diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2d8d8483..4aac5e48 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,3 +22,73 @@ updates: directory: "/packages/dsl-java" # Location of package manifests schedule: interval: "weekly" + + - package-ecosystem: npm + directory: /packages/case-connector + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/case-core-plugin-http-dsl + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/case-core-plugin-http + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/case-core + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/case-entities + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/case-example-mock-types + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/case-maintainer-config + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/case-plugin-base + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/contract-case-cli + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/contract-case-jest + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/documentation + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/dsl-java + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/eslint-config-case-maintainer + schedule: + interval: daily + + - package-ecosystem: npm + directory: /packages/test-equivalence-matchers + schedule: + interval: daily diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 6b56f015..98b74c89 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -14,15 +14,20 @@ jobs: node-version: [18.x, 20.x] os: [macos-latest, ubuntu-latest, windows-latest] steps: - - uses: actions/checkout@v4.1.6 + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + + - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 with: fetch-depth: 0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4.0.2 + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: node-version: ${{ matrix.node-version }} - name: Set up JDK 17 - uses: actions/setup-java@v4.2.1 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: java-version: '17' distribution: 'temurin' @@ -48,11 +53,16 @@ jobs: contents: write steps: - - uses: actions/checkout@v4.1.6 + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + + - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 with: fetch-depth: 0 - name: Set up JDK 17 - uses: actions/setup-java@v4.2.1 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: java-version: '17' distribution: 'temurin' diff --git a/.github/workflows/builld-and-test-pr.yml b/.github/workflows/builld-and-test-pr.yml index 5a83e50d..8ba4b412 100644 --- a/.github/workflows/builld-and-test-pr.yml +++ b/.github/workflows/builld-and-test-pr.yml @@ -15,15 +15,20 @@ jobs: node-version: [18.x, 20.x] os: [macos-latest, ubuntu-latest, windows-latest] steps: - - uses: actions/checkout@v4.1.6 + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + + - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 with: fetch-depth: 0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4.0.2 + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: node-version: ${{ matrix.node-version }} - name: Set up JDK 17 - uses: actions/setup-java@v4.2.1 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: java-version: '17' distribution: 'temurin' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..d7618e60 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,78 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: ["main"] + pull_request: + # The branches below must be a subset of the branches above + branches: ["main"] + schedule: + - cron: "0 0 * * 1" + +permissions: + contents: read + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: ["java", "javascript", "typescript"] + # CodeQL supports [ $supported-codeql-languages ] + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + + - name: Checkout repository + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@6ac9fc7e8e290bda8fac86290b68e176def71959 # v2.25.8 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@6ac9fc7e8e290bda8fac86290b68e176def71959 # v2.25.8 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@6ac9fc7e8e290bda8fac86290b68e176def71959 # v2.25.8 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index a8aab21c..8789f434 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -9,17 +9,22 @@ jobs: name: Coverage runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4.1.6 + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + + - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 with: fetch-depth: 0 - name: Use Node.js 18.x - uses: actions/setup-node@v4.0.2 + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: node-version: 18.x - name: Set up JDK 17 - uses: actions/setup-java@v4.2.1 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: java-version: '17' distribution: 'temurin' @@ -28,7 +33,7 @@ jobs: - name: Setup Gradle uses: gradle/actions/setup-gradle@db19848a5fa7950289d3668fb053140cf3028d43 # pin@v3.3.2 - name: Validate Gradle wrapper - uses: gradle/actions/wrapper-validation@v3.3.2 + uses: gradle/actions/wrapper-validation@db19848a5fa7950289d3668fb053140cf3028d43 # v3.3.2 - run: npm install -g npm@latest - name: test @@ -40,7 +45,7 @@ jobs: FORCE_COLOR: true - name: Coveralls Core - uses: coverallsapp/github-action@master + uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master with: path-to-lcov: 'packages/case-core/combined-coverage.info' base-path: 'packages/case-core' diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 6936a6e4..e1806160 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -14,7 +14,12 @@ jobs: dependency-review: runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + - name: 'Checkout Repository' - uses: actions/checkout@v4.1.6 + uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 - name: 'Dependency Review' - uses: actions/dependency-review-action@v4.3.3 + uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3 diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index 6279b8b5..6ecb159a 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -13,15 +13,20 @@ jobs: matrix: node-version: [18.x] steps: - - uses: actions/checkout@v4.1.6 + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + + - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 with: fetch-depth: 0 - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4.0.2 + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: node-version: ${{ matrix.node-version }} - name: Set up JDK 17 - uses: actions/setup-java@v4.2.1 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: java-version: '17' distribution: 'temurin' diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index a0fa2c17..0399a4eb 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -12,7 +12,12 @@ jobs: release-please: runs-on: ubuntu-latest steps: - - uses: googleapis/release-please-action@v4 + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + + - uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3 id: release with: token: ${{ secrets.RATE_TOKEN_GH }} @@ -27,15 +32,20 @@ jobs: if: ${{ needs.release-please.outputs.release_created }} steps: # The logic below handles the npm publication: + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + - name: Checkout Repository - uses: actions/checkout@v4.1.6 + uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 - name: Setup Node - uses: actions/setup-node@v4.0.2 + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 with: node-version: 18 registry-url: 'https://registry.npmjs.org' - name: Set up JDK 17 - uses: actions/setup-java@v4.2.1 + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 with: java-version: '17' distribution: 'temurin' diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index aace5103..e7f45725 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -31,6 +31,11 @@ jobs: # actions: read steps: + - name: Harden Runner + uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1 + with: + egress-policy: audit + - name: "Checkout code" uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: