Skip to content

Commit f695853

Browse files
CDiezRodriguezCDiezRodriguez
authored
Merge branch 'eclipse-tractusx:main' into feat/add-Dash-License
2 parents 529289c + 8b5e904 commit f695853

File tree

105 files changed

+7278
-1987
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

105 files changed

+7278
-1987
lines changed

‎.github/dependabot.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
###############################################################
2+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
3+
#
4+
# See the NOTICE file(s) distributed with this work for additional
5+
# information regarding copyright ownership.
6+
#
7+
# This program and the accompanying materials are made available under the
8+
# terms of the Apache License, Version 2.0 which is available at
9+
# https://www.apache.org/licenses/LICENSE-2.0.
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
###############################################################
19+
20+
version: 2
21+
registries:
22+
github-central-pipelines:
23+
type: git
24+
url: https://github.com
25+
username: x-access-token
26+
password: ${{ secrets.CENTRAL_PIPELINES_READ_ONLY_GH_TOKEN }}
27+
28+
updates:
29+
# Github Actions
30+
-
31+
package-ecosystem: "github-actions"
32+
directory: /
33+
labels:
34+
- "dependabot"
35+
- "github-actions"
36+
schedule:
37+
interval: "weekly"
38+
groups:
39+
dependencies:
40+
dependency-type: "production"

‎.github/workflows/codeql.yml‎

Lines changed: 12 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,21 @@ name: "CodeQL"
2222
on:
2323
push:
2424
branches: ["main"]
25+
paths:
26+
- "ichub-backend/**/*.py"
27+
- "ichub-frontend/**/*.py"
2528
paths-ignore:
29+
- "**/*.yml"
30+
- "**/*.yaml"
2631
- "**/*.md"
2732
- "**/*.txt"
2833
pull_request:
29-
# The branches below must be a subset of the branches above
30-
branches: ["main"]
34+
paths:
35+
- "ichub-backend/**/*.py"
36+
- "ichub-frontend/**/*.py"
3137
paths-ignore:
38+
- "**/*.yml"
39+
- "**/*.yaml"
3240
- "**/*.md"
3341
- "**/*.txt"
3442
schedule:
@@ -45,15 +53,6 @@ jobs:
4553
contents: read
4654
security-events: write
4755

48-
strategy:
49-
fail-fast: false
50-
matrix:
51-
language: ["python"] # Define languages here
52-
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
53-
# Use only 'java' to analyze code written in Java, Kotlin or both
54-
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
55-
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
56-
5756
steps:
5857
- name: Checkout repository
5958
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -62,7 +61,7 @@ jobs:
6261
- name: Initialize CodeQL
6362
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
6463
with:
65-
languages: ${{ matrix.language }}
64+
languages: python
6665
# If you wish to specify custom queries, you can do so here or in a config file
6766
# By default, queries listed here will override any specified in a config file
6867
# Prefix the list here with "+" to use these queries and those in the config file
@@ -71,12 +70,6 @@ jobs:
7170
# Use +security-extended,security-and-quality for wider security and better code quality
7271
queries: +security-extended,security-and-quality
7372

74-
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift)
75-
# Automates dependency installation for Python, Ruby, and JavaScript, optimizing the CodeQL analysis setup
76-
# If this step fails, then you should remove it and run the build manually (see below)
77-
- name: Autobuild
78-
uses: github/codeql-action/autobuild@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
79-
8073
# ℹ️ Command-line programs to run using the OS shell.
8174
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
8275

@@ -89,5 +82,5 @@ jobs:
8982
- name: Perform CodeQL Analysis
9083
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
9184
with:
92-
category: "/language:${{matrix.language}}"
85+
category: "/language:python"
9386
fail-on: error

‎.github/workflows/dependencies-frontend.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
###############################################################
2+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
3+
#
4+
# See the NOTICE file(s) distributed with this work for additional
5+
# information regarding copyright ownership.
6+
#
7+
# This program and the accompanying materials are made available under the
8+
# terms of the Apache License, Version 2.0 which is available at
9+
# https://www.apache.org/licenses/LICENSE-2.0.
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
###############################################################
19+
20+
name: Check Frontend Dependencies
21+
22+
on:
23+
push:
24+
branches: [main]
25+
paths:
26+
- ichub-frontend/package-lock.json
27+
- DEPENDENCIES_ICHUB-FRONTEND
28+
- .github/workflows/dependencies-frontend.yaml
29+
pull_request:
30+
types: [opened, synchronize, reopened]
31+
paths:
32+
- ichub-frontend/package-lock.json
33+
- DEPENDENCIES_ICHUB-FRONTEND
34+
- .github/workflows/dependencies-frontend.yaml
35+
workflow_dispatch:
36+
37+
jobs:
38+
check-dependencies:
39+
runs-on: ubuntu-latest
40+
41+
steps:
42+
- name: Set up JDK 17
43+
uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
44+
with:
45+
distribution: 'temurin'
46+
java-version: '17'
47+
48+
- name: Checkout repository
49+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
50+
51+
- name: Generate Dependencies file
52+
run: |
53+
curl -L --output ./dash.jar 'https://repo.eclipse.org/service/local/artifact/maven/redirect?r=dash-licenses&g=org.eclipse.dash&a=org.eclipse.dash.licenses&v=LATEST'
54+
55+
java -jar ./dash.jar ichub-frontend/package-lock.json -project automotive.tractusx -summary DEPENDENCIES_ICHUB-FRONTEND || true
56+
57+
- name: Check if dependencies were changed
58+
id: dependencies-changed
59+
run: |
60+
changed=$(git diff DEPENDENCIES_ICHUB-FRONTEND)
61+
if [[ -n "$changed" ]]; then
62+
echo "dependencies changed"
63+
echo "changed=true" >> $GITHUB_OUTPUT
64+
else
65+
echo "dependencies not changed"
66+
echo "changed=false" >> $GITHUB_OUTPUT
67+
fi
68+
69+
- name: Check for restricted dependencies
70+
run: |
71+
restricted=$(grep ' restricted,' DEPENDENCIES_ICHUB-FRONTEND || true)
72+
if [[ -n "$restricted" ]]; then
73+
echo "The following dependencies are restricted: $restricted"
74+
exit 1
75+
fi
76+
if: steps.dependencies-changed.outputs.changed == 'true'
77+
78+
- name: Upload DEPENDENCIES_ICHUB-FRONTEND file
79+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
80+
with:
81+
path: DEPENDENCIES_ICHUB-FRONTEND
82+
if: steps.dependencies-changed.outputs.changed == 'true'
83+
84+
- name: Signal need to update DEPENDENCIES_ICHUB
85+
run: |
86+
echo "Dependencies need to be updated (updated DEPENDENCIES_ICHUB file has been uploaded to workflow run)"
87+
exit 1
88+
if: steps.dependencies-changed.outputs.changed == 'true'

‎.github/workflows/kics.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
###############################################################
2+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
3+
#
4+
# See the NOTICE file(s) distributed with this work for additional
5+
# information regarding copyright ownership.
6+
#
7+
# This program and the accompanying materials are made available under the
8+
# terms of the Apache License, Version 2.0 which is available at
9+
# https://www.apache.org/licenses/LICENSE-2.0.
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
###############################################################
19+
20+
name: KICS
21+
22+
on:
23+
push:
24+
branches: ["main"]
25+
paths-ignore:
26+
- "**/*.md"
27+
- "**/*.txt"
28+
pull_request:
29+
# The branches below must be a subset of the branches above
30+
branches: ["main"]
31+
paths-ignore:
32+
- "**/*.md"
33+
- "**/*.txt"
34+
schedule:
35+
- cron: "0 0 * * 0"
36+
workflow_dispatch:
37+
38+
jobs:
39+
analyze:
40+
name: Analyze
41+
runs-on: ubuntu-latest
42+
permissions:
43+
actions: read
44+
contents: read
45+
security-events: write
46+
47+
steps:
48+
- name: Checkout repo
49+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
50+
51+
- name: Run KICS Scan with SARIF result
52+
uses: checkmarx/kics-github-action@3246fb456a46d1ea8848ae18793c036718b19fe0 # v2.1.5
53+
with:
54+
path: "." # Scanning directory .
55+
output_path: kicsResults/ # Output path for SARIF results
56+
output_formats: "json,sarif" # Output format
57+
# ignore_on_exit: results # Ignore the results and return exit status code 0 unless a KICS engine error happens
58+
fail_on: high # If you want your pipeline to fail only on high severity results and KICS engine execution errors
59+
# exclude_paths: "terraform/gcp/big_data.tf,terraform/azure" # Exclude paths or files from scan
60+
# exclude_queries: 0437633b-daa6-4bbc-8526-c0d2443b946e # Exclude accepted queries from the build
61+
disable_secrets: true # No secret scanning
62+
63+
- name: Upload SARIF file
64+
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
65+
with:
66+
sarif_file: kicsResults/results.sarif

‎.github/workflows/trivy.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
###############################################################
2+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
3+
#
4+
# See the NOTICE file(s) distributed with this work for additional
5+
# information regarding copyright ownership.
6+
#
7+
# This program and the accompanying materials are made available under the
8+
# terms of the Apache License, Version 2.0 which is available at
9+
# https://www.apache.org/licenses/LICENSE-2.0.
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
13+
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
14+
# License for the specific language governing permissions and limitations
15+
# under the License.
16+
#
17+
# SPDX-License-Identifier: Apache-2.0
18+
###############################################################
19+
20+
name: "Trivy"
21+
22+
on:
23+
push:
24+
branches: [main]
25+
schedule:
26+
- cron: "0 0 * * 0"
27+
workflow_dispatch:
28+
29+
env:
30+
IMAGE_NAMESPACE: 'tractusx'
31+
ICHUB_BACKEND_IMAGE_NAME: "ichub-backend"
32+
DATASPACE_SDK_IMAGE_NAME: "dataspace-sdk"
33+
INDUSTRY_SDK_IMAGE_NAME: "industry-sdk"
34+
35+
jobs:
36+
analyze-ichub-backend:
37+
name: Analyze ICHub Backend
38+
runs-on: ubuntu-latest
39+
permissions:
40+
actions: read
41+
contents: read
42+
security-events: write
43+
44+
steps:
45+
- name: Checkout repository
46+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
47+
48+
- name: Build ichub-backend Docker image
49+
id: build-docker-ichub-backend
50+
run: |
51+
cd ichub-backend
52+
docker build -t ${{ env.IMAGE_NAMESPACE }}/${{ env.ICHUB_BACKEND_IMAGE_NAME }}:latest .
53+
54+
- name: Run Trivy vulnerability scanner
55+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
56+
with:
57+
image-ref: "${{ env.IMAGE_NAMESPACE }}/${{ env.ICHUB_BACKEND_IMAGE_NAME }}:latest" # Pull image from Docker Hub and run Trivy vulnerability scanner
58+
format: "sarif"
59+
output: "trivy-results-ichub-backend.sarif"
60+
severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH).
61+
hide-progress: false
62+
exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail.
63+
limit-severities-for-sarif: true
64+
65+
- name: Upload Trivy scan results to GitHub Security tab
66+
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
67+
if: always()
68+
with:
69+
sarif_file: "trivy-results-ichub-backend.sarif"

0 commit comments

Comments
 (0)