Skip to content

Commit 35f6590

Browse files
eliamezzanoeliamezzano
authored
Merge pull request #5 from entando-ps/ESB-452
ESB-452 Fix vulnerability CVE-2023-50164
2 parents 33e4564 + c0d8be2 commit 35f6590

File tree

28 files changed

+286
-480
lines changed

28 files changed

+286
-480
lines changed

‎.github/build.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
mvn -B clean
4+
5+
(mvn org.codehaus.mojo:license-maven-plugin:2.5.0:aggregate-download-licenses &> ./license-maven-plugin.log) &
6+
BKMVNPID="$!"
7+
8+
mvn versions:set -DnewVersion="$ARTIFACT_VERSION"
9+
10+
mvn -B package;
11+
12+
echo ""
13+
echo "~> Waiting for license download completion"
14+
wait "$BKMVNPID" || true
15+
16+
if grep -q "BUILD SUCCESS" ./license-maven-plugin.log; then
17+
echo "~> License download completed with success"
18+
else
19+
echo "::error::License download terminated with error"
20+
exit 99
21+
fi

‎.github/configure‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
git config --global advice.detachedHead false
4+
5+
(
6+
cd .github
7+
git clone --depth 1 --branch "${ENTANDO_GITHUB_TOOLS_VERSION}" "https://github.com/entando-ps/github-tools" &>/dev/null
8+
)
9+
10+
. .github/github-tools/lib.sh
11+
12+
configure.start "$1"
13+
14+
if [[ "$GITHUB_REF" == refs/tags/* ]]; then
15+
. .github/github-tools/base.configure --tag "$GITHUB_REF"
16+
else
17+
. .github/github-tools/base.configure "$GH_PR_TITLE" "$GH_PR_NUMBER"
18+
fi
19+
20+
configure.complete

‎.github/pr-title-checker-config.json‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎.github/test-and-scan.sh‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/bin/bash
2+
3+
OPT1="" OPT2=""
4+
if ! $SKIP_TESTS; then
5+
# ~ TEST setup
6+
OPT1+="-Ppre-deployment-verification"
7+
#OPT1+=" -Dsurefire.skipAfterFailure=false"
8+
#OPT1+=" -Dmaven.test.failure.ignore=false"
9+
10+
# ~ COVERAGE setup
11+
OPT2+="org.jacoco:jacoco-maven-plugin:prepare-agent"
12+
OPT2+=" org.jacoco:jacoco-maven-plugin:report"
13+
fi
14+
15+
OPT3=""
16+
if ! $SKIP_SCANS; then
17+
# ~ SCAN setup
18+
OPT3+=" org.sonarsource.scanner.maven:sonar-maven-plugin:5.0.0.4389:sonar"
19+
OPT3+=" -Dsonar.verbose=true"
20+
else
21+
SONAR_PROJECT_KEY=""
22+
SONAR_ORG=""
23+
fi
24+
25+
# ~ version set
26+
mvn versions:set -DnewVersion="$ARTIFACT_VERSION"
27+
28+
_mvn_verify() {
29+
if $VERBOSE; then
30+
echo "~> Running mvn verify with options: $*"
31+
fi
32+
33+
mvn -B verify "$@"
34+
}
35+
36+
_mvn_verify $OPT1 $OPT2 $OPT3 \
37+
${SONAR_PROJECT_KEY:+-Dsonar.projectKey="$SONAR_PROJECT_KEY"} \
38+
${SONAR_ORG:+-Dsonar.organization="$SONAR_ORG"} \
39+
;
40+
41+
RV="$?"
42+
.github/github-tools/mvn.test.report.generate
43+
exit "$RV"

‎.github/workflows/build.yml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
name: Maven MultiModule PR
2+
3+
env:
4+
ENTANDO_GITHUB_TOOLS_VERSION: "v0.1.0"
5+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6+
GH_PR_TITLE: ${{ github.event.pull_request.title }}
7+
GH_PR_NUMBER: ${{ github.event.pull_request.number }}
8+
GH_PR_RUN_NUMBER: ${{ github.run_number }}
9+
IMAGES_TO_BUILD: "Dockerfile.eap:entando-de-app-eap,Dockerfile.wildfly:entando-de-app-wildfly,Dockerfile.tomcat:entando-de-app-tomcat"
10+
ENTANDO_CRANE_VERSION: ${{ vars.ENTANDO_CRANE_VERSION || 'v0.10.0' }}
11+
GITHUB_REF: ${{ github.ref }}
12+
13+
on:
14+
push:
15+
branches: [ "develop", "release/*" ]
16+
tags: [ 'v*' ]
17+
pull_request:
18+
branches: [ "develop", "release/*" ]
19+
20+
jobs:
21+
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
22+
build:
23+
permissions:
24+
contents: write
25+
pull-requests: read
26+
27+
runs-on: ubuntu-latest
28+
29+
steps:
30+
- uses: actions/checkout@v4
31+
32+
- name: Set up JDK 11
33+
uses: actions/setup-java@v4
34+
with:
35+
java-version: '11'
36+
distribution: 'temurin'
37+
cache: maven
38+
39+
- name: Configure
40+
id: configure
41+
run: |
42+
if [ -f ".github/configure" ]; then . .github/configure "build"; fi
43+
gh.job.outputVar SKIP_SCANS
44+
gh.job.outputVar SKIP_TESTS
45+
46+
- name: Cache Maven packages
47+
uses: actions/cache@v4
48+
with:
49+
path: ~/.m2
50+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
51+
restore-keys: ${{ runner.os }}-m2-
52+
53+
- name: Build Java
54+
run: .github/build.sh
55+
56+
- name: Submit Dependency Snapshot
57+
uses: advanced-security/maven-dependency-submission-action@v4
58+
59+
- name: Save the build output
60+
uses: actions/upload-artifact@v4
61+
with:
62+
name: target
63+
overwrite: true
64+
path: |
65+
target/generated-resources/licenses
66+
webapp/target/*.war
67+
68+
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
69+
test-and-scan:
70+
needs: build
71+
if: ${{ needs.build.outputs.SKIP_SCANS != 'true' || needs.build.outputs.SKIP_TESTS != 'true' }}
72+
73+
permissions:
74+
contents: read
75+
pull-requests: write
76+
77+
runs-on: ubuntu-latest
78+
79+
env:
80+
SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY }}
81+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
82+
SONAR_ORG: ${{ vars.SONAR_ORG }}
83+
SONAR_URL: ${{ vars.SONAR_URL }}
84+
85+
steps:
86+
- uses: actions/checkout@v4
87+
88+
- name: Set up JDK 11
89+
uses: actions/setup-java@v4
90+
with:
91+
java-version: '11'
92+
distribution: 'temurin'
93+
cache: maven
94+
95+
- name: Cache SonarQube packages
96+
uses: actions/cache@v4
97+
with:
98+
path: ~/.sonar/cache
99+
key: ${{ runner.os }}-sonar
100+
restore-keys: ${{ runner.os }}-sonar
101+
102+
- name: Restore the build output
103+
uses: actions/download-artifact@v4
104+
with:
105+
name: target
106+
path: .
107+
108+
- name: Configure
109+
id: configure
110+
run: if [ -f ".github/configure" ]; then . .github/configure "test-and-scan"; fi
111+
112+
- name: Test and Scan
113+
run: .github/test-and-scan.sh
114+
115+
- name: Save the test report
116+
if: failure()
117+
uses: actions/upload-artifact@v4
118+
with:
119+
name: tests-report
120+
compression-level: 0
121+
overwrite: true
122+
path: |
123+
target/site/surefire-report.html
124+
target/reports/surefire.html
125+
126+
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
127+
publish:
128+
permissions:
129+
contents: read
130+
pull-requests: write
131+
132+
runs-on: ubuntu-latest
133+
needs: build
134+
135+
steps:
136+
- uses: actions/checkout@v4
137+
138+
- name: Restore the build output
139+
uses: actions/download-artifact@v4
140+
with:
141+
name: target
142+
path: .
143+
144+
- name: Configure
145+
run: if [ -f ".github/configure" ]; then . .github/configure "publish"; fi
146+
147+
- name: Build Docker image
148+
run: |
149+
mkdir -p ./target/generated-resources/licenses
150+
touch ./target/generated-resources/licenses.xml
151+
152+
.github/github-tools/docker.multiBuild \
153+
"${IMAGES_TO_BUILD}" \
154+
"${ARTIFACT_VERSION}" \
155+
"${{ vars.DOCKER_ORG }}" \
156+
;
157+
158+
- name: Publish Docker image
159+
run: |
160+
GH_DO_COMMENT=true \
161+
.github/github-tools/docker.multiPublish \
162+
"${IMAGES_TO_BUILD}" \
163+
"${ARTIFACT_VERSION}" \
164+
"${{ vars.DOCKER_ORG }}" \
165+
"${{ vars.DOCKER_REGISTRY }}" \
166+
"${{ secrets.DOCKER_USERNAME }}" \
167+
"${{ secrets.DOCKER_PASSWORD }}" \
168+
"${ARTIFACT_PUB_TYPE}" \
169+
;

‎.github/workflows/ga-publication.yml‎

Lines changed: 0 additions & 63 deletions
This file was deleted.

‎.github/workflows/post-merge.yml‎

Lines changed: 0 additions & 42 deletions
This file was deleted.

0 commit comments

Comments
 (0)