ci: integrate Bright CI pipeline for security testing and remediation [160 eps; re-index-changed-v2; stopped]

.github/workflows/ci.yml

@@ -1,22 +1,25 @@
 name: "CI/CD Pipeline"
 on:
-  push:
-    branches-ignore:
-      - l10n_develop
-      - gh-pages
-    paths-ignore:
-      - '*.md'
-      - 'LICENSE'
-      - 'monitoring/grafana-dashboard.json'
-      - 'screenshots/**'
-    tags-ignore:
-      - '*'
-  pull_request:
-    paths-ignore:
-      - '*.md'
-      - 'LICENSE'
-      - 'data/static/i18n/*.json'
-      - 'frontend/src/assets/i18n/*.json'
+  workflow_dispatch:
+# on:
+#   push:
+#     branches-ignore:
+#       - l10n_develop
+#       - gh-pages
+#     paths-ignore:
+#       - '*.md'
+#       - 'LICENSE'
+#       - 'monitoring/grafana-dashboard.json'
+#       - 'screenshots/**'
+#     tags-ignore:
+#       - '*'
+#   pull_request:
+#     paths-ignore:
+#       - '*.md'
+#       - 'LICENSE'
+#       - 'data/static/i18n/*.json'
+#       - 'frontend/src/assets/i18n/*.json'
+
 env:
   NODE_DEFAULT_VERSION: 22
   NODE_OPTIONS: "--max_old_space_size=4096"
@@ -40,18 +43,8 @@ jobs:
         run: npm run lint
       - name: "Lint customization configs"
         run: >
-          npm run lint:config -- -f ./config/7ms.yml &&
-          npm run lint:config -- -f ./config/addo.yml &&
-          npm run lint:config -- -f ./config/bodgeit.yml &&
-          npm run lint:config -- -f ./config/ctf.yml &&
-          npm run lint:config -- -f ./config/default.yml &&
-          npm run lint:config -- -f ./config/fbctf.yml &&
-          npm run lint:config -- -f ./config/juicebox.yml &&
-          npm run lint:config -- -f ./config/mozilla.yml &&
-          npm run lint:config -- -f ./config/oss.yml &&
-          npm run lint:config -- -f ./config/quiet.yml &&
-          npm run lint:config -- -f ./config/tutorial.yml &&
-          npm run lint:config -- -f ./config/unsafe.yml
+          npm run lint:config -- -f ./config/7ms.yml && npm run lint:config -- -f ./config/addo.yml && npm run lint:config -- -f ./config/bodgeit.yml && npm run lint:config -- -f ./config/ctf.yml && npm run lint:config -- -f ./config/default.yml && npm run lint:config -- -f ./config/fbctf.yml && npm run lint:config -- -f ./config/juicebox.yml && npm run lint:config -- -f ./config/mozilla.yml && npm run lint:config -- -f ./config/oss.yml && npm run lint:config -- -f ./config/quiet.yml && npm run lint:config -- -f ./config/tutorial.yml && npm run lint:config -- -f ./config/unsafe.yml
+
   coding-challenge-rsn:
     runs-on: windows-latest
     steps:
@@ -184,17 +177,8 @@ jobs:
           timeout_minutes: 30
           max_attempts: 3
           command: >
-            NODE_ENV=7ms npm run test:server &&
-            NODE_ENV=addo npm run test:server &&
-            NODE_ENV=bodgeit npm run test:server &&
-            NODE_ENV=ctf npm run test:server &&
-            NODE_ENV=fbctf npm run test:server &&
-            NODE_ENV=juicebox npm run test:server &&
-            NODE_ENV=mozilla npm run test:server &&
-            NODE_ENV=oss npm run test:server &&
-            NODE_ENV=quiet npm run test:server &&
-            NODE_ENV=tutorial npm run test:server &&
-            NODE_ENV=unsafe npm run test:server
+            NODE_ENV=7ms npm run test:server && NODE_ENV=addo npm run test:server && NODE_ENV=bodgeit npm run test:server && NODE_ENV=ctf npm run test:server && NODE_ENV=fbctf npm run test:server && NODE_ENV=juicebox npm run test:server && NODE_ENV=mozilla npm run test:server && NODE_ENV=oss npm run test:server && NODE_ENV=quiet npm run test:server && NODE_ENV=tutorial npm run test:server && NODE_ENV=unsafe npm run test:server
+
   e2e:
     runs-on: ${{ matrix.os }}
     strategy:

.github/workflows/codeql-analysis.yml

@@ -1,8 +1,9 @@
 name: "CodeQL Scan"
-
 on:
-  push:
-  pull_request:
+  workflow_dispatch:
+# on:
+#   push:
+#   pull_request:
 
 jobs:
   analyze:
@@ -15,19 +16,19 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript-typescript' ]
+        language: ['javascript-typescript']
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        queries: security-extended
-        config: |
-          paths-ignore:
-            - 'data/static/codefixes'
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+          config: |
+            paths-ignore:
+              - 'data/static/codefixes'
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.github/workflows/lint-fixer.yml

@@ -1,29 +1,30 @@
 name: "Let me lint:fix that for you"
-
-on: [push]
+on:
+  workflow_dispatch:
+# on: [push]
 
 jobs:
   LMLFTFY:
     runs-on: ubuntu-latest
     steps:
-    - name: "Check out Git repository"
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-    - name: "Use Node.js 22"
-      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af #v4.1.0
-      with:
-        node-version: 22
-    - name: "Install application"
-      run: |
-        npm install --ignore-scripts
-        cd frontend
-        npm install --ignore-scripts --legacy-peer-deps
-    - name: "Fix everything which can be fixed"
-      run: 'npm run lint:fix'
-    - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
-      with:
-        commit_message: "Auto-fix linting issues"
-        branch: ${{ github.head_ref }}
-        commit_options: '--signoff'
-        commit_user_name: JuiceShopBot
-        commit_user_email: 61591748+JuiceShopBot@users.noreply.github.com
-        commit_author: JuiceShopBot <61591748+JuiceShopBot@users.noreply.github.com>
+      - name: "Check out Git repository"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+      - name: "Use Node.js 22"
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af #v4.1.0
+        with:
+          node-version: 22
+      - name: "Install application"
+        run: |
+          npm install --ignore-scripts
+          cd frontend
+          npm install --ignore-scripts --legacy-peer-deps
+      - name: "Fix everything which can be fixed"
+        run: 'npm run lint:fix'
+      - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
+        with:
+          commit_message: "Auto-fix linting issues"
+          branch: ${{ github.head_ref }}
+          commit_options: '--signoff'
+          commit_user_name: JuiceShopBot
+          commit_user_email: 61591748+JuiceShopBot@users.noreply.github.com
+          commit_author: JuiceShopBot <61591748+JuiceShopBot@users.noreply.github.com>

.github/workflows/rebase.yml

@@ -1,8 +1,9 @@
 name: Automatic Rebase
-
 on:
-  issue_comment:
-    types: [created]
+  workflow_dispatch:
+# on:
+#   issue_comment:
+#     types: [created]
 
 jobs:
   rebase:

.github/workflows/release.yml

@@ -1,8 +1,11 @@
 name: "Release Pipeline"
 on:
-  push:
-    tags:
-      - v*
+  workflow_dispatch:
+# on:
+#   push:
+#     tags:
+#       - v*
+
 env:
   CYCLONEDX_NPM_VERSION: '^2.0.0||^3.0.0'
 jobs:

.github/workflows/update-challenges-www.yml

@@ -1,34 +1,34 @@
 name: "Update challenges on owasp-juice.shop"
-
 on:
-  push:
-    branches: [ master ]
-    paths:
-      - 'data/static/challenges.yml'
+  workflow_dispatch:
+# on:
+#   push:
+#     branches: [master]
+#     paths:
+#       - 'data/static/challenges.yml'
 
 jobs:
   UpdateChallengesOnWebsite:
     if: github.repository == 'juice-shop/juice-shop'
     runs-on: ubuntu-latest
     steps:
-    - name: Check out Git repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-      with:
-        token: ${{ secrets.BOT_TOKEN }}
-        repository: OWASP/www-project-juice-shop
-        ref: master
-    - name: Update challenges.yml
-      run: |
-        cd _data/
-        rm challenges.yml
-        wget https://raw.githubusercontent.com/juice-shop/juice-shop/master/data/static/challenges.yml
-    - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
-      with:
-        commit_message: "Auto-update challenges.yml from ${{ github.sha }}"
-        branch: master
-        commit_options: '--signoff'
-
-        # Optional commit user and author settings
-        commit_user_name: JuiceShopBot
-        commit_user_email: 61591748+JuiceShopBot@users.noreply.github.com
-        commit_author: JuiceShopBot <61591748+JuiceShopBot@users.noreply.github.com>
+      - name: Check out Git repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        with:
+          token: ${{ secrets.BOT_TOKEN }}
+          repository: OWASP/www-project-juice-shop
+          ref: master
+      - name: Update challenges.yml
+        run: |
+          cd _data/
+          rm challenges.yml
+          wget https://raw.githubusercontent.com/juice-shop/juice-shop/master/data/static/challenges.yml
+      - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
+        with:
+          commit_message: "Auto-update challenges.yml from ${{ github.sha }}"
+          branch: master
+          commit_options: '--signoff'
+          # Optional commit user and author settings
+          commit_user_name: JuiceShopBot
+          commit_user_email: 61591748+JuiceShopBot@users.noreply.github.com
+          commit_author: JuiceShopBot <61591748+JuiceShopBot@users.noreply.github.com>

.github/workflows/update-news-www.yml

@@ -1,29 +1,29 @@
 name: "Update news on owasp-juice.shop"
-
 on:
-  release:
-    types: [ published ]
+  workflow_dispatch:
+# on:
+#   release:
+#     types: [published]
 
 jobs:
   UpdateNewsOnWebsite:
     runs-on: ubuntu-latest
     steps:
-    - name: Check out Git repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-      with:
-        token: ${{ secrets.BOT_TOKEN }}
-        repository: OWASP/www-project-juice-shop
-        branch: master
-    - name: Update tab_news.md
-      run: |
-        sed -i 's/<!-- next:juice-shop -->/<!-- next:juice-shop -->\n* ${{ github.event.release.published_at }}: juice-shop [`${{ github.event.release.tag_name }}`](https:\/\/github.com\/juice-shop\/juice-shop\/releases\/tag\/${{ github.event.release.tag_name }})/' tab_news.md
-    - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
-      with:
-        commit_message: "Add juice-shop ${{ github.event.release.tag_name }} release notes to tab_news.md"
-        branch: master
-        commit_options: '--signoff'
-
-        # Optional commit user and author settings
-        commit_user_name: JuiceShopBot
-        commit_user_email: 61591748+JuiceShopBot@users.noreply.github.com
-        commit_author: JuiceShopBot <61591748+JuiceShopBot@users.noreply.github.com>
+      - name: Check out Git repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        with:
+          token: ${{ secrets.BOT_TOKEN }}
+          repository: OWASP/www-project-juice-shop
+          branch: master
+      - name: Update tab_news.md
+        run: |
+          sed -i 's/<!-- next:juice-shop -->/<!-- next:juice-shop -->\n* ${{ github.event.release.published_at }}: juice-shop [`${{ github.event.release.tag_name }}`](https:\/\/github.com\/juice-shop\/juice-shop\/releases\/tag\/${{ github.event.release.tag_name }})/' tab_news.md
+      - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 #v5.0.1
+        with:
+          commit_message: "Add juice-shop ${{ github.event.release.tag_name }} release notes to tab_news.md"
+          branch: master
+          commit_options: '--signoff'
+          # Optional commit user and author settings
+          commit_user_name: JuiceShopBot
+          commit_user_email: 61591748+JuiceShopBot@users.noreply.github.com
+          commit_author: JuiceShopBot <61591748+JuiceShopBot@users.noreply.github.com>