Repository navigation
Merge "fix: preserve attribute name in RFC 6902 ProvMnS patch" #143
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # SPDX-FileCopyrightText: 2026 The Linux Foundation | |
| # Sonatype Lifecycle (Nexus IQ) CLM lane for cps. | |
| # | |
| # This file used to carry the whole lane inline: checkout, 1Password | |
| # secret retrieval, ~150 lines of hand-written settings.xml, the Maven | |
| # build and the scan. All of that now lives in the reusable workflow, so | |
| # a fix reaches this repository by bumping a pin rather than by editing | |
| # a copy. The GitHub lane writes to the same Nexus IQ application as the | |
| # Jenkins job (onap-cps), so the two report to one place. | |
| # | |
| # Runs weekly, on merges to master, and on demand. gerrit_to_platform | |
| # also dispatches it for a patchset when the filename convention matches. | |
| name: '🔐 Security Scans (CLM)' | |
| # yamllint disable-line rule:truthy | |
| on: | |
| schedule: | |
| # An odd minute lets GitHub's queue randomise the exact start. | |
| - cron: "37 0 * * 6" | |
| push: | |
| branches: ["main", "master"] | |
| paths: | |
| - "**" | |
| - "!.github/**" | |
| workflow_dispatch: | |
| inputs: | |
| GERRIT_BRANCH: | |
| description: 'Branch that change is against' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_CHANGE_ID: | |
| description: 'The ID for the change' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_CHANGE_NUMBER: | |
| description: 'The Gerrit number' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_CHANGE_URL: | |
| description: 'URL to the change' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_EVENT_TYPE: | |
| description: 'Type of Gerrit event' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_PATCHSET_NUMBER: | |
| description: 'The patch number for the change' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_PATCHSET_REVISION: | |
| description: 'The revision sha' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_PROJECT: | |
| description: 'Project in Gerrit' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_REFSPEC: | |
| description: 'Gerrit refspec of change' | |
| required: false | |
| type: string | |
| default: '' | |
| GERRIT_DISABLED: | |
| description: 'Run without Gerrit components' | |
| required: false | |
| default: false | |
| type: boolean | |
| concurrency: | |
| # Group on the Gerrit change when there is one, so a new patchset | |
| # supersedes the run for its predecessor. Fall back to the ref rather | |
| # than github.run_id: run_id is unique per run, so cancel-in-progress | |
| # could never fire for a manual dispatch, and three full-reactor | |
| # builds were seen competing for runners at once. | |
| # | |
| # The workflow name is part of the group because the group is | |
| # repository-wide. Without it the verify and CLM lanes shared a group | |
| # and cancelled each other for the same change. | |
| # yamllint disable-line rule:line-length | |
| group: '${{ github.workflow }}-${{ github.event.inputs.GERRIT_CHANGE_ID || github.ref }}' | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| # Clear any previous Verified vote so a dispatched change starts from | |
| # a clean state. Skipped for schedule and push, which have no change. | |
| clear-vote: | |
| name: 'Clear Gerrit Vote' | |
| # yamllint disable-line rule:line-length | |
| if: github.event_name == 'workflow_dispatch' && inputs.GERRIT_DISABLED != true | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| timeout-minutes: 5 | |
| steps: | |
| - name: 'Harden runner' | |
| # yamllint disable-line rule:line-length | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - name: 'Clear votes' | |
| # yamllint disable-line rule:line-length | |
| uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3 | |
| with: | |
| host: ${{ vars.GERRIT_SERVER }} | |
| username: ${{ vars.GERRIT_SSH_USER }} | |
| key: ${{ secrets.GERRIT_SSH_PRIVKEY }} # zizmor: ignore[secrets-outside-env] | |
| known_hosts: ${{ vars.GERRIT_KNOWN_HOSTS }} | |
| gerrit-change-number: ${{ inputs.GERRIT_CHANGE_NUMBER }} | |
| gerrit-patchset-number: ${{ inputs.GERRIT_PATCHSET_NUMBER }} | |
| vote-type: clear | |
| - name: 'Allow replication' | |
| run: sleep 10s | |
| sonatype-lifecycle: | |
| name: 'Sonatype Lifecycle/CLM -> Nexus IQ' | |
| needs: clear-vote | |
| if: >- | |
| always() | |
| && (needs.clear-vote.result == 'success' | |
| || needs.clear-vote.result == 'skipped') | |
| permissions: | |
| contents: read | |
| # yamllint disable-line rule:line-length | |
| uses: lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml@0dd3d5f05930b3c782a67f7735fd0133c0fa51d9 # v0.6.1 | |
| with: | |
| # Build before scanning: Nexus IQ identifies far more components | |
| # from the packaged output than from source alone. Tests and Jib | |
| # are skipped because neither affects the dependency set. | |
| build_type: 'maven' | |
| mvn_params: '-DskipTests -Djib.skip=true --fail-at-end' | |
| # java_version is deliberately left unset so the lane detects the | |
| # project's JDK. Pinning it here is how the sibling | |
| # cps/ncmp-dmi-plugin lane broke: it held 17 while the POMs moved | |
| # to 21, and every scan after that ran against a failed compile. | |
| # | |
| # Surface a broken pre-scan build instead of scanning whatever | |
| # happens to have compiled. The reusable defaults this to true, on | |
| # the reasoning that a partial dependency tree still yields a | |
| # useful signal. That trade reads differently here: a thin scan | |
| # reports FEWER findings, so a silently degraded run looks like an | |
| # improvement. The build lane in gerrit-verify.yaml is the place | |
| # where a build regression should surface, and it does so loudly. | |
| build_permit_fail: false | |
| # Maven pulls from artifact CDNs that are impractical to enumerate | |
| # in the allow-list, and the build shares this job with the scan. | |
| # NOTE: security-workflows v0.2.1 is the first release in which | |
| # this input has any effect. Until then each lane chose between | |
| # two harden-runner steps with a step-level 'if:', and the action | |
| # runs its pre-phase regardless of that condition, so the block | |
| # step always won. Every job ran blocked however the caller asked. | |
| # Setting this true now genuinely yields audit, which is what the | |
| # Testcontainers image pulls below need. | |
| build_permit_egress_traffic: true | |
| # harden_runner_allowlist is no longer overridden here. This lane | |
| # pinned v0.12.2 explicitly while the reusable still defaulted to | |
| # v0.10.0, which lacked the two endpoints the scan cannot run | |
| # without: nexus-iq.wl.linuxfoundation.org and | |
| # download.sonatype.com. security-workflows v0.1.0 moved its own | |
| # default to v0.12.2, so the override became a second copy of the | |
| # same pin. Dropping it means future allow-list updates arrive | |
| # with the reusable instead of needing a change here. | |
| # application_id is left unset: the lane derives <owner>-<name>, | |
| # giving onap-cps, which is what the Jenkins job already reports | |
| # to ({nexus-iq-namespace}{project-name} = 'onap-' + 'cps'). | |
| # | |
| # Gerrit-aware checkout. Blank for schedule/push and for a manual | |
| # GERRIT_DISABLED run, so the lane does a normal checkout. | |
| # yamllint disable-line rule:line-length | |
| gerrit_refspec: ${{ github.event_name == 'workflow_dispatch' && !inputs.GERRIT_DISABLED && inputs.GERRIT_REFSPEC || '' }} | |
| # yamllint disable-line rule:line-length | |
| gerrit_project: ${{ github.event_name == 'workflow_dispatch' && !inputs.GERRIT_DISABLED && inputs.GERRIT_PROJECT || '' }} | |
| # yamllint disable-line rule:line-length | |
| gerrit_branch: ${{ github.event_name == 'workflow_dispatch' && !inputs.GERRIT_DISABLED && inputs.GERRIT_BRANCH || '' }} | |
| secrets: | |
| nexus_iq_password: ${{ secrets.NEXUS_IQ_PASSWORD }} | |
| # The organisation's authoritative Maven settings, which define the | |
| # onap-public mirror and the docker.pull.registry property the cps | |
| # POMs reference without defaulting. It carries no credentials and | |
| # needs none: the ONAP public group serves anonymously, and this | |
| # lane only resolves dependencies, never deploys. That replaces the | |
| # 1Password retrieval and inline settings.xml this file used to | |
| # carry. | |
| maven_global_settings: ${{ vars.MVN_GLOBAL_SETTINGS }} | |
| # Report the overall conclusion back to Gerrit as a Verified vote. | |
| vote: | |
| name: 'Report Status to Gerrit' | |
| # yamllint disable-line rule:line-length | |
| if: ${{ always() && github.event_name == 'workflow_dispatch' && inputs.GERRIT_DISABLED != true }} | |
| needs: [clear-vote, sonatype-lifecycle] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: read # workflow-conclusion lists run jobs via the API | |
| timeout-minutes: 5 | |
| steps: | |
| - name: 'Harden runner' | |
| # yamllint disable-line rule:line-length | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - name: 'Get workflow conclusion' | |
| # yamllint disable-line rule:line-length | |
| uses: im-open/workflow-conclusion@8eac7f17381a6917bc04fec3e2c92e70ebc37526 # v3.0.0 | |
| - name: 'Set vote' | |
| # yamllint disable-line rule:line-length | |
| uses: lfreleng-actions/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3 | |
| with: | |
| host: ${{ vars.GERRIT_SERVER }} | |
| username: ${{ vars.GERRIT_SSH_USER }} | |
| key: ${{ secrets.GERRIT_SSH_PRIVKEY }} # zizmor: ignore[secrets-outside-env] | |
| known_hosts: ${{ vars.GERRIT_KNOWN_HOSTS }} | |
| gerrit-change-number: ${{ inputs.GERRIT_CHANGE_NUMBER }} | |
| gerrit-patchset-number: ${{ inputs.GERRIT_PATCHSET_NUMBER }} | |
| vote-type: ${{ env.WORKFLOW_CONCLUSION }} |