From 30aa4c9e815122a1c09ca753e6071b54740b0702 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:45:03 +0000 Subject: [PATCH 01/15] chore(dependabot.yml): add Dependabot configuration file to manage daily updates for npm packages in various directories --- .github/dependabot.yml | 156 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..f3699f479 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,156 @@ +### +# @format +# ----- +# Project: zenstack-monorepo +# File: dependabot.yml +# Path: \.github\dependabot.yml +# Created Date: Monday, February 19th 2024 +# Author: Jonathan Stevens, jonathan@resnovas.com +# Github: https://github.com/TGTGamer +# ----- +# Contributing: Please read through our contributing guidelines. +# Included are directions for opening issues, coding standards, +# and notes on development. These can be found at +# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md +# ----- +# Code of Conduct: This project abides by the Contributor Covenant, v2.0 +# Please interact in ways that contribute to an open, welcoming, diverse, +# inclusive, and healthy community. Our Code of Conduct can be found at +# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md +# ----- +# Copyright (c) 2024 ZenstackHQ - All Rights Reserved +# LICENSE: MIT License (MIT) +# ----- +# This program has been provided under confidence of the copyright holder and +# is licensed for copying, distribution and modification under the terms +# of the MIT License (MIT) published as the License, +# or (at your option) any later version of this license. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MIT License for more details. +# You should have received a copy of the MIT License +# along with this program. If not, please write to: jonathan@resnovas.com, +# or see https://opensource.org/licenses/MIT +# ----- +# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE +### + +version: 2 +updates: + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/ide/jetbrains" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/language" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/misc/redwood" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/plugins/openapi" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/plugins/swr" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/plugins/tanstack-query" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/plugins/trpc" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/runtime" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/sdk" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/server" + + - package-ecosystem: "npm" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/packages/testtools" + + - package-ecosystem: "github-actions" + schedule: + interval: "daily" + time: "02:00" + commit-message: + prefix: ":arrow_up: maint" + include: scope + directory: "/" \ No newline at end of file From afb8d9164c824da47512e5a0e6f5a270427d650d Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:45:20 +0000 Subject: [PATCH 02/15] feat(release): add release manifest and main config files for version 2.0.0-alpha.1 feat(release): define package names and components in release main config file feat(release): set up configuration for automated versioning and release process --- .github/release/.release-manifest.json | 14 ++++++ .github/release/release-main-config.json | 60 ++++++++++++++++++++++++ 2 files changed, 74 insertions(+) create mode 100644 .github/release/.release-manifest.json create mode 100644 .github/release/release-main-config.json diff --git a/.github/release/.release-manifest.json b/.github/release/.release-manifest.json new file mode 100644 index 000000000..5b18bf702 --- /dev/null +++ b/.github/release/.release-manifest.json @@ -0,0 +1,14 @@ +{ + ".": "2.0.0-alpha.1", + "packages/ide/jetbrains": "2.0.0-alpha.1", + "packages/language": "2.0.0-alpha.1", + "packages/misc/redwood": "2.0.0-alpha.1", + "packages/plugins/openapi": "2.0.0-alpha.1", + "packages/plugins/swr": "2.0.0-alpha.1", + "packages/plugins/tanstack-query": "2.0.0-alpha.1", + "packages/plugins/trpc": "2.0.0-alpha.1", + "packages/runtime": "2.0.0-alpha.1", + "packages/sdk": "2.0.0-alpha.1", + "packages/server": "2.0.0-alpha.1", + "packages/testtools": "2.0.0-alpha.1" +} \ No newline at end of file diff --git a/.github/release/release-main-config.json b/.github/release/release-main-config.json new file mode 100644 index 000000000..06bb2df22 --- /dev/null +++ b/.github/release/release-main-config.json @@ -0,0 +1,60 @@ +{ + "packages": { + ".": { + "package-name": "zenstack-monorepo", + "component": "Monorepo" + }, + "packages/ide/jetbrains": { + "package-name": "jetbrains", + "component": "JetBrains IDE" + }, + "packages/language": { + "package-name": "@zenstackhq/language", + "component": "Language" + }, + "packages/misc/redwood": { + "package-name": "@zenstackhq/redwood", + "component": "Redwood" + }, + "packages/plugins/openapi": { + "package-name": "@zenstackhq/openapi", + "component": "OpenAPI Plugin" + }, + "packages/plugins/swr": { + "package-name": "@zenstackhq/swr", + "component": "SWR Plugin" + }, + "packages/plugins/tanstack-query": { + "package-name": "@zenstackhq/tanstack-query", + "component": "Tanstack Query Plugin" + }, + "packages/plugins/trpc": { + "package-name": "@zenstackhq/trpc", + "component": "tRPC Plugin" + }, + "packages/runtime": { + "package-name": "@zenstackhq/runtime", + "component": "Runtime" + }, + "packages/sdk": { + "package-name": "@zenstackhq/sdk", + "component": "SDK" + }, + "packages/server": { + "package-name": "@zenstackhq/server", + "component": "Server" + }, + "packages/testtools": { + "package-name": "@zenstackhq/testtools", + "component": "Test Tools" + } + }, + "pull-request-footer": "This PR was generated by [Release-Please](https://github.com/googleapis/release-please), and approved by the ZenStack Team.", + "bump-minor-pre-major": true, + "bump-patch-for-minor-pre-major": true, + "sequential-calls": true, + "separate-pull-requests": true, + "versioning": "default", + "release-type": "node", + "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json" +} \ No newline at end of file From 42096796ae85235b71ddd4b0e76dbfa7ae4c690f Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:46:06 +0000 Subject: [PATCH 03/15] feat(codeql.yml): add CodeQL workflow for security analysis on push, pull request, and schedule events targeting main, develop, and release/* branches. Set permissions for job execution and analysis. Include steps to harden runner, checkout repository, initialize CodeQL, autobuild, and perform CodeQL analysis for javascript and typescript languages. --- .github/workflows/codeql.yml | 112 +++++++++++++++++++++++++++++++++++ 1 file changed, 112 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 000000000..028a774f2 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,112 @@ +### +# @format +# ----- +# Project: zenstack-monorepo +# File: codeql.yml +# Path: \.github\workflows\codeql.yml +# Created Date: Monday, February 19th 2024 +# Author: Jonathan Stevens, jonathan@resnovas.com +# Github: https://github.com/TGTGamer +# ----- +# Contributing: Please read through our contributing guidelines. +# Included are directions for opening issues, coding standards, +# and notes on development. These can be found at +# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md +# ----- +# Code of Conduct: This project abides by the Contributor Covenant, v2.0 +# Please interact in ways that contribute to an open, welcoming, diverse, +# inclusive, and healthy community. Our Code of Conduct can be found at +# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md +# ----- +# Copyright (c) 2024 ZenstackHQ - All Rights Reserved +# LICENSE: MIT License (MIT) +# ----- +# This program has been provided under confidence of the copyright holder and +# is licensed for copying, distribution and modification under the terms +# of the MIT License (MIT) published as the License, +# or (at your option) any later version of this license. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MIT License for more details. +# You should have received a copy of the MIT License +# along with this program. If not, please write to: jonathan@resnovas.com, +# or see https://opensource.org/licenses/MIT +# ----- +# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE +### + +name: Security - CodeQL + +on: + merge_group: + push: + branches: + - main + - develop + - release/* + pull_request: + branches: + - main + - develop + - release/* + schedule: + - cron: "0 0 * * 1" + +permissions: + contents: read + + +jobs: + analyze: + permissions: + actions: read + contents: read + security-events: write + name: Analyze + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + language: ["javascript", "typescript"] + # CodeQL supports [ $supported-codeql-languages ] + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - name: Checkout repository + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + with: + category: "/language:${{matrix.language}}" From 8fac60d46f9b4c87639286d5485f6cc2a6358102 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:46:49 +0000 Subject: [PATCH 04/15] feat(workflows): add management-changelog.yml file for release workflow feat(workflows): configure release workflow to trigger on push to main, dev, and release branches feat(workflows): set permissions for contents to read and write in release job feat(workflows): add steps to harden runner for runtime security in release job feat(workflows): add release-please-action for automated releases in release job feat(workflows): add actions/checkout and actions/setup-node for release job setup feat(workflows): add pnpm installation and publishing steps in release job --- .github/workflows/management-changelog.yml | 103 +++++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 .github/workflows/management-changelog.yml diff --git a/.github/workflows/management-changelog.yml b/.github/workflows/management-changelog.yml new file mode 100644 index 000000000..c150977d9 --- /dev/null +++ b/.github/workflows/management-changelog.yml @@ -0,0 +1,103 @@ +### +# @format +# ----- +# Project: zenstack-monorepo +# File: management-changelog.yml +# Path: \.github\workflows\management-changelog.yml +# Created Date: Monday, February 19th 2024 +# Author: Jonathan Stevens, jonathan@resnovas.com +# Github: https://github.com/TGTGamer +# ----- +# Contributing: Please read through our contributing guidelines. +# Included are directions for opening issues, coding standards, +# and notes on development. These can be found at +# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md +# ----- +# Code of Conduct: This project abides by the Contributor Covenant, v2.0 +# Please interact in ways that contribute to an open, welcoming, diverse, +# inclusive, and healthy community. Our Code of Conduct can be found at +# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md +# ----- +# Copyright (c) 2024 ZenstackHQ - All Rights Reserved +# LICENSE: MIT License (MIT) +# ----- +# This program has been provided under confidence of the copyright holder and +# is licensed for copying, distribution and modification under the terms +# of the MIT License (MIT) published as the License, +# or (at your option) any later version of this license. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MIT License for more details. +# You should have received a copy of the MIT License +# along with this program. If not, please write to: jonathan@resnovas.com, +# or see https://opensource.org/licenses/MIT +# ----- +# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE +### + + + +on: + push: + branches: + - main # Your main branch + - dev # Your development branch + - release/* # Your releases branch + # - v2 # Your current v2 branch - disabled for now because I don't know if you want to have this tag on this branch or not -_- + # TODO: Rename your V2 brach to release/v2 for proper versioning if you intend to use a Release branch method + +permissions: + contents: read + +name: Management - Release Workflow + +jobs: + release: + permissions: + contents: write + pull-requests: write + env: + GITHUB_TOKEN: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. + runs-on: ubuntu-latest + steps: + # Harden-Runner provides runtime security for GitHub-hosted and self-hosted environments. + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + # This tells you useful infomation about the workflow, but it's not required (hence commented out) - it's just nice to have + # - name: Workflow Telemetry + # uses: catchpoint/workflow-telemetry-action@6705383eabd01833acfe8412ec697384830e1455 # v1.8.7 + # with: + # comment_on_pr: false + # theme: dark + # proc_trace_sys_enable: true + + - uses: google-github-actions/release-please-action@v4 + id: release + with: + config-file: '.github/releases/release-main-config.json' + manifest-file: '.github/releases/.release-manifest.json' + target-branch: ${{ github.ref_name == 'develop' && 'main' || github.ref_name }} + include-component-in-tag: true + + - uses: actions/checkout@v4 + if: ${{ steps.release.outputs.release_created }} + + - uses: actions/setup-node@v4 + if: ${{ steps.release.outputs.release_created }} + with: + node-version: 12 + registry-url: 'https://registry.npmjs.org' + + - run: pnpm i # Install using pnpm + if: ${{ steps.release.outputs.release_created }} + + - run: pnpm publish-all # Publish using pre-defined pnpm script + if: ${{ steps.release.outputs.release_created }} + env: + NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} + + \ No newline at end of file From 38b40d70b079aa39c9405269a45be487e5c58b0e Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:47:22 +0000 Subject: [PATCH 05/15] feat(security-defender-for-devops.yml): add GitHub Actions workflow for Microsoft Defender For DevOps security checks --- .../security-defender-for-devops.yml | 107 ++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 .github/workflows/security-defender-for-devops.yml diff --git a/.github/workflows/security-defender-for-devops.yml b/.github/workflows/security-defender-for-devops.yml new file mode 100644 index 000000000..96b702ce0 --- /dev/null +++ b/.github/workflows/security-defender-for-devops.yml @@ -0,0 +1,107 @@ +### +# @format +# ----- +# Project: zenstack-monorepo +# File: security-defender-for-devops.yml +# Path: \.github\workflows\security-defender-for-devops.yml +# Created Date: Monday, February 19th 2024 +# Author: Jonathan Stevens, jonathan@resnovas.com +# Github: https://github.com/TGTGamer +# ----- +# Contributing: Please read through our contributing guidelines. +# Included are directions for opening issues, coding standards, +# and notes on development. These can be found at +# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md +# ----- +# Code of Conduct: This project abides by the Contributor Covenant, v2.0 +# Please interact in ways that contribute to an open, welcoming, diverse, +# inclusive, and healthy community. Our Code of Conduct can be found at +# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md +# ----- +# Copyright (c) 2024 ZenstackHQ - All Rights Reserved +# LICENSE: MIT License (MIT) +# ----- +# This program has been provided under confidence of the copyright holder and +# is licensed for copying, distribution and modification under the terms +# of the MIT License (MIT) published as the License, +# or (at your option) any later version of this license. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MIT License for more details. +# You should have received a copy of the MIT License +# along with this program. If not, please write to: jonathan@resnovas.com, +# or see https://opensource.org/licenses/MIT +# ----- +# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE +### + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# Microsoft Security DevOps (MSDO) is a command line application which integrates static analysis tools into the development cycle. +# MSDO installs, configures and runs the latest versions of static analysis tools +# (including, but not limited to, SDL/security and compliance tools). +# +# The Microsoft Security DevOps action is currently in beta and runs on the windows-latest queue, +# as well as Windows self hosted agents. ubuntu-latest support coming soon. +# +# For more information about the action , check out https://github.com/microsoft/security-devops-action +# +# Please note this workflow do not integrate your GitHub Org with Microsoft Defender For DevOps. You have to create an integration +# and provide permission before this can report data back to azure. +# Read the official documentation here : https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github + +name: Security - Microsoft Defender For Devops + +on: + merge_group: + push: + branches: + - main + - develop + - release/* + pull_request: + branches: + - main + - develop + - release/* + schedule: + - cron: '34 12 * * 0' + +permissions: + contents: read + security-events: read + +jobs: + MSDO: + # currently only windows latest is supported + runs-on: windows-latest + permissions: + security-events: write + + steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + # checks out the repository + - uses: actions/checkout@v4 + + - uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3.2.0 + with: + dotnet-version: | + 5.0.x + 6.0.x + + - name: Run Microsoft Security DevOps + uses: microsoft/security-devops-action@e94440350ed10e2806d47cd0d7504a2c51abdbe9 # v1.6.0 + id: msdo + + - name: Upload results to Security tab + uses: github/codeql-action/upload-sarif@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + with: + sarif_file: ${{ steps.msdo.outputs.sarifFile }} From 610a246852803128b30071a71bff5bd5b36e2552 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:47:34 +0000 Subject: [PATCH 06/15] feat(security-dependency-review.yml): add security dependency review workflow to scan and block PRs with known-vulnerable packages --- .../workflows/security-dependency-review.yml | 71 +++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/security-dependency-review.yml diff --git a/.github/workflows/security-dependency-review.yml b/.github/workflows/security-dependency-review.yml new file mode 100644 index 000000000..060baa17e --- /dev/null +++ b/.github/workflows/security-dependency-review.yml @@ -0,0 +1,71 @@ +### +# @format +# ----- +# Project: zenstack-monorepo +# File: security-dependency-review.yml +# Path: \.github\workflows\security-dependency-review.yml +# Created Date: Monday, February 19th 2024 +# Author: Jonathan Stevens, jonathan@resnovas.com +# Github: https://github.com/TGTGamer +# ----- +# Contributing: Please read through our contributing guidelines. +# Included are directions for opening issues, coding standards, +# and notes on development. These can be found at +# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md +# ----- +# Code of Conduct: This project abides by the Contributor Covenant, v2.0 +# Please interact in ways that contribute to an open, welcoming, diverse, +# inclusive, and healthy community. Our Code of Conduct can be found at +# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md +# ----- +# Copyright (c) 2024 ZenstackHQ - All Rights Reserved +# LICENSE: MIT License (MIT) +# ----- +# This program has been provided under confidence of the copyright holder and +# is licensed for copying, distribution and modification under the terms +# of the MIT License (MIT) published as the License, +# or (at your option) any later version of this license. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MIT License for more details. +# You should have received a copy of the MIT License +# along with this program. If not, please write to: jonathan@resnovas.com, +# or see https://opensource.org/licenses/MIT +# ----- +# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE +### + +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, +# surfacing known-vulnerable versions of the packages declared or updated in the PR. +# Once installed, if the workflow run is marked as required, +# PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +name: Security - Dependency Review +on: + merge_group: + pull_request: + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + # checks out the repository + - uses: actions/checkout@v4 + with: + submodules: 'recursive' + token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. + + - name: 'Dependency Review' + uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 From 621c50322473bd95df7e792d89eaf0470d93500c Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:47:49 +0000 Subject: [PATCH 07/15] feat(security-ossar.yml): add GitHub workflow for security scanning using OSSAR feat(security-ossar.yml): integrate open source static analysis tools with GitHub code scanning feat(security-ossar.yml): schedule security scans on main, develop, and release branches --- .github/workflows/security-ossar.yml | 110 +++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) create mode 100644 .github/workflows/security-ossar.yml diff --git a/.github/workflows/security-ossar.yml b/.github/workflows/security-ossar.yml new file mode 100644 index 000000000..889d890c5 --- /dev/null +++ b/.github/workflows/security-ossar.yml @@ -0,0 +1,110 @@ +### +# @format +# ----- +# Project: zenstack-monorepo +# File: security-ossar.yml +# Path: \.github\workflows\security-ossar.yml +# Created Date: Monday, February 19th 2024 +# Author: Jonathan Stevens, jonathan@resnovas.com +# Github: https://github.com/TGTGamer +# ----- +# Contributing: Please read through our contributing guidelines. +# Included are directions for opening issues, coding standards, +# and notes on development. These can be found at +# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md +# ----- +# Code of Conduct: This project abides by the Contributor Covenant, v2.0 +# Please interact in ways that contribute to an open, welcoming, diverse, +# inclusive, and healthy community. Our Code of Conduct can be found at +# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md +# ----- +# Copyright (c) 2024 ZenstackHQ - All Rights Reserved +# LICENSE: MIT License (MIT) +# ----- +# This program has been provided under confidence of the copyright holder and +# is licensed for copying, distribution and modification under the terms +# of the MIT License (MIT) published as the License, +# or (at your option) any later version of this license. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MIT License for more details. +# You should have received a copy of the MIT License +# along with this program. If not, please write to: jonathan@resnovas.com, +# or see https://opensource.org/licenses/MIT +# ----- +# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE +### + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow integrates a collection of open source static analysis tools +# with GitHub code scanning. For documentation, or to provide feedback, visit +# https://github.com/github/ossar-action +name: Security - OSSAR + +on: + merge_group: + push: + branches: + - main + - develop + - release/* + pull_request: + branches: + - main + - develop + - release/* + schedule: + - cron: '41 3 * * 5' + +permissions: + contents: read + +jobs: + OSSAR-Scan: + runs-on: windows-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + + steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - name: Workflow Telemetry + uses: catchpoint/workflow-telemetry-action@6705383eabd01833acfe8412ec697384830e1455 # v1.8.7 + with: + github_token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. + comment_on_pr: false + theme: dark + proc_trace_sys_enable: true + + # checks out the repository + - uses: actions/checkout@v4 + with: + submodules: 'recursive' + token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. + + - uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3.2.0 + with: + dotnet-version: | + 5.0.x + 6.0.x + + # Run open source static analysis tools + - name: Run OSSAR + uses: github/ossar-action@786a16a90ba92b4ae6228fe7382fb16ef5c51000 # v1 + id: ossar + + # Upload results to the Security tab + - name: Upload OSSAR results + uses: github/codeql-action/upload-sarif@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + with: + sarif_file: ${{ steps.ossar.outputs.sarifFile }} From 50f003754adeffe93b4008653085afc4e88f5e13 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:48:02 +0000 Subject: [PATCH 08/15] feat(security-scorecard.yml): add GitHub Actions workflow for security scorecard analysis to enhance supply-chain security monitoring and compliance with best practices --- .github/workflows/security-scorecard.yml | 117 +++++++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 .github/workflows/security-scorecard.yml diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml new file mode 100644 index 000000000..09fb11865 --- /dev/null +++ b/.github/workflows/security-scorecard.yml @@ -0,0 +1,117 @@ +### +# @format +# ----- +# Project: zenstack-monorepo +# File: security-scorecard.yml +# Path: \.github\workflows\security-scorecard.yml +# Created Date: Monday, February 19th 2024 +# Author: Jonathan Stevens, jonathan@resnovas.com +# Github: https://github.com/TGTGamer +# ----- +# Contributing: Please read through our contributing guidelines. +# Included are directions for opening issues, coding standards, +# and notes on development. These can be found at +# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md +# ----- +# Code of Conduct: This project abides by the Contributor Covenant, v2.0 +# Please interact in ways that contribute to an open, welcoming, diverse, +# inclusive, and healthy community. Our Code of Conduct can be found at +# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md +# ----- +# Copyright (c) 2024 ZenstackHQ - All Rights Reserved +# LICENSE: MIT License (MIT) +# ----- +# This program has been provided under confidence of the copyright holder and +# is licensed for copying, distribution and modification under the terms +# of the MIT License (MIT) published as the License, +# or (at your option) any later version of this license. +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# MIT License for more details. +# You should have received a copy of the MIT License +# along with this program. If not, please write to: jonathan@resnovas.com, +# or see https://opensource.org/licenses/MIT +# ----- +# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE +### + + + +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Security - Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '21 9 * * 6' + push: + branches: + - main + - develop + +# Declare default permissions as read only. +permissions: + contents: read + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + # Uncomment the permissions below if installing in a private repository. + # contents: read + # actions: read + + steps: + - name: Harden Runner + uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 + with: + egress-policy: audit + + - name: Workflow Telemetry + uses: catchpoint/workflow-telemetry-action@6705383eabd01833acfe8412ec697384830e1455 # v1.8.7 + with: + github_token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. + comment_on_pr: false + theme: dark + proc_trace_sys_enable: true + + # checks out the repository + - uses: actions/checkout@v4 + with: + submodules: 'recursive' + token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. + + - name: "Run analysis" + uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2 + with: + results_file: results.sarif + results_format: sarif + repo_token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4 + with: + sarif_file: results.sarif From 07f6b1fd3969c1a03956e699a179214e8b2987d5 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 02:53:04 +0000 Subject: [PATCH 09/15] chore(workflows): update workflow files to include v2 branch in branch filtering for push and pull_request events to align with project requirements --- .github/workflows/build-test.yml | 18 ++++++++++++++++-- .github/workflows/codeql.yml | 2 ++ .../workflows/security-defender-for-devops.yml | 2 ++ .github/workflows/security-ossar.yml | 2 ++ 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index cbdbce76c..267a89362 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -8,8 +8,22 @@ env: DO_NOT_TRACK: '1' on: - pull_request: - branches: ['dev', 'main', 'v2'] + merge_group: + push: + branches: + - main + - develop + - release/* + - v2 + pull_request: + branches: + - main + - develop + - release/* + - v2 + +permissions: + contents: read jobs: build-test: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 028a774f2..e9a91101a 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -45,11 +45,13 @@ on: - main - develop - release/* + - v2 pull_request: branches: - main - develop - release/* + - v2 schedule: - cron: "0 0 * * 1" diff --git a/.github/workflows/security-defender-for-devops.yml b/.github/workflows/security-defender-for-devops.yml index 96b702ce0..258ef2a1a 100644 --- a/.github/workflows/security-defender-for-devops.yml +++ b/.github/workflows/security-defender-for-devops.yml @@ -63,11 +63,13 @@ on: - main - develop - release/* + - v2 pull_request: branches: - main - develop - release/* + - v2 schedule: - cron: '34 12 * * 0' diff --git a/.github/workflows/security-ossar.yml b/.github/workflows/security-ossar.yml index 889d890c5..c53a45d04 100644 --- a/.github/workflows/security-ossar.yml +++ b/.github/workflows/security-ossar.yml @@ -53,11 +53,13 @@ on: - main - develop - release/* + - v2 pull_request: branches: - main - develop - release/* + - v2 schedule: - cron: '41 3 * * 5' From 3a675d28f652885af6dd341cd9dfaf780cf40e21 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 03:08:07 +0000 Subject: [PATCH 10/15] fix(workflows): correct paths for config-file and manifest-file in release-please-action configuration --- .github/workflows/management-changelog.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/management-changelog.yml b/.github/workflows/management-changelog.yml index c150977d9..ae83efc55 100644 --- a/.github/workflows/management-changelog.yml +++ b/.github/workflows/management-changelog.yml @@ -78,8 +78,8 @@ jobs: - uses: google-github-actions/release-please-action@v4 id: release with: - config-file: '.github/releases/release-main-config.json' - manifest-file: '.github/releases/.release-manifest.json' + config-file: '.github/release/release-main-config.json' + manifest-file: '.github/release/.release-manifest.json' target-branch: ${{ github.ref_name == 'develop' && 'main' || github.ref_name }} include-component-in-tag: true From 554ed1da81a7f44ead122b36246f1055e5303216 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 03:19:50 +0000 Subject: [PATCH 11/15] chore(release-main-config.json): update component names to use underscores instead of spaces for consistency and readability. --- .github/release/release-main-config.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/release/release-main-config.json b/.github/release/release-main-config.json index 06bb2df22..4d1ed0cd5 100644 --- a/.github/release/release-main-config.json +++ b/.github/release/release-main-config.json @@ -6,7 +6,7 @@ }, "packages/ide/jetbrains": { "package-name": "jetbrains", - "component": "JetBrains IDE" + "component": "JetBrains_IDE" }, "packages/language": { "package-name": "@zenstackhq/language", @@ -18,7 +18,7 @@ }, "packages/plugins/openapi": { "package-name": "@zenstackhq/openapi", - "component": "OpenAPI Plugin" + "component": "OpenAPI_Plugin" }, "packages/plugins/swr": { "package-name": "@zenstackhq/swr", @@ -26,11 +26,11 @@ }, "packages/plugins/tanstack-query": { "package-name": "@zenstackhq/tanstack-query", - "component": "Tanstack Query Plugin" + "component": "Tanstack_Query_Plugin" }, "packages/plugins/trpc": { "package-name": "@zenstackhq/trpc", - "component": "tRPC Plugin" + "component": "tRPC_Plugin" }, "packages/runtime": { "package-name": "@zenstackhq/runtime", @@ -46,7 +46,7 @@ }, "packages/testtools": { "package-name": "@zenstackhq/testtools", - "component": "Test Tools" + "component": "Test_Tools" } }, "pull-request-footer": "This PR was generated by [Release-Please](https://github.com/googleapis/release-please), and approved by the ZenStack Team.", From bb7f10c5a262783f8957a5cf91e41492ea4fc28c Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 03:21:11 +0000 Subject: [PATCH 12/15] chore(release-main-config.json): update component value for SWR Plugin to use underscore instead of space for consistency across components --- .github/release/release-main-config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/release/release-main-config.json b/.github/release/release-main-config.json index 4d1ed0cd5..731a26788 100644 --- a/.github/release/release-main-config.json +++ b/.github/release/release-main-config.json @@ -22,7 +22,7 @@ }, "packages/plugins/swr": { "package-name": "@zenstackhq/swr", - "component": "SWR Plugin" + "component": "SWR_Plugin" }, "packages/plugins/tanstack-query": { "package-name": "@zenstackhq/tanstack-query", From eee7c3e532d7c4f31200e4a8265fb99af9ebf9f9 Mon Sep 17 00:00:00 2001 From: Jonathan Stevens Date: Mon, 19 Feb 2024 03:23:32 +0000 Subject: [PATCH 13/15] chore: release 2.0.0 Release-As: 2.0.0 From 238bb2f72665280eca09dec6eb467c4810f5f164 Mon Sep 17 00:00:00 2001 From: Jonathan S Date: Tue, 20 Feb 2024 19:51:29 +0000 Subject: [PATCH 14/15] Apply suggestions from code review --- .github/dependabot.yml | 37 ----------------- .github/workflows/build-test.yml | 4 +- .github/workflows/codeql.yml | 41 +------------------ .github/workflows/management-changelog.yml | 39 +----------------- .../security-defender-for-devops.yml | 41 +------------------ .../workflows/security-dependency-review.yml | 37 ----------------- .github/workflows/security-ossar.yml | 41 +------------------ .github/workflows/security-scorecard.yml | 39 +----------------- 8 files changed, 10 insertions(+), 269 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f3699f479..bba71a575 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,40 +1,3 @@ -### -# @format -# ----- -# Project: zenstack-monorepo -# File: dependabot.yml -# Path: \.github\dependabot.yml -# Created Date: Monday, February 19th 2024 -# Author: Jonathan Stevens, jonathan@resnovas.com -# Github: https://github.com/TGTGamer -# ----- -# Contributing: Please read through our contributing guidelines. -# Included are directions for opening issues, coding standards, -# and notes on development. These can be found at -# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md -# ----- -# Code of Conduct: This project abides by the Contributor Covenant, v2.0 -# Please interact in ways that contribute to an open, welcoming, diverse, -# inclusive, and healthy community. Our Code of Conduct can be found at -# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md -# ----- -# Copyright (c) 2024 ZenstackHQ - All Rights Reserved -# LICENSE: MIT License (MIT) -# ----- -# This program has been provided under confidence of the copyright holder and -# is licensed for copying, distribution and modification under the terms -# of the MIT License (MIT) published as the License, -# or (at your option) any later version of this license. -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# MIT License for more details. -# You should have received a copy of the MIT License -# along with this program. If not, please write to: jonathan@resnovas.com, -# or see https://opensource.org/licenses/MIT -# ----- -# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE -### version: 2 updates: diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 267a89362..27982bbd2 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -12,13 +12,13 @@ on: push: branches: - main - - develop + - dev - release/* - v2 pull_request: branches: - main - - develop + - dev - release/* - v2 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e9a91101a..187f90653 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,40 +1,3 @@ -### -# @format -# ----- -# Project: zenstack-monorepo -# File: codeql.yml -# Path: \.github\workflows\codeql.yml -# Created Date: Monday, February 19th 2024 -# Author: Jonathan Stevens, jonathan@resnovas.com -# Github: https://github.com/TGTGamer -# ----- -# Contributing: Please read through our contributing guidelines. -# Included are directions for opening issues, coding standards, -# and notes on development. These can be found at -# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md -# ----- -# Code of Conduct: This project abides by the Contributor Covenant, v2.0 -# Please interact in ways that contribute to an open, welcoming, diverse, -# inclusive, and healthy community. Our Code of Conduct can be found at -# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md -# ----- -# Copyright (c) 2024 ZenstackHQ - All Rights Reserved -# LICENSE: MIT License (MIT) -# ----- -# This program has been provided under confidence of the copyright holder and -# is licensed for copying, distribution and modification under the terms -# of the MIT License (MIT) published as the License, -# or (at your option) any later version of this license. -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# MIT License for more details. -# You should have received a copy of the MIT License -# along with this program. If not, please write to: jonathan@resnovas.com, -# or see https://opensource.org/licenses/MIT -# ----- -# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE -### name: Security - CodeQL @@ -43,13 +6,13 @@ on: push: branches: - main - - develop + - dev - release/* - v2 pull_request: branches: - main - - develop + - dev - release/* - v2 schedule: diff --git a/.github/workflows/management-changelog.yml b/.github/workflows/management-changelog.yml index ae83efc55..12a968f46 100644 --- a/.github/workflows/management-changelog.yml +++ b/.github/workflows/management-changelog.yml @@ -1,40 +1,3 @@ -### -# @format -# ----- -# Project: zenstack-monorepo -# File: management-changelog.yml -# Path: \.github\workflows\management-changelog.yml -# Created Date: Monday, February 19th 2024 -# Author: Jonathan Stevens, jonathan@resnovas.com -# Github: https://github.com/TGTGamer -# ----- -# Contributing: Please read through our contributing guidelines. -# Included are directions for opening issues, coding standards, -# and notes on development. These can be found at -# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md -# ----- -# Code of Conduct: This project abides by the Contributor Covenant, v2.0 -# Please interact in ways that contribute to an open, welcoming, diverse, -# inclusive, and healthy community. Our Code of Conduct can be found at -# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md -# ----- -# Copyright (c) 2024 ZenstackHQ - All Rights Reserved -# LICENSE: MIT License (MIT) -# ----- -# This program has been provided under confidence of the copyright holder and -# is licensed for copying, distribution and modification under the terms -# of the MIT License (MIT) published as the License, -# or (at your option) any later version of this license. -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# MIT License for more details. -# You should have received a copy of the MIT License -# along with this program. If not, please write to: jonathan@resnovas.com, -# or see https://opensource.org/licenses/MIT -# ----- -# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE -### @@ -80,7 +43,7 @@ jobs: with: config-file: '.github/release/release-main-config.json' manifest-file: '.github/release/.release-manifest.json' - target-branch: ${{ github.ref_name == 'develop' && 'main' || github.ref_name }} + target-branch: ${{ github.ref_name == 'dev' && 'main' || github.ref_name }} include-component-in-tag: true - uses: actions/checkout@v4 diff --git a/.github/workflows/security-defender-for-devops.yml b/.github/workflows/security-defender-for-devops.yml index 258ef2a1a..a75c6f4a8 100644 --- a/.github/workflows/security-defender-for-devops.yml +++ b/.github/workflows/security-defender-for-devops.yml @@ -1,40 +1,3 @@ -### -# @format -# ----- -# Project: zenstack-monorepo -# File: security-defender-for-devops.yml -# Path: \.github\workflows\security-defender-for-devops.yml -# Created Date: Monday, February 19th 2024 -# Author: Jonathan Stevens, jonathan@resnovas.com -# Github: https://github.com/TGTGamer -# ----- -# Contributing: Please read through our contributing guidelines. -# Included are directions for opening issues, coding standards, -# and notes on development. These can be found at -# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md -# ----- -# Code of Conduct: This project abides by the Contributor Covenant, v2.0 -# Please interact in ways that contribute to an open, welcoming, diverse, -# inclusive, and healthy community. Our Code of Conduct can be found at -# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md -# ----- -# Copyright (c) 2024 ZenstackHQ - All Rights Reserved -# LICENSE: MIT License (MIT) -# ----- -# This program has been provided under confidence of the copyright holder and -# is licensed for copying, distribution and modification under the terms -# of the MIT License (MIT) published as the License, -# or (at your option) any later version of this license. -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# MIT License for more details. -# You should have received a copy of the MIT License -# along with this program. If not, please write to: jonathan@resnovas.com, -# or see https://opensource.org/licenses/MIT -# ----- -# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE -### # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by @@ -61,13 +24,13 @@ on: push: branches: - main - - develop + - dev - release/* - v2 pull_request: branches: - main - - develop + - dev - release/* - v2 schedule: diff --git a/.github/workflows/security-dependency-review.yml b/.github/workflows/security-dependency-review.yml index 060baa17e..f76681581 100644 --- a/.github/workflows/security-dependency-review.yml +++ b/.github/workflows/security-dependency-review.yml @@ -1,40 +1,3 @@ -### -# @format -# ----- -# Project: zenstack-monorepo -# File: security-dependency-review.yml -# Path: \.github\workflows\security-dependency-review.yml -# Created Date: Monday, February 19th 2024 -# Author: Jonathan Stevens, jonathan@resnovas.com -# Github: https://github.com/TGTGamer -# ----- -# Contributing: Please read through our contributing guidelines. -# Included are directions for opening issues, coding standards, -# and notes on development. These can be found at -# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md -# ----- -# Code of Conduct: This project abides by the Contributor Covenant, v2.0 -# Please interact in ways that contribute to an open, welcoming, diverse, -# inclusive, and healthy community. Our Code of Conduct can be found at -# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md -# ----- -# Copyright (c) 2024 ZenstackHQ - All Rights Reserved -# LICENSE: MIT License (MIT) -# ----- -# This program has been provided under confidence of the copyright holder and -# is licensed for copying, distribution and modification under the terms -# of the MIT License (MIT) published as the License, -# or (at your option) any later version of this license. -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# MIT License for more details. -# You should have received a copy of the MIT License -# along with this program. If not, please write to: jonathan@resnovas.com, -# or see https://opensource.org/licenses/MIT -# ----- -# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE -### # Dependency Review Action # diff --git a/.github/workflows/security-ossar.yml b/.github/workflows/security-ossar.yml index c53a45d04..eae2de45f 100644 --- a/.github/workflows/security-ossar.yml +++ b/.github/workflows/security-ossar.yml @@ -1,40 +1,3 @@ -### -# @format -# ----- -# Project: zenstack-monorepo -# File: security-ossar.yml -# Path: \.github\workflows\security-ossar.yml -# Created Date: Monday, February 19th 2024 -# Author: Jonathan Stevens, jonathan@resnovas.com -# Github: https://github.com/TGTGamer -# ----- -# Contributing: Please read through our contributing guidelines. -# Included are directions for opening issues, coding standards, -# and notes on development. These can be found at -# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md -# ----- -# Code of Conduct: This project abides by the Contributor Covenant, v2.0 -# Please interact in ways that contribute to an open, welcoming, diverse, -# inclusive, and healthy community. Our Code of Conduct can be found at -# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md -# ----- -# Copyright (c) 2024 ZenstackHQ - All Rights Reserved -# LICENSE: MIT License (MIT) -# ----- -# This program has been provided under confidence of the copyright holder and -# is licensed for copying, distribution and modification under the terms -# of the MIT License (MIT) published as the License, -# or (at your option) any later version of this license. -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# MIT License for more details. -# You should have received a copy of the MIT License -# along with this program. If not, please write to: jonathan@resnovas.com, -# or see https://opensource.org/licenses/MIT -# ----- -# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE -### # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by @@ -51,13 +14,13 @@ on: push: branches: - main - - develop + - dev - release/* - v2 pull_request: branches: - main - - develop + - dev - release/* - v2 schedule: diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml index 09fb11865..57875f59d 100644 --- a/.github/workflows/security-scorecard.yml +++ b/.github/workflows/security-scorecard.yml @@ -1,40 +1,3 @@ -### -# @format -# ----- -# Project: zenstack-monorepo -# File: security-scorecard.yml -# Path: \.github\workflows\security-scorecard.yml -# Created Date: Monday, February 19th 2024 -# Author: Jonathan Stevens, jonathan@resnovas.com -# Github: https://github.com/TGTGamer -# ----- -# Contributing: Please read through our contributing guidelines. -# Included are directions for opening issues, coding standards, -# and notes on development. These can be found at -# https://github.com/zenstack-monorepo/blob/develop/CONTRIBUTING.md -# ----- -# Code of Conduct: This project abides by the Contributor Covenant, v2.0 -# Please interact in ways that contribute to an open, welcoming, diverse, -# inclusive, and healthy community. Our Code of Conduct can be found at -# https://github.com/zenstack-monorepo/blob/develop/CODE_OF_CONDUCT.md -# ----- -# Copyright (c) 2024 ZenstackHQ - All Rights Reserved -# LICENSE: MIT License (MIT) -# ----- -# This program has been provided under confidence of the copyright holder and -# is licensed for copying, distribution and modification under the terms -# of the MIT License (MIT) published as the License, -# or (at your option) any later version of this license. -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# MIT License for more details. -# You should have received a copy of the MIT License -# along with this program. If not, please write to: jonathan@resnovas.com, -# or see https://opensource.org/licenses/MIT -# ----- -# DELETING THIS NOTICE AUTOMATICALLY VOIDS YOUR LICENSE -### @@ -54,7 +17,7 @@ on: push: branches: - main - - develop + - dev # Declare default permissions as read only. permissions: From 0dc41f9bd72d5bdd69ac1e28ab27b388c918e5f4 Mon Sep 17 00:00:00 2001 From: Jonathan S Date: Tue, 20 Feb 2024 20:49:23 +0000 Subject: [PATCH 15/15] Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 2 +- .github/workflows/security-defender-for-devops.yml | 2 +- .github/workflows/security-dependency-review.yml | 1 + .github/workflows/security-ossar.yml | 2 +- .github/workflows/security-scorecard.yml | 1 + 5 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 187f90653..0a2173708 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,7 +49,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12 + uses: github/codeql-action/init@v2.22.12 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. diff --git a/.github/workflows/security-defender-for-devops.yml b/.github/workflows/security-defender-for-devops.yml index a75c6f4a8..dc32fc584 100644 --- a/.github/workflows/security-defender-for-devops.yml +++ b/.github/workflows/security-defender-for-devops.yml @@ -63,7 +63,7 @@ jobs: 6.0.x - name: Run Microsoft Security DevOps - uses: microsoft/security-devops-action@e94440350ed10e2806d47cd0d7504a2c51abdbe9 # v1.6.0 + uses: microsoft/security-devops-action@v1.6.0 id: msdo - name: Upload results to Security tab diff --git a/.github/workflows/security-dependency-review.yml b/.github/workflows/security-dependency-review.yml index f76681581..17b0f0506 100644 --- a/.github/workflows/security-dependency-review.yml +++ b/.github/workflows/security-dependency-review.yml @@ -31,4 +31,5 @@ jobs: token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. - name: 'Dependency Review' ++ uses: actions/dependency-review-action@v2.5.1 uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 diff --git a/.github/workflows/security-ossar.yml b/.github/workflows/security-ossar.yml index eae2de45f..10db124ae 100644 --- a/.github/workflows/security-ossar.yml +++ b/.github/workflows/security-ossar.yml @@ -65,7 +65,7 @@ jobs: # Run open source static analysis tools - name: Run OSSAR - uses: github/ossar-action@786a16a90ba92b4ae6228fe7382fb16ef5c51000 # v1 + uses: github/ossar-action@v1 id: ossar # Upload results to the Security tab diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml index 57875f59d..1222d331c 100644 --- a/.github/workflows/security-scorecard.yml +++ b/.github/workflows/security-scorecard.yml @@ -57,6 +57,7 @@ jobs: token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account. - name: "Run analysis" ++ uses: ossf/scorecard-action@v2.1.2 uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2 with: results_file: results.sarif