Merge Master to Main #2934

TayGov · 2025-08-22T14:42:25Z

Description

This PR includes the following proposed change(s):

Merge Master Branch to Main

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Refactoring / Documentation
Version change

if your change is a breaking change, please add breaking change label to this PR

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Does the change impact or break the Docker build?

Yes
No

If Yes: Has Docker been updated accordingly?

Yes
No

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my own code
I have made corresponding changes to the documentation
New and existing unit tests pass locally with my changes

Artifactory

…bom/org.springframework-spring-web-6.0.23

…/efiling-bom/org.springframework-spring-web-6.0.23 Bump org.springframework:spring-web from 6.0.19 to 6.0.23 in /src/backend/libs/efiling-bom

fix frontend vulnerabilities

fix frontend vulnerability

…ng-demo/semver-5.7.2

…ng-frontend/semver-5.7.2

…end/efiling-demo/semver-5.7.2 Bump semver from 5.7.1 to 5.7.2 in /src/frontend/efiling-demo

…ng-frontend/semver-5.7.2

…end/efiling-frontend/semver-5.7.2 Bump semver from 5.7.1 to 5.7.2 in /src/frontend/efiling-frontend

Feature/fla 1576 vulnerabilities

Update dev-efiling-api-build.yaml

React Shared Components

.github/workflows/build-and-test-apps.yml

Version update 2.0.11

Move to SNAPSHOT

November Vulnerabilities.

Update Tomcat

Update code-climate-coverage-aggregation.yml

.github/workflows/build-and-test-apps.yml

+    env:
+      FILE_COUNTER: 0
+      ACTION_DEBUG: true
+
+    name: Build and Test React Apps
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Printing node and yarn versions
+        run: node --version && yarn --version
+      # Figure out where yarn is caching things
+      - name: Yarn Cache
+        run: yarn cache dir
+
+      # Run Yarn Install - eFiling Frontend
+      - name: Run Yarn Install - eFiling Frontend
+        run: yarn --cwd src/frontend/efiling-frontend install
+
+      # Check lint version
+      - name: Check lint - eFiling Frontend
+        run: yarn --cwd src/frontend/efiling-frontend run lint -v
+
+      # Run lint - eFiling Frontend
+      - name: Run lint - eFiling Frontend
+        run: yarn --cwd src/frontend/efiling-frontend run lint
+
+      # Yarn Coverage - eFiling Frontend
+      - name: Run Yarn Coverage - eFiling Frontend
+        run: yarn --cwd /home/runner/work/jag-file-submission/jag-file-submission/src/frontend/efiling-frontend coverage
+
+      # Run Yarn Install - eFiling Demo
+      - name: Run Yarn Install - eFiling Demo
+        run: yarn --cwd src/frontend/efiling-demo install
+
+      # Run lint - eFiling Demo
+      - name: Run lint - eFiling Demo
+        run: yarn --cwd src/frontend/efiling-demo run lint
+
+      # Yarn Coverage - eFiling Demo
+      - name: Run Yarn Coverage - eFiling Demo
+        run: yarn --cwd /home/runner/work/jag-file-submission/jag-file-submission/src/frontend/efiling-demo coverage
+
+      # Formatting the FRONTEND DEMO coverage report
+      #- name: Format the FRONTEND DEMO coverage report
+      #  run: |          
+      #    pushd .
+      #    cd ${{github.workspace}}/src/frontend/efiling-demo/
+      #    ${{github.workspace}}/cc-test-reporter format-coverage -t lcov -o ${{github.workspace}}/coverage/frontend-demo-codeclimate.json coverage/lcov.info
+      #    popd
+      # Implement Caching Action for Yarn Project
+      - name: Cache node modules
+        uses: actions/cache@v4
+        env:
+          cache-name: cache-node-modules
+        with:
+          # YARN cache files are stored in `/home/runner/.cache/yarn/v6` on git actions
+          path: /home/runner/.cache/yarn/v6
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+
+
+
+
+  spring-boot:


To address this issue, we need to explicitly set a permissions key at the top level of the workflow file .github/workflows/build-and-test-apps.yml. This key should grant only the minimum necessary access for the jobs in the workflow. Since all current jobs merely build, test, and cache artifacts but do not perform any write operations (e.g., creating releases, commenting, or pushing code), we can safely set contents: read globally. This should be inserted before the jobs: section, right after the name: and on: keys (typically after line 7 or 8 in the current file). No additional methods, imports, or definitions are required.

.github/workflows/build-and-test-apps.yml

+    name: Build and Test Java
+    runs-on: ubuntu-latest
+    env:
+      FILE_COUNTER: 0
+      ACTION_DEBUG: true
+
+    steps:
+      - name: Checkout Spring Starters Repository
+        uses: actions/checkout@v4
+        with:
+          repository: bcgov/spring-boot-starters
+          path: spring-boot-starters
+          ref: v1.0.5
+
+      # Setup Java Environment
+      - name: Set up JDK 17
+        uses: actions/setup-java@v1
+        with:
+          java-version: 17
+
+      # TODO REMOVE AFTER SFTP IS IN MAVEN CENTRAL
+      - name: Build Spring Starters
+        run: mvn install -P all --file ./spring-boot-starters/src/pom.xml
+
+      - name: Checkout File Submission Repository
+        uses: actions/checkout@v2
+
+
+      # Trimming the ref to master in order to publish correct report (paambaati)
+      - name: Set ref/head/master to master
+        run: |
+          echo "GIT_BRANCH=master" >> $GITHUB_ENV
+          #echo "::set-env name=GIT_BRANCH::master"
+        if: env.GIT_BRANCH == 'refs/heads/master'
+
+      #- uses: actions/cache@v1
+      #  with:
+      #    path: ~/.m2/repository
+      #    key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+      #    restore-keys: |
+      #      ${{ runner.os }}-maven-
+
+      #Set env again??
+      - name: Set up JDK 17
+        uses: actions/setup-java@v1
+        with:
+          java-version: 17
+
+     # Run Maven Verify to generate all jacoco reports        
+      - name: Build with Maven
+        run: mvn -B verify -P all --file src/backend/pom.xml


To address the issue, add a permissions block setting the minimal necessary permissions to either the workflow root or to each individual job (if jobs have different needs). In this workflow, the jobs only check out code, install dependencies, build, and test; they do not require write access to any GitHub objects, so contents: read is sufficient. Insert the following under the workflow name (line 1) to apply to all jobs:

permissions: contents: read

This ensures the workflow token only has read access to repository contents. No actions in the current jobs require additional write access. Edit .github/workflows/build-and-test-apps.yml as described.

Update zap-baseline.yaml

jjstratton and others added 30 commits October 18, 2024 11:39

updated pipeline

08654ca

Update dev-efiling-admin-build-4.yml

2f947f2

Update dev-efiling-admin-build-4.yml

8cac89e

Update dev-efiling-frontend-build-4.yaml

a1143ff

added back in profiles

15f9fdd

updated

bd789b8

Merge remote-tracking branch 'origin/master' into artifactory

3491012

Merge pull request #2850 from bcgov/artifactory

175371f

Artifactory

updated

c22ad7d

updated tag

a71799d

updated pat

d06a721

Merge branch 'master' into dependabot/maven/src/backend/libs/efiling-…

4cebb7e

…bom/org.springframework-spring-web-6.0.23

Merge pull request #2831 from bcgov/dependabot/maven/src/backend/libs…

5481767

…/efiling-bom/org.springframework-spring-web-6.0.23 Bump org.springframework:spring-web from 6.0.19 to 6.0.23 in /src/backend/libs/efiling-bom

fix frontend vulnerabilities

d043cad

Merge pull request #2856 from bcgov/feature/FLA-1576-vulnerabilities

a62ea9d

fix frontend vulnerabilities

fix frontend vulnerability

fb88582

Merge pull request #2857 from bcgov/feature/FLA-1576-vulnerabilities

9cfc48d

fix frontend vulnerability

Merge branch 'master' into dependabot/npm_and_yarn/src/frontend/efili…

adbbdb9

…ng-demo/semver-5.7.2

Merge branch 'master' into dependabot/npm_and_yarn/src/frontend/efili…

d03df1f

…ng-frontend/semver-5.7.2

Merge pull request #2700 from bcgov/dependabot/npm_and_yarn/src/front…

bde38f9

…end/efiling-demo/semver-5.7.2 Bump semver from 5.7.1 to 5.7.2 in /src/frontend/efiling-demo

Merge branch 'master' into dependabot/npm_and_yarn/src/frontend/efili…

732b40a

…ng-frontend/semver-5.7.2

Merge pull request #2701 from bcgov/dependabot/npm_and_yarn/src/front…

e0d4182

…end/efiling-frontend/semver-5.7.2 Bump semver from 5.7.1 to 5.7.2 in /src/frontend/efiling-frontend

update shared-components and spring-boot-starters

27915b6

update shared-components and spring-boot-starters

55febdf

fix spring-boot-starters version in gitaction

652bd5d

fix spring-boot-starters version in gitaction

17a9d19

fix spring-boot-starters version in gitaction

7383d2c

Merge pull request #2860 from bcgov/feature/FLA-1576-vulnerabilities

2033cb8

Feature/fla 1576 vulnerabilities

Update dev-efiling-api-build.yaml

0031265

Merge pull request #2861 from bcgov/TayGov-patch-1

48f021e

Update dev-efiling-api-build.yaml

TayGov and others added 2 commits September 3, 2025 09:17

Remove code climate

bd56295

Merge pull request #2945 from bcgov/feature/vulnerability-updates-25

23a12da

React Shared Components

TayGov temporarily deployed to github-pages September 3, 2025 16:28 — with GitHub Pages Inactive

github-advanced-security bot found potential problems Sep 3, 2025

View reviewed changes

.github/workflows/build-and-test-apps.yml Fixed Show fixed Hide fixed

TayGov and others added 3 commits September 5, 2025 10:09

Version update

393c432

Merge branch 'master' into feature/vulnerability-updates-25

6438088

Merge pull request #2946 from bcgov/feature/vulnerability-updates-25

7fb673c

Version update 2.0.11

TayGov temporarily deployed to github-pages September 9, 2025 15:54 — with GitHub Pages Inactive

TayGov and others added 2 commits September 23, 2025 08:21

Move to SNAPSHOT

957b101

Merge pull request #2950 from bcgov/feature/2.0.12-SNAPSHOT

fad76ad

Move to SNAPSHOT

TayGov temporarily deployed to github-pages September 23, 2025 16:33 — with GitHub Pages Inactive

TayGov and others added 3 commits November 10, 2025 07:16

axios

6a48384

API Updates

50d8e3f

Merge pull request #2959 from bcgov/feature/vuln-nov-updates

4e98277

November Vulnerabilities.

TayGov temporarily deployed to github-pages November 10, 2025 21:05 — with GitHub Pages Inactive

TayGov and others added 3 commits November 12, 2025 08:24

Tomcat

1d29a02

Merge branch 'master' into feature/vuln-nov-updates

e70893c

Merge pull request #2961 from bcgov/feature/vuln-nov-updates

e60b2cd

Update Tomcat

TayGov temporarily deployed to github-pages November 12, 2025 17:04 — with GitHub Pages Inactive

TayGov added 2 commits November 12, 2025 09:37

Update code-climate-coverage-aggregation.yml

3ae166c

Update zap-baseline.yaml

d325095

jjstratton previously approved these changes Nov 12, 2025

View reviewed changes

TayGov and others added 2 commits November 12, 2025 10:00

Update file name to be appropriate

d3a23f4

Merge pull request #2964 from bcgov/TayGov-patch-1

e137636

Update code-climate-coverage-aggregation.yml

TayGov dismissed jjstratton’s stale review via e137636 November 12, 2025 18:22

TayGov temporarily deployed to github-pages November 12, 2025 18:22 — with GitHub Pages Inactive

github-advanced-security bot found potential problems Nov 12, 2025

View reviewed changes

TayGov added 2 commits November 12, 2025 13:08

Merge branch 'master' into TayGov-patch-2

649918d

Merge pull request #2965 from bcgov/TayGov-patch-2

e9f26af

Update zap-baseline.yaml

TayGov deployed to github-pages November 13, 2025 15:59 — with GitHub Pages View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Merge Master to Main #2934

Merge Master to Main #2934

Uh oh!

TayGov commented Aug 22, 2025

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

@@ -6,6 +6,9 @@
               pull_request:
                 branches: [master]
+            permissions:
+              contents: read
             jobs:
               yarn:
                 env:

Merge Master to Main #2934

Are you sure you want to change the base?

Merge Master to Main #2934

Uh oh!

Conversation

TayGov commented Aug 22, 2025

Description

Type of change

How Has This Been Tested?

Does the change impact or break the Docker build?

Checklist:

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants