Skip to content

Commit faab61c

Browse files
mkleenemkleene
authored
Merge branch 'main' into feature/code-coverage
2 parents 235170a + ba11d49 commit faab61c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+2338
-897
lines changed

‎.github/dco.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
require:
2+
members: false

‎.github/workflows/checks.yaml‎

Lines changed: 35 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
- name: Conventional Commits Check
2828
if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name)
2929
id: conventional-commits
30-
uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017
30+
uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
3131
env:
3232
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3333
with:
@@ -58,12 +58,12 @@ jobs:
5858
mavenverify:
5959
runs-on: ubuntu-latest
6060
steps:
61-
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
62-
- uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
61+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
62+
- uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
6363
with:
6464
github_token: ${{ secrets.GITHUB_TOKEN }}
6565
- name: Set up JDK
66-
uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7
66+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
6767
with:
6868
java-version: "11"
6969
distribution: "adopt"
@@ -79,26 +79,26 @@ jobs:
7979
runs-on: ubuntu-22.04
8080
steps:
8181
- name: Check out repository
82-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
82+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8383
with:
8484
fetch-depth: 0
85-
- uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
85+
- uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
8686
with:
8787
github_token: ${{ secrets.GITHUB_TOKEN }}
8888
- name: Set up JDK
89-
uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7
89+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
9090
with:
9191
java-version: "17"
9292
distribution: "temurin"
9393
server-id: github
9494
- name: Cache SonarCloud packages
95-
uses: actions/cache@v4
95+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
9696
with:
9797
path: ~/.sonar/cache
9898
key: ${{ runner.os }}-sonar
9999
restore-keys: ${{ runner.os }}-sonar
100100
- name: Cache Maven packages
101-
uses: actions/cache@v4
101+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
102102
with:
103103
path: ~/.m2
104104
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -115,12 +115,12 @@ jobs:
115115
runs-on: ubuntu-22.04
116116
steps:
117117
- name: Checkout Java SDK
118-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
119-
- uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
118+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
119+
- uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
120120
with:
121121
github_token: ${{ secrets.GITHUB_TOKEN }}
122122
- name: Set up JDK
123-
uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7
123+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
124124
with:
125125
java-version: "11"
126126
distribution: "adopt"
@@ -152,21 +152,21 @@ jobs:
152152
java -jar target/cmdline.jar \
153153
--client-id=opentdf-sdk \
154154
--client-secret=secret \
155-
--platform-endpoint=localhost:8080 \
155+
--platform-endpoint=http://localhost:8080 \
156156
-h\
157-
encrypt --kas-url=localhost:8080 --mime-type=text/plain --attr https://example.com/attr/attr1/value/value1 --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
157+
encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --attr https://example.com/attr/attr1/value/value1 --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
158158
159159
java -jar target/cmdline.jar \
160160
--client-id=opentdf-sdk \
161161
--client-secret=secret \
162-
--platform-endpoint=localhost:8080 \
162+
--platform-endpoint=http://localhost:8080 \
163163
-h\
164164
decrypt -f test.tdf > decrypted
165165
166166
java -jar target/cmdline.jar \
167167
--client-id=opentdf-sdk \
168168
--client-secret=secret \
169-
--platform-endpoint=localhost:8080 \
169+
--platform-endpoint=http://localhost:8080 \
170170
-h\
171171
metadata -f test.tdf > metadata
172172
@@ -188,14 +188,14 @@ jobs:
188188
java -jar target/cmdline.jar \
189189
--client-id=opentdf-sdk \
190190
--client-secret=secret \
191-
--platform-endpoint=localhost:8080 \
191+
--platform-endpoint=http://localhost:8080 \
192192
-h\
193193
encryptnano --kas-url=http://localhost:8080 --attr https://example.com/attr/attr1/value/value1 -f data -m 'here is some metadata' > nano.ntdf
194194
195195
java -jar target/cmdline.jar \
196196
--client-id=opentdf-sdk \
197197
--client-secret=secret \
198-
--platform-endpoint=localhost:8080 \
198+
--platform-endpoint=http://localhost:8080 \
199199
-h\
200200
decryptnano -f nano.ntdf > decrypted
201201
@@ -215,14 +215,14 @@ jobs:
215215
java -jar target/cmdline.jar \
216216
--client-id=opentdf-sdk \
217217
--client-secret=secret \
218-
--platform-endpoint=localhost:8080 \
218+
--platform-endpoint=http://localhost:8080 \
219219
-h\
220-
encrypt --kas-url=localhost:8080 --mime-type=text/plain --with-assertions=$ASSERTIONS --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
220+
encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --with-assertions=$ASSERTIONS --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
221221
222222
java -jar target/cmdline.jar \
223223
--client-id=opentdf-sdk \
224224
--client-secret=secret \
225-
--platform-endpoint=localhost:8080 \
225+
--platform-endpoint=http://localhost:8080 \
226226
-h\
227227
decrypt -f test.tdf > decrypted
228228
@@ -246,14 +246,14 @@ jobs:
246246
java -jar target/cmdline.jar \
247247
--client-id=opentdf-sdk \
248248
--client-secret=secret \
249-
--platform-endpoint=localhost:8080 \
249+
--platform-endpoint=http://localhost:8080 \
250250
-h\
251-
encrypt --kas-url=localhost:8080 --mime-type=text/plain --with-assertions="$SIGNED_ASSERTIONS_HS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
251+
encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --with-assertions="$SIGNED_ASSERTIONS_HS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
252252
253253
java -jar target/cmdline.jar \
254254
--client-id=opentdf-sdk \
255255
--client-secret=secret \
256-
--platform-endpoint=localhost:8080 \
256+
--platform-endpoint=http://localhost:8080 \
257257
-h\
258258
decrypt --with-assertion-verification-keys="$SIGNED_ASSERTION_VERIFICATON_HS256" -f test.tdf > decrypted
259259
@@ -267,14 +267,14 @@ jobs:
267267
java -jar target/cmdline.jar \
268268
--client-id=opentdf-sdk \
269269
--client-secret=secret \
270-
--platform-endpoint=localhost:8080 \
270+
--platform-endpoint=http://localhost:8080 \
271271
-h\
272-
encrypt --kas-url=localhost:8080 --mime-type=text/plain --with-assertions "$SIGNED_ASSERTIONS_RS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
272+
encrypt --kas-url=http://localhost:8080 --mime-type=text/plain --with-assertions "$SIGNED_ASSERTIONS_RS256" --autoconfigure=false -f data -m 'here is some metadata' > test.tdf
273273
274274
java -jar target/cmdline.jar \
275275
--client-id=opentdf-sdk \
276276
--client-secret=secret \
277-
--platform-endpoint=localhost:8080 \
277+
--platform-endpoint=http://localhost:8080 \
278278
-h\
279279
decrypt --with-assertion-verification-keys "$SIGNED_ASSERTION_VERIFICATON_RS256" -f test.tdf > decrypted
280280
@@ -300,23 +300,23 @@ jobs:
300300
java -jar target/cmdline.jar \
301301
--client-id=opentdf-sdk \
302302
--client-secret=secret \
303-
--platform-endpoint=localhost:8080 \
303+
--platform-endpoint=http://localhost:8080 \
304304
-h\
305-
encrypt --kas-url=localhost:8080,localhost:8282 -f data -m 'here is some metadata' > test.tdf
305+
encrypt --kas-url=http://localhost:8080,http://localhost:8282 -f data -m 'here is some metadata' > test.tdf
306306
307307
java -jar target/cmdline.jar \
308308
--client-id=opentdf-sdk \
309309
--client-secret=secret \
310-
--platform-endpoint=localhost:8080 \
310+
--platform-endpoint=http://localhost:8080 \
311311
-h\
312-
decrypt -f test.tdf > decrypted
312+
decrypt -f test.tdf --kas-allowlist http://localhost:8080,http://localhost:8282 > decrypted
313313
314314
java -jar target/cmdline.jar \
315315
--client-id=opentdf-sdk \
316316
--client-secret=secret \
317-
--platform-endpoint=localhost:8080 \
317+
--platform-endpoint=http://localhost:8080 \
318318
-h\
319-
metadata -f test.tdf > metadata
319+
metadata -f test.tdf --kas-allowlist http://localhost:8080,http://localhost:8282 > metadata
320320
321321
if ! diff -q data decrypted; then
322322
printf 'decrypted data is incorrect [%s]' "$(< decrypted)"
@@ -337,7 +337,8 @@ jobs:
337337
uses: opentdf/tests/.github/workflows/xtest.yml@main
338338
with:
339339
focus-sdk: java
340-
java-ref: ${{ github.ref }}
340+
java-ref: ${{ github.ref }} latest
341+
platform-ref: main lts
341342

342343
ci:
343344
needs:

‎.github/workflows/codeql.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ jobs:
2323

2424
steps:
2525
- name: Checkout repository
26-
uses: actions/checkout@v4
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2727

2828
- name: Buf setup
29-
uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
29+
uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
3030

3131
- name: Initialize the CodeQL tools for scanning
3232
uses: github/codeql-action/init@v3

‎.github/workflows/dependency-review.yaml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Config documentation: https://github.com/actions/dependency-review-action?tab=readme-ov-file#configuration
2+
name: 'Dependency Review'
3+
on:
4+
pull_request: {}
5+
merge_group:
6+
workflow_call:
7+
inputs:
8+
fail-on-severity:
9+
description: "Minimum severity to fail job."
10+
default: "low"
11+
required: false
12+
type: string
13+
base-ref:
14+
description: "Base ref for building diff."
15+
default: ""
16+
required: false
17+
type: string
18+
head-ref:
19+
description: "Head ref for building diff."
20+
default: ""
21+
required: false
22+
type: string
23+
24+
jobs:
25+
dependency-review:
26+
runs-on: ubuntu-latest
27+
28+
permissions:
29+
contents: read
30+
pull-requests: write
31+
32+
steps:
33+
- name: "Skipping on merge queue event"
34+
if: ${{ github.event_name == 'merge_group' }}
35+
run: |
36+
echo "Skipping on merge queue event"
37+
38+
- name: Checkout
39+
if: ${{ github.event_name != 'merge_group' }}
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
with:
42+
persist-credentials: false
43+
44+
- name: 'Dependency Review'
45+
if: ${{ github.event_name != 'merge_group' }}
46+
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
47+
with:
48+
fail-on-severity: ${{ inputs.fail-on-severity }}
49+
deny-licenses: >
50+
GPL-2.0,
51+
AGPL-1.0,
52+
AGPL-1.0-or-later,
53+
AGPL-1.0-only,
54+
AGPL-3.0,
55+
AGPL-3.0-only,
56+
AGPL-3.0-or-later,
57+
GPL-1.0,
58+
GPL-1.0+,
59+
GPL-1.0-only,
60+
GPL-1.0-or-later,
61+
CNRI-Python-GPL-Compatible,
62+
GPL-2.0+,
63+
GPL-2.0-only,
64+
GPL-2.0-or-later,
65+
GPL-2.0-with-GCC-exception,
66+
GPL-2.0-with-autoconf-exception,
67+
GPL-2.0-with-bison-exception,
68+
GPL-2.0-with-classpath-exception,
69+
GPL-2.0-with-font-exception,
70+
GPL-3.0,
71+
GPL-3.0+,
72+
GPL-3.0-only,
73+
GPL-3.0-or-later,
74+
GPL-3.0-with-GCC-exception,
75+
GPL-3.0-with-autoconf-exception,
76+
LGPL-2.0,
77+
LGPL-2.0+,
78+
LGPL-2.0-only,
79+
LGPL-2.0-or-later,
80+
LGPL-2.1,
81+
LGPL-2.1+,
82+
LGPL-2.1-only,
83+
LGPL-2.1-or-later,
84+
LGPL-3.0,
85+
LGPL-3.0+,
86+
LGPL-3.0-only,
87+
LGPL-3.0-or-later,
88+
LGPLLR,
89+
NGPL
90+
comment-summary-in-pr: on-failure
91+
base-ref: ${{ inputs.base-ref || github.event.pull_request.base.sha || github.event.repository.default_branch }}
92+
head-ref: ${{ inputs.head-ref || github.event.pull_request.head.sha || github.ref }}

‎.github/workflows/release.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
with:
2222
app-id: "${{ secrets.APP_ID }}"
2323
private-key: "${{ secrets.AUTOMATION_KEY }}"
24-
- uses: google-github-actions/release-please-action@v4
24+
- uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4.2.0
2525
with:
2626
token: "${{ steps.generate_token.outputs.token }}"
2727
config-file: release-please.json
@@ -30,15 +30,15 @@ jobs:
3030
runs-on: ubuntu-latest
3131
steps:
3232
- name: Checkout
33-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3434
- name: Setup Buf
35-
uses: bufbuild/buf-setup-action@2211e06e8cf26d628cda2eea15c95f8c42b080b3
35+
uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
3636
with:
3737
github_token: ${{ secrets.GITHUB_TOKEN }}
3838
# stage maven profile
3939
- name: Set up JDK to publish to GitHub Packages
4040
if: github.ref == 'refs/heads/main'
41-
uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7
41+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
4242
with:
4343
java-version: "11"
4444
distribution: "adopt"
@@ -60,7 +60,7 @@ jobs:
6060
# release maven profile
6161
- name: Set up JDK to publish to Maven Central
6262
if: startsWith(github.ref, 'refs/tags/')
63-
uses: actions/setup-java@5896cecc08fd8a1fbdfaf517e29b571164b031f7
63+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
6464
with:
6565
java-version: "11"
6666
distribution: "adopt"

0 commit comments

Comments
 (0)