diff --git a/.circleci/config.yml b/.circleci/config.yml index 2fff094c41..15d9f4dac4 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -146,12 +146,6 @@ jobs: command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:3.1.0 . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] #;> TOOL_DCLINT - #;< CI_GITLEAKS - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - #;> CI_GITLEAKS - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -166,10 +160,6 @@ jobs: docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" #;> TOOL_ESLINT_STYLELINT - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -218,6 +208,34 @@ jobs: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] #;> DRUPAL_THEME + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + #;< CI_GITLEAKS + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + #;> CI_GITLEAKS + + #;< VORTEX_DEV + #; Vortex does not track 'composer.lock', so resolve dependencies to give + #; the audit below something to read. Nothing is installed, so the runner + #; does not need to provide the platform extensions Drupal requires. + - run: + name: Create Composer lock file + command: composer update --no-install --no-audit --ignore-platform-reqs + #;> VORTEX_DEV + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + #;< !PROVISION_TYPE_PROFILE # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump @@ -719,6 +737,15 @@ workflows: #============================================================================= #;> VORTEX_DEV + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + #;< !PROVISION_TYPE_PROFILE # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml new file mode 100644 index 0000000000..e9e4347a1f --- /dev/null +++ b/.github/workflows/audit.yml @@ -0,0 +1,106 @@ +# GitHub Actions configuration file. +# +# Security checks run in their own workflow so that a failing audit is +# distinguishable from a failing linter and can be re-run on its own. +#; +#; Comments starting with '#;<' and '#;>' are internal Vortex comments +#; and will be removed during installation or update of Vortex. +name: Security audit + +on: + push: + # Pushes to the following branches will trigger the workflow. + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - project/** + #;< VORTEX_DEV + - '*.x' + #;> VORTEX_DEV + # Pushes of tags will also trigger the workflow. + tags: + - '*' + # Pull requests to the following branches will trigger the workflow. + pull_request: + types: + - opened + - synchronize + - reopened + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - feature/** + - bugfix/** + - project/** + #;< VORTEX_DEV + - '*.x' + #;> VORTEX_DEV + + workflow_dispatch: + +defaults: + run: + shell: bash + +# Workaround for the Actions runner creating /root/.docker/config.json +# with permissions that prevent the container from reading it. +# https://github.com/actions/runner/issues/863 +env: + DOCKER_CONFIG: /tmp/.docker + +permissions: + contents: read + +jobs: + + audit: + runs-on: ubuntu-latest + + container: + # https://hub.docker.com/r/drevops/ci-runner + image: drevops/ci-runner:26.7.0@sha256:6f917acfc2903e77e1bd9a2a32f3633ff49538553474fe43df3033352e0059b0 + env: + TZ: ${{ vars.TZ || 'UTC' }} + TERM: xterm-256color + VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} + + steps: + - name: Preserve $HOME set in the container + run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 + + - name: Check out code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Fix Git ownership permissions + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" + + #;< CI_GITLEAKS + - name: Scan for committed secrets with Gitleaks + run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner + continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + #;> CI_GITLEAKS + + #;< VORTEX_DEV + #; Vortex does not track 'composer.lock', so resolve dependencies to give + #; the audit below something to read. Nothing is installed, so the runner + #; does not need to provide the platform extensions Drupal requires. + - name: Create Composer lock file + run: composer update --no-install --no-audit --ignore-platform-reqs + #;> VORTEX_DEV + + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml index a95629078b..d19da02e2c 100644 --- a/.github/workflows/build-test-deploy.yml +++ b/.github/workflows/build-test-deploy.yml @@ -141,12 +141,6 @@ jobs: continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} #;> TOOL_DCLINT - #;< CI_GITLEAKS - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} - #;> CI_GITLEAKS - - name: Build stack run: docker compose up --no-deps --detach cli @@ -159,10 +153,6 @@ jobs: docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" #;> TOOL_ESLINT_STYLELINT - - name: Audit Composer packages - run: docker compose exec -T cli composer audit - continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} - - name: Validate Composer configuration is normalized run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} diff --git a/.vortex/docs/content/_code-lifecycle.mdx b/.vortex/docs/content/_code-lifecycle.mdx index 79b6ad29fd..4d6fb37210 100644 --- a/.vortex/docs/content/_code-lifecycle.mdx +++ b/.vortex/docs/content/_code-lifecycle.mdx @@ -25,25 +25,25 @@ │ │ ▼ │ │ exists? │ │ │ │ Composer validate │ │ │ No │ │ │ │ ▼ │ │ ▼ │ │ -│ │ Composer audit │ │ Download ──► Sanitize ──► Store database │ │ +│ │ Composer normalize │ │ Download ──► Sanitize ──► Store database │ │ │ │ ▼ │ │ production database cache │ │ -│ │ Composer normalize │ │ database Remove │ │ +│ │ Hadolint │ │ database Remove │ │ │ │ ▼ │ │ sensitive data │ │ -│ │ Hadolint │ │ │ │ +│ │ DCLint │ │ │ │ │ │ ▼ │ └───────────────────────────┬─────────────────────────────┘ │ -│ │ DCLint │ │ │ +│ │ PHPCS │ │ │ │ │ ▼ │ ▼ │ -│ │ PHPCS │ ┌─ Build Job ────────────────────────────────────────────┐ │ +│ │ PHPStan │ ┌─ Build Job ────────────────────────────────────────────┐ │ │ │ ▼ │ │ │ │ -│ │ PHPStan │ │ Code assembly │ │ +│ │ Rector │ │ Code assembly │ │ │ │ ▼ │ │ Build Docker ──► Composer deps ──► NPM deps ──► Assets│ │ -│ │ Rector │ │ │ │ │ +│ │ Twig CS Fixer │ │ │ │ │ │ │ ▼ │ │ ▼ │ │ -│ │ Twig CS Fixer │ │ Website setup │ │ +│ │ Gherkin Lint │ │ Website setup │ │ │ │ ▼ │ │ Import cached DB ──► drush deploy ──► Custom scripts │ │ -│ │ Gherkin Lint │ │ │ │ │ -│ │ ▼ │ │ ▼ │ │ -│ │ ESLint / Stylelint │ │ Testing │ │ +│ │ ESLint / Stylelint │ │ │ │ │ +│ │ │ │ ▼ │ │ +│ │ │ │ Testing │ │ │ │ │ │ PHPUnit tests ──► Behat tests │ │ │ │ │ │ │ │ │ │ │ └────────────────────────────┬───────────────────────────┘ │ @@ -74,4 +74,13 @@ ═════════════════════════════════════════════════════════════════════════════════════════ ┊ PR Environment ┊ Dev Staging Production ┊ (auto-removed) ┊ develop branch main branch production branch or tag + + + Security Audit Workflow + ═════════════════════════════════════════════════════════════════════════════════════════ + Push, pull request or manual run ──► Gitleaks secret scan ──► Composer advisory audit + (committed secrets) (composer audit --locked) + + Runs as its own workflow, independently of the pipeline above, and does not gate + deployment. ``` diff --git a/.vortex/docs/content/continuous-integration/README.mdx b/.vortex/docs/content/continuous-integration/README.mdx index ad8f832f99..d9cb74a46e 100644 --- a/.vortex/docs/content/continuous-integration/README.mdx +++ b/.vortex/docs/content/continuous-integration/README.mdx @@ -31,7 +31,7 @@ import CodeLifecycle from '../_code-lifecycle.mdx'; - Lints Dockerfiles and Docker Compose files - Installs development dependencies - Runs all code linters: PHPCS, PHPStan, Rector, Twig CS Fixer, Gherkin Lint, ESLint, Stylelint -- Audits and normalizes Composer packages +- Checks that Composer configuration is normalized ### 2. Database @@ -57,6 +57,28 @@ import CodeLifecycle from '../_code-lifecycle.mdx'; - Adds required secrets and environment variables - Triggers a deployment using a router script +## Security audit + +Security checks run in their own workflow, separate from the pipeline above, so that a failing audit is never confused with a failing linter and can be re-run on its own: + +| Provider | Location | +|----------|----------| +| GitHub Actions | The `Security audit` workflow in `.github/workflows/audit.yml` | +| CircleCI | The `audit` workflow in `.circleci/config.yml` | + +The workflow runs the same two checks in both providers, and needs neither the application containers nor installed dependencies: + +- [Gitleaks](/docs/tools/gitleaks) scans the codebase for committed secrets +- `composer audit --locked` checks the packages pinned in `composer.lock` against published security advisories + +It is triggered by the same pushes, pull requests and tags as the main pipeline, and can also be started on demand - in GitHub Actions from **Actions → Security audit → Run workflow**, and in CircleCI by re-running the `audit` workflow from the pipeline view. + +:::note + +Because the audit is a separate workflow, it is not a dependency of the `deploy` job - a failing audit does not by itself stop a deployment. To block merges and deployments on it, add its check to the repository's branch protection rules as a required status check. + +::: + ## Caching strategy Database is fetched overnight and cached so that the next continuous integration run on the same diff --git a/.vortex/docs/content/continuous-integration/circleci.mdx b/.vortex/docs/content/continuous-integration/circleci.mdx index b68bdef1a8..852809ee69 100644 --- a/.vortex/docs/content/continuous-integration/circleci.mdx +++ b/.vortex/docs/content/continuous-integration/circleci.mdx @@ -27,7 +27,7 @@ in the Installation guide and select **CircleCI**. ### Update deployment branches -All CI jobs (`database`, `lint`, `build`) run on every branch. The `deploy` job +All jobs in the `commit` and `audit` workflows (`database`, `lint`, `build`, `audit`) run on every branch. The `deploy` job only runs for specific branch patterns, controlled by a regex filter in the `workflows` section of `.circleci/config.yml`: diff --git a/.vortex/docs/content/continuous-integration/github-actions.mdx b/.vortex/docs/content/continuous-integration/github-actions.mdx index 951a65a62a..14095e1a9d 100644 --- a/.vortex/docs/content/continuous-integration/github-actions.mdx +++ b/.vortex/docs/content/continuous-integration/github-actions.mdx @@ -57,6 +57,15 @@ pull requests, not on direct pushes. To add or remove branches, update the `push` and `pull_request` sections in the workflow file. +### Security audit workflow + +Security checks live in a second workflow, `.github/workflows/audit.yml`, which +triggers on the same branches and tags as the main workflow and can also be +started on demand from **Actions → Security audit → Run workflow**. + +See [Security audit](/docs/continuous-integration#security-audit) for what it +runs and how to make it block merges and deployments. + ### Update nightly database schedule The nightly database job caches a fresh database dump for faster builds the next diff --git a/.vortex/docs/content/development/composer.mdx b/.vortex/docs/content/development/composer.mdx index 2f68eb8071..1c2d0b3d1d 100644 --- a/.vortex/docs/content/development/composer.mdx +++ b/.vortex/docs/content/development/composer.mdx @@ -387,7 +387,7 @@ Each section accepts `block` (refuse affected versions during `composer update`/ ### Why advisories do not block installation -Coupling installation to advisory publication makes builds non-deterministic: a newly published advisory against an already-installed dependency can fail every build - including work unrelated to security - until the advisory is assessed and ignored. **Vortex** decouples the two by setting `advisories.block` to `false` while keeping `advisories.audit` at `fail`, so installs and updates remain reproducible while vulnerabilities are still surfaced by `composer audit` and the CI lint job. +Coupling installation to advisory publication makes builds non-deterministic: a newly published advisory against an already-installed dependency can fail every build - including work unrelated to security - until the advisory is assessed and ignored. **Vortex** decouples the two by setting `advisories.block` to `false` while keeping `advisories.audit` at `fail`, so installs and updates remain reproducible while vulnerabilities are still surfaced by `composer audit` and the CI security audit workflow. If your project requires installation to hard-stop on advisories - for example, a production site with strict supply-chain controls - set `advisories.block` to `true`. @@ -451,6 +451,6 @@ Check your dependencies for security issues manually: ### CI/CD integration -**Vortex** runs `composer audit` as part of the CI lint job. Because `advisories.audit` is `fail`, the audit reports vulnerabilities and the lint job fails when any are found - even though installs and updates are not blocked. +**Vortex** runs `composer audit --locked` in the [security audit workflow](/docs/continuous-integration#security-audit), so the audited set is exactly what `composer.lock` pins. Because `advisories.audit` is `fail`, the audit reports vulnerabilities and the workflow fails when any are found - even though installs and updates are not blocked. -By default that failure gates the build. Set the repository variable `VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE` to `1` to make the audit step run and report without failing the build - useful as a one-off bypass while a known advisory is being addressed. +That failure is reported by the audit workflow, which runs independently of the build. Set the repository variable `VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE` to `1` to make the audit step run and report without failing that workflow - useful as a one-off bypass while a known advisory is being addressed. diff --git a/.vortex/docs/content/development/faqs.mdx b/.vortex/docs/content/development/faqs.mdx index d462c750f5..318fd7cd8e 100644 --- a/.vortex/docs/content/development/faqs.mdx +++ b/.vortex/docs/content/development/faqs.mdx @@ -258,7 +258,7 @@ Provided that your stack is already running: ## What should I do when `composer audit` reports a security vulnerability? -**Vortex** does not block installation on security advisories by default, so `composer install` and `composer update` keep working. Advisories are surfaced by `composer audit`, which runs locally and in the CI lint job. When one appears: +**Vortex** does not block installation on security advisories by default, so `composer install` and `composer update` keep working. Advisories are surfaced by `composer audit`, which runs locally and in the CI security audit workflow. When one appears: 1. **Update the affected package**: try a newer version that resolves the advisory: `composer update vendor/package-name`. 2. **Review the advisory**: run `composer audit` for details and assess whether it affects your project. diff --git a/.vortex/docs/content/tools/gitleaks.mdx b/.vortex/docs/content/tools/gitleaks.mdx index 5b71dccbb0..dc9fe5b369 100644 --- a/.vortex/docs/content/tools/gitleaks.mdx +++ b/.vortex/docs/content/tools/gitleaks.mdx @@ -8,7 +8,7 @@ https://github.com/gitleaks/gitleaks **Vortex** does not install Gitleaks locally. Please follow the [instructions](https://github.com/gitleaks/gitleaks#installing) to install it on your system. -In CI, Gitleaks runs from its official Docker image as part of the lint job. +In CI, Gitleaks runs from its official Docker image as part of the [security audit workflow](/docs/continuous-integration#security-audit). ::: diff --git a/.vortex/installer/src/Prompts/Handlers/CiProvider.php b/.vortex/installer/src/Prompts/Handlers/CiProvider.php index 09244f097d..e7019191de 100644 --- a/.vortex/installer/src/Prompts/Handlers/CiProvider.php +++ b/.vortex/installer/src/Prompts/Handlers/CiProvider.php @@ -97,6 +97,7 @@ public function process(): void { if ($remove_gha) { File::remove($t . '/.github/workflows/build-test-deploy.yml'); + File::remove($t . '/.github/workflows/audit.yml'); File::remove($t . '/' . $this->webroot . '/sites/default/includes/providers/settings.gha.php'); File::removeTokenAsync('CI_PROVIDER_GHA'); File::removeTokenAsync('SETTINGS_PROVIDER_GHA'); diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/audit.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/audit.yml new file mode 100644 index 0000000000..cf70c3d21c --- /dev/null +++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/audit.yml @@ -0,0 +1,87 @@ +# GitHub Actions configuration file. +# +# Security checks run in their own workflow so that a failing audit is +# distinguishable from a failing linter and can be re-run on its own. +name: Security audit + +on: + push: + # Pushes to the following branches will trigger the workflow. + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - project/** + # Pushes of tags will also trigger the workflow. + tags: + - '*' + # Pull requests to the following branches will trigger the workflow. + pull_request: + types: + - opened + - synchronize + - reopened + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - feature/** + - bugfix/** + - project/** + + workflow_dispatch: + +defaults: + run: + shell: bash + +# Workaround for the Actions runner creating /root/.docker/config.json +# with permissions that prevent the container from reading it. +# https://github.com/actions/runner/issues/863 +env: + DOCKER_CONFIG: /tmp/.docker + +permissions: + contents: read + +jobs: + + audit: + runs-on: ubuntu-latest + + container: + # https://hub.docker.com/r/drevops/ci-runner + image: drevops/ci-runner:__VERSION__ + env: + TZ: ${{ vars.TZ || 'UTC' }} + TERM: xterm-256color + VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} + + steps: + - name: Preserve $HOME set in the container + run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 + + - name: Check out code + uses: actions/checkout@__HASH__ # __VERSION__ + with: + persist-credentials: false + + - name: Fix Git ownership permissions + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" + + - name: Scan for committed secrets with Gitleaks + run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner + continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml index f5454f03d1..d875d3d199 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml @@ -124,10 +124,6 @@ jobs: run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} - - name: Build stack run: docker compose up --no-deps --detach cli @@ -138,10 +134,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit - continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} - - name: Validate Composer configuration is normalized run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml index 7fff3cf778..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -575,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml index ff97474925..0252669c11 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -457,6 +457,17 @@ +@@ -449,6 +449,17 @@ hide_and_recreate: true diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml index 8d3c7eb2f4..a5e1dd0fca 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -583,6 +592,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_provider_other/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/code_provider_other/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml index 2cd33340fb..2dd0a9d967 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -260,6 +260,9 @@ +@@ -252,6 +252,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml index 7fff3cf778..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -575,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml index f436e4c9cf..bbbb6ec682 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -478,6 +487,15 @@ workflows: tags: only: /.*/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml index 61c2e71005..db25c62ac6 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -536,104 +536,3 @@ +@@ -528,104 +528,3 @@ timeout-minutes: 120 # Cancel the action after 120 minutes, regardless of whether a connection has been established. with: detached: true diff --git a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml index 7fff3cf778..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -575,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/audit.yml b/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/audit.yml new file mode 100644 index 0000000000..b61649beda --- /dev/null +++ b/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/audit.yml @@ -0,0 +1,11 @@ +@@ -78,10 +78,6 @@ + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" + +- - name: Scan for committed secrets with Gitleaks +- run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner +- continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} +- + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml deleted file mode 100644 index 4b35f94471..0000000000 --- a/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml +++ /dev/null @@ -1,11 +0,0 @@ -@@ -124,10 +124,6 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - -- - name: Scan for committed secrets with Gitleaks -- run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner -- continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} -- - - name: Build stack - run: docker compose up --no-deps --detach cli - diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml index 2cd33340fb..2dd0a9d967 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -260,6 +260,9 @@ +@@ -252,6 +252,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml index 2cd33340fb..2dd0a9d967 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -260,6 +260,9 @@ +@@ -252,6 +252,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml index 7fff3cf778..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -575,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml index e1446bb5ef..cd0dc0b743 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -585,6 +594,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml index c436c70567..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml index 7a4c83d436..b815dc72a9 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -467,18 +467,6 @@ +@@ -459,18 +459,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml index 7a4c83d436..b815dc72a9 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -467,18 +467,6 @@ +@@ -459,18 +459,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml index 7a4c83d436..b815dc72a9 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -467,18 +467,6 @@ +@@ -459,18 +459,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml index 48c1b1f727..c47c08b4f4 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml @@ -15,7 +15,7 @@ container: # https://hub.docker.com/r/drevops/ci-runner -@@ -175,118 +172,8 @@ +@@ -167,118 +164,8 @@ run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -134,7 +134,7 @@ permissions: contents: read -@@ -312,14 +199,6 @@ +@@ -304,14 +191,6 @@ VORTEX_SSH_DISABLE_STRICT_HOST_KEY_CHECKING: "1" VORTEX_SSH_REMOVE_ALL_KEYS: "1" VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} @@ -149,7 +149,7 @@ steps: - name: Preserve $HOME set in the container -@@ -346,29 +225,6 @@ +@@ -338,29 +217,6 @@ - name: Install Vortex tooling run: ./scripts/vortex-tooling.sh @@ -179,7 +179,7 @@ - name: Login to container registry run: ./vendor/bin/vortex-login-container-registry -@@ -540,7 +396,6 @@ +@@ -532,7 +388,6 @@ deploy: runs-on: ubuntu-latest needs: [build, lint] diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml index 715a8ebaa2..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -10,7 +10,7 @@ database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml index 715a8ebaa2..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -10,7 +10,7 @@ database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml index 715a8ebaa2..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -10,7 +10,7 @@ database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml index 7fff3cf778..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -575,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml index bc4e2f6633..96c349475a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -146,18 +146,6 @@ +@@ -138,18 +138,6 @@ run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml index ffb059d6b5..d056922b5f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -173,6 +165,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -563,6 +572,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml index 9233df65c1..c2ca74c745 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -162,10 +162,6 @@ +@@ -154,10 +154,6 @@ run: docker compose exec -T cli vendor/bin/twig-cs-fixer continue-on-error: ${{ vars.VORTEX_CI_TWIG_CS_FIXER_IGNORE_FAILURE == '1' }} @@ -9,7 +9,7 @@ - name: Lint module code with NodeJS linters run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} -@@ -407,66 +403,6 @@ +@@ -399,66 +395,6 @@ run: docker compose exec -T cli bash -c "yarn test" continue-on-error: ${{ vars.VORTEX_CI_JEST_IGNORE_FAILURE == '1' }} @@ -76,7 +76,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -479,20 +415,6 @@ +@@ -471,20 +407,6 @@ fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} @@ -97,7 +97,7 @@ - name: Process test logs and artifacts if: always() run: | -@@ -509,16 +431,6 @@ +@@ -501,16 +423,6 @@ path: .logs include-hidden-files: true if-no-files-found: error diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml index fdaceb83ab..bd6d49a852 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -521,6 +530,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml index 4fd36a3294..bf27379bd1 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -166,10 +165,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -158,10 +157,6 @@ run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} @@ -17,7 +17,7 @@ - name: Lint theme code with NodeJS linters if: ${{ vars.VORTEX_FRONTEND_BUILD_SKIP != '1' }} run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" -@@ -388,7 +383,6 @@ +@@ -380,7 +375,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -25,7 +25,7 @@ - name: Provision site run: | -@@ -401,11 +395,6 @@ +@@ -393,11 +387,6 @@ fi docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml index 3d13c4463e..2f39f3f500 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -146,10 +142,6 @@ jobs: if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -180,6 +172,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -565,6 +574,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml index f14717877e..e09c708962 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -166,15 +165,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -158,15 +157,6 @@ run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} @@ -22,7 +22,7 @@ database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -388,7 +378,6 @@ +@@ -380,7 +370,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -30,7 +30,7 @@ - name: Provision site run: | -@@ -402,11 +391,6 @@ +@@ -394,11 +383,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 @@ -42,7 +42,7 @@ - name: Test with PHPUnit if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: docker compose exec -T cli vendor/bin/phpunit -@@ -466,18 +450,6 @@ +@@ -458,18 +442,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml index cbe6701add..8651ac3435 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -146,10 +142,6 @@ jobs: if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -174,6 +166,23 @@ jobs: name: Lint code with Gherkin Lint command: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features || [ "${VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -547,6 +556,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml index 0f9d6f7891..507938be10 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -162,10 +162,6 @@ +@@ -154,10 +154,6 @@ run: docker compose exec -T cli vendor/bin/twig-cs-fixer continue-on-error: ${{ vars.VORTEX_CI_TWIG_CS_FIXER_IGNORE_FAILURE == '1' }} @@ -9,7 +9,7 @@ - name: Lint module code with NodeJS linters run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} -@@ -478,20 +474,6 @@ +@@ -470,20 +466,6 @@ exit 1 fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml index 6ee138d5eb..3ea99bfcfb 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -561,6 +570,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml index 3f38dfc155..a5c5132ec2 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml @@ -6,6 +6,6 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + - name: Build stack + run: docker compose up --no-deps --detach cli + diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml index 0fa9e2c824..42fc8602e4 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml @@ -127,10 +127,6 @@ jobs: echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ] done - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -143,10 +139,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -571,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml index 8aa65eaaa3..38abd55e52 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml @@ -13,6 +13,6 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + - name: Build stack + run: docker compose up --no-deps --detach cli + diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml index 22bf52eda0..8d314cfe3f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml @@ -120,10 +120,6 @@ jobs: name: Login to container registry command: ./vendor/bin/vortex-login-container-registry - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -136,10 +132,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -174,6 +166,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -564,6 +573,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml index bd33bf97aa..dfa9b37800 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -165,10 +164,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -157,10 +156,6 @@ - name: Lint code with Gherkin Lint run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml index 865c9bc80e..e56e5e7e92 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -146,10 +142,6 @@ jobs: if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -180,6 +172,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -570,6 +579,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml index 1faa945c4d..121be3d419 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -166,15 +165,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -158,15 +157,6 @@ run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} @@ -22,7 +22,7 @@ database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +456,6 @@ +@@ -458,18 +448,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml index 9aac1e50f7..58f544d582 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml @@ -124,10 +124,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -140,10 +136,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -178,6 +170,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -568,6 +577,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml index 1c1d706278..ff261ccb0d 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -388,7 +388,6 @@ +@@ -380,7 +380,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -6,7 +6,7 @@ - name: Provision site run: | -@@ -401,11 +400,6 @@ +@@ -393,11 +392,6 @@ fi docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml index 19b98e17b9..9bb4c72557 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -570,6 +579,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml index 794b707082..b6ca4aef6b 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -146,10 +146,6 @@ +@@ -138,10 +138,6 @@ run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml index 444d786e5c..13fcd63fa7 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -571,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml index 7cd6231224..11d8ae51eb 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -150,10 +150,6 @@ +@@ -142,10 +142,6 @@ run: docker compose exec -T cli vendor/bin/phpcs continue-on-error: ${{ vars.VORTEX_CI_PHPCS_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml index aae1f0f229..37096d90be 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -571,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml index ce5895f612..f1513693dd 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -407,66 +407,6 @@ +@@ -399,66 +399,6 @@ run: docker compose exec -T cli bash -c "yarn test" continue-on-error: ${{ vars.VORTEX_CI_JEST_IGNORE_FAILURE == '1' }} @@ -65,7 +65,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -509,16 +449,6 @@ +@@ -501,16 +441,6 @@ path: .logs include-hidden-files: true if-no-files-found: error diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml index 10c3346062..7061984551 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -535,6 +544,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml index 134731c275..dc3c9f074e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -154,10 +154,6 @@ +@@ -146,10 +146,6 @@ run: docker compose exec -T cli vendor/bin/phpstan continue-on-error: ${{ vars.VORTEX_CI_PHPSTAN_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml index 30d70baf22..af309a5903 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -571,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml index 7fff3cf778..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -575,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml index 715a8ebaa2..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -10,7 +10,7 @@ database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml index 9576f1ff6f..d0b0b38e1f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -158,10 +158,6 @@ +@@ -150,10 +150,6 @@ run: docker compose exec -T cli vendor/bin/rector --dry-run continue-on-error: ${{ vars.VORTEX_CI_RECTOR_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml index 7632f0608c..5cca5bc539 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Audit job runs in its own workflow, independently of the commit workflow. + audit: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -571,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml index e096e00b73..ff12849029 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml @@ -13,18 +13,16 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} -@@ -136,7 +125,6 @@ + - name: Build stack + run: docker compose up --no-deps --detach cli + +@@ -132,36 +121,11 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -146,30 +134,6 @@ + - name: Validate Composer configuration is normalized run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} @@ -55,7 +53,7 @@ - name: Lint theme code with NodeJS linters if: ${{ vars.VORTEX_FRONTEND_BUILD_SKIP != '1' }} run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" -@@ -388,7 +352,6 @@ +@@ -380,7 +344,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -63,7 +61,7 @@ - name: Provision site run: | -@@ -402,71 +365,6 @@ +@@ -394,71 +357,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 @@ -135,7 +133,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -479,20 +377,6 @@ +@@ -471,20 +369,6 @@ fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} @@ -156,7 +154,7 @@ - name: Process test logs and artifacts if: always() run: | -@@ -509,16 +393,6 @@ +@@ -501,16 +385,6 @@ path: .logs include-hidden-files: true if-no-files-found: error