Skip to content

[Snyk] Security upgrade com.amazonaws:aws-java-sdk-s3 from 1.12.272 to 1.12.738 #144

[Snyk] Security upgrade com.amazonaws:aws-java-sdk-s3 from 1.12.272 to 1.12.738

[Snyk] Security upgrade com.amazonaws:aws-java-sdk-s3 from 1.12.272 to 1.12.738 #144

name: On Code Change
on:
pull_request:
types: [opened, reopened, synchronize]
push:
branches:
- master
- '/feature-.*/'
- '/JAHIA-[0-9]-[0-9]-[0-9]-X-BRANCH/'
env:
TESTS_PATH: docker/docker-tests/
TARGET_BRANCH: ""
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
build:
runs-on: ubuntu-latest
outputs:
jahia_version: ${{ steps.tags.outputs.jahia_version }}
image_tag: ${{ steps.tags.outputs.image_tag }}
steps:
- uses: actions/checkout@v2
- name: Cache local Maven repository
uses: actions/cache@v3
with:
path: |
~/.m2/repository
/root/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-
- name: Save/Restore build artifacts from cache
uses: actions/cache@v3
with:
key: run-${{ github.run_id }}
path: |
./**/target/**
- name: Set environment variables from parameters
shell: bash
run: |
echo "NEXUS_USERNAME=${{ secrets.NEXUS_USERNAME }}" >> $GITHUB_ENV
echo "NEXUS_PASSWORD=${{ secrets.NEXUS_PASSWORD }}" >> $GITHUB_ENV
- uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
- name: Store project version
shell: bash
run: mvn -q -Dexec.executable=echo -Dexec.args='${project.version}' --non-recursive exec:exec > jahia.version
- name: Get branch name
id: branch-name
uses: tj-actions/branch-names@v5.4
- name: Determine tag
shell: bash
run: |
if [ "${{ github.event_name }}" != "pull_request" ]; then
cp jahia.version image.tag
else
echo `cat jahia.version`-"${{ steps.branch-name.outputs.current_branch}}" > image.tag
fi
- id: tags
name: Set Output variables
run: |
echo "::set-output name=jahia_version::`cat jahia.version`"
echo "::set-output name=image_tag::`cat image.tag`"
- name: Display Output variables
run: |
echo "OUTPUT: jahia_version = ${{steps.tags.outputs.jahia_version}}"
echo "OUTPUT: image_tag = ${{steps.tags.outputs.image_tag}}"
# Series of steps only executed when pushing to master or to one of the maintenance branches
- name: Build package and load all dependencies into local Maven repository
shell: bash
if: ${{ github.event_name == 'push' }}
run: |
mvn -U -ntp -s .github/maven.settings.xml -e \
-Dimage.tag=${{steps.tags.outputs.image_tag}} \
clean deploy de.qaware.maven:go-offline-maven-plugin:resolve-dependencies \
-Pgwt-production,unit-tests,docker \
-Dbamboo.buildNumber=${{ github.run_id }}
- name: Compile GWT development
shell: bash
if: ${{ github.event_name == 'push' }}
run: |
cd gwt/
mvn -U -ntp -s ../.github/maven.settings.xml -e \
-Dimage.tag=${{steps.tags.outputs.image_tag}} \
clean deploy \
-Pgwt-development \
-Dbamboo.buildNumber=${{ github.run_id }}
- uses: jahia/jahia-modules-action/docker-tags@v2
if: ${{ github.event_name == 'push' }}
with:
docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}
version: ${{steps.tags.outputs.image_tag}}
repo: "jahia-core-dev"
dry-run: false
- name: Build graalvm image
shell: bash
if: ${{ github.event_name == 'push' }}
run: |
cd docker/docker-jahia-core/
mvn -U -ntp -s ../../.github/maven.settings.xml -e \
-Dimage.tag=${{steps.tags.outputs.image_tag}}-graalvm \
-Dimage.graalvm=true deploy \
-Dbamboo.buildNumber=${{ github.run_id }}
# Series of steps only executed when in a PR
- name: Build package and load all dependencies into local Maven repository
shell: bash
if: ${{ github.event_name == 'pull_request' }}
run: |
mvn -U -ntp -s .github/maven.settings.xml -e \
-Dimage.tag=${{steps.tags.outputs.image_tag}} \
clean install de.qaware.maven:go-offline-maven-plugin:resolve-dependencies \
-Pgwt-production,unit-tests,docker \
-Dbamboo.buildNumber=${{ github.run_id }}
- name: Push PR Docker image
# This is only done on PR, as master is pushed with mvn deploy in "Deploy artifacts to server repository"
shell: bash
if: ${{ github.event_name == 'pull_request' }}
run: docker push jahia/jahia-core-dev:${{steps.tags.outputs.image_tag}}
- name: Store docker image
shell: bash
run: docker save -o image.tar jahia/jahia-core-dev:${{steps.tags.outputs.image_tag}}
- uses: jahia/jahia-modules-action/slack-jahia@v2
if: ${{ failure() && github.event_name == 'push' }}
with:
job-event: "fail"
skip-docker: true
slack-webhook: ${{ secrets.SLACK_WEBHOOK_TEAM_PRODUCT_SNAPSHOTS_NOTIFICATIONS }}
- uses: actions/upload-artifact@v3
with:
name: integration-artifacts
path: image.tar
integration-tests:
name: Integration Tests (Standalone)
needs: build
runs-on: self-hosted
timeout-minutes: 45
steps:
- uses: jahia/jahia-modules-action/helper@v2
- uses: KengoTODA/actions-setup-docker-compose@main
with:
version: '1.29.2'
- uses: actions/setup-node@v2
with:
node-version: 'lts/*'
- uses: actions/checkout@v2
- uses: actions/download-artifact@v3
with:
name: integration-artifacts
- name: Load docker image
shell: bash
run: |
docker load -i image.tar
- name: Prepare environment variable for Jahia Image
shell: bash
run: |
export JAHIA_IMAGE=jahia/jahia-core-dev:${{needs.build.outputs.image_tag}}
echo "JAHIA_IMAGE = ${JAHIA_IMAGE}"
echo "JAHIA_IMAGE=${JAHIA_IMAGE}" >> $GITHUB_ENV
- uses: jahia/jahia-modules-action/integration-tests@v2
with:
module_id: jahia-root
testrail_project: Jahia
tests_manifest: provisioning-manifest-build.yml
tests_path: ${{ env.TESTS_PATH }}
jahia_image: ${{ env.JAHIA_IMAGE }}
should_use_build_artifacts: false
should_skip_testrail: true
should_skip_zencrepes: true
github_artifact_name: jahia-integ-tests-${{ github.run_number }}
jahia_license: ${{ secrets.JAHIA_LICENSE_8X_FULL }}
docker_username: ${{ secrets.DOCKERHUB_USERNAME }}
docker_password: ${{ secrets.DOCKERHUB_PASSWORD }}
nexus_username: ${{ secrets.NEXUS_USERNAME }}
nexus_password: ${{ secrets.NEXUS_PASSWORD }}
tests_report_name: Test report (Standalone)
testrail_username: ${{ secrets.TESTRAIL_USERNAME }}
testrail_password: ${{ secrets.TESTRAIL_PASSWORD }}
incident_pagerduty_api_key: ${{ secrets.INCIDENT_PAGERDUTY_API_KEY }}
incident_pagerduty_reporter_email: ${{ secrets.INCIDENT_PAGERDUTY_REPORTER_EMAIL }}
incident_pagerduty_reporter_id: ${{ secrets.INCIDENT_PAGERDUTY_REPORTER_ID }}
incident_google_spreadsheet_id: ${{ secrets.INCIDENT_GOOGLE_SPREADSHEET_ID }}
incident_google_client_email: ${{ secrets.INCIDENT_GOOGLE_CLIENT_EMAIL }}
incident_google_api_key_base64: ${{ secrets.INCIDENT_GOOGLE_PRIVATE_KEY_BASE64 }}
zencrepes_secret: ${{ secrets.ZENCREPES_WEBHOOK_SECRET }}
vulnerability-scan:
runs-on: ubuntu-latest
needs: build
steps:
- uses: actions/checkout@v2
- uses: jahia/jahia-modules-action/static-analysis@v2
with:
node_version: 14
auditci_level: critical
auditci_level_tests: critical
module_path: war/
tests_path: ${{ env.TESTS_PATH }}
skip_lint_modules: true
skip_lint_tests: true
security-scan:
runs-on: ubuntu-latest
needs: build
steps:
- uses: actions/checkout@v2
- uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_PASSWORD }}
- name: Scan image
id: scan-build-sbom
uses: anchore/scan-action@v3
with:
image: jahia/jahia-core-dev:${{needs.build.outputs.image_tag}}
fail-build: false
acs-report-enable: true
- name: Print content from the SARIF file
shell: bash
run: cat ${{ steps.scan-build-sbom.outputs.sarif }} | jq -r '.runs[0].tool.driver.rules[].shortDescription.text'
- uses: actions/upload-artifact@v3
with:
name: SARIF
retention-days: 5
path: |
${{ steps.scan-build-sbom.outputs.sarif }}
sonar-analysis:
name: Sonar Analysis
needs: build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/cache@v3
with:
path: ~/.m2
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
- name: Get branch name
id: branch-name
uses: tj-actions/branch-names@v5.4
- name: Save/Restore build artifacts from cache
uses: actions/cache@v3
with:
key: run-${{ github.run_id }}
path: |
./**/target/**
- name: Set environment variables
shell: bash
run: |
echo "SONAR_URL=${{ secrets.SONAR_URL }}" >> $GITHUB_ENV
echo "SONAR_TOKEN=${{ secrets.SONAR_TOKEN }}" >> $GITHUB_ENV
echo "NEXUS_USERNAME=${{ secrets.NEXUS_USERNAME }}" >> $GITHUB_ENV
echo "NEXUS_PASSWORD=${{ secrets.NEXUS_PASSWORD }}" >> $GITHUB_ENV
- name: Analyze pull request with sonar
if: ${{ github.event_name == 'pull_request' }}
shell: bash
run: |
mvn -B -U -ntp -s .github/maven.settings.xml sonar:sonar -Dsonar.pullrequest.branch=${{ steps.branch-name.outputs.current_branch }} \
-Dsonar.pullrequest.key=${{ github.run_id }} \
-Dsonar.pullrequest.base=${{ env.TARGET_BRANCH }} \
-Dsonar.pullrequest.github.repository=${{ github.event.repository.name }}
- name: Sonar analysis
shell: bash
if: ${{ github.event_name != 'pull_request' }}
env:
DEPENDENCY_CHECK_SETTINGS: -DfailOnError=false -DskipProvidedScope=true -DskipTestScope=false
-DretireJsAnalyzerEnabled=false -DnodeAnalyzerEnabled=false -Dformats=HTML,JSON
-Dsonar.dependencyCheck.jsonReportPath=target/dependency-check-report.json
-Dsonar.dependencyCheck.htmlReportPath=target/dependency-check-report.html
-DdataDirectory=/home/circleci/.owasp/dependency-check-data
-DsuppressionFile=.circleci/owasp-suppressions.xml
run: |
if [[ "${{ steps.branch-name.outputs.current_branch }}" == "master" ]];
then
mvn -B -U -ntp -s .github/maven.settings.xml dependency-check:aggregate sonar:sonar \
$DEPENDENCY_CHECK_SETTINGS
else
mvn -B -U -ntp -s .github/maven.settings.xml dependency-check:aggregate sonar:sonar \
-Dsonar.branch.name=$CIRCLE_BRANCH $DEPENDENCY_CHECK_SETTINGS
fi
trigger-jahia-pack-private:
runs-on: ubuntu-latest
needs: [integration-tests, sonar-analysis, security-scan, vulnerability-scan, build]
steps:
- name: Get branch name
id: branch-name
uses: tj-actions/branch-names@v5.4
- name: Preparing variables for remote branch
id: exports
shell: bash
run: |
# If we are in a PR, we use master for the remote branch
# If we are not in a PR, we use the current branch for the remote branch
if [[ "${{ github.event.pull_request.head.ref }}" == "" ]]; then
echo "Currently NOT in a PR: ${{ github.event.pull_request.head.ref }}, using ${{ steps.branch-name.outputs.current_branch }} as remote branch"
echo "remote_branch=${{ steps.branch-name.outputs.current_branch }}" >> $GITHUB_OUTPUT
else
echo "Currently in a PR with head: ${{ github.event.pull_request.head.ref }}, using master as remote branch"
echo "remote_branch=master" >> $GITHUB_OUTPUT
fi
- name: Call Jahia-pack-private
id: trigger-step
uses: jonas-schievink/workflow-proxy@v1
with:
workflow: do-it-all.yml
ref: ${{ steps.exports.outputs.remote_branch }}
repo: Jahia/jahia-pack-private
wait-for-completion-timeout: 2h
inputs: '{ "parent_image_tag": "${{needs.build.outputs.image_tag}}" }'
token: ${{ secrets.GH_API_TOKEN }}
- name: Get results of Jahia-pack-private
if: always()
shell: bash
run: |
echo "Jahia-pack-private workflow conclustion -> ${{ steps.trigger-step.outputs.workflow-conclusion }}"
echo "::notice title=Jahia-pack-private workflow::The following workflow has been executed: ${{ steps.trigger-step.outputs.workflow-url }} its conclusion was: ${{ steps.trigger-step.outputs.workflow-conclusion }}"