Merge branch 'develop' into unsigned-jwt-verifier

OWASP · Aug 26, 2024 · 2b47188 · 2b47188
2 parents 63c4c63 + 3fd0372
commit 2b47188
Show file tree

Hide file tree

Showing 329 changed files with 25,270 additions and 33,069 deletions.
diff --git a/.github/workflows/ci.yml → .github/workflows/pr-build.yml b/.github/workflows/ci.yml → .github/workflows/pr-build.yml
@@ -1,30 +1,16 @@
-name: Docker Image CI
+name: PR Build
 
 on:
-  push:
-    branches:
-      - 'develop'
-      - 'main'
-    tags:
-      - 'v*.*.*'
-    paths:
-      - 'services/**'
-      - 'postman_collections/**'
-      - 'deploy/**'
-      - '.github/workflows/**'
   pull_request:
     paths:
       - 'services/**'
       - 'postman_collections/**'
       - 'deploy/**'
       - '.github/workflows/**'
   workflow_dispatch:
-
 jobs:
   build-context:
     runs-on: ubuntu-latest
-    outputs:
-      push_image: ${{ (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')) || (github.event_name == 'release' && github.event.action == 'published') }}
     steps:
       - name: Dump GitHub context
         env:
@@ -35,16 +21,18 @@ jobs:
     runs-on: ubuntu-latest
     env:
       PLATFORMS: "linux/amd64,linux/arm64"
+    permissions:
+      pull-requests: write # Required to post comments
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Env seen prerun
         run: env
 
       - name: Get branch name
         id: branch-name
-        uses: tj-actions/branch-names@v5.2
+        uses: tj-actions/branch-names@v8
 
       - name: Current branch name
         run: |
@@ -79,20 +67,13 @@ jobs:
       # setup Docker build action
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       - name: Set up QEMU
         id: qemu
-        uses: docker/setup-qemu-action@v2
-
-      - name: Login to DockerHub
-        if: needs.build-context.outputs.push_image == 'true'
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        uses: docker/setup-qemu-action@v3
 
       - name: Build crapi-identity image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: ./services/identity
           tags: crapi/crapi-identity:${{ env.TAG_LATEST }},crapi/crapi-identity:${{ env.TAG_NAME }}
@@ -103,7 +84,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=identity-service
 
       - name: Build crapi-workshop image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: ./services/workshop
           tags: crapi/crapi-workshop:${{ env.TAG_LATEST }},crapi/crapi-workshop:${{ env.TAG_NAME }}
@@ -114,7 +95,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=workshop-service
 
       - name: Build crapi-community image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: ./services/community
           tags: crapi/crapi-community:${{ env.TAG_LATEST }},crapi/crapi-community:${{ env.TAG_NAME }}
@@ -125,7 +106,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=community-service
 
       - name: Build crapi-web image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: ./services/web
           tags: crapi/crapi-web:${{ env.TAG_LATEST }},crapi/crapi-web:${{ env.TAG_NAME }}
@@ -136,7 +117,7 @@ jobs:
           cache-to: type=gha,mode=max,scope=web-service
 
       - name: Build gateway-service image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: ./services/gateway-service
           tags: crapi/gateway-service:${{ env.TAG_LATEST }},crapi/gateway-service:${{ env.TAG_NAME }}
@@ -146,16 +127,8 @@ jobs:
           cache-from: type=gha,scope=gateway-service
           cache-to: type=gha,mode=max,scope=gateway-service
 
-
-      - name: Check Mailhog existence
-        id: check_mailhog_exists
-        uses: andstor/file-existence-action@v1
-        with:
-          files: "./services/mailhog"
-
       - name: Build mailhog image
-        if: steps.check_mailhog_exists.outputs.files_exists == 'true'
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v3
         with:
           context: ./services/mailhog
           tags: crapi/mailhog:${{ env.TAG_LATEST }},crapi/mailhog:${{ env.TAG_NAME }}
@@ -171,82 +144,119 @@ jobs:
       - name: Env seen
         run: env
 
+      - name: Cleanup docker before running
+        if: always()
+        continue-on-error: true
+        run:  docker compose -f deploy/docker/docker-compose.yml down --volumes --remove-orphans
+
       - name: Run crAPI using built images
-        run: VERSION=${{ env.TAG_NAME }} docker-compose -f deploy/docker/docker-compose.yml --compatibility up -d
+        run: VERSION=${{ env.TAG_NAME }} docker compose -f deploy/docker/docker-compose.yml --compatibility up -d
 
       - name: Install Node
         uses: actions/setup-node@v3
         with:
-          node-version: 14
+          node-version: 16
 
       - name: Install newman
         run: npm install -g newman
 
       - name: Run Postman Collection
-        run: (newman run "./postman_collections/crAPI.postman_collection.json" -e ./postman_collections/crAPI.postman_environment.json --verbose) || true
+        run: newman run "./postman_collections/crAPI.postman_collection.json" -e ./postman_collections/crAPI.postman_environment.json --verbose
 
-      - name: Build crapi-identity all platforms and conditionally push to Docker Hub
-        uses: docker/build-push-action@v2
-        with:
-          context: ./services/identity
-          tags: crapi/crapi-identity:${{ env.TAG_LATEST }},crapi/crapi-identity:${{ env.TAG_NAME }}
-          push: ${{ needs.build-context.outputs.push_image }}
-          platforms: ${{ env.PLATFORMS }}
-          cache-from: type=gha,scope=identity-service
-          cache-to: type=gha,mode=max,scope=identity-service
+      - name: Dump docker logs on failure
+        if: failure()
+        uses: jwalton/gh-docker-logs@v2
+
+      - name: Cleanup docker
+        if: always()
+        run:  docker compose -f deploy/docker/docker-compose.yml down --volumes --remove-orphans
 
-      - name: Build crapi-workshop all platforms and conditionally push to Docker Hub
-        uses: docker/build-push-action@v2
+
+  tests:
+    needs: build-context
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
         with:
-          context: ./services/workshop
-          tags: crapi/crapi-workshop:${{ env.TAG_LATEST }},crapi/crapi-workshop:${{ env.TAG_NAME }}
-          push: ${{ needs.build-context.outputs.push_image }}
-          platforms: ${{ env.PLATFORMS }}
-          cache-from: type=gha,scope=workshop-service
-          cache-to: type=gha,mode=max,scope=workshop-service
+          python-version: '3.10'
 
-      - name: Build crapi-community all platforms and conditionally push to Docker Hub
-        uses: docker/build-push-action@v2
+      - name: Setup Java
+        uses: actions/setup-java@v4
         with:
-          context: ./services/community
-          tags: crapi/crapi-community:${{ env.TAG_LATEST }},crapi/crapi-community:${{ env.TAG_NAME }}
-          push: ${{ needs.build-context.outputs.push_image }}
-          platforms: ${{ env.PLATFORMS }}
-          cache-from: type=gha,scope=community-service
-          cache-to: type=gha,mode=max,scope=community-service
+          distribution: 'adopt'
+          java-version: '17'
 
-      - name: Build crapi-web all platforms and conditionally push to Docker Hub
-        uses: docker/build-push-action@v2
+      - name: Setup Go
+        uses: actions/setup-go@v5
         with:
-          context: ./services/web
-          tags: crapi/crapi-web:${{ env.TAG_LATEST }},crapi/crapi-web:${{ env.TAG_NAME }}
-          push: ${{ needs.build-context.outputs.push_image }}
-          platforms: ${{ env.PLATFORMS }}
-          cache-from: type=gha,scope=web-service
-          cache-to: type=gha,mode=max,scope=web-service
+          go-version: '1.21'
+
+      - name: Start the database
+        run: docker compose -f services/docker-database.yml up -d
+
+      - name: Run identity tests
+        run: |
+          cd services/identity
+          ./gradlew test
 
-      - name: Build gateway-service all platforms and conditionally push to Docker Hub
-        uses: docker/build-push-action@v2
+      - name: Run community tests
+        run: |
+          cd services/community
+          go test -v ./...
+          mkdir test-results
+          go run gotest.tools/gotestsum@latest --format testname --junitfile test-results/unit-tests.xml
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v3
         with:
-          context: ./services/gateway-service
-          tags: crapi/gateway-service:${{ env.TAG_LATEST }},crapi/gateway-service:${{ env.TAG_NAME }}
-          push: ${{ needs.build-context.outputs.push_image }}
-          platforms: ${{ env.PLATFORMS }}
-          cache-from: type=gha,scope=gateway-service
-          cache-to: type=gha,mode=max,scope=gateway-service
+          # Require: The version of golangci-lint to use.
+          # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
+          # When `install-mode` is `goinstall` the value can be v1.2.3, `latest`, or the hash of a commit.
+          version: v1.54
+          working-directory: services/community
+
 
-      - name: Build mailhog all platforms and conditionally push to Docker Hub
-        if: steps.check_mailhog_exists.outputs.files_exists == 'true'
-        uses: docker/build-push-action@v2
+      - name: Run workshop tests
+        run: |
+          cd services/workshop
+          pip3 install virtualenv
+          virtualenv venv
+          source venv/bin/activate
+          pip3 install -r requirements.txt
+          pip3 install -r dev-requirements.txt
+          mkdir -p test-results
+          source .env
+          IS_TESTING=True python3 manage.py test --no-input --testrunner xmlrunner.extra.djangotestrunner.XMLTestRunner
+
+      - name: Publish Test Results
+        uses: EnricoMi/publish-unit-test-result-action@v2
+        if: always()
         with:
-          context: ./services/mailhog
-          tags: crapi/mailhog:${{ env.TAG_LATEST }},crapi/mailhog:${{ env.TAG_NAME }}
-          push: ${{ needs.build-context.outputs.push_image }}
-          platforms: ${{ env.PLATFORMS }}
-          cache-from: type=gha,scope=mailhog-service
-          cache-to: type=gha,mode=max,scope=mailhog-service
+          files: |
+            **/test-results/**/*.xml
+            **/test-results/**/*.json
 
-      - name: Dump docker logs on failure
-        if: failure()
-        uses: jwalton/gh-docker-logs@v2
+      - name: Run workshop coverage
+        run: |
+          cd services/workshop
+          source venv/bin/activate
+          source .env
+          IS_TESTING=True coverage run ./manage.py test --no-input crapi
+          coverage report
+          coverage xml -o coverage.xml
+
+      - name: Publish Coverage for workshop
+        uses: orgoro/coverage@v3.2
+        with:
+            coverageFile: services/workshop/coverage.xml
+            token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: node prettier
+        run: |
+          cd services/web
+          npm install
+          npm run lint