Merge branch 'main' into 185-test-workflows-for-lhm_actions

Author: ejcsid

action-templates/actions/action-build-docs/action.yml

@@ -19,6 +19,10 @@ inputs:
     description: "Output directory that will be uploaded to GitHub Pages"
     required: false
     default: ".vitepress/dist"
+  npm-ci-parameter:
+    description: "disallow external scripts during npm ci https://about.gitlab.com/blog/pipeline-security-lessons-from-march-supply-chain-incidents/#use-case-2-detect-dependency-tampering-and-lockfile-manipulation"
+    required: false
+    default: "--ignore-scripts"
 
 runs:
   using: "composite"
@@ -41,8 +45,9 @@ runs:
       env:
         DOCS_PATH: ${{ inputs.docs-path }}
         BUILD_CMD: ${{ inputs.build-cmd }}
+        NPM_CI_PARAMETER: ${{ inputs.npm-ci-parameter }}
       run: |
-        npm --prefix "$DOCS_PATH" ci
+        npm --prefix "$DOCS_PATH" ci $NPM_CI_PARAMETER
         npm --prefix "$DOCS_PATH" run  lint
         npm --prefix "$DOCS_PATH" run "$BUILD_CMD"
     - name: Upload artifact

action-templates/actions/action-filter/action.yml

@@ -29,6 +29,9 @@ outputs:
   python:
     description: "Name of the python artifact upload"
     value: ${{ steps.filter.outputs.python }}
+  changes:
+    description: "JSON array of filter names that have matched changes"
+    value: ${{ steps.filter.outputs.changes }}
 
 runs:
   using: "composite"

action-templates/actions/action-maven-build/action.yml

@@ -14,6 +14,12 @@ outputs:
   artifact-name:
     description: "Name of the artifact upload"
     value: ${{steps.artifact-name.outputs.artifact-name}}
+  cyclone-artifact-id:
+    description: "ID of the sbom artifact"
+    value: ${{steps.upload-sbom-artifact.outputs.artifact-id}}
+  cyclone-path:
+    description: "path of the sbom"
+    value: ${{steps.artifact-name.outputs.cyclone-path}}
 
 runs:
   using: "composite"
@@ -36,7 +42,11 @@ runs:
       shell: bash
     - id: artifact-name
       name: Set output variable $GITHUB_OUTPUT
-      run: echo "artifact-name=${{hashFiles(format('./{0}/pom.xml', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+      env:
+        APP_PATH: ${{inputs.app-path}}
+      run: |
+        echo "artifact-name=${{hashFiles(format('./{0}/pom.xml', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+        echo "cyclone-path=$APP_PATH/target/classes/META-INF/sbom/application.cdx.json" >> "$GITHUB_OUTPUT"
       shell: bash
     - id: upload-artifact
       name: Upload artifact
@@ -45,3 +55,11 @@ runs:
         name: ${{steps.artifact-name.outputs.artifact-name}}
         path: "**/target"
         retention-days: 5
+    - id: upload-sbom-artifact
+      name: upload-sbom-artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: ${{inputs.app-path}}
+        path: "${{inputs.app-path}}/target/classes/META-INF/sbom/application.cdx.json"
+        retention-days: 5
+        archive: false

action-templates/actions/action-npm-build/action.yml

@@ -17,12 +17,21 @@ inputs:
     description: "Controls the execution of the 'npm run test' script"
     required: false
     default: "true"
+  npm-ci-parameter:
+    description: "disallow external scripts during npm ci https://about.gitlab.com/blog/pipeline-security-lessons-from-march-supply-chain-incidents/#use-case-2-detect-dependency-tampering-and-lockfile-manipulation"
+    required: false
+    default: "--ignore-scripts=true"
 
 outputs:
   artifact-name:
     description: "Name of the artifact upload"
     value: ${{steps.artifact-name.outputs.artifact-name}}
-
+  cyclone-artifact-id:
+    description: "ID of the sbom artifact"
+    value: ${{steps.upload-sbom-artifact.outputs.artifact-id}}
+  cyclone-path:
+    value: ${{steps.artifact-name.outputs.cyclone-path}}
+    description: "path of the sbom"
 runs:
   using: "composite"
   steps:
@@ -35,7 +44,8 @@ runs:
     - name: Install dependencies
       env:
         APP_PATH: ${{inputs.app-path}}
-      run: npm --prefix ./$APP_PATH ci
+        NPM_CI_PARAMETER: ${{ inputs.npm-ci-parameter }}
+      run: npm --prefix ./$APP_PATH ci $NPM_CI_PARAMETER
       shell: bash
     - name: Run lint
       env:
@@ -56,11 +66,22 @@ runs:
       shell: bash
     - id: artifact-name
       name: Sets output variable $GITHUB_OUTPUT
-      run: echo "artifact-name=${{hashFiles(format('./{0}/package.json', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+      env:
+        APP_PATH: ${{inputs.app-path}}
+      run: |
+        echo "artifact-name=${{hashFiles(format('./{0}/package.json', inputs.app-path))}}" >> "$GITHUB_OUTPUT"
+        echo "cyclone-path=$APP_PATH/dist/application.cdx.json" >> "$GITHUB_OUTPUT"
       shell: bash
     - name: Upload artifact
       uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{steps.artifact-name.outputs.artifact-name}}
         path: "**/dist"
         retention-days: 5
+    - id: upload-sbom-artifact
+      name: upload-sbom-artifact
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        path: "${{inputs.app-path}}/dist/application.cdx.json"
+        retention-days: 5
+        archive: false

action-templates/actions/action-trivy/action.yml

@@ -7,14 +7,23 @@ inputs:
     required: false
     default: ".trivyignore"
   timeout:
-    description: "timeout for trivy scan"
+    description: "Timeout for Trivy scan"
     required: false
     default: 15m0s
+  path:
+    description: "Path to scan with Trivy. For scan-type=sbom, this must point to a specific SBOM file (e.g. sbom.cdx.json), not a directory."
+    required: false
+    default: "."
+  scan-type:
+    description: "scan type, e.g. fs or sbom"
+    required: false
+    default: "fs"
 
 runs:
   using: "composite"
   steps:
     - name: Checkout repository
+      if: inputs.scan-type  == 'fs'
       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         fetch-depth: 0 # Required for vitepress lastUpdated
@@ -24,8 +33,8 @@ runs:
       env:
         TRIVY_INCLUDE_DEV_DEPS: "true"
       with:
-        scan-type: "fs"
-        scan-ref: "."
+        scan-type: "${{ inputs.scan-type }}"
+        scan-ref: "${{ inputs.path }}"
         format: "json"
         exit-code: "1"
         timeout: "${{ inputs.timeout }}"

docs/actions.md

@@ -85,7 +85,9 @@ Workflows using that action need the following permissions:
     # VitePress output path that will be uploaded as artifact
     # Default: .vitepress/dist
     dist-path: ".vitepress/dist"
-```
+    # disallow external scripts during npm ci https://about.gitlab.com/blog/pipeline-security-lessons-from-march-supply-chain-incidents/#use-case-2-detect-dependency-tampering-and-lockfile-manipulation
+    # Default: "--ignore-scripts"
+    npm-ci-parameter: "--ignore-scripts"
 
 ### action-build-image
 
@@ -223,9 +225,10 @@ Executes the following steps:
 
 Output parameters:
 
-- For each filter, it sets output variable named by the filter to the text:
+- For each filter (Java, javascript-typescript-vue, python), it sets output variable named by the filter to the text:
   - 'true' - if any of changed files matches any of filter rules
   - 'false' - if none of changed files matches any of filter rules
+- 'changes' - JSON array with names of all filters matching any of the changed files.
 
 Workflows using that action need the following permissions:
 
@@ -425,6 +428,8 @@ Executes the following steps:
 Output parameters:
 
 1. `artifact-name`: Name of the uploaded artifact
+2. `cyclone-artifact-id`: ID of the sbom artifact
+3. `cyclone-path`: path of the sbom
 
 Workflows using that action need the following permissions:
 
@@ -530,6 +535,8 @@ Executes the following steps:
 Output parameters:
 
 1. `artifact-name`: Name of the uploaded artifact
+2. `cyclone-artifact-id`: ID of the sbom artifact
+3. `cyclone-path`: path of the sbom
 
 Workflows using that action need the following permissions:
 
@@ -555,7 +562,9 @@ Workflows using that action need the following permissions:
     # Controls the execution of the 'npm run test' script
     # Default: true
     run-test: "true"
-```
+    # disallow external scripts during npm ci https://about.gitlab.com/blog/pipeline-security-lessons-from-march-supply-chain-incidents/#use-case-2-detect-dependency-tampering-and-lockfile-manipulation
+    # Default: "--ignore-scripts=true"
+    npm-ci-parameter: "--ignore-scripts=true"
 
 ### action-npm-release
 
@@ -663,4 +672,13 @@ Workflows using that action need the following permissions:
     # Relative Path to the trivyignore files
     # Default: ".trivyignore"
     trivyignore-files: ".trivyignore"
+    # Timeout for Trivy scan
+    # Default: 15m0s
+    timeout: "15m0s"
+    # scan type, e.g. fs or sbom
+    # default: fs
+    scan-type: fs
+    # Path to scan with Trivy
+    # Default: .
+    path: "."
 ```