From b93d84b93c202fb221b2d0f7bd76164285f8e1ee Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 20 Oct 2026 16:07:29 +0200 Subject: [PATCH 1/7] maven plugin version upgrades --- .github/workflows/build.yml | 6 +++--- pom.xml | 20 ++++++++++---------- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 39fa386f5..bc37fca18 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -58,7 +58,7 @@ jobs: queries: security-extended, security-and-quality - name: Minimal Maven Build if: ${{ matrix.language == 'java-kotlin' }} - run: mvn package $MVN_BATCH_MODE_FAIL_AT_END $MVN_SKIP_MOST -DskipTests + run: mvn package $MVN_BATCH_MODE_FAIL_AT_END $MVN_SKIP_MOST -DskipTests -DskipITs - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: @@ -81,7 +81,7 @@ jobs: java-version: 25 cache: 'maven' - name: Minimal Maven Build - run: mvn install $MVN_BATCH_MODE_FAIL_AT_END $MVN_SKIP_MOST -DskipTests -DbuildNumber=${GITHUB_SHA} -DscmBranch=${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} + run: mvn install $MVN_BATCH_MODE_FAIL_AT_END $MVN_SKIP_MOST -DskipTests -DskipITs -DbuildNumber=${GITHUB_SHA} -DscmBranch=${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} - name: Upload quick-build results uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: @@ -305,7 +305,7 @@ jobs: gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} gpg-passphrase: MAVEN_GPG_PASSPHRASE - name: Deploy to Maven Central - run: mvn deploy -Dimpsort.skip=true -Dformatter.skip=true -Dlicense.skip=true -DskipTests -Ppublish-to-maven-central -Dmaven.buildNumber.skip=true -DbuildNumber=${GITHUB_SHA} -DscmBranch=${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} + run: mvn deploy -Dimpsort.skip=true -Dformatter.skip=true -Dlicense.skip=true -DskipTests -DskipITs -Ppublish-to-maven-central -Dmaven.buildNumber.skip=true -DbuildNumber=${GITHUB_SHA} -DscmBranch=${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} env: MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }} diff --git a/pom.xml b/pom.xml index 82dd0a9e7..b9c311080 100755 --- a/pom.xml +++ b/pom.xml @@ -503,7 +503,7 @@ org.apache.maven.plugins maven-compiler-plugin - 3.15.0 + 3.16.0 org.apache.maven.plugins @@ -535,12 +535,12 @@ org.apache.maven.plugins maven-surefire-plugin - 3.5.6 + 3.6.0 org.apache.maven.plugins maven-failsafe-plugin - 3.5.6 + 3.6.0 org.apache.maven.plugins @@ -575,12 +575,12 @@ org.codehaus.mojo buildnumber-maven-plugin - 3.3.0 + 3.3.1 org.apache.maven.plugins maven-plugin-plugin - 3.15.2 + 3.16.0 org.apache.maven.plugins @@ -595,7 +595,7 @@ com.github.spotbugs spotbugs-maven-plugin - 4.10.3.0 + 4.10.5.0 org.apache.maven.plugins @@ -610,17 +610,17 @@ org.sonatype.central central-publishing-maven-plugin - 0.11.0 + 0.12.0 org.apache.maven.plugins maven-plugin-report-plugin - 3.15.2 + 3.16.0 com.mycila license-maven-plugin - 5.1.1 + 5.1.2 org.apache.maven.plugins @@ -1088,7 +1088,7 @@ - 3.6.3 + 3.8.9 From 666020d9bd54357759c6974decbbe66032816299 Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 20 Oct 2026 17:25:10 +0200 Subject: [PATCH 2/7] keycloak version upgrade --- dsf-docker-dev-setup-3dic-ttp/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml b/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml index 6f52011f0..566758226 100644 --- a/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml +++ b/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml @@ -98,7 +98,7 @@ services: read_only: true keycloak: - image: quay.io/keycloak/keycloak:26.7 + image: quay.io/keycloak/keycloak:26.8 restart: "no" ports: - 127.0.0.1:8443:8443 From 74221328faf0592d431b213b9cd7612d534d0a1c Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 20 Oct 2026 17:25:33 +0200 Subject: [PATCH 3/7] forward-proxy alpine base image version upgrade --- dsf-docker-dev-setup-3dic-ttp/forward-proxy/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dsf-docker-dev-setup-3dic-ttp/forward-proxy/Dockerfile b/dsf-docker-dev-setup-3dic-ttp/forward-proxy/Dockerfile index 70d7a3c25..2349786fa 100644 --- a/dsf-docker-dev-setup-3dic-ttp/forward-proxy/Dockerfile +++ b/dsf-docker-dev-setup-3dic-ttp/forward-proxy/Dockerfile @@ -14,7 +14,7 @@ # limitations under the License. # -FROM alpine:3.22 +FROM alpine:3.24 RUN apk add --no-cache tinyproxy COPY tinyproxy.conf /etc/tinyproxy/tinyproxy.conf CMD ["tinyproxy", "-d"] \ No newline at end of file From bfcdbfc07910c517f6ecc4590472f230776865a0 Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 20 Oct 2026 17:31:54 +0200 Subject: [PATCH 4/7] docker base image upgrades --- dsf-bpe/dsf-bpe-server-jetty/docker/Dockerfile | 4 ++-- dsf-docker/bpe_proxy/Dockerfile | 2 +- dsf-docker/fhir_proxy/Dockerfile | 2 +- dsf-fhir/dsf-fhir-server-jetty/docker/Dockerfile | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dsf-bpe/dsf-bpe-server-jetty/docker/Dockerfile b/dsf-bpe/dsf-bpe-server-jetty/docker/Dockerfile index fc0d51a23..6c2fc3280 100755 --- a/dsf-bpe/dsf-bpe-server-jetty/docker/Dockerfile +++ b/dsf-bpe/dsf-bpe-server-jetty/docker/Dockerfile @@ -14,7 +14,7 @@ # limitations under the License. # -FROM docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd AS builder +FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS builder WORKDIR /opt/bpe COPY --chown=root:2202 ./ ./ RUN chown root:2202 ./ && \ @@ -23,7 +23,7 @@ RUN chown root:2202 ./ && \ chmod 1775 ./log -FROM docker.io/azul/zulu-openjdk:25-jre-headless@sha256:44df5eb4a2055e85fff47cb5c6bd4edca4045210a1b05beecd8114822e2f2cdd +FROM docker.io/azul/zulu-openjdk:25-jre-headless@sha256:c9a6fbc5152d0cbf14bc729caaec6e3168493f598c1e2b8b95b648d6a7cf225e LABEL org.opencontainers.image.source=https://github.com/datasharingframework/dsf LABEL org.opencontainers.image.description="DSF BPE Server" LABEL org.opencontainers.image.licenses="Apache License, Version 2.0" diff --git a/dsf-docker/bpe_proxy/Dockerfile b/dsf-docker/bpe_proxy/Dockerfile index 557f326f8..096c6bad2 100644 --- a/dsf-docker/bpe_proxy/Dockerfile +++ b/dsf-docker/bpe_proxy/Dockerfile @@ -14,7 +14,7 @@ # limitations under the License. # -FROM docker.io/library/httpd:2.4-alpine@sha256:1b766f17b84026429b7cb243317b142921b24432336e798bc881c43f45ed9567 +FROM docker.io/library/httpd:2.4-alpine@sha256:3440c39d8d6f54fa9ad2549e5a60c19ddd435faadc29c1ad28aa795f71888889 LABEL org.opencontainers.image.source=https://github.com/datasharingframework/dsf LABEL org.opencontainers.image.description="DSF BPE Reverse Proxy" LABEL org.opencontainers.image.licenses="Apache License, Version 2.0" diff --git a/dsf-docker/fhir_proxy/Dockerfile b/dsf-docker/fhir_proxy/Dockerfile index 750e9f816..c1020132a 100755 --- a/dsf-docker/fhir_proxy/Dockerfile +++ b/dsf-docker/fhir_proxy/Dockerfile @@ -14,7 +14,7 @@ # limitations under the License. # -FROM docker.io/library/httpd:2.4-alpine@sha256:1b766f17b84026429b7cb243317b142921b24432336e798bc881c43f45ed9567 +FROM docker.io/library/httpd:2.4-alpine@sha256:3440c39d8d6f54fa9ad2549e5a60c19ddd435faadc29c1ad28aa795f71888889 LABEL org.opencontainers.image.source=https://github.com/datasharingframework/dsf LABEL org.opencontainers.image.description="DSF FHIR Reverse Proxy" LABEL org.opencontainers.image.licenses="Apache License, Version 2.0" diff --git a/dsf-fhir/dsf-fhir-server-jetty/docker/Dockerfile b/dsf-fhir/dsf-fhir-server-jetty/docker/Dockerfile index 576b73e4d..2d15fb68e 100755 --- a/dsf-fhir/dsf-fhir-server-jetty/docker/Dockerfile +++ b/dsf-fhir/dsf-fhir-server-jetty/docker/Dockerfile @@ -14,7 +14,7 @@ # limitations under the License. # -FROM docker.io/library/debian:trixie-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd AS builder +FROM docker.io/library/debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS builder WORKDIR /opt/fhir COPY --chown=root:2101 ./ ./ RUN chown root:2101 ./ && \ @@ -23,7 +23,7 @@ RUN chown root:2101 ./ && \ chmod 1775 ./log -FROM docker.io/azul/zulu-openjdk:25-jre-headless@sha256:44df5eb4a2055e85fff47cb5c6bd4edca4045210a1b05beecd8114822e2f2cdd +FROM docker.io/azul/zulu-openjdk:25-jre-headless@sha256:c9a6fbc5152d0cbf14bc729caaec6e3168493f598c1e2b8b95b648d6a7cf225e LABEL org.opencontainers.image.source=https://github.com/datasharingframework/dsf LABEL org.opencontainers.image.description="DSF FHIR Server" LABEL org.opencontainers.image.licenses="Apache License, Version 2.0" From 78a6d4ced76b2c5fede638c31a209090e90e181c Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 20 Oct 2026 22:35:40 +0200 Subject: [PATCH 5/7] manual trusted reverse proxy config Added a manual (non default) trusted reverse proxy config because the reverse proxy has two IP addresses for every fhir and bpe server (frontend and internet networks) and reverse DNS does not return both addresses. --- dsf-docker-dev-setup-3dic-ttp/docker-compose.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml b/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml index 566758226..e08a8bb91 100644 --- a/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml +++ b/dsf-docker-dev-setup-3dic-ttp/docker-compose.yml @@ -212,6 +212,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dic1-fhir DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_dic1_fhir.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.2 networks: dic1-fhir-frontend: ipv4_address: 172.20.0.3 @@ -293,6 +294,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dic2-fhir DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_dic2_fhir.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.18 networks: dic2-fhir-frontend: ipv4_address: 172.20.0.19 @@ -372,6 +374,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dic3-fhir DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_dic3_fhir.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.34 networks: dic3-fhir-frontend: ipv4_address: 172.20.0.35 @@ -459,6 +462,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: ttp-fhir DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_ttp_fhir.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.50 networks: ttp-fhir-frontend: ipv4_address: 172.20.0.51 @@ -547,6 +551,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dic1-bpe DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_dic1_bpe.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.66 DEV_DSF_PROXY_URL: http://forward-proxy:8080 DEV_DSF_PROXY_USERNAME: proxy_user DEV_DSF_PROXY_PASSWORD: proxy_password @@ -667,6 +672,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dic2-bpe DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_dic2_bpe.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.82 networks: dic2-bpe-frontend: ipv4_address: 172.20.0.83 @@ -756,6 +762,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dic3-bpe DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_dic3_bpe.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.98 networks: dic3-bpe-frontend: ipv4_address: 172.20.0.99 @@ -846,6 +853,7 @@ services: DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/root_ca.crt DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: ttp-bpe DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_ttp_bpe.secret + DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY: 172.20.0.114 networks: ttp-bpe-frontend: ipv4_address: 172.20.0.115 From 5178dbbece3b164032ca029ac240da53b7ffa65f Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 20 Oct 2026 22:36:26 +0200 Subject: [PATCH 6/7] maven dependency version upgrades and jetty upgrade related code changes --- .../dev/dsf/common/auth/DsfLoginService.java | 2 +- .../common/auth/DsfOpenIdLoginService.java | 16 ++++-- pom.xml | 51 ++++++++++--------- 3 files changed, 42 insertions(+), 27 deletions(-) diff --git a/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfLoginService.java b/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfLoginService.java index c1156edb1..0aab10955 100644 --- a/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfLoginService.java +++ b/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfLoginService.java @@ -57,7 +57,7 @@ private UserIdentityImpl(Principal principal, Set roles) @Override public Subject getSubject() { - return null; + return new Subject(true, Set.of(principal), Set.of(), Set.of()); } @Override diff --git a/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java b/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java index eefb8625c..5a8087851 100644 --- a/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java +++ b/dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/auth/DsfOpenIdLoginService.java @@ -22,6 +22,7 @@ import org.eclipse.jetty.security.openid.OpenIdConfiguration; import org.eclipse.jetty.security.openid.OpenIdCredentials; import org.eclipse.jetty.security.openid.OpenIdLoginService; +import org.eclipse.jetty.security.openid.OpenIdUserPrincipal; import org.eclipse.jetty.server.Request; import org.eclipse.jetty.server.Session; import org.slf4j.Logger; @@ -54,16 +55,25 @@ public UserIdentity login(String identifier, Object credentials, Request request @Override public boolean validate(UserIdentity user) { - if (!(user.getUserPrincipal() instanceof PractitionerIdentity identity)) + if (!(user.getUserPrincipal() instanceof OpenIdUserPrincipal identity)) + { + logger.warn("Login principal not OpenId"); + return false; + } + + if (user.getSubject().getPrincipals(PractitionerIdentity.class).isEmpty()) + { + logger.warn("No practitioner identity principal"); return false; + } - if (identity.getCredentials().isEmpty()) + if (identity.getCredentials() == null) { logger.warn("No credentials"); return false; } - if (!identity.isNotExpired()) + if (identity.getCredentials().isExpired()) { logger.debug("ID Token has expired"); return false; diff --git a/pom.xml b/pom.xml index b9c311080..ac9480461 100755 --- a/pom.xml +++ b/pom.xml @@ -38,25 +38,25 @@ ${project.basedir} - 2.0.18 + 2.0.20 2.26.1 - 12.1.11 + 12.1.14 2.2.2 - 7.0.8 - - 2.21.5 - 2.1.3 + 7.0.9 + + 2.21.8 + 2.1.5 5.1.0 8.4.2 6.5.27 8.4.2 - 1.85 + 1.86 3.8.0 5.2.1 6.2.0 3.1.12 - 4.0.2 - 4.0.2 + 4.0.3 + 4.0.3 3.1.0 4.0.0 4.0.0 @@ -165,7 +165,7 @@ org.mockito mockito-core - 5.23.0 + 5.24.0 org.bouncycastle @@ -197,7 +197,7 @@ org.postgresql postgresql - 42.7.13 + 42.7.14 org.checkerframework @@ -207,7 +207,7 @@ com.github.ben-manes.caffeine caffeine - 3.2.4 + 3.3.1 @@ -219,7 +219,7 @@ com.auth0 java-jwt - 4.6.0 + 4.6.2 @@ -389,7 +389,7 @@ org.apache.commons commons-lang3 - 3.20.0 + 3.21.0 org.apache.httpcomponents @@ -404,7 +404,7 @@ com.google.guava guava - 33.6.0-jre + 33.7.2-jre com.google.code.gson @@ -419,13 +419,18 @@ com.nimbusds nimbus-jose-jwt - 10.9.1 + 10.10 org.fhir ucum 1.0.10 + + org.apache.thrift + libthrift + 0.25.0 + commons-io @@ -435,7 +440,7 @@ commons-codec commons-codec - 1.22.0 + 1.23.0 @@ -457,7 +462,7 @@ org.yaml snakeyaml - 2.6 + 2.7 @@ -469,30 +474,30 @@ org.ow2.asm asm - 9.10.1 + 9.11.1 org.apache.tika tika-core - 3.3.2 + 3.3.3 org.apache.maven maven-core - 3.9.16 + 3.10.0 org.apache.maven maven-plugin-api - 3.9.16 + 3.10.0 org.apache.maven.plugin-tools maven-plugin-annotations - 3.15.2 + 3.16.0 From 3e6d93c055640a1009f03758c3f2e33d65088ddb Mon Sep 17 00:00:00 2001 From: Hauke Hund Date: Tue, 20 Oct 2026 22:54:29 +0200 Subject: [PATCH 7/7] actions version upgrades --- .github/workflows/build.yml | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index bc37fca18..d65e3d319 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -45,13 +45,13 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 25 if: ${{ matrix.language == 'java-kotlin' }} - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: 'zulu' java-version: 25 cache: 'maven' - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -60,7 +60,7 @@ jobs: if: ${{ matrix.language == 'java-kotlin' }} run: mvn package $MVN_BATCH_MODE_FAIL_AT_END $MVN_SKIP_MOST -DskipTests -DskipITs - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:${{matrix.language}}" @@ -75,7 +75,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up JDK 25 - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: 'zulu' java-version: 25 @@ -83,7 +83,7 @@ jobs: - name: Minimal Maven Build run: mvn install $MVN_BATCH_MODE_FAIL_AT_END $MVN_SKIP_MOST -DskipTests -DskipITs -DbuildNumber=${GITHUB_SHA} -DscmBranch=${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}} - name: Upload quick-build results - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: quick_build path: | @@ -144,12 +144,12 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download quick-build results - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: quick_build path: ./ - name: Set up JDK 25 - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: 'zulu' java-version: 25 @@ -180,12 +180,12 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download quick-build results - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: quick_build path: ./ - name: Set up Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Build Docker image run: docker build -t ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}:${{ github.sha }} ${{ matrix.image.context }} - name: Scan Docker image with Trivy @@ -196,7 +196,7 @@ jobs: output: 'trivy-results-${{ matrix.image.name }}.sarif' trivyignores: './.trivyignore' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 if: always() with: sarif_file: 'trivy-results-${{ matrix.image.name }}.sarif' @@ -227,16 +227,16 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download quick-build results - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: quick_build path: ./ - name: Set up QEMU - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 + uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - name: Set up Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: Login to GitHub Container Registry - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} @@ -257,7 +257,7 @@ jobs: # latest only for stable releases # develop builds - name: Build and Push - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 + uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 id: push with: push: true @@ -269,7 +269,7 @@ jobs: - name: Export digest run: echo "DIGEST=${{ steps.push.outputs.digest }}" >> $GITHUB_ENV - name: Set up syft - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 - name: Generate SBOM run: syft ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}@${DIGEST} -o cyclonedx-json > sbom.json - name: Set up cosign @@ -289,12 +289,12 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Download quick-build results - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: quick_build path: ./ - name: Set up JDK 25 - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0 + uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0 with: distribution: 'zulu' java-version: 25