From c8d5dfe98182a1f7df06d55ca6df2abccad3289a Mon Sep 17 00:00:00 2001 From: ssvoss Date: Fri, 11 Sep 2026 11:51:24 -0400 Subject: [PATCH 1/3] npm dependency updates --- package-lock.json | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/package-lock.json b/package-lock.json index 965755e..fc90053 100644 --- a/package-lock.json +++ b/package-lock.json @@ -713,9 +713,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", - "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, "funding": [ { @@ -826,29 +826,43 @@ } }, "node_modules/@humanfs/core": { - "version": "0.19.1", - "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz", - "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==", + "version": "0.19.2", + "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz", + "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==", "dev": true, "license": "Apache-2.0", + "dependencies": { + "@humanfs/types": "^0.15.0" + }, "engines": { "node": ">=18.18.0" } }, "node_modules/@humanfs/node": { - "version": "0.16.7", - "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz", - "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==", + "version": "0.16.8", + "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz", + "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==", "dev": true, "license": "Apache-2.0", "dependencies": { - "@humanfs/core": "^0.19.1", + "@humanfs/core": "^0.19.2", + "@humanfs/types": "^0.15.0", "@humanwhocodes/retry": "^0.4.0" }, "engines": { "node": ">=18.18.0" } }, + "node_modules/@humanfs/types": { + "version": "0.15.0", + "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz", + "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==", + "dev": true, + "license": "Apache-2.0", + "engines": { + "node": ">=18.18.0" + } + }, "node_modules/@humanwhocodes/module-importer": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz", @@ -4045,9 +4059,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "license": "MIT", "dependencies": { From a73d45f29b992ff7566cc6c743072231e0480351 Mon Sep 17 00:00:00 2001 From: ssvoss Date: Fri, 11 Sep 2026 11:52:31 -0400 Subject: [PATCH 2/3] add reusable sonar scan workflow --- .../workflows/CHANGELOGS/run_sonar_scan.md | 11 +++++ .github/workflows/READMES/run_sonar_scan.md | 45 +++++++++++++++++++ .github/workflows/run_sonar_scan.yml | 33 ++++++++++++++ 3 files changed, 89 insertions(+) create mode 100644 .github/workflows/CHANGELOGS/run_sonar_scan.md create mode 100644 .github/workflows/READMES/run_sonar_scan.md create mode 100644 .github/workflows/run_sonar_scan.yml diff --git a/.github/workflows/CHANGELOGS/run_sonar_scan.md b/.github/workflows/CHANGELOGS/run_sonar_scan.md new file mode 100644 index 0000000..d0fbe46 --- /dev/null +++ b/.github/workflows/CHANGELOGS/run_sonar_scan.md @@ -0,0 +1,11 @@ +# Run SonarQube Scan Workflow Changelog + +All notable changes to the **run_sonar_scan** callable workflow are documented in this file. + +## 1.0.0 + +### Added + +- First release of the `run_sonar_scan` reusable workflow. +- Defaults to scanning the ref that triggered the caller's workflow and optionally accepts a commit SHA, tag, or branch. +- Runs the SonarQube scan with full Git history and an explicitly mapped `SONAR_TOKEN` secret. diff --git a/.github/workflows/READMES/run_sonar_scan.md b/.github/workflows/READMES/run_sonar_scan.md new file mode 100644 index 0000000..45762fa --- /dev/null +++ b/.github/workflows/READMES/run_sonar_scan.md @@ -0,0 +1,45 @@ +# Run SonarQube Scan + +This reusable workflow checks out the ref that triggered the caller, or a specified commit or ref, and runs a SonarQube scan with full Git history. + +## Prerequisites + +The consuming repository must include its SonarQube configuration, such as a `sonar-project.properties` file, or otherwise provide configuration supported by the scan action. + +## Usage + +```yaml +jobs: + sonar-scan: + uses: OpenSesame/core-github-actions/.github/workflows/run_sonar_scan.yml@workflows/run_sonar_scan/1.0.0 + secrets: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} +``` + +To scan a different commit, tag, or branch, pass `commit-identifier`: + +```yaml +with: + commit-identifier: ${{ github.sha }} +``` + +## Inputs + +| Input | Type | Required | Default | Description | +| ------------------- | ------ | -------- | --------------------- | ------------------------------------------------- | +| `commit-identifier` | string | No | Triggering ref or SHA | Commit SHA, tag, or branch to check out and scan. | + +## Secrets + +| Secret | Required | Description | +| ------------- | -------- | ---------------------------------------------- | +| `SONAR_TOKEN` | Yes | Token used to authenticate the SonarQube scan. | + +## Contribution + +- Update the workflow, README, and changelog together. +- Create a PR and set a version label following the [versioning instructions](../../../VERSIONING.md). + +## References + +- [SonarQube scan action](https://github.com/SonarSource/sonarqube-scan-action) diff --git a/.github/workflows/run_sonar_scan.yml b/.github/workflows/run_sonar_scan.yml new file mode 100644 index 0000000..d9a4fbe --- /dev/null +++ b/.github/workflows/run_sonar_scan.yml @@ -0,0 +1,33 @@ +name: SonarQube Scan + +on: + workflow_call: + inputs: + commit-identifier: + description: Commit SHA or ref to scan; defaults to the ref that triggered the workflow + type: string + required: false + default: '' + secrets: + SONAR_TOKEN: + required: true + +permissions: + contents: read + +jobs: + sonar-scan: + name: Run SonarQube scan + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.commit-identifier }} + fetch-depth: 0 + + - name: Run SonarQube scan + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 + env: + SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} From 117179e9368681b74a554cd1eb53f05c77e4524b Mon Sep 17 00:00:00 2001 From: ssvoss Date: Fri, 11 Sep 2026 12:22:00 -0400 Subject: [PATCH 3/3] deprecation notice added known consumers --- .gitignore | 1 - build-apply/README.md | 8 ++++ build-publish/README.md | 8 ++++ build/README.md | 9 ++++ cleanup/README.md | 8 ++++ deploy/README.md | 8 ++++ select-branch-workspace/README.md | 8 +++- semgrep/README.md | 68 ++++++++++++++++++------------- tf-apply/README.md | 4 ++ tf-plan-comment/README.md | 25 +++++++++++- tf-plan/README.md | 8 ++++ 11 files changed, 124 insertions(+), 31 deletions(-) diff --git a/.gitignore b/.gitignore index 48cc490..ad96889 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,6 @@ # Compiled output dist/ **/dist/ -build/ **/build/ # Dependencies diff --git a/build-apply/README.md b/build-apply/README.md index 522004e..ff9b3da 100644 --- a/build-apply/README.md +++ b/build-apply/README.md @@ -1,9 +1,17 @@ +# Build-Apply Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +Known Consumers - Audited Sept 2026 + +* [player-ingestion](https://github.com/OpenSesame/player-ingestion) +* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure) +* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router) + ### Overview The build-apply composite action builds and applies the current branch to a destination environment. diff --git a/build-publish/README.md b/build-publish/README.md index cdfb01c..a53ba56 100644 --- a/build-publish/README.md +++ b/build-publish/README.md @@ -1,9 +1,17 @@ +# Build-Publish Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +Known Consumers - Audited Sept 2026 +* [core-build-library](https://github.com/OpenSesame/core-build-library) +* [core-repo-template](https://github.com/OpenSesame/core-repo-template) +* [identity-messages](https://github.com/OpenSesame/identity-messages) +* [player-messages](https://github.com/OpenSesame/player-messages) + ### Overview The publish composite action builds a library and publishes it to the configured registry. diff --git a/build/README.md b/build/README.md index eba2c8f..a85f1cd 100644 --- a/build/README.md +++ b/build/README.md @@ -1,8 +1,17 @@ +# Build Composite Action + ## ❌ Deprecation Notice + This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +Known Consumers - Audited Sept 2026 + +* [player-ingestion](https://github.com/OpenSesame/player-ingestion) +* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure) +* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router) + ### Overview The build composite action generates and builds the code. diff --git a/cleanup/README.md b/cleanup/README.md index d38abb6..2c77bc7 100644 --- a/cleanup/README.md +++ b/cleanup/README.md @@ -1,9 +1,17 @@ +# Cleanup Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +Known Consumers - Audited Sept 2026 + +* [identity-saml-test-idp](https://github.com/OpenSesame/identity-saml-test-idp) +* [player-ingestion](https://github.com/OpenSesame/player-ingestion) +* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router) + ### Overview The cleanup composite action destroys terraform resources in a target environment diff --git a/deploy/README.md b/deploy/README.md index 157c73a..c0af6c3 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -1,9 +1,17 @@ +# Deploy Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +Known Consumers - Audited Sept 2026 + +* [player-ingestion](https://github.com/OpenSesame/player-ingestion) +* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure) +* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router) + ### Overview The deploy composite action runs npm commands to deploy to a target environment, followed by post-deployment contract tests. diff --git a/select-branch-workspace/README.md b/select-branch-workspace/README.md index e6c2a67..e7a6437 100644 --- a/select-branch-workspace/README.md +++ b/select-branch-workspace/README.md @@ -1,10 +1,16 @@ +# Select Branch Workspace Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. -# Overview +Known Consumers - Audited Sept 2026 + +* [identity-userstore](https://github.com/OpenSesame/identity-userstore) + +### Overview Takes in a string input meant to be the name of a branch. The branch name is sanitized to be used as a workspace name. diff --git a/semgrep/README.md b/semgrep/README.md index 756d151..c2d6a62 100644 --- a/semgrep/README.md +++ b/semgrep/README.md @@ -1,25 +1,34 @@ +# Semgrep CE Scan Composite Action + +This action runs Semgrep security scanning with configurable options and reporting capabilities. + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. -If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +We suggest consumers switch over to the reusable workflow for [semgrep scan](https://github.com/OpenSesame/.github/blob/main/.github/workflows/semgrep-scan.yml) so it can be run in parallel with your other jobs. -# Semgrep CE Scan Action +Known Consumers - Audited Sept 2026 -This action runs Semgrep security scanning with configurable options and reporting capabilities. +* [identity-idp-api](https://github.com/OpenSesame/identity-idp-api) +* [identity-catalog-okta](https://github.com/OpenSesame/identity-catalog-okta) +* [core-orchestrator](https://github.com/OpenSesame/core-orchestrator) +* [core-okta-widget](https://github.com/OpenSesame/core-okta-widget) +* [core-mfe-error-page](https://github.com/OpenSesame/core-mfe-error-page) +* [core-pii-scrubber](https://github.com/OpenSesame/core-pii-scrubber) ## Features -- **Configurable scan modes**: diff, full, or baseline scanning -- **Multiple severity levels**: error, warning, info -- **Reviewdog integration**: Inline PR comments for findings -- **PR summary comments**: Automated PR comments with scan results -- **Flexible configuration**: Support for custom Semgrep rulesets +* **Configurable scan modes**: diff, full, or baseline scanning +* **Multiple severity levels**: error, warning, info +* **Reviewdog integration**: Inline PR comments for findings +* **PR summary comments**: Automated PR comments with scan results +* **Flexible configuration**: Support for custom Semgrep rulesets ## Inputs | Input | Description | Required | Default | -|-------|-------------|----------|---------| +| ----- | ----------- | -------- | ------- | | `branch_name` | The name of the branch where lint is running | No | - | | `semgrep_config` | Rulesets to run with Semgrep | No | `p/default` | | `fail_severity` | Severity level that causes the action to fail | No | `error` | @@ -30,7 +39,7 @@ This action runs Semgrep security scanning with configurable options and reporti ## Outputs | Output | Description | -|--------|-------------| +| ------ | ----------- | | `total_findings` | Total number of findings from the scan | | `error_count` | Number of error-level findings | | `warning_count` | Number of warning-level findings | @@ -81,30 +90,33 @@ This action runs Semgrep security scanning with configurable options and reporti ## Scan Modes ### Diff Mode (Default) -- Scans only changed files in PRs -- Compares against the base branch -- Fastest option for PR workflows + +* Scans only changed files in PRs +* Compares against the base branch +* Fastest option for PR workflows ### Full Mode -- Scans entire codebase -- Comprehensive security review -- Best for main branch or release workflows + +* Scans entire codebase +* Comprehensive security review +* Best for main branch or release workflows ### Baseline Mode -- Scans against a baseline commit (usually main) -- Good for tracking security debt -- Shows new issues since baseline + +* Scans against a baseline commit (usually main) +* Good for tracking security debt +* Shows new issues since baseline ## Severity Levels -- **error**: High-severity security issues that should block deployment -- **warning**: Medium-severity issues that should be reviewed -- **info**: Low-severity issues or informational findings +* **error**: High-severity security issues that should block deployment +* **warning**: Medium-severity issues that should be reviewed +* **info**: Low-severity issues or informational findings ## Reviewdog Reporters -- **github-pr-review**: Inline comments on specific lines in PR -- **github-pr-check**: Summary in PR checks without inline comments +* **github-pr-review**: Inline comments on specific lines in PR +* **github-pr-check**: Summary in PR checks without inline comments ## Permissions Required @@ -150,7 +162,7 @@ jobs: ## Notes -- The action automatically installs Semgrep version 1.124.0 -- Git history is required for diff mode scanning -- The action will fail if error-level findings are detected (configurable) -- PR comments are automatically updated on subsequent runs +* The action automatically installs Semgrep version 1.124.0 +* Git history is required for diff mode scanning +* The action will fail if error-level findings are detected (configurable) +* PR comments are automatically updated on subsequent runs diff --git a/tf-apply/README.md b/tf-apply/README.md index e37d9dd..420f689 100644 --- a/tf-apply/README.md +++ b/tf-apply/README.md @@ -1,9 +1,13 @@ +# Terraform Apply Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +No Known Consumers - Audited Sept 2026 + ### Overview The tf-apply composite action initializes, validates and apply terraform resources whilst selecting the desired workspace. diff --git a/tf-plan-comment/README.md b/tf-plan-comment/README.md index bf4263c..51fc514 100644 --- a/tf-plan-comment/README.md +++ b/tf-plan-comment/README.md @@ -1,9 +1,33 @@ +# Terraform Plan Comment Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +Known Consumers - Audited Sept 2026 + +* [catalog-feedback-service](https://github.com/OpenSesame/catalog-feedback-service) +* [catalog-search-proxy](https://github.com/OpenSesame/catalog-search-proxy) +* [catalog-service-template](https://github.com/OpenSesame/catalog-service-template) +* [core-mfe-auth-invitations](https://github.com/OpenSesame/core-mfe-auth-invitations) +* [core-mfe-error-page](https://github.com/OpenSesame/core-mfe-error-page) +* [core-mfe-profile-manager](https://github.com/OpenSesame/core-mfe-profile-manager) +* [core-mfe-template](https://github.com/OpenSesame/core-mfe-template) +* [core-mfe-terms-and-conditions](https://github.com/OpenSesame/core-mfe-terms-and-conditions) +* [core-okta-widget](https://github.com/OpenSesame/core-okta-widget) +* [core-orchestrator](https://github.com/OpenSesame/core-orchestrator) +* [identity-catalog-okta](https://github.com/OpenSesame/identity-catalog-okta) +* [identity-idp-api](https://github.com/OpenSesame/identity-idp-api) +* [identity-learner-okta](https://github.com/OpenSesame/identity-learner-okta) +* [identity-okta](https://github.com/OpenSesame/identity-okta) +* [identity-saml-test-idp](https://github.com/OpenSesame/identity-saml-test-idp) +* [identity-userstore](https://github.com/OpenSesame/identity-userstore) +* [identity-userstore-infrastructure](https://github.com/OpenSesame/identity-userstore-infrastructure) +* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure) +* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router) + ### Overview The tf-plan-comment composite action initializes actions/github-scripts. Bringing the script under core-github-actions allows us to be more modularized. We can now make any changes to the desired output in one area and have it apply to all the repos utilizing it. @@ -11,4 +35,3 @@ The tf-plan-comment composite action initializes actions/github-scripts. Bringin The action will do the following: 1. Output the terraform plan onto the pull request for easy access and readability. - diff --git a/tf-plan/README.md b/tf-plan/README.md index bb72be4..0be37f9 100644 --- a/tf-plan/README.md +++ b/tf-plan/README.md @@ -1,9 +1,17 @@ +# Terraform Plan Composite Action + ## ❌ Deprecation Notice This composite action is no longer maintained by the Core Services team. Use at your own risk. If your team still relies on this action, you may request CODEOWNER status for this directory to maintain it. +Known Consumers - Audited Sept 2026 + +* [player-ingestion](https://github.com/OpenSesame/player-ingestion) +* [player-infrastructure](https://github.com/OpenSesame/player-infrastructure) +* [player-xapi-statement-router](https://github.com/OpenSesame/player-xapi-statement-router) + ### Overview The tf-plan composite action initializes, validates and plans terraform resources whilst selecting the desired workspace.