diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f7a1bfc..dcfbd21 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,12 +1,21 @@ version: 2 +registries: + maven-github: + type: maven-repository + url: https://maven.pkg.github.com/navikt/fp-felles + username: x-access-token + password: ${{ secrets.READER_TOKEN }} + updates: - - package-ecosystem: maven + - package-ecosystem: github-actions directory: "/" schedule: interval: daily open-pull-requests-limit: 10 - - package-ecosystem: github-actions + - package-ecosystem: maven directory: "/" + registries: + - maven-github schedule: interval: daily - open-pull-requests-limit: 10 + open-pull-requests-limit: 20 \ No newline at end of file diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml deleted file mode 100644 index 0b31b05..0000000 --- a/.github/workflows/codeql-analysis.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: "CodeQL" - -on: - push: - branches: [master] - schedule: - - cron: '0 0 * * 3' - workflow_dispatch: - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - - strategy: - fail-fast: false - matrix: - # Override automatic language detection by changing the below list - # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python'] - language: ['java'] - # Learn more... - # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection - - steps: - - uses: actions/checkout@v3 - - - name: Setup maven - uses: whelk-io/maven-settings-xml-action@v21 - with: - repositories: '[{ "id": "github", "name": "github", "url": "https://maven.pkg.github.com/${{ github.repository }}", "releases": { "enabled": "true" }, "snapshots": { "enabled": "false" } }]' - servers: '[{ "id": "github", "username": "${{ github.actor }}", "password": "${{ secrets.GITHUB_TOKEN }}" }]' - output_file: settings.xml - - # If this run was triggered by a pull request event, then checkout - # the head of the pull request instead of the merge commit. - - run: git checkout HEAD^2 - if: ${{ github.event_name == 'pull_request' }} - - - uses: actions/setup-java@v3.11.0 - with: - java-version: '17' - distribution: 'temurin' - check-latest: true - cache: 'maven' - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v2 - with: - languages: ${{ matrix.language }} - config-file: ./.github/codeql/codeql-config.yml - - - name: Build - shell: bash - run: | - mvn clean package -B -V -e -s settings.xml -Dfindbugs.skip -Dcheckstyle.skip -Dpmd.skip=true -Denforcer.skip -Dmaven.javadoc.skip -DskipTests -Dmaven.test.skip.exec -Dlicense.skip=true -Drat.skip=true - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..541176a --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,21 @@ +name: "CodeQL" + +on: + push: + branches: [ "master" ] + pull_request: + branches: [ "master" ] + schedule: + - cron: '0 0 * * 0,4' + +jobs: + codeql: + name: CodeQl + permissions: + actions: read + contents: read + security-events: write + uses: navikt/fp-gha-workflows/.github/workflows/codeql.yml@main + with: + config-file: ./.github/codeql/codeql-config.yml + secrets: inherit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index de52d0a..a7e126a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,38 +1,13 @@ name: Publish release - -env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GITHUB_USERNAME: x-access-token - on: release: - types: [published] + types: [ published ] jobs: - publish-release: - runs-on: ubuntu-latest - - steps: - - name: Checkout latest code - uses: actions/checkout@v3 - - - name: Setup maven - uses: whelk-io/maven-settings-xml-action@v21 - with: - repositories: '[{ "id": "github", "name": "github", "url": "https://maven.pkg.github.com/${{ github.repository }}", "releases": { "enabled": "true" }, "snapshots": { "enabled": "false" } }]' - servers: '[{ "id": "github", "username": "${{ github.actor }}", "password": "${{ secrets.GITHUB_TOKEN }}" }]' - output_file: settings.xml - - - name: Set up JDK - uses: actions/setup-java@v3.11.0 - with: - java-version: '17' - distribution: 'temurin' - cache: 'maven' - - name: Publish artifact - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NEW_VERSION: ${{ github.event.release.tag_name }} - run: | - mvn -B -s settings.xml versions:set -DnewVersion="${NEW_VERSION}" -DgenerateBackupPoms=false - mvn -B -s settings.xml clean deploy + release: + name: Feature + uses: navikt/fp-gha-workflows/.github/workflows/release-feature.yml@main + with: + release-version: ${{ github.event.release.tag_name }} + release-profiles: '' + secrets: inherit diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml deleted file mode 100644 index dc002a2..0000000 --- a/.github/workflows/snyk.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Snyk vulnerabilities scanning of dependencies -on: - schedule: - - cron: '0 0 * * *' - workflow_dispatch: - -jobs: - snyk: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - - name: Setup maven - uses: whelk-io/maven-settings-xml-action@v21 - with: - repositories: '[{ "id": "github", "name": "github", "url": "https://maven.pkg.github.com/${{ github.repository }}", "releases": { "enabled": "true" }, "snapshots": { "enabled": "false" } }]' - servers: '[{ "id": "github", "username": "${{ github.actor }}", "password": "${{ secrets.READER_TOKEN }}" }]' - output_file: settings.xml - - - uses: actions/setup-java@v3.11.0 - with: - java-version: 17 - distribution: temurin - - - uses: snyk/actions/setup@master - - - name: Build - run: | - echo "Building snyk-snapshot" - mvn -B -s settings.xml versions:set -DnewVersion=snyk-snapshot - mvn install -q -B -s settings.xml -DskipTests - - - name: Run Snyk monitor - run: > - snyk monitor - --org=teamforeldrepenger - --all-projects - --configuration-attributes=usage:java-runtime - --remote-repo-url=https://github.com/${{ github.repository }}.git - -- -s settings.xml - env: - SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}