chore: [DHIS2-21571] dev container (incl. safe-chain) and CI safe-chain

.devcontainer/Dockerfile

@@ -0,0 +1,17 @@
+FROM mcr.microsoft.com/devcontainers/base:trixie
+
+RUN apt-get update && apt-get install -y \
+    libgtk2.0-0 \
+    libgtk-3-0 \
+    libgbm-dev \
+    libnotify-dev \
+    libnss3 \
+    libxss1 \
+    libasound2t64 \
+    libxtst6 \
+    xauth \
+    xvfb \
+    x11vnc \
+    novnc \
+    openbox \
+    && rm -rf /var/lib/apt/lists/*

.devcontainer/devcontainer-lock.json

@@ -0,0 +1,9 @@
+{
+    "features": {
+        "ghcr.io/devcontainers/features/node:2": {
+            "version": "2.0.0",
+            "resolved": "ghcr.io/devcontainers/features/node@sha256:fedd4c11f7adfb64283b578dddc7da906728daa25fa293351c9d913231acf12f",
+            "integrity": "sha256:fedd4c11f7adfb64283b578dddc7da906728daa25fa293351c9d913231acf12f"
+        }
+    }
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,36 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/debian
+{
+    "name": "capture-app-dev",
+    "dockerComposeFile": ["docker-compose.yml", "docker-compose.override.yml"],
+    "service": "dev",
+    "workspaceFolder": "/workspaces/capture-app",
+    "features": {
+        "ghcr.io/devcontainers/features/node:2": {
+            "nodeGypDependencies": true,
+            "installYarnUsingApt": true,
+            "version": "24.16.0",
+            "npmVersion": "11.16.0",
+            "pnpmVersion": "11.5.0",
+            "nvmVersion": "0.40.4"
+        }
+    },
+    "portsAttributes": {
+        "3000": { "onAutoForward": "notify" },
+        "6080": { "onAutoForward": "notify" }
+    },
+    "otherPortsAttributes": { "onAutoForward": "ignore" },
+    "remoteEnv": { "IN_DEVCONTAINER": "true" },
+    "postCreateCommand": "sudo chown -R $(id -u):$(id -g) /workspaces/capture-app/node_modules /home/vscode/.cache && curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.5.3/install-safe-chain.sh | sh && echo '{\"minimumPackageAgeHours\": 120, \"yarn\": {\"minimumPackageAgeExclusions\": [\"@dhis2/*\"]}}' > ~/.safe-chain/config.json",
+    "customizations": {
+        "vscode": {
+            "extensions": [
+                "Anthropic.claude-code@2.1.145",
+                "waderyan.gitblame@13.0.1",
+                "mhutchie.git-graph@1.30.0",
+                "esbenp.prettier-vscode@12.4.0",
+                "mxsdev.typescript-explorer@0.4.2"
+            ]
+        }
+    }
+}

.devcontainer/docker-compose.yml

@@ -0,0 +1,16 @@
+services:
+    dev:
+        build:
+            context: .
+            dockerfile: Dockerfile
+        volumes:
+            - ..:/workspaces/capture-app:cached
+            - node_modules:/workspaces/capture-app/node_modules
+            - yarn_cache:/home/vscode/.cache/yarn
+            - cypress_cache:/home/vscode/.cache/Cypress
+        command: sleep infinity
+
+volumes:
+    node_modules:
+    yarn_cache:
+    cypress_cache:

.github/actions/safe-yarn-install-using-cache/action.yml

@@ -0,0 +1,36 @@
+name: 'Safe yarn install using cache'
+description: 'Restore yarn/Cypress cache, install safe-chain, and run yarn install'
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/cache@v5
+      with:
+        path: |
+          ~/.cache/yarn
+          ~/.cache/Cypress
+        key: ${{ runner.os }}-yarn-cache-${{ hashFiles('**/yarn.lock') }}
+
+    - uses: actions/cache@v5
+      id: safe-chain-cache
+      with:
+        path: ~/tmp/safe-chain
+        key: ${{ runner.os }}-safe-chain-1.5.3
+
+    - name: Download safe-chain script
+      if: steps.safe-chain-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        mkdir -p ~/tmp/safe-chain
+        curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.5.3/install-safe-chain.sh -o ~/tmp/safe-chain/install-safe-chain.sh
+
+    - name: Install safe-chain
+      shell: bash
+      run: sh ~/tmp/safe-chain/install-safe-chain.sh --ci
+
+    - name: Install
+      shell: bash
+      env:
+        SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS: 120
+        SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: "@dhis2/*"
+      run: yarn install --frozen-lockfile

.github/workflows/codeql-analysis.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
 
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v2

.github/workflows/dhis2-verify-commits.yml

@@ -9,16 +9,11 @@ jobs:
     if: github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'dhis2-bot'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: 18.x
-      - uses: actions/cache@v4
-        id: yarn-cache
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-      - run: yarn install --frozen-lockfile
+          cache: ''
+      - uses: ./.github/actions/safe-yarn-install-using-cache
       - id: commitlint
         run: echo ::set-output name=config_path::$(node -e "process.stdout.write(require('@dhis2/cli-style').config.commitlint)")
       - uses: JulienKode/pull-request-name-linter-action@v0.5.0
@@ -29,18 +24,13 @@ jobs:
     if: github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'dhis2-bot'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 18.x
-      - uses: actions/cache@v4
-        id: yarn-cache
+      - uses: actions/setup-node@v6
         with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-      - run: yarn install --frozen-lockfile
+          cache: ''
+      - uses: ./.github/actions/safe-yarn-install-using-cache
       - id: commitlint
         run: echo ::set-output name=config_path::$(node -e "process.stdout.write(require('@dhis2/cli-style').config.commitlint)")
       - uses: wagoid/commitlint-github-action@v4

.github/workflows/e2e-tests.yml

@@ -42,7 +42,7 @@ jobs:
         outputs:
             matrix: ${{ steps.set-matrix.outputs.specs }}
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v6
             - name: Generate test matrix
               id: set-matrix
               run: |
@@ -64,7 +64,7 @@ jobs:
                   echo "::set-output name=labels::[ ${labels%,} ]"
 
             - if: contains(fromJson(steps.json-labels.outputs.labels), github.event.label.name)
-              uses: actions/checkout@v2
+              uses: actions/checkout@v6
 
             - name: compute-instance-url
               id: instance-url
@@ -91,11 +91,11 @@ jobs:
         env:
             SHOULD_RECORD: ${{ contains(github.event.head_commit.message, '[e2e record]') || contains(join(github.event.pull_request.labels.*.name), 'e2e record') }}
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v6
 
-            - uses: actions/setup-node@v3
+            - uses: actions/setup-node@v6
               with:
-                  node-version: 18.x
+                  cache: ''
 
             - name: compute-instance-url
               id: instance-url
@@ -118,9 +118,13 @@ jobs:
                 echo "Computed Tag=${{ env.SHOULD_RECORD == 'true' && env.CYPRESS_TAG || '' }}"
                 echo "Computed CI Build ID=${{ env.SHOULD_RECORD == 'true' && env.CYPRESS_CI_BUILD_ID || '' }}"
                 echo "Spec=${{ join(matrix.spec-group.tests, ',') }}"
+
+            - uses: ./.github/actions/safe-yarn-install-using-cache
+
             - name: Cypress run
-              uses: cypress-io/github-action@v6
+              uses: cypress-io/github-action@v7
               with:
+                  install: false
                   record: ${{ env.SHOULD_RECORD }}
                   parallel: ${{ env.SHOULD_RECORD }}
                   group: ${{ env.SHOULD_RECORD == 'true' && env.CYPRESS_GROUP || '' }}

.github/workflows/preview.yml

@@ -9,20 +9,12 @@ jobs:
     runs-on: ubuntu-latest
     if: (github.event.label.name == 'preview' || github.event.label.name == 'testing') && !github.event.push.repository.fork && github.actor != 'dependabot[bot]'
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: 18.x
+          cache: ''
 
-      - uses: actions/cache@v4
-        id: yarn-cache
-        with:
-          path: '**/node_modules'
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-
-      - name: Install
-        if: steps.yarn-cache.outputs.cache-hit != 'true'
-        run: yarn install --frozen-lockfile
+      - uses: ./.github/actions/safe-yarn-install-using-cache
 
       - name: Build
         run: yarn build:standalone