Skip to content

Fix Aquasec alerts #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
miroslavpojer merged 4 commits into from
Dec 22, 2025
Merged

Fix Aquasec alerts #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
22bb315
Update GitHub Actions workflows and add Dependabot configuration
miroslavpojer Dec 4, 2025
420cfbe
Remove Aquasec Manifest Generation steps from CI workflows
miroslavpojer Dec 4, 2025
ea46d10
Remove Dependabot auto-approve and auto-merge workflow
miroslavpojer Dec 18, 2025
117768a
Merge branch 'master' into feature/59-Fix-Aquasec-alerts
miroslavpojer Dec 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
target-branch: "master"
schedule:
interval: "weekly"
day: "sunday"
labels:
- "auto update"
- "infrastructure"
- "no RN"
open-pull-requests-limit: 3
commit-message:
prefix: "chore"
include: "scope"

- package-ecosystem: "sbt"
directory: "/"
target-branch: "master"
schedule:
interval: "weekly"
day: "sunday"
labels:
- "auto update"
- "dependencies"
- "no RN"
open-pull-requests-limit: 3
commit-message:
prefix: "chore"
include: "scope"
2 changes: 1 addition & 1 deletion .github/workflows/assign_issue_to_project.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
name: Add issue to project
runs-on: ubuntu-latest
steps:
- uses: actions/add-to-project@v0.5.0
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e
Copy link
Copy Markdown
Collaborator

@lsulak lsulak Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this necessary? It's really really cumbersome to use such rule globally across our repos

Copy link
Copy Markdown
Collaborator Author

@miroslavpojer miroslavpojer Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was in extra meeting with CSO. From security point of view, it is reasonable. This reason of low resistance from our side and why I have introduced the dependabot.

Copy link
Copy Markdown
Collaborator

@lsulak lsulak Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Understood. Let's die on another hill, not this one.

with:
project-url: https://github.com/orgs/AbsaOSS/projects/7
github-token: ${{ secrets.PAT_REPO_PROJECT_DISCUSS }}
6 changes: 3 additions & 3 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,12 +49,12 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

- uses: coursier/cache-action@v6
- uses: coursier/cache-action@bebeeb0e6f48ebad66d3783946588ecf43114433

- name: Setup Scala
uses: olafurpg/setup-scala@v10
uses: olafurpg/setup-scala@32ffa16635ff8f19cc21ea253a987f0fdf29844c
with:
java-version: "adopt@1.8"

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/check_pr_release_notes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,12 +30,12 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/setup-python@v6
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548
with:
python-version: '3.13'

- name: Check presence of release notes in PR description
uses: AbsaOSS/release-notes-presence-check@v0.4.0
uses: AbsaOSS/release-notes-presence-check@8e586b26a5e27f899ee8590a5d988fd4780a3dbf
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependent_items.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: z0al/dependent-issues@v1.5.2
- uses: z0al/dependent-issues@950226e7ca8fc43dc209a7febf67c655af3bdb43
env:
# (Required) The token to use to make API calls to GitHub.
GITHUB_TOKEN: ${{ secrets.PAT_REPO_PROJECT_DISCUSS }}
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/jacoco_report.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,9 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
- name: Setup Scala
uses: olafurpg/setup-scala@v10
uses: olafurpg/setup-scala@32ffa16635ff8f19cc21ea253a987f0fdf29844c
with:
java-version: "adopt@1.8"

Expand All @@ -57,7 +57,7 @@ jobs:
- name: Add coverage to PR
if: steps.jacocorun.outcome == 'success'
id: jacoco-balta
uses: madrapps/jacoco-report@v1.7.1
uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848
with:
paths: ${{ github.workspace }}/balta/target/scala-${{ env.scalaShort }}/jacoco/report/jacoco.xml
token: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -72,7 +72,7 @@ jobs:
echo "Changed Files coverage ${{ steps.jacoco-balta.outputs.coverage-changed-files }}"
- name: Fail PR if changed files coverage is less than ${{ env.coverage-changed-files }}%
if: steps.jacocorun.outcome == 'success'
uses: actions/github-script@v6
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
with:
script: |
const coverageCheckFailed =
Expand All @@ -82,7 +82,7 @@ jobs:
}
- name: Fail PR if overall files coverage is less than ${{ env.coverage-overall }}%
if: ${{ (steps.jacocorun.outcome == 'success') && (env.check-overall-coverages == 'true') }}
uses: actions/github-script@v6
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
with:
script: |
const coverageCheckFailed =
Expand All @@ -92,7 +92,7 @@ jobs:
}
- name: Edit JaCoCo comments on build failure
if: steps.jacocorun.outcome != 'success'
uses: actions/github-script@v6
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
with:
script: |
const issue_number = context.issue.number;
Expand Down
28 changes: 28 additions & 0 deletions .github/workflows/release_draft.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,9 @@ jobs:
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
env:
TAG_NAME: ${{ github.event.inputs.tag-name }}

- name: Create and push tag
Copy link
Copy Markdown
Collaborator

@lsulak lsulak Dec 18, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this has nothing to do with the Aquasec. Please let's all strive to have as relevant and small PRs as possible. You can keep it now...and thank for the contribution, definitely feel grateful, but I like us to improve on such things

uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
with:
script: |
const tag = process.env.TAG_NAME
Expand All @@ -114,6 +117,31 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
name: ${{ github.event.inputs.tag-name }}
tag-name: ${{ github.event.inputs.tagName }}
chapters: |
- { title: No entry 🚫, label: duplicate }
- { title: Breaking Changes 💥, label: breaking-change }
- { title: New Features 🎉, label: enhancement }
- { title: Bugfixes 🛠, label: bug }
- { title: Infrastructure ⚙️, label: infrastructure }
- { title: Silent-live 🤫, label: silent-live }
- { title: Documentation 📜, label: documentation }
- { title: Closed Epics 📚, label: epic }
duplicity-scope: 'service'
duplicity-icon: '🔁'
warnings: true
skip-release-notes-labels: "no RN"
print-empty-chapters: false
row-format-issue: '_{title}_ {developed-by} {co-authored-by} in #{number}'
row-format-pr: '_{title}_ {developed-by} {co-authored-by} in #{number}'
row-format-link-pr: true

- name: Create draft release
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
with:
name: ${{ github.event.inputs.tagName }}
body: ${{ steps.generate_release_notes.outputs.release-notes }}
tag_name: ${{ github.event.inputs.tag-name }}
draft: true
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/release_publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,13 +25,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
with:
fetch-depth: 0
- uses: coursier/cache-action@v5
- uses: coursier/cache-action@bebeeb0e6f48ebad66d3783946588ecf43114433

- name: Setup Scala
uses: olafurpg/setup-scala@v14
uses: olafurpg/setup-scala@32ffa16635ff8f19cc21ea253a987f0fdf29844c
with:
java-version: "adopt@1.8"

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test_filenames_check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,11 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v2
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

- name: Filename Inspector
id: scan-test-files
uses: AbsaOSS/filename-inspector@v0.1.0
uses: AbsaOSS/filename-inspector@355108975e656fac9faaa04209b6df3f9997c8fa
with:
name-patterns: '*UnitTests.*,*IntegrationTests.*'
paths: '**/src/test/scala/**'
Expand Down
Loading