
working-directory: app/frontend
77+
outputs:
78+
HAS_CC_SECRETS: ${{ steps.check-secrets.outputs.HAS_CC_SECRETS }}
6079
timeout-minutes: 10
6180
strategy:
6281
fail-fast: true
6382
matrix:
6483
node-version:
65-
- 14.x
6684
- 16.x
6785
- 18.x
86+
- 20.x
6887
steps:
6988
- name: Checkout Repository
70-
uses: actions/checkout@v2
71-
with:
72-
fetch-depth: 0
89+
uses: actions/checkout@v4
90+
- name: Check CodeClimate Secrets
91+
id: check-secrets
92+
run: |
93+
echo "HAS_CC_SECRETS=${{ secrets.CC_TEST_REPORTER_ID != '' }}" >> $GITHUB_OUTPUT
7394
- name: Use Node.js ${{ matrix.node-version }}
74-
uses: actions/setup-node@v1
95+
uses: actions/setup-node@v4
7596
with:
7697
node-version: ${{ matrix.node-version }}
7798
- name: Cache node modules
78-
uses: actions/cache@v2
99+
uses: actions/cache@v4
79100
id: cache-frontend
80101
env:
81102
cache-name: cache-node-modules
@@ -94,38 +115,38 @@ jobs:
94115
env:
95116
CI: true
96117
- name: Save Coverage Results
97-
if: matrix.node-version == '18.x'
98-
uses: actions/upload-artifact@v2
118+
if: matrix.node-version == '20.x'
119+
uses: actions/upload-artifact@v4
99120
with:
100121
name: coverage-frontend
101122
path: ${{ github.workspace }}/app/frontend/coverage
102123
retention-days: 1
124+
- name: Monitor Coverage
125+
if: "matrix.node-version == '20.x' && ! github.event.pull_request.head.repo.fork"
126+
uses: slavcodev/coverage-monitor-action@v1
127+
with:
128+
comment_mode: update
129+
comment_footer: false
130+
comment_context: Coverage Report (Frontend)
131+
coverage_path: app/frontend/coverage/clover.xml
132+
github_token: ${{ secrets.GITHUB_TOKEN }}
133+
threshold_alert: 50
134+
threshold_warning: 80
103135
test-coverage:
136+
name: Publish to Code Climate
104137
needs:
105138
- test-app
106139
- test-frontend
140+
if: needs.test-app.outputs.HAS_CC_SECRETS == 'true'
107141
runs-on: ubuntu-latest
108142
timeout-minutes: 10
109143
steps:
110-
- name: Check Workflow Secrets
111-
id: check-secrets
112-
run: |
113-
unset HAS_SECRETS
114-
if [ -n "$CC_TEST_REPORTER_ID" ]; then HAS_SECRETS='true'; fi
115-
echo ::set-output name=HAS_SECRETS::${HAS_SECRETS}
116-
env:
117-
CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
118144
- name: Checkout Repository
119-
if: steps.check-secrets.outputs.HAS_SECRETS
120-
uses: actions/checkout@v2
121-
with:
122-
fetch-depth: 0
145+
uses: actions/checkout@v4
123146
- name: Restore Coverage Results
124-
if: steps.check-secrets.outputs.HAS_SECRETS
125-
uses: actions/download-artifact@v2
147+
uses: actions/download-artifact@v4
126148
- name: Publish code coverage
127-
if: steps.check-secrets.outputs.HAS_SECRETS
128-
uses: paambaati/codeclimate-action@v2.7.5
149+
uses: paambaati/codeclimate-action@v5
129150
env:
130151
CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
131152
with:

0 commit comments

Comments
 (0)