From 7b21d4e34f6c70f0fd1753ecaab265031b13f493 Mon Sep 17 00:00:00 2001 From: Duncan Crawford Date: Mon, 22 Sep 2025 13:43:47 +0100 Subject: [PATCH 1/2] align the build and increment GHA versions --- .github/workflows/ci-draft.yml | 16 +++++++-------- .github/workflows/ci-released.yml | 18 ++++++----------- .github/workflows/code-analysis.yml | 4 ++-- .github/workflows/codeql.yml | 4 ++-- .github/workflows/lint-openapi.yml | 14 ++++++------- .github/workflows/publish-openapi-spec.yml | 4 ++-- .github/workflows/secrets-scanner.yml | 23 ++++++++++++++++++++++ 7 files changed, 50 insertions(+), 33 deletions(-) create mode 100644 .github/workflows/secrets-scanner.yml diff --git a/.github/workflows/ci-draft.yml b/.github/workflows/ci-draft.yml index 7eb853b..11448a5 100644 --- a/.github/workflows/ci-draft.yml +++ b/.github/workflows/ci-draft.yml @@ -20,7 +20,7 @@ jobs: artefact_version: ${{ steps.artefact.outputs.draft_version }} steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 with: fetch-depth: 0 # Necessary to fetch all history for accurate versioning @@ -42,7 +42,7 @@ jobs: upload_artifact_name: ${{ steps.update_spec.outputs.upload_artifact_name }} steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Update OpenAPI Spec Version id: update_spec @@ -62,10 +62,10 @@ jobs: steps: - name: Checkout source code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ matrix.java }} @@ -76,7 +76,7 @@ jobs: gradle-version: current - name: Download updated OpenAPI file - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: ${{ needs.Update-Spec-Version.outputs.upload_artifact_name }} path: ${{ env.FILE_PATH_OPENAPI }} @@ -111,10 +111,10 @@ jobs: steps: - name: Checkout source code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ matrix.java }} @@ -123,7 +123,7 @@ jobs: uses: gradle/actions/setup-gradle@v4 - name: Download updated OpenAPI file - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: ${{ needs.Update-Spec-Version.outputs.upload_artifact_name }} path: ${{ env.FILE_PATH_OPENAPI }} diff --git a/.github/workflows/ci-released.yml b/.github/workflows/ci-released.yml index e083171..2568f4c 100644 --- a/.github/workflows/ci-released.yml +++ b/.github/workflows/ci-released.yml @@ -16,7 +16,7 @@ jobs: artefact_version: ${{ steps.artefact.outputs.release_version }} steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 with: fetch-depth: 0 @@ -38,7 +38,7 @@ jobs: upload_artifact_name: ${{ steps.update_spec.outputs.upload_artifact_name }} steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Update OpenAPI Spec Version id: update_spec @@ -70,10 +70,10 @@ jobs: steps: - name: Checkout source code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: ${{ matrix.java }} @@ -82,7 +82,7 @@ jobs: uses: gradle/actions/setup-gradle@v4 - name: Download updated OpenAPI file - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: ${{ needs.Update-Spec-Version.outputs.upload_artifact_name }} path: ${{ env.FILE_PATH_OPENAPI }} @@ -95,14 +95,8 @@ jobs: AZURE_DEVOPS_ARTIFACT_TOKEN: ${{ secrets.AZURE_DEVOPS_ARTIFACT_TOKEN }} JAVA_VERSION: ${{ matrix.java }} run: | - if [ -z "$ARTEFACT_VERSION" ]; then - echo "❌ ERROR: ARTEFACT_VERSION is empty. Publishing cannot proceed." - exit 1 - else - echo "✅ Publishing artefact for ARTEFACT_VERSION=$ARTEFACT_VERSION using Java $JAVA_VERSION" - fi + echo "Publishing artefact for ARTEFACT_VERSION=$ARTEFACT_VERSION using Java $JAVA_VERSION" - echo "Publishing DEFAULT Java $JAVA_VERSION artefact" gradle build -x test publish \ -DAPI_SPEC_VERSION=$ARTEFACT_VERSION \ -DGITHUB_REPOSITORY=${{ github.repository }} \ diff --git a/.github/workflows/code-analysis.yml b/.github/workflows/code-analysis.yml index f8ee234..d4ad519 100644 --- a/.github/workflows/code-analysis.yml +++ b/.github/workflows/code-analysis.yml @@ -10,11 +10,11 @@ jobs: pmd-analysis: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v5 with: fetch-depth: 0 - - uses: actions/setup-java@v4 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: '21' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 84fa902..a9c8111 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Initialize CodeQL uses: github/codeql-action/init@v3 @@ -37,7 +37,7 @@ jobs: queries: security-extended - - uses: actions/setup-java@v4 + - uses: actions/setup-java@v5 with: distribution: 'temurin' java-version: 17 diff --git a/.github/workflows/lint-openapi.yml b/.github/workflows/lint-openapi.yml index e64c508..895988d 100644 --- a/.github/workflows/lint-openapi.yml +++ b/.github/workflows/lint-openapi.yml @@ -15,7 +15,7 @@ jobs: FILE_PATH_OPENAPI: "src/main/resources/openapi" steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Find OpenAPI file id: find_spec @@ -37,10 +37,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '22' @@ -63,10 +63,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '22' @@ -92,10 +92,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 with: node-version: '22' diff --git a/.github/workflows/publish-openapi-spec.yml b/.github/workflows/publish-openapi-spec.yml index 23d147f..bc9c6f7 100644 --- a/.github/workflows/publish-openapi-spec.yml +++ b/.github/workflows/publish-openapi-spec.yml @@ -30,13 +30,13 @@ jobs: SWAGGERHUB_API_KEY: ${{ secrets.SWAGGERHUB_API_KEY }} steps: - name: Download versioned OpenAPI spec - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v5 with: name: ${{ inputs.upload_artifact_name }} path: ./${{ inputs.api_version }} - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v5 - name: Install SwaggerHub CLI run: npm install -g swaggerhub-cli diff --git a/.github/workflows/secrets-scanner.yml b/.github/workflows/secrets-scanner.yml new file mode 100644 index 0000000..7acd032 --- /dev/null +++ b/.github/workflows/secrets-scanner.yml @@ -0,0 +1,23 @@ +name: Secrets Scanner +on: + pull_request: + branches: + - master + - main + schedule: + - cron: '0 4 * * 4' # Every Thursday at 04:00 + workflow_dispatch: + +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + with: + fetch-depth: 0 + + - uses: hmcts/secrets-scanner@main + with: + github_token: ${{ secrets.GITHUB_TOKEN }} + gitleaks_license: ${{ secrets.GITLEAKS_LICENSE }} + gitleaks_regex_internal_url: ${{ secrets.HMCTS_CP_GITLEAKS_REGEX_INTERNAL_URL }} From b57f34dc93cd48e60b9f86e3c2f46ec7f24ac6fa Mon Sep 17 00:00:00 2001 From: Duncan Crawford Date: Mon, 22 Sep 2025 13:55:23 +0100 Subject: [PATCH 2/2] fix publishing of draft only on merge --- .github/workflows/ci-draft.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci-draft.yml b/.github/workflows/ci-draft.yml index 11448a5..24600da 100644 --- a/.github/workflows/ci-draft.yml +++ b/.github/workflows/ci-draft.yml @@ -90,6 +90,7 @@ jobs: gradle build -DAPI_SPEC_VERSION=$ARTEFACT_VERSION Push-Draft-OpenAPI-Spec: + if: github.event_name == 'push' needs: [ Test ] uses: ./.github/workflows/publish-openapi-spec.yml secrets: