Skip to content

Commit 7525cf0

Browse files
rsendenrsenden
authored
Merge branch 'main' into fortify-20241106
2 parents dd84e34 + a413869 commit 7525cf0

32 files changed

+545
-51
lines changed

‎ci/datadog-synthetics.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
runs-on: ubuntu-latest
2525

2626
steps:
27-
- uses: actions/checkout@v2
27+
- uses: actions/checkout@v4
2828

2929
# Run Synthetic tests within your GitHub workflow.
3030
# For additional configuration options visit the action within the marketplace: https://github.com/marketplace/actions/datadog-synthetics-ci

‎ci/dotnet-desktop.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ jobs:
109109

110110
# Upload the MSIX package: https://github.com/marketplace/actions/upload-a-build-artifact
111111
- name: Upload build artifacts
112-
uses: actions/upload-artifact@v3
112+
uses: actions/upload-artifact@v4
113113
with:
114114
name: MSIX Package
115115
path: ${{ env.Wap_Project_Directory }}\AppPackages

‎ci/python-publish.yml‎

Lines changed: 49 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# This workflow will upload a Python Package using Twine when a release is created
1+
# This workflow will upload a Python Package to PyPI when a release is created
22
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
33

44
# This workflow uses actions that are not certified by GitHub.
@@ -16,24 +16,55 @@ permissions:
1616
contents: read
1717

1818
jobs:
19-
deploy:
19+
release-build:
20+
runs-on: ubuntu-latest
21+
22+
steps:
23+
- uses: actions/checkout@v4
24+
25+
- uses: actions/setup-python@v5
26+
with:
27+
python-version: "3.x"
2028

29+
- name: Build release distributions
30+
run: |
31+
# NOTE: put your own distribution build steps here.
32+
python -m pip install build
33+
python -m build
34+
35+
- name: Upload distributions
36+
uses: actions/upload-artifact@v4
37+
with:
38+
name: release-dists
39+
path: dist/
40+
41+
pypi-publish:
2142
runs-on: ubuntu-latest
43+
needs:
44+
- release-build
45+
permissions:
46+
# IMPORTANT: this permission is mandatory for trusted publishing
47+
id-token: write
48+
49+
# Dedicated environments with protections for publishing are strongly recommended.
50+
# For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules
51+
environment:
52+
name: pypi
53+
# OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status:
54+
# url: https://pypi.org/p/YOURPROJECT
55+
#
56+
# ALTERNATIVE: if your GitHub Release name is the PyPI project version string
57+
# ALTERNATIVE: exactly, uncomment the following line instead:
58+
# url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }}
2259

2360
steps:
24-
- uses: actions/checkout@v4
25-
- name: Set up Python
26-
uses: actions/setup-python@v3
27-
with:
28-
python-version: '3.x'
29-
- name: Install dependencies
30-
run: |
31-
python -m pip install --upgrade pip
32-
pip install build
33-
- name: Build package
34-
run: python -m build
35-
- name: Publish package
36-
uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
37-
with:
38-
user: __token__
39-
password: ${{ secrets.PYPI_API_TOKEN }}
61+
- name: Retrieve release distributions
62+
uses: actions/download-artifact@v4
63+
with:
64+
name: release-dists
65+
path: dist/
66+
67+
- name: Publish release distributions to PyPI
68+
uses: pypa/gh-action-pypi-publish@release/v1
69+
with:
70+
packages-dir: dist/

‎code-scanning/appknox.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
runs-on: ubuntu-latest
3232
steps:
3333
- name: Checkout Code
34-
uses: actions/checkout@v2
34+
uses: actions/checkout@v4
3535

3636
- name: Grant execute permission for gradlew
3737
run: chmod +x gradlew

‎code-scanning/bandit.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ jobs:
2929

3030
runs-on: ubuntu-latest
3131
steps:
32-
- uses: actions/checkout@v2
32+
- uses: actions/checkout@v4
3333
- name: Bandit Scan
34-
uses: shundor/python-bandit-scan@9cc5aa4a006482b8a7f91134412df6772dbda22c
34+
uses: shundor/python-bandit-scan@ab1d87dfccc5a0ffab88be3aaac6ffe35c10d6cd
3535
with: # optional arguments
3636
# exit with 0, even with results found
3737
exit_zero: true # optional, default is DEFAULT

‎code-scanning/black-duck-security-scan-ci.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# Black Duck Security Action allows you to integrate Static Analysis Security Testing (SAST) and Software Composition Analysis (SCA) into your CI/CD pipelines.
7+
# For more information about configuring your workflow,
8+
# read our documentation at https://github.com/blackduck-inc/black-duck-security-scan
9+
10+
name: CI Black Duck security scan
11+
12+
on:
13+
push:
14+
branches: [ $default-branch, $protected-branches ]
15+
pull_request:
16+
# The branches below must be a subset of the branches above
17+
branches: [ $default-branch ]
18+
schedule:
19+
- cron: $cron-weekly
20+
21+
jobs:
22+
build:
23+
runs-on: ubuntu-latest
24+
permissions:
25+
contents: read
26+
pull-requests: write
27+
security-events: write
28+
actions: read
29+
30+
steps:
31+
- name: Checkout source
32+
uses: actions/checkout@v4
33+
- name: Black Duck SCA scan
34+
uses: blackduck-inc/black-duck-security-scan@805cbd09e806b01907bbea0f990723c2bb85abe9
35+
with:
36+
### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ----------
37+
blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }}
38+
blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }}
39+
40+
### ---------- COVERITY SCANNING: REQUIRED FIELDS ----------
41+
coverity_url: ${{ vars.COVERITY_URL }}
42+
coverity_user: ${{ secrets.COVERITY_USER }}
43+
coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
44+
45+
### ---------- POLARIS SCANNING: REQUIRED FIELDS ----------
46+
polaris_server_url: ${{ vars.POLARIS_SERVER_URL }}
47+
polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }}
48+
polaris_assessment_types: "SCA,SAST"
49+
50+
### ---------- SRM SCANNING: REQUIRED FIELDS ----------
51+
srm_url: ${{ vars.SRM_URL }}
52+
srm_apikey: ${{ secrets.SRM_API_KEY }}
53+
srm_assessment_types: "SCA,SAST"
54+

‎code-scanning/clj-holmes.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
2828
steps:
2929
- name: Checkout code
30-
uses: actions/checkout@v2
30+
uses: actions/checkout@v4
3131

3232
- name: Scan code
3333
uses: clj-holmes/clj-holmes-action@200d2d03900917d7eb3c24fc691ab83579a87fcb

‎code-scanning/clj-watson.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
3333
steps:
3434
- name: Checkout code
35-
uses: actions/checkout@v2
35+
uses: actions/checkout@v4
3636

3737
- name: Dependency scan
3838
uses: clj-holmes/clj-watson-action@39b8ed306f2c125860cf6e69b6939363689f998c

‎code-scanning/codeql.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,12 @@ jobs:
5555
- name: Checkout repository
5656
uses: actions/checkout@v4
5757

58+
# Add any setup steps before running the `github/codeql-action/init` action.
59+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
60+
# or others). This is typically only required for manual builds.
61+
# - name: Setup runtime (example)
62+
# uses: actions/setup-example@v1
63+
5864
# Initializes the CodeQL tools for scanning.
5965
- name: Initialize CodeQL
6066
uses: github/codeql-action/init@v3

‎code-scanning/crda.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,11 +77,11 @@ jobs:
7777
contents: read # for actions/checkout to fetch code
7878
security-events: write # for redhat-actions/crda to upload SARIF results
7979
name: Scan project vulnerabilities with CRDA
80-
runs-on: ubuntu-20.04
80+
runs-on: ubuntu-latest
8181
steps:
8282

8383
- name: Check out repository
84-
uses: actions/checkout@v2
84+
uses: actions/checkout@v4
8585

8686
# *******************************************************************
8787
# Required: Instructions to setup project

0 commit comments

Comments
 (0)