diff --git a/.github/workflows/veracode.yml b/.github/workflows/veracode.yml deleted file mode 100644 index ed9b82ff6b..0000000000 --- a/.github/workflows/veracode.yml +++ /dev/null @@ -1,248 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert - -name: Veracode - -on: - pull_request: - # The branches below must be a subset of the branches above - branches: [ "maintenance-3.0.x" ] - schedule: - # At 20:00 every day - - cron: '0 20 * * *' - workflow_call: - inputs: - branch: - description: 'The branch to Analyze' - type: string - required: true - secrets: - NPM_PACKAGES_TOKEN: - description: 'NPM_PACKAGES_TOKEN' - required: true - PACKAGES_AUTH_USER: - description: 'PACKAGES_AUTH_USER' - required: true - PACKAGES_AUTH_TOKEN: - description: 'PACKAGES_AUTH_TOKEN' - required: true - VERACODE_API_ID: - description: 'VERACODE_API_ID' - required: true - VERACODE_API_KEY: - description: 'VERACODE_API_KEY' - required: true - -env: - REFERENCE_BRANCH: maintenance-3.0.x - NPM_REPOSITORY: https://packages.nuxeo.com/repository/npm-public/ - BRANCH_NAME: ${{ github.head_ref || inputs.branch || 'maintenance-3.0.x' }} - -# A workflow run is made up of one or more jobs that can run sequentially or in parallel -permissions: - contents: read - -jobs: - # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter - sast-scan: - # The type of runner that the job will run on - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status - runs-on: ubuntu-latest - steps: - - # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps - - uses: actions/checkout@v2 - with: - ref: ${{ env.BRANCH_NAME }} - - - uses: actions/setup-node@v3 - with: - registry-url: ${{ env.NPM_REPOSITORY }} - node-version: 18 - scope: '@nuxeo' - - - uses: actions/setup-java@v2 - with: - distribution: 'zulu' - java-version: '11' - - - name: 'Update settings.xml with server configuration' - run: | - echo ' - - - maven-internal - ${{ secrets.PACKAGES_AUTH_USER }} - ${{ secrets.PACKAGES_AUTH_TOKEN }} - - - ' > ~/.m2/settings.xml - - - name: Get OS Details - run: | - if [ -f /etc/os-release ]; then - source /etc/os-release - echo "Operating System: $PRETTY_NAME" - elif [ -f /etc/redhat-release ]; then - cat /etc/redhat-release - elif [ -f /etc/centos-release ]; then - cat /etc/centos-release - elif [ -f /etc/debian_version ]; then - cat /etc/debian_version - else - echo "Unable to determine operating system" - fi - - - name: Install Docker - run: | - # Install necessary packages to allow apt to use a repository over HTTPS - apt-get install -y \ - apt-transport-https \ - ca-certificates \ - curl \ - software-properties-common - - # Add Docker's official GPG key - curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - - - # Add Docker repository to APT sources - add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" - - # Install Docker - apt-get install -y docker-ce - - # Verify Docker installation - docker --version - - - - name: view settings.xml - run : cat ~/.m2/settings.xml - - - name: Check Nexus Repository Authentication - run: | - curl -u ${{ secrets.PACKAGES_AUTH_USER }}:${{ secrets.PACKAGES_AUTH_TOKEN }} ${{ env.NPM_REPOSITORY }} - - - name: Determine nuxeo-elements branch to link - id: pick_nuxeo_elements_branch - run: | - if git ls-remote --exit-code --heads https://github.com/nuxeo/nuxeo-elements ${{ env.BRANCH_NAME }}; then - echo ::set-output name=branch::${{ env.BRANCH_NAME }} - else - echo ::set-output name=branch::${{ env.REFERENCE_BRANCH }} - fi - - - name: Install Web UI - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }} - run: | - npm install - pushd packages/nuxeo-web-ui-ftest - npm install - popd - - - name: Checkout the nuxeo-elements repo - uses: actions/checkout@v2 - with: - repository: nuxeo/nuxeo-elements - path: nuxeo-elements - fetch-depth: 1 - ref: ${{ steps.pick_nuxeo_elements_branch.outputs.branch }} - - - - name: Pack Elements modules - run: | - pushd nuxeo-elements - pushd core - echo "ELEMENTS_CORE=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV - popd - pushd ui - echo "ELEMENTS_UI=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV - popd - pushd dataviz - echo "ELEMENTS_DATAVIZ=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV - popd - pushd testing-helpers - echo "ELEMENTS_HELPERS=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV - popd - popd - - - name: add .npmrc - run: | - pushd /tmp/_temp/ - ls - rm .npmrc - touch .npmrc - popd - echo ' - packages.nuxeo.com/repository/npm-public/:_auth=${NODE_AUTH_TOKEN} - @nuxeo:registry=https://packages.nuxeo.com/repository/npm-public/ - always-auth=true - ' >> /tmp/_temp/.npmrc - - - name: Link elements to Web UI - run: | - npm config set @nuxeo:registry https://packages.nuxeo.com/repository/npm-public/ - npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/core/${ELEMENTS_CORE} - npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/ui/${ELEMENTS_UI} - npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/dataviz/${ELEMENTS_DATAVIZ} - npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/testing-helpers/${ELEMENTS_HELPERS} - - - name: Delete Node Modules - run: | - rm -rf node_modules - rm -rf packages/nuxeo-designer-catalog/node_modules - rm -rf packages/nuxeo-web-ui-ftest/node_modules - rm -rf plugin/a11y/node_modules - - - name: Delete Test Folders - run: | - rm -rf nuxeo-elements/testing-helpers/ - rm -rf nuxeo-elements/ui/test/ - rm -rf nuxeo-elements/storybook/ - rm -rf ftest/ - rm -rf plugin/ - rm -rf scripts/ - rm -rf test/ - rm -rf packages/nuxeo-web-ui-ftest/ - - - name: Install zip - run: apt-get install zip - - - name: Zip nuxeo-web-ui - run: zip -r nuxeo-web-ui-${{ steps.get-tag.outputs.TAG }}.zip * - - - name: Get Latest Tag - id: get-tag - run: echo "::set-output name=TAG::$(git describe --tags --abbrev=0)" - - - name: pipeline-scan action step - id: pipeline-scan - uses: veracode/Veracode-pipeline-scan-action@v1.0.12 - with: - vid: '${{ secrets.VERACODE_SECRET_API_ID }}' - vkey: '${{ secrets.VERACODE_SECRET_KEY }}' - file: 'nuxeo-web-ui-${{ steps.get-tag.outputs.TAG }}.zip' - request_policy: "VeraDemo Policy" - fail_build: true - - - - name: Veracode Upload And Scan - uses: veracode/veracode-uploadandscan-action@0.2.6 - with: - appname: 'Nuxeo Web UI' - createprofile: false - filepath: 'nuxeo-web-ui-${{ steps.get-tag.outputs.TAG }}.zip' - vid: '${{ secrets.VERACODE_SECRET_API_ID }}' - vkey: '${{ secrets.VERACODE_SECRET_KEY }}' - sandboxname: 'master' - scantimeout: 600 - include: '*.war, *.zip, *.js, *.html, *.css, *.json' - criticality: 'VeryHigh' - includenewmodules: 'true' \ No newline at end of file