From b5f622a3e80554db5f033608b7d8a379be36a39e Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 06:57:25 +1000 Subject: [PATCH 1/8] [#2885] Moved security checks into a dedicated CI job. --- .circleci/config.yml | 43 ++++++++++---- .github/workflows/build-test-deploy.yml | 58 +++++++++++++++---- .vortex/docs/content/_code-lifecycle.mdx | 38 ++++++------ .../content/continuous-integration/README.mdx | 21 ++++--- .../continuous-integration/circleci.mdx | 2 +- .vortex/docs/content/development/composer.mdx | 4 +- .vortex/docs/content/development/faqs.mdx | 2 +- .vortex/docs/content/tools/gitleaks.mdx | 2 +- 8 files changed, 118 insertions(+), 52 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 2fff094c41..700b6afe6b 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -146,12 +146,6 @@ jobs: command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:3.1.0 . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] #;> TOOL_DCLINT - #;< CI_GITLEAKS - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - #;> CI_GITLEAKS - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -166,10 +160,6 @@ jobs: docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" #;> TOOL_ESLINT_STYLELINT - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -218,6 +208,33 @@ jobs: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] #;> DRUPAL_THEME + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + #;< CI_GITLEAKS + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + #;> CI_GITLEAKS + + #;< VORTEX_DEV + #; Vortex does not track 'composer.lock', so the audit below has nothing to + #; read until the dependencies are resolved. + - run: + name: Create Composer lock file + command: composer update --no-install --no-audit + #;> VORTEX_DEV + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + #;< !PROVISION_TYPE_PROFILE # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump @@ -659,6 +676,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: #;< !PROVISION_TYPE_PROFILE requires: @@ -672,6 +693,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -691,6 +713,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml index a95629078b..8fa0d4bc2d 100644 --- a/.github/workflows/build-test-deploy.yml +++ b/.github/workflows/build-test-deploy.yml @@ -141,12 +141,6 @@ jobs: continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} #;> TOOL_DCLINT - #;< CI_GITLEAKS - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} - #;> CI_GITLEAKS - - name: Build stack run: docker compose up --no-deps --detach cli @@ -159,10 +153,6 @@ jobs: docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" #;> TOOL_ESLINT_STYLELINT - - name: Audit Composer packages - run: docker compose exec -T cli composer audit - continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} - - name: Validate Composer configuration is normalized run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} @@ -210,6 +200,52 @@ jobs: continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} #;> DRUPAL_THEME + security: + runs-on: ubuntu-latest + #;< !PROVISION_TYPE_PROFILE + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} + #;> !PROVISION_TYPE_PROFILE + + container: + # https://hub.docker.com/r/drevops/ci-runner + image: drevops/ci-runner:26.7.0@sha256:6f917acfc2903e77e1bd9a2a32f3633ff49538553474fe43df3033352e0059b0 + env: + TZ: ${{ vars.TZ || 'UTC' }} + TERM: xterm-256color + VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} + + steps: + - name: Preserve $HOME set in the container + run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 + + - name: Check out code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Fix Git ownership permissions + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" + + #;< CI_GITLEAKS + - name: Scan for committed secrets with Gitleaks + run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner + continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + #;> CI_GITLEAKS + + #;< VORTEX_DEV + #; Vortex does not track 'composer.lock', so the audit below has nothing to + #; read until the dependencies are resolved. + - name: Create Composer lock file + run: composer update --no-install --no-audit + #;> VORTEX_DEV + + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} + #;< !PROVISION_TYPE_PROFILE database: runs-on: ubuntu-latest @@ -627,7 +663,7 @@ jobs: #;< DEPLOYMENT deploy: runs-on: ubuntu-latest - needs: [build, lint] + needs: [build, lint, security] #;< !PROVISION_TYPE_PROFILE if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} #;> !PROVISION_TYPE_PROFILE diff --git a/.vortex/docs/content/_code-lifecycle.mdx b/.vortex/docs/content/_code-lifecycle.mdx index 79b6ad29fd..68198ee061 100644 --- a/.vortex/docs/content/_code-lifecycle.mdx +++ b/.vortex/docs/content/_code-lifecycle.mdx @@ -25,33 +25,33 @@ │ │ ▼ │ │ exists? │ │ │ │ Composer validate │ │ │ No │ │ │ │ ▼ │ │ ▼ │ │ -│ │ Composer audit │ │ Download ──► Sanitize ──► Store database │ │ +│ │ Composer normalize │ │ Download ──► Sanitize ──► Store database │ │ │ │ ▼ │ │ production database cache │ │ -│ │ Composer normalize │ │ database Remove │ │ +│ │ Hadolint │ │ database Remove │ │ │ │ ▼ │ │ sensitive data │ │ -│ │ Hadolint │ │ │ │ +│ │ DCLint │ │ │ │ │ │ ▼ │ └───────────────────────────┬─────────────────────────────┘ │ -│ │ DCLint │ │ │ +│ │ PHPCS │ │ │ │ │ ▼ │ ▼ │ -│ │ PHPCS │ ┌─ Build Job ────────────────────────────────────────────┐ │ +│ │ PHPStan │ ┌─ Build Job ────────────────────────────────────────────┐ │ │ │ ▼ │ │ │ │ -│ │ PHPStan │ │ Code assembly │ │ +│ │ Rector │ │ Code assembly │ │ │ │ ▼ │ │ Build Docker ──► Composer deps ──► NPM deps ──► Assets│ │ -│ │ Rector │ │ │ │ │ +│ │ Twig CS Fixer │ │ │ │ │ │ │ ▼ │ │ ▼ │ │ -│ │ Twig CS Fixer │ │ Website setup │ │ +│ │ Gherkin Lint │ │ Website setup │ │ │ │ ▼ │ │ Import cached DB ──► drush deploy ──► Custom scripts │ │ -│ │ Gherkin Lint │ │ │ │ │ -│ │ ▼ │ │ ▼ │ │ -│ │ ESLint / Stylelint │ │ Testing │ │ -│ │ │ │ PHPUnit tests ──► Behat tests │ │ -│ │ │ │ │ │ -│ │ │ └────────────────────────────┬───────────────────────────┘ │ -│ └──────────┬────────────┘ │ │ -│ │ │ │ -│ │ │ │ -│ │ │ │ -│ ▼ ▼ │ +│ │ ESLint / Stylelint │ │ │ │ │ +│ └─┬─────────────────────┘ │ ▼ │ │ +│ │ ┌─ Security Job ───┐ │ Testing │ │ +│ │ │ Gitleaks │ │ PHPUnit tests ──► Behat tests │ │ +│ │ │ ▼ │ │ │ │ +│ │ │ Composer audit │ └────────────────────────────┬───────────────────────────┘ │ +│ │ └────────┬─────────┘ │ │ +│ │ │ │ │ +│ └─────┬─────┘ │ │ +│ │ │ │ +│ ▼ ▼ │ │ ┌─ Deployment Job ─────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Webhook Artifact Lagoon Docker │ │ diff --git a/.vortex/docs/content/continuous-integration/README.mdx b/.vortex/docs/content/continuous-integration/README.mdx index ad8f832f99..2bce940628 100644 --- a/.vortex/docs/content/continuous-integration/README.mdx +++ b/.vortex/docs/content/continuous-integration/README.mdx @@ -31,14 +31,21 @@ import CodeLifecycle from '../_code-lifecycle.mdx'; - Lints Dockerfiles and Docker Compose files - Installs development dependencies - Runs all code linters: PHPCS, PHPStan, Rector, Twig CS Fixer, Gherkin Lint, ESLint, Stylelint -- Audits and normalizes Composer packages +- Checks that Composer configuration is normalized -### 2. Database +### 2. Security + +- Runs in parallel with other jobs (no dependencies) +- Needs no containers and no installed dependencies +- Scans the codebase for committed secrets with Gitleaks +- Audits the locked Composer packages against known security advisories + +### 3. Database - Fetches the latest DB version based on a caching strategy - Caches database dumps to speed up the follow-up runs -### 3. Build +### 4. Build - Runs after the `database` job - Uses Docker Compose to set up the full environment @@ -50,9 +57,9 @@ import CodeLifecycle from '../_code-lifecycle.mdx'; - Runs BDD tests (distributed across all instances) - Collects and stores test results and artifacts -### 4. Deployment +### 5. Deployment -- Runs after successful completion of both `build` and `lint` jobs +- Runs after successful completion of the `build`, `lint` and `security` jobs - Uses the built codebase without development dependencies from the `build` step - Adds required secrets and environment variables - Triggers a deployment using a router script @@ -122,8 +129,8 @@ The build job runs across multiple parallel containers (2 by default) to speed up test execution. Since each container runs the full build and provision steps, the test workload is distributed to make the best use of each container. -Code linting runs in a separate `lint` job and is not affected by test -parallelism settings. +Code linting and security checks run in the separate `lint` and `security` jobs +and are not affected by test parallelism settings. ### What runs where diff --git a/.vortex/docs/content/continuous-integration/circleci.mdx b/.vortex/docs/content/continuous-integration/circleci.mdx index b68bdef1a8..0fc9012f9c 100644 --- a/.vortex/docs/content/continuous-integration/circleci.mdx +++ b/.vortex/docs/content/continuous-integration/circleci.mdx @@ -27,7 +27,7 @@ in the Installation guide and select **CircleCI**. ### Update deployment branches -All CI jobs (`database`, `lint`, `build`) run on every branch. The `deploy` job +All CI jobs (`database`, `lint`, `security`, `build`) run on every branch. The `deploy` job only runs for specific branch patterns, controlled by a regex filter in the `workflows` section of `.circleci/config.yml`: diff --git a/.vortex/docs/content/development/composer.mdx b/.vortex/docs/content/development/composer.mdx index 2f68eb8071..f40e855401 100644 --- a/.vortex/docs/content/development/composer.mdx +++ b/.vortex/docs/content/development/composer.mdx @@ -387,7 +387,7 @@ Each section accepts `block` (refuse affected versions during `composer update`/ ### Why advisories do not block installation -Coupling installation to advisory publication makes builds non-deterministic: a newly published advisory against an already-installed dependency can fail every build - including work unrelated to security - until the advisory is assessed and ignored. **Vortex** decouples the two by setting `advisories.block` to `false` while keeping `advisories.audit` at `fail`, so installs and updates remain reproducible while vulnerabilities are still surfaced by `composer audit` and the CI lint job. +Coupling installation to advisory publication makes builds non-deterministic: a newly published advisory against an already-installed dependency can fail every build - including work unrelated to security - until the advisory is assessed and ignored. **Vortex** decouples the two by setting `advisories.block` to `false` while keeping `advisories.audit` at `fail`, so installs and updates remain reproducible while vulnerabilities are still surfaced by `composer audit` and the CI security job. If your project requires installation to hard-stop on advisories - for example, a production site with strict supply-chain controls - set `advisories.block` to `true`. @@ -451,6 +451,6 @@ Check your dependencies for security issues manually: ### CI/CD integration -**Vortex** runs `composer audit` as part of the CI lint job. Because `advisories.audit` is `fail`, the audit reports vulnerabilities and the lint job fails when any are found - even though installs and updates are not blocked. +**Vortex** runs `composer audit --locked` as part of the CI security job, so the audited set is exactly what `composer.lock` pins. Because `advisories.audit` is `fail`, the audit reports vulnerabilities and the security job fails when any are found - even though installs and updates are not blocked. By default that failure gates the build. Set the repository variable `VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE` to `1` to make the audit step run and report without failing the build - useful as a one-off bypass while a known advisory is being addressed. diff --git a/.vortex/docs/content/development/faqs.mdx b/.vortex/docs/content/development/faqs.mdx index d462c750f5..73d398d432 100644 --- a/.vortex/docs/content/development/faqs.mdx +++ b/.vortex/docs/content/development/faqs.mdx @@ -258,7 +258,7 @@ Provided that your stack is already running: ## What should I do when `composer audit` reports a security vulnerability? -**Vortex** does not block installation on security advisories by default, so `composer install` and `composer update` keep working. Advisories are surfaced by `composer audit`, which runs locally and in the CI lint job. When one appears: +**Vortex** does not block installation on security advisories by default, so `composer install` and `composer update` keep working. Advisories are surfaced by `composer audit`, which runs locally and in the CI security job. When one appears: 1. **Update the affected package**: try a newer version that resolves the advisory: `composer update vendor/package-name`. 2. **Review the advisory**: run `composer audit` for details and assess whether it affects your project. diff --git a/.vortex/docs/content/tools/gitleaks.mdx b/.vortex/docs/content/tools/gitleaks.mdx index 5b71dccbb0..8265edb6c7 100644 --- a/.vortex/docs/content/tools/gitleaks.mdx +++ b/.vortex/docs/content/tools/gitleaks.mdx @@ -8,7 +8,7 @@ https://github.com/gitleaks/gitleaks **Vortex** does not install Gitleaks locally. Please follow the [instructions](https://github.com/gitleaks/gitleaks#installing) to install it on your system. -In CI, Gitleaks runs from its official Docker image as part of the lint job. +In CI, Gitleaks runs from its official Docker image as part of the security job. ::: From d90f2d43906a3ec63ff34ddfc1f6e3ae65796a98 Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 06:57:38 +1000 Subject: [PATCH 2/8] Updated snapshots. --- .../.github/workflows/build-test-deploy.yml | 45 +++++++++++++++---- .../ciprovider_circleci/.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.circleci/config.yml | 29 ++++++++---- .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 12 ++--- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 22 ++++++--- .../.github/workflows/build-test-deploy.yml | 8 ++-- .../.github/workflows/build-test-deploy.yml | 8 ++-- .../.github/workflows/build-test-deploy.yml | 8 ++-- .../timezone_circleci/.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 8 ++-- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 12 ++--- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 18 ++++---- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 6 +-- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 6 +-- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 8 ++-- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 14 +++--- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 8 ++-- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 31 +++++++++---- .../.github/workflows/build-test-deploy.yml | 20 ++++----- 63 files changed, 704 insertions(+), 313 deletions(-) diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml index f5454f03d1..132475e543 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml @@ -124,10 +124,6 @@ jobs: run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} - - name: Build stack run: docker compose up --no-deps --detach cli @@ -138,10 +134,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit - continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} - - name: Validate Composer configuration is normalized run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} @@ -175,6 +167,41 @@ jobs: run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} + security: + runs-on: ubuntu-latest + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} + + container: + # https://hub.docker.com/r/drevops/ci-runner + image: drevops/ci-runner:__VERSION__ + env: + TZ: ${{ vars.TZ || 'UTC' }} + TERM: xterm-256color + VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} + + steps: + - name: Preserve $HOME set in the container + run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 + + - name: Check out code + uses: actions/checkout@__HASH__ # __VERSION__ + with: + persist-credentials: false + + - name: Fix Git ownership permissions + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" + + - name: Scan for committed secrets with Gitleaks + run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner + continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} + database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} @@ -539,7 +566,7 @@ jobs: deploy: runs-on: ubuntu-latest - needs: [build, lint] + needs: [build, lint, security] if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} permissions: diff --git a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml index 7fff3cf778..d4eec64072 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -537,6 +546,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -547,6 +560,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -566,6 +580,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml index ff97474925..f9aee50630 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -457,6 +457,17 @@ +@@ -484,6 +484,17 @@ hide_and_recreate: true diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml index 8d3c7eb2f4..7d66857eea 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -545,6 +554,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -555,6 +568,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -574,6 +588,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml index 2cd33340fb..52760c4871 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -260,6 +260,9 @@ +@@ -287,6 +287,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml index 7fff3cf778..d4eec64072 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -537,6 +546,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -547,6 +560,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -566,6 +580,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml index f436e4c9cf..9afe729665 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -471,6 +480,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml index 61c2e71005..81986b4e60 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml @@ -1,11 +1,11 @@ -@@ -536,104 +536,3 @@ +@@ -563,104 +563,3 @@ timeout-minutes: 120 # Cancel the action after 120 minutes, regardless of whether a connection has been established. with: detached: true - - deploy: - runs-on: ubuntu-latest -- needs: [build, lint] +- needs: [build, lint, security] - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} - - permissions: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml index 7fff3cf778..d4eec64072 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -537,6 +546,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -547,6 +560,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -566,6 +580,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml index 4b35f94471..96cdcb8342 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml @@ -1,11 +1,11 @@ -@@ -124,10 +124,6 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} +@@ -194,10 +194,6 @@ + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} - - - name: Build stack - run: docker compose up --no-deps --detach cli - + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml index 2cd33340fb..52760c4871 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -260,6 +260,9 @@ +@@ -287,6 +287,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml index 2cd33340fb..52760c4871 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -260,6 +260,9 @@ +@@ -287,6 +287,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml index 7fff3cf778..d4eec64072 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -537,6 +546,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -547,6 +560,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -566,6 +580,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml index e1446bb5ef..d36284c2e4 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -547,6 +556,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -557,6 +570,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -576,6 +590,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml index c436c70567..a5a3c95f6e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -261,6 +261,9 @@ +@@ -288,6 +288,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -398,6 +401,11 @@ +@@ -425,6 +428,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml index 7a4c83d436..bfe261cf95 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -467,18 +467,6 @@ +@@ -494,18 +494,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml index 7a4c83d436..bfe261cf95 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -467,18 +467,6 @@ +@@ -494,18 +494,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml index 7a4c83d436..bfe261cf95 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -467,18 +467,6 @@ +@@ -494,18 +494,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml index 48c1b1f727..9fd501776f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml @@ -15,9 +15,17 @@ container: # https://hub.docker.com/r/drevops/ci-runner -@@ -175,118 +172,8 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} +@@ -169,7 +166,6 @@ + + security: + runs-on: ubuntu-latest +- if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} + + container: + # https://hub.docker.com/r/drevops/ci-runner +@@ -202,118 +198,8 @@ + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} - database: - runs-on: ubuntu-latest @@ -134,7 +142,7 @@ permissions: contents: read -@@ -312,14 +199,6 @@ +@@ -339,14 +225,6 @@ VORTEX_SSH_DISABLE_STRICT_HOST_KEY_CHECKING: "1" VORTEX_SSH_REMOVE_ALL_KEYS: "1" VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} @@ -149,7 +157,7 @@ steps: - name: Preserve $HOME set in the container -@@ -346,29 +225,6 @@ +@@ -373,29 +251,6 @@ - name: Install Vortex tooling run: ./scripts/vortex-tooling.sh @@ -179,10 +187,10 @@ - name: Login to container registry run: ./vendor/bin/vortex-login-container-registry -@@ -540,7 +396,6 @@ +@@ -567,7 +422,6 @@ deploy: runs-on: ubuntu-latest - needs: [build, lint] + needs: [build, lint, security] - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} permissions: diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml index 715a8ebaa2..592519a4ec 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - database: + security: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -493,18 +488,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml index 715a8ebaa2..592519a4ec 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - database: + security: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -493,18 +488,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml index 715a8ebaa2..592519a4ec 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - database: + security: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -493,18 +488,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml index 7fff3cf778..d4eec64072 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -537,6 +546,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -547,6 +560,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -566,6 +580,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml index bc4e2f6633..96c349475a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -146,18 +146,6 @@ +@@ -138,18 +138,6 @@ run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml index ffb059d6b5..876f0ce792 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -173,6 +165,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -525,6 +534,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -535,6 +548,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -554,6 +568,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml index 9233df65c1..06ea89cb07 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -162,10 +162,6 @@ +@@ -154,10 +154,6 @@ run: docker compose exec -T cli vendor/bin/twig-cs-fixer continue-on-error: ${{ vars.VORTEX_CI_TWIG_CS_FIXER_IGNORE_FAILURE == '1' }} @@ -9,7 +9,7 @@ - name: Lint module code with NodeJS linters run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} -@@ -407,66 +403,6 @@ +@@ -434,66 +430,6 @@ run: docker compose exec -T cli bash -c "yarn test" continue-on-error: ${{ vars.VORTEX_CI_JEST_IGNORE_FAILURE == '1' }} @@ -76,7 +76,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -479,20 +415,6 @@ +@@ -506,20 +442,6 @@ fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} @@ -97,7 +97,7 @@ - name: Process test logs and artifacts if: always() run: | -@@ -509,16 +431,6 @@ +@@ -536,16 +458,6 @@ path: .logs include-hidden-files: true if-no-files-found: error diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml index fdaceb83ab..6f3aa917fe 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -483,6 +492,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -493,6 +506,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -512,6 +526,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml index 4fd36a3294..ed62f4de2b 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -166,10 +165,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -158,10 +157,6 @@ run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} @@ -17,7 +17,7 @@ - name: Lint theme code with NodeJS linters if: ${{ vars.VORTEX_FRONTEND_BUILD_SKIP != '1' }} run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" -@@ -388,7 +383,6 @@ +@@ -415,7 +410,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -25,7 +25,7 @@ - name: Provision site run: | -@@ -401,11 +395,6 @@ +@@ -428,11 +422,6 @@ fi docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml index 3d13c4463e..a99d1622b2 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -146,10 +142,6 @@ jobs: if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -180,6 +172,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -527,6 +536,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -537,6 +550,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -556,6 +570,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml index f14717877e..0a6c5602ad 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -166,15 +165,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -158,15 +157,6 @@ run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} @@ -19,10 +19,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - database: + security: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -388,7 +378,6 @@ + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -415,7 +405,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -30,7 +30,7 @@ - name: Provision site run: | -@@ -402,11 +391,6 @@ +@@ -429,11 +418,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 @@ -42,7 +42,7 @@ - name: Test with PHPUnit if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: docker compose exec -T cli vendor/bin/phpunit -@@ -466,18 +450,6 @@ +@@ -493,18 +477,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml index cbe6701add..01fbeec259 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -146,10 +142,6 @@ jobs: if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -174,6 +166,23 @@ jobs: name: Lint code with Gherkin Lint command: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features || [ "${VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -509,6 +518,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -519,6 +532,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -538,6 +552,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml index 0f9d6f7891..3561b2e6b5 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -162,10 +162,6 @@ +@@ -154,10 +154,6 @@ run: docker compose exec -T cli vendor/bin/twig-cs-fixer continue-on-error: ${{ vars.VORTEX_CI_TWIG_CS_FIXER_IGNORE_FAILURE == '1' }} @@ -9,7 +9,7 @@ - name: Lint module code with NodeJS linters run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} -@@ -478,20 +474,6 @@ +@@ -505,20 +501,6 @@ exit 1 fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml index 6ee138d5eb..78e93e472a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -523,6 +532,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -533,6 +546,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -552,6 +566,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml index 3f38dfc155..a5c5132ec2 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint/.github/workflows/build-test-deploy.yml @@ -6,6 +6,6 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + - name: Build stack + run: docker compose up --no-deps --detach cli + diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml index 0fa9e2c824..8a00b7a998 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml @@ -127,10 +127,6 @@ jobs: echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint:__VERSION__ || [ "${VORTEX_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ] done - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -143,10 +139,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -533,6 +542,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -543,6 +556,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -562,6 +576,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml index 8aa65eaaa3..38abd55e52 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters/.github/workflows/build-test-deploy.yml @@ -13,6 +13,6 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + - name: Build stack + run: docker compose up --no-deps --detach cli + diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml index 22bf52eda0..edc9cd8573 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml @@ -120,10 +120,6 @@ jobs: name: Login to container registry command: ./vendor/bin/vortex-login-container-registry - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -136,10 +132,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -174,6 +166,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -526,6 +535,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -536,6 +549,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -555,6 +569,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml index bd33bf97aa..dfa9b37800 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -165,10 +164,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -157,10 +156,6 @@ - name: Lint code with Gherkin Lint run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml index 865c9bc80e..27edbcbe2a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -146,10 +142,6 @@ jobs: if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -180,6 +172,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -532,6 +541,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -542,6 +555,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -561,6 +575,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml index 1faa945c4d..8d86d31f75 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml @@ -1,12 +1,12 @@ -@@ -136,7 +136,6 @@ +@@ -132,7 +132,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -166,15 +165,6 @@ + - name: Validate Composer configuration is normalized + run: docker compose exec -T cli composer normalize --dry-run +@@ -158,15 +157,6 @@ run: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features continue-on-error: ${{ vars.VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE == '1' }} @@ -19,10 +19,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - database: + security: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +456,6 @@ + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -493,18 +483,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml index 9aac1e50f7..6d60a7efcf 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml @@ -124,10 +124,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -140,10 +136,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -178,6 +170,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -530,6 +539,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -540,6 +553,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -559,6 +573,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml index 1c1d706278..1e10fa800b 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -388,7 +388,6 @@ +@@ -415,7 +415,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -6,7 +6,7 @@ - name: Provision site run: | -@@ -401,11 +400,6 @@ +@@ -428,11 +427,6 @@ fi docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml index 19b98e17b9..2a7a81572f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -532,6 +541,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -542,6 +555,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -561,6 +575,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml index 794b707082..b6ca4aef6b 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -146,10 +146,6 @@ +@@ -138,10 +138,6 @@ run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml index 444d786e5c..337e43e0d3 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -533,6 +542,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -543,6 +556,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -562,6 +576,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml index 7cd6231224..11d8ae51eb 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -150,10 +150,6 @@ +@@ -142,10 +142,6 @@ run: docker compose exec -T cli vendor/bin/phpcs continue-on-error: ${{ vars.VORTEX_CI_PHPCS_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml index aae1f0f229..143778f54c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -533,6 +542,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -543,6 +556,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -562,6 +576,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml index ce5895f612..014ed56c5e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -407,66 +407,6 @@ +@@ -434,66 +434,6 @@ run: docker compose exec -T cli bash -c "yarn test" continue-on-error: ${{ vars.VORTEX_CI_JEST_IGNORE_FAILURE == '1' }} @@ -65,7 +65,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -509,16 +449,6 @@ +@@ -536,16 +476,6 @@ path: .logs include-hidden-files: true if-no-files-found: error diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml index 10c3346062..05ff76ed51 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -497,6 +506,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -507,6 +520,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -526,6 +540,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml index 134731c275..dc3c9f074e 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -154,10 +154,6 @@ +@@ -146,10 +146,6 @@ run: docker compose exec -T cli vendor/bin/phpstan continue-on-error: ${{ vars.VORTEX_CI_PHPSTAN_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml index 30d70baf22..ed6fae2658 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -533,6 +542,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -543,6 +556,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -562,6 +576,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml index 7fff3cf778..d4eec64072 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -185,6 +177,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -537,6 +546,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -547,6 +560,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -566,6 +580,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml index 715a8ebaa2..592519a4ec 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -170,11 +170,6 @@ +@@ -162,11 +162,6 @@ run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - database: + security: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -466,18 +461,6 @@ + if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -493,18 +488,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml index 9576f1ff6f..d0b0b38e1f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -158,10 +158,6 @@ +@@ -150,10 +150,6 @@ run: docker compose exec -T cli vendor/bin/rector --dry-run continue-on-error: ${{ vars.VORTEX_CI_RECTOR_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml index 7632f0608c..376c8ee3dd 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml @@ -131,10 +131,6 @@ jobs: name: Lint Docker Compose files with DCLint command: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . || [ "${VORTEX_CI_DCLINT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: - name: Scan for committed secrets with Gitleaks - command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Build stack command: docker compose up --no-deps --detach cli @@ -147,10 +143,6 @@ jobs: COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - run: - name: Audit Composer packages - command: docker compose exec -T cli composer audit || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] - - run: name: Validate Composer configuration is normalized command: docker compose exec -T cli composer normalize --dry-run || [ "${VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE:-0}" -eq 1 ] @@ -181,6 +173,23 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] + # Security job runs in parallel with lint, database and build jobs. + security: + <<: *runner_config + steps: + - checkout + - *load_variables_from_dotenv + + - *step_setup_remote_docker + + - run: + name: Scan for committed secrets with Gitleaks + command: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner || [ "${VORTEX_CI_GITLEAKS_IGNORE_FAILURE:-0}" -eq 1 ] + + - run: + name: Audit Composer packages + command: composer audit --locked || [ "${VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE:-0}" -eq 1 ] + # Database handling is a first step of the build. # - $VORTEX_CI_DB_CACHE_TIMESTAMP is used to determine if a fresh DB dump # should be fetched for the current build. Usually, a daily database dump @@ -533,6 +542,10 @@ workflows: filters: tags: only: /.*/ + - security: + filters: + tags: + only: /.*/ - build: requires: - database @@ -543,6 +556,7 @@ workflows: requires: - build - lint + - security filters: branches: # Allowed branches: @@ -562,6 +576,7 @@ workflows: requires: - build - lint + - security filters: branches: ignore: /.*/ diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml index e096e00b73..bb3ea913bb 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml @@ -13,18 +13,16 @@ - run: docker run --rm -v "${PWD}":/app zavoloklom/dclint:__VERSION__ . - continue-on-error: ${{ vars.VORTEX_CI_DCLINT_IGNORE_FAILURE == '1' }} - - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} -@@ -136,7 +125,6 @@ + - name: Build stack + run: docker compose up --no-deps --detach cli + +@@ -132,36 +121,11 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" - docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c "yarn install --frozen-lockfile" - - name: Audit Composer packages - run: docker compose exec -T cli composer audit -@@ -146,30 +134,6 @@ + - name: Validate Composer configuration is normalized run: docker compose exec -T cli composer normalize --dry-run continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_NORMALIZE_IGNORE_FAILURE == '1' }} @@ -55,7 +53,7 @@ - name: Lint theme code with NodeJS linters if: ${{ vars.VORTEX_FRONTEND_BUILD_SKIP != '1' }} run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" -@@ -388,7 +352,6 @@ +@@ -415,7 +379,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -63,7 +61,7 @@ - name: Provision site run: | -@@ -402,71 +365,6 @@ +@@ -429,71 +392,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 @@ -135,7 +133,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -479,20 +377,6 @@ +@@ -506,20 +404,6 @@ fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} @@ -156,7 +154,7 @@ - name: Process test logs and artifacts if: always() run: | -@@ -509,16 +393,6 @@ +@@ -536,16 +420,6 @@ path: .logs include-hidden-files: true if-no-files-found: error From 8e7566189c44f4a9f2bea6da552f60966b22ae44 Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 07:03:45 +1000 Subject: [PATCH 3/8] [#2885] Drew the security job as a sibling of the lint job in the pipeline diagram. --- .vortex/docs/content/_code-lifecycle.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.vortex/docs/content/_code-lifecycle.mdx b/.vortex/docs/content/_code-lifecycle.mdx index 68198ee061..8462556a96 100644 --- a/.vortex/docs/content/_code-lifecycle.mdx +++ b/.vortex/docs/content/_code-lifecycle.mdx @@ -43,14 +43,14 @@ │ │ ▼ │ │ Import cached DB ──► drush deploy ──► Custom scripts │ │ │ │ ESLint / Stylelint │ │ │ │ │ │ └─┬─────────────────────┘ │ ▼ │ │ -│ │ ┌─ Security Job ───┐ │ Testing │ │ -│ │ │ Gitleaks │ │ PHPUnit tests ──► Behat tests │ │ -│ │ │ ▼ │ │ │ │ -│ │ │ Composer audit │ └────────────────────────────┬───────────────────────────┘ │ +│ │ │ Testing │ │ +│ │ ┌─ Security Job ───┐ │ PHPUnit tests ──► Behat tests │ │ +│ │ │ Gitleaks │ │ │ │ +│ │ │ ▼ │ └────────────────────────────┬───────────────────────────┘ │ +│ │ │ Composer audit │ │ │ │ │ └────────┬─────────┘ │ │ │ │ │ │ │ │ └─────┬─────┘ │ │ -│ │ │ │ │ ▼ ▼ │ │ ┌─ Deployment Job ─────────────────────────────────────────────────────────────────┐ │ │ │ │ │ From fd69933b494f0f5ba54601e597df2c1240289d3d Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 07:03:54 +1000 Subject: [PATCH 4/8] [#2885] Clarified that the security job needs no application containers. --- .vortex/docs/content/continuous-integration/README.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.vortex/docs/content/continuous-integration/README.mdx b/.vortex/docs/content/continuous-integration/README.mdx index 2bce940628..4534aafa12 100644 --- a/.vortex/docs/content/continuous-integration/README.mdx +++ b/.vortex/docs/content/continuous-integration/README.mdx @@ -36,7 +36,7 @@ import CodeLifecycle from '../_code-lifecycle.mdx'; ### 2. Security - Runs in parallel with other jobs (no dependencies) -- Needs no containers and no installed dependencies +- Needs no application containers and no installed project dependencies - Scans the codebase for committed secrets with Gitleaks - Audits the locked Composer packages against known security advisories From 72c8947d6c86b7b04eaa4172f2ee5a9128f54bca Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 07:35:11 +1000 Subject: [PATCH 5/8] [#2885] Moved security checks into a standalone 'Security audit' workflow. --- .circleci/config.yml | 19 ++-- .github/workflows/audit.yml | 105 ++++++++++++++++++ .github/workflows/build-test-deploy.yml | 48 +------- .vortex/docs/content/_code-lifecycle.mdx | 29 +++-- .../content/continuous-integration/README.mdx | 41 ++++--- .../continuous-integration/circleci.mdx | 2 +- .../continuous-integration/github-actions.mdx | 9 ++ .vortex/docs/content/development/composer.mdx | 4 +- .vortex/docs/content/development/faqs.mdx | 2 +- .vortex/docs/content/tools/gitleaks.mdx | 2 +- .../src/Prompts/Handlers/CiProvider.php | 1 + 11 files changed, 179 insertions(+), 83 deletions(-) create mode 100644 .github/workflows/audit.yml diff --git a/.circleci/config.yml b/.circleci/config.yml index 700b6afe6b..51eba0b298 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -208,8 +208,8 @@ jobs: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] #;> DRUPAL_THEME - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -676,10 +676,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: #;< !PROVISION_TYPE_PROFILE requires: @@ -693,7 +689,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -713,7 +708,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -742,6 +736,15 @@ workflows: #============================================================================= #;> VORTEX_DEV + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + #;< !PROVISION_TYPE_PROFILE # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml new file mode 100644 index 0000000000..4678b9016b --- /dev/null +++ b/.github/workflows/audit.yml @@ -0,0 +1,105 @@ +# GitHub Actions configuration file. +# +# Security checks run in their own workflow so that a failing audit is +# distinguishable from a failing linter and can be re-run on its own. +#; +#; Comments starting with '#;<' and '#;>' are internal Vortex comments +#; and will be removed during installation or update of Vortex. +name: Security audit + +on: + push: + # Pushes to the following branches will trigger the workflow. + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - project/** + #;< VORTEX_DEV + - '*.x' + #;> VORTEX_DEV + # Pushes of tags will also trigger the workflow. + tags: + - '*' + # Pull requests to the following branches will trigger the workflow. + pull_request: + types: + - opened + - synchronize + - reopened + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - feature/** + - bugfix/** + - project/** + #;< VORTEX_DEV + - '*.x' + #;> VORTEX_DEV + + workflow_dispatch: + +defaults: + run: + shell: bash + +# Workaround for the Actions runner creating /root/.docker/config.json +# with permissions that prevent the container from reading it. +# https://github.com/actions/runner/issues/863 +env: + DOCKER_CONFIG: /tmp/.docker + +permissions: + contents: read + +jobs: + + audit: + runs-on: ubuntu-latest + + container: + # https://hub.docker.com/r/drevops/ci-runner + image: drevops/ci-runner:26.7.0@sha256:6f917acfc2903e77e1bd9a2a32f3633ff49538553474fe43df3033352e0059b0 + env: + TZ: ${{ vars.TZ || 'UTC' }} + TERM: xterm-256color + VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} + + steps: + - name: Preserve $HOME set in the container + run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 + + - name: Check out code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Fix Git ownership permissions + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" + + #;< CI_GITLEAKS + - name: Scan for committed secrets with Gitleaks + run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner + continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + #;> CI_GITLEAKS + + #;< VORTEX_DEV + #; Vortex does not track 'composer.lock', so the audit below has nothing + #; to read until the dependencies are resolved. + - name: Create Composer lock file + run: composer update --no-install --no-audit + #;> VORTEX_DEV + + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} diff --git a/.github/workflows/build-test-deploy.yml b/.github/workflows/build-test-deploy.yml index 8fa0d4bc2d..d19da02e2c 100644 --- a/.github/workflows/build-test-deploy.yml +++ b/.github/workflows/build-test-deploy.yml @@ -200,52 +200,6 @@ jobs: continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} #;> DRUPAL_THEME - security: - runs-on: ubuntu-latest - #;< !PROVISION_TYPE_PROFILE - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} - #;> !PROVISION_TYPE_PROFILE - - container: - # https://hub.docker.com/r/drevops/ci-runner - image: drevops/ci-runner:26.7.0@sha256:6f917acfc2903e77e1bd9a2a32f3633ff49538553474fe43df3033352e0059b0 - env: - TZ: ${{ vars.TZ || 'UTC' }} - TERM: xterm-256color - VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} - - steps: - - name: Preserve $HOME set in the container - run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 - - - name: Check out code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - with: - persist-credentials: false - - - name: Fix Git ownership permissions - run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - - - name: Load environment variables from .env - run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" - - #;< CI_GITLEAKS - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} - #;> CI_GITLEAKS - - #;< VORTEX_DEV - #; Vortex does not track 'composer.lock', so the audit below has nothing to - #; read until the dependencies are resolved. - - name: Create Composer lock file - run: composer update --no-install --no-audit - #;> VORTEX_DEV - - - name: Audit Composer packages - run: composer audit --locked - continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} - #;< !PROVISION_TYPE_PROFILE database: runs-on: ubuntu-latest @@ -663,7 +617,7 @@ jobs: #;< DEPLOYMENT deploy: runs-on: ubuntu-latest - needs: [build, lint, security] + needs: [build, lint] #;< !PROVISION_TYPE_PROFILE if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} #;> !PROVISION_TYPE_PROFILE diff --git a/.vortex/docs/content/_code-lifecycle.mdx b/.vortex/docs/content/_code-lifecycle.mdx index 8462556a96..4d6fb37210 100644 --- a/.vortex/docs/content/_code-lifecycle.mdx +++ b/.vortex/docs/content/_code-lifecycle.mdx @@ -42,16 +42,16 @@ │ │ Gherkin Lint │ │ Website setup │ │ │ │ ▼ │ │ Import cached DB ──► drush deploy ──► Custom scripts │ │ │ │ ESLint / Stylelint │ │ │ │ │ -│ └─┬─────────────────────┘ │ ▼ │ │ -│ │ │ Testing │ │ -│ │ ┌─ Security Job ───┐ │ PHPUnit tests ──► Behat tests │ │ -│ │ │ Gitleaks │ │ │ │ -│ │ │ ▼ │ └────────────────────────────┬───────────────────────────┘ │ -│ │ │ Composer audit │ │ │ -│ │ └────────┬─────────┘ │ │ -│ │ │ │ │ -│ └─────┬─────┘ │ │ -│ ▼ ▼ │ +│ │ │ │ ▼ │ │ +│ │ │ │ Testing │ │ +│ │ │ │ PHPUnit tests ──► Behat tests │ │ +│ │ │ │ │ │ +│ │ │ └────────────────────────────┬───────────────────────────┘ │ +│ └──────────┬────────────┘ │ │ +│ │ │ │ +│ │ │ │ +│ │ │ │ +│ ▼ ▼ │ │ ┌─ Deployment Job ─────────────────────────────────────────────────────────────────┐ │ │ │ │ │ │ │ Webhook Artifact Lagoon Docker │ │ @@ -74,4 +74,13 @@ ═════════════════════════════════════════════════════════════════════════════════════════ ┊ PR Environment ┊ Dev Staging Production ┊ (auto-removed) ┊ develop branch main branch production branch or tag + + + Security Audit Workflow + ═════════════════════════════════════════════════════════════════════════════════════════ + Push, pull request or manual run ──► Gitleaks secret scan ──► Composer advisory audit + (committed secrets) (composer audit --locked) + + Runs as its own workflow, independently of the pipeline above, and does not gate + deployment. ``` diff --git a/.vortex/docs/content/continuous-integration/README.mdx b/.vortex/docs/content/continuous-integration/README.mdx index 4534aafa12..d9cb74a46e 100644 --- a/.vortex/docs/content/continuous-integration/README.mdx +++ b/.vortex/docs/content/continuous-integration/README.mdx @@ -33,19 +33,12 @@ import CodeLifecycle from '../_code-lifecycle.mdx'; - Runs all code linters: PHPCS, PHPStan, Rector, Twig CS Fixer, Gherkin Lint, ESLint, Stylelint - Checks that Composer configuration is normalized -### 2. Security - -- Runs in parallel with other jobs (no dependencies) -- Needs no application containers and no installed project dependencies -- Scans the codebase for committed secrets with Gitleaks -- Audits the locked Composer packages against known security advisories - -### 3. Database +### 2. Database - Fetches the latest DB version based on a caching strategy - Caches database dumps to speed up the follow-up runs -### 4. Build +### 3. Build - Runs after the `database` job - Uses Docker Compose to set up the full environment @@ -57,13 +50,35 @@ import CodeLifecycle from '../_code-lifecycle.mdx'; - Runs BDD tests (distributed across all instances) - Collects and stores test results and artifacts -### 5. Deployment +### 4. Deployment -- Runs after successful completion of the `build`, `lint` and `security` jobs +- Runs after successful completion of both `build` and `lint` jobs - Uses the built codebase without development dependencies from the `build` step - Adds required secrets and environment variables - Triggers a deployment using a router script +## Security audit + +Security checks run in their own workflow, separate from the pipeline above, so that a failing audit is never confused with a failing linter and can be re-run on its own: + +| Provider | Location | +|----------|----------| +| GitHub Actions | The `Security audit` workflow in `.github/workflows/audit.yml` | +| CircleCI | The `audit` workflow in `.circleci/config.yml` | + +The workflow runs the same two checks in both providers, and needs neither the application containers nor installed dependencies: + +- [Gitleaks](/docs/tools/gitleaks) scans the codebase for committed secrets +- `composer audit --locked` checks the packages pinned in `composer.lock` against published security advisories + +It is triggered by the same pushes, pull requests and tags as the main pipeline, and can also be started on demand - in GitHub Actions from **Actions → Security audit → Run workflow**, and in CircleCI by re-running the `audit` workflow from the pipeline view. + +:::note + +Because the audit is a separate workflow, it is not a dependency of the `deploy` job - a failing audit does not by itself stop a deployment. To block merges and deployments on it, add its check to the repository's branch protection rules as a required status check. + +::: + ## Caching strategy Database is fetched overnight and cached so that the next continuous integration run on the same @@ -129,8 +144,8 @@ The build job runs across multiple parallel containers (2 by default) to speed up test execution. Since each container runs the full build and provision steps, the test workload is distributed to make the best use of each container. -Code linting and security checks run in the separate `lint` and `security` jobs -and are not affected by test parallelism settings. +Code linting runs in a separate `lint` job and is not affected by test +parallelism settings. ### What runs where diff --git a/.vortex/docs/content/continuous-integration/circleci.mdx b/.vortex/docs/content/continuous-integration/circleci.mdx index 0fc9012f9c..852809ee69 100644 --- a/.vortex/docs/content/continuous-integration/circleci.mdx +++ b/.vortex/docs/content/continuous-integration/circleci.mdx @@ -27,7 +27,7 @@ in the Installation guide and select **CircleCI**. ### Update deployment branches -All CI jobs (`database`, `lint`, `security`, `build`) run on every branch. The `deploy` job +All jobs in the `commit` and `audit` workflows (`database`, `lint`, `build`, `audit`) run on every branch. The `deploy` job only runs for specific branch patterns, controlled by a regex filter in the `workflows` section of `.circleci/config.yml`: diff --git a/.vortex/docs/content/continuous-integration/github-actions.mdx b/.vortex/docs/content/continuous-integration/github-actions.mdx index 951a65a62a..14095e1a9d 100644 --- a/.vortex/docs/content/continuous-integration/github-actions.mdx +++ b/.vortex/docs/content/continuous-integration/github-actions.mdx @@ -57,6 +57,15 @@ pull requests, not on direct pushes. To add or remove branches, update the `push` and `pull_request` sections in the workflow file. +### Security audit workflow + +Security checks live in a second workflow, `.github/workflows/audit.yml`, which +triggers on the same branches and tags as the main workflow and can also be +started on demand from **Actions → Security audit → Run workflow**. + +See [Security audit](/docs/continuous-integration#security-audit) for what it +runs and how to make it block merges and deployments. + ### Update nightly database schedule The nightly database job caches a fresh database dump for faster builds the next diff --git a/.vortex/docs/content/development/composer.mdx b/.vortex/docs/content/development/composer.mdx index f40e855401..0d3e12a3b5 100644 --- a/.vortex/docs/content/development/composer.mdx +++ b/.vortex/docs/content/development/composer.mdx @@ -387,7 +387,7 @@ Each section accepts `block` (refuse affected versions during `composer update`/ ### Why advisories do not block installation -Coupling installation to advisory publication makes builds non-deterministic: a newly published advisory against an already-installed dependency can fail every build - including work unrelated to security - until the advisory is assessed and ignored. **Vortex** decouples the two by setting `advisories.block` to `false` while keeping `advisories.audit` at `fail`, so installs and updates remain reproducible while vulnerabilities are still surfaced by `composer audit` and the CI security job. +Coupling installation to advisory publication makes builds non-deterministic: a newly published advisory against an already-installed dependency can fail every build - including work unrelated to security - until the advisory is assessed and ignored. **Vortex** decouples the two by setting `advisories.block` to `false` while keeping `advisories.audit` at `fail`, so installs and updates remain reproducible while vulnerabilities are still surfaced by `composer audit` and the CI security audit workflow. If your project requires installation to hard-stop on advisories - for example, a production site with strict supply-chain controls - set `advisories.block` to `true`. @@ -451,6 +451,6 @@ Check your dependencies for security issues manually: ### CI/CD integration -**Vortex** runs `composer audit --locked` as part of the CI security job, so the audited set is exactly what `composer.lock` pins. Because `advisories.audit` is `fail`, the audit reports vulnerabilities and the security job fails when any are found - even though installs and updates are not blocked. +**Vortex** runs `composer audit --locked` in the [security audit workflow](/docs/continuous-integration#security-audit), so the audited set is exactly what `composer.lock` pins. Because `advisories.audit` is `fail`, the audit reports vulnerabilities and the workflow fails when any are found - even though installs and updates are not blocked. By default that failure gates the build. Set the repository variable `VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE` to `1` to make the audit step run and report without failing the build - useful as a one-off bypass while a known advisory is being addressed. diff --git a/.vortex/docs/content/development/faqs.mdx b/.vortex/docs/content/development/faqs.mdx index 73d398d432..318fd7cd8e 100644 --- a/.vortex/docs/content/development/faqs.mdx +++ b/.vortex/docs/content/development/faqs.mdx @@ -258,7 +258,7 @@ Provided that your stack is already running: ## What should I do when `composer audit` reports a security vulnerability? -**Vortex** does not block installation on security advisories by default, so `composer install` and `composer update` keep working. Advisories are surfaced by `composer audit`, which runs locally and in the CI security job. When one appears: +**Vortex** does not block installation on security advisories by default, so `composer install` and `composer update` keep working. Advisories are surfaced by `composer audit`, which runs locally and in the CI security audit workflow. When one appears: 1. **Update the affected package**: try a newer version that resolves the advisory: `composer update vendor/package-name`. 2. **Review the advisory**: run `composer audit` for details and assess whether it affects your project. diff --git a/.vortex/docs/content/tools/gitleaks.mdx b/.vortex/docs/content/tools/gitleaks.mdx index 8265edb6c7..dc9fe5b369 100644 --- a/.vortex/docs/content/tools/gitleaks.mdx +++ b/.vortex/docs/content/tools/gitleaks.mdx @@ -8,7 +8,7 @@ https://github.com/gitleaks/gitleaks **Vortex** does not install Gitleaks locally. Please follow the [instructions](https://github.com/gitleaks/gitleaks#installing) to install it on your system. -In CI, Gitleaks runs from its official Docker image as part of the security job. +In CI, Gitleaks runs from its official Docker image as part of the [security audit workflow](/docs/continuous-integration#security-audit). ::: diff --git a/.vortex/installer/src/Prompts/Handlers/CiProvider.php b/.vortex/installer/src/Prompts/Handlers/CiProvider.php index 09244f097d..e7019191de 100644 --- a/.vortex/installer/src/Prompts/Handlers/CiProvider.php +++ b/.vortex/installer/src/Prompts/Handlers/CiProvider.php @@ -97,6 +97,7 @@ public function process(): void { if ($remove_gha) { File::remove($t . '/.github/workflows/build-test-deploy.yml'); + File::remove($t . '/.github/workflows/audit.yml'); File::remove($t . '/' . $this->webroot . '/sites/default/includes/providers/settings.gha.php'); File::removeTokenAsync('CI_PROVIDER_GHA'); File::removeTokenAsync('SETTINGS_PROVIDER_GHA'); From d7fc47d5b7adc2ee1e8c32aa3002a973d8306402 Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 07:35:23 +1000 Subject: [PATCH 6/8] Updated snapshots. --- .../_baseline/.github/workflows/audit.yml | 87 +++++++++++++++++++ .../.github/workflows/build-test-deploy.yml | 37 +------- .../ciprovider_circleci/.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 17 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../{build-test-deploy.yml => audit.yml} | 2 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 4 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 2 +- .../.github/workflows/build-test-deploy.yml | 22 ++--- .../.github/workflows/build-test-deploy.yml | 6 +- .../.github/workflows/build-test-deploy.yml | 6 +- .../.github/workflows/build-test-deploy.yml | 6 +- .../timezone_circleci/.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 6 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 10 +-- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 2 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 6 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 4 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 6 +- .../.circleci/config.yml | 19 ++-- .../.github/workflows/-audit.yml | 0 .../.github/workflows/build-test-deploy.yml | 8 +- 81 files changed, 419 insertions(+), 301 deletions(-) create mode 100644 .vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/code_provider_other/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.github/workflows/-audit.yml rename .vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/{build-test-deploy.yml => audit.yml} (96%) create mode 100644 .vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.github/workflows/-audit.yml create mode 100644 .vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.github/workflows/-audit.yml diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/audit.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/audit.yml new file mode 100644 index 0000000000..cf70c3d21c --- /dev/null +++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/audit.yml @@ -0,0 +1,87 @@ +# GitHub Actions configuration file. +# +# Security checks run in their own workflow so that a failing audit is +# distinguishable from a failing linter and can be re-run on its own. +name: Security audit + +on: + push: + # Pushes to the following branches will trigger the workflow. + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - project/** + # Pushes of tags will also trigger the workflow. + tags: + - '*' + # Pull requests to the following branches will trigger the workflow. + pull_request: + types: + - opened + - synchronize + - reopened + branches: + - production + - main + - master + - develop + - release/** + - hotfix/** + - feature/** + - bugfix/** + - project/** + + workflow_dispatch: + +defaults: + run: + shell: bash + +# Workaround for the Actions runner creating /root/.docker/config.json +# with permissions that prevent the container from reading it. +# https://github.com/actions/runner/issues/863 +env: + DOCKER_CONFIG: /tmp/.docker + +permissions: + contents: read + +jobs: + + audit: + runs-on: ubuntu-latest + + container: + # https://hub.docker.com/r/drevops/ci-runner + image: drevops/ci-runner:__VERSION__ + env: + TZ: ${{ vars.TZ || 'UTC' }} + TERM: xterm-256color + VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} + + steps: + - name: Preserve $HOME set in the container + run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 + + - name: Check out code + uses: actions/checkout@__HASH__ # __VERSION__ + with: + persist-credentials: false + + - name: Fix Git ownership permissions + run: git config --global --add safe.directory "$GITHUB_WORKSPACE" + + - name: Load environment variables from .env + run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" + + - name: Scan for committed secrets with Gitleaks + run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner + continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} + + - name: Audit Composer packages + run: composer audit --locked + continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml index 132475e543..d875d3d199 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml @@ -167,41 +167,6 @@ jobs: run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - security: - runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} - - container: - # https://hub.docker.com/r/drevops/ci-runner - image: drevops/ci-runner:__VERSION__ - env: - TZ: ${{ vars.TZ || 'UTC' }} - TERM: xterm-256color - VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} - - steps: - - name: Preserve $HOME set in the container - run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 - - - name: Check out code - uses: actions/checkout@__HASH__ # __VERSION__ - with: - persist-credentials: false - - - name: Fix Git ownership permissions - run: git config --global --add safe.directory "$GITHUB_WORKSPACE" - - - name: Load environment variables from .env - run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" - - - name: Scan for committed secrets with Gitleaks - run: docker run --rm -v "${PWD}":/repo -w /repo ghcr.io/gitleaks/gitleaks:__VERSION__ dir . --no-banner - continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} - - - name: Audit Composer packages - run: composer audit --locked - continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} - database: runs-on: ubuntu-latest if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} @@ -566,7 +531,7 @@ jobs: deploy: runs-on: ubuntu-latest - needs: [build, lint, security] + needs: [build, lint] if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} permissions: diff --git a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml index d4eec64072..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -546,10 +546,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -560,7 +556,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -580,7 +575,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -590,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/ciprovider_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml index f9aee50630..0252669c11 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -484,6 +484,17 @@ +@@ -449,6 +449,17 @@ hide_and_recreate: true diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml index 7d66857eea..a5e1dd0fca 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -554,10 +554,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -568,7 +564,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -588,7 +583,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -598,6 +592,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/code_coverage_provider_codecov_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/code_provider_other/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/code_provider_other/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml index 52760c4871..2dd0a9d967 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/db_fetch_source_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -287,6 +287,9 @@ +@@ -252,6 +252,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml index d4eec64072..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -546,10 +546,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -560,7 +556,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -580,7 +575,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -590,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_all_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml index 9afe729665..bbbb6ec682 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -480,10 +480,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -491,6 +487,15 @@ workflows: tags: only: /.*/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml index 81986b4e60..db25c62ac6 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml @@ -1,11 +1,11 @@ -@@ -563,104 +563,3 @@ +@@ -528,104 +528,3 @@ timeout-minutes: 120 # Cancel the action after 120 minutes, regardless of whether a connection has been established. with: detached: true - - deploy: - runs-on: ubuntu-latest -- needs: [build, lint, security] +- needs: [build, lint] - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} - - permissions: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml index d4eec64072..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -546,10 +546,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -560,7 +556,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -580,7 +575,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -590,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/deps_updates_provider_ci_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/audit.yml similarity index 96% rename from .vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml rename to .vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/audit.yml index 96cdcb8342..b61649beda 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/gitleaks_disabled/.github/workflows/audit.yml @@ -1,4 +1,4 @@ -@@ -194,10 +194,6 @@ +@@ -78,10 +78,6 @@ - name: Load environment variables from .env run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml index 52760c4871..2dd0a9d967 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -287,6 +287,9 @@ +@@ -252,6 +252,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml index 52760c4871..2dd0a9d967 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -287,6 +287,9 @@ +@@ -252,6 +252,9 @@ VORTEX_FETCH_DB_SEMAPHORE=/tmp/fetch-db-fresh ./vendor/bin/vortex-fetch-db echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml index d4eec64072..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -546,10 +546,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -560,7 +556,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -580,7 +575,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -590,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_disabled_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml index d36284c2e4..cd0dc0b743 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -556,10 +556,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -570,7 +566,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -590,7 +585,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -600,6 +594,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_enabled_lagoon/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_acquia/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_container_registry/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_ftp/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_lagoon/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_s3/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml index a5a3c95f6e..7c9f5dd48c 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/migration_fetch_source_url/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -288,6 +288,9 @@ +@@ -253,6 +253,9 @@ echo "db_hash=${{ hashFiles('.data') }}" >> "$GITHUB_ENV" timeout-minutes: 30 @@ -8,7 +8,7 @@ - name: Export DB run: | if [ ! -f /tmp/fetch-db-fresh ]; then echo "==> Database fetch semaphore file is missing. DB export will not proceed."; exit 0; fi -@@ -425,6 +428,11 @@ +@@ -390,6 +393,11 @@ docker compose exec cli mkdir -p .data docker compose cp -L .data/db.sql cli:/app/.data/db.sql rm -f .data/db.sql diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml index bfe261cf95..b815dc72a9 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_no_devel_sdc_devel/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -494,18 +494,6 @@ +@@ -459,18 +459,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml index bfe261cf95..b815dc72a9 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_no_sdc_devel/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -494,18 +494,6 @@ +@@ -459,18 +459,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml index bfe261cf95..b815dc72a9 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/modules_none/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -494,18 +494,6 @@ +@@ -459,18 +459,6 @@ env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml index 9fd501776f..c47c08b4f4 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml @@ -15,17 +15,9 @@ container: # https://hub.docker.com/r/drevops/ci-runner -@@ -169,7 +166,6 @@ - - security: - runs-on: ubuntu-latest -- if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} - - container: - # https://hub.docker.com/r/drevops/ci-runner -@@ -202,118 +198,8 @@ - run: composer audit --locked - continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} +@@ -167,118 +164,8 @@ + run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" + continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - database: - runs-on: ubuntu-latest @@ -142,7 +134,7 @@ permissions: contents: read -@@ -339,14 +225,6 @@ +@@ -304,14 +191,6 @@ VORTEX_SSH_DISABLE_STRICT_HOST_KEY_CHECKING: "1" VORTEX_SSH_REMOVE_ALL_KEYS: "1" VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} @@ -157,7 +149,7 @@ steps: - name: Preserve $HOME set in the container -@@ -373,29 +251,6 @@ +@@ -338,29 +217,6 @@ - name: Install Vortex tooling run: ./scripts/vortex-tooling.sh @@ -187,10 +179,10 @@ - name: Login to container registry run: ./vendor/bin/vortex-login-container-registry -@@ -567,7 +422,6 @@ +@@ -532,7 +388,6 @@ deploy: runs-on: ubuntu-latest - needs: [build, lint, security] + needs: [build, lint] - if: ${{ !cancelled() && (inputs.deploy_target || (success() && github.event_name != 'schedule' && !startsWith(github.head_ref || github.ref_name, 'deps/') && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')))) }} permissions: diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml index 592519a4ec..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.github/workflows/build-test-deploy.yml @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - security: + database: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -493,18 +488,6 @@ + if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml index 592519a4ec..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.github/workflows/build-test-deploy.yml @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - security: + database: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -493,18 +488,6 @@ + if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml index 592519a4ec..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.github/workflows/build-test-deploy.yml @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - security: + database: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -493,18 +488,6 @@ + if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml index d4eec64072..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -546,10 +546,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -560,7 +556,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -580,7 +575,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -590,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/timezone_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml index 876f0ce792..d056922b5f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.circleci/config.yml @@ -165,8 +165,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -534,10 +534,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -548,7 +544,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -568,7 +563,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -578,6 +572,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_lint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml index 06ea89cb07..c2ca74c745 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests/.github/workflows/build-test-deploy.yml @@ -9,7 +9,7 @@ - name: Lint module code with NodeJS linters run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} -@@ -434,66 +430,6 @@ +@@ -399,66 +395,6 @@ run: docker compose exec -T cli bash -c "yarn test" continue-on-error: ${{ vars.VORTEX_CI_JEST_IGNORE_FAILURE == '1' }} @@ -76,7 +76,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -506,20 +442,6 @@ +@@ -471,20 +407,6 @@ fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} @@ -97,7 +97,7 @@ - name: Process test logs and artifacts if: always() run: | -@@ -536,16 +458,6 @@ +@@ -501,16 +423,6 @@ path: .logs include-hidden-files: true if-no-files-found: error diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml index 6f3aa917fe..bd6d49a852 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.circleci/config.yml @@ -173,8 +173,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -492,10 +492,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -506,7 +502,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -526,7 +521,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -536,6 +530,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_be_tests_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml index ed62f4de2b..bf27379bd1 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint/.github/workflows/build-test-deploy.yml @@ -17,7 +17,7 @@ - name: Lint theme code with NodeJS linters if: ${{ vars.VORTEX_FRONTEND_BUILD_SKIP != '1' }} run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" -@@ -415,7 +410,6 @@ +@@ -380,7 +375,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -25,7 +25,7 @@ - name: Provision site run: | -@@ -428,11 +422,6 @@ +@@ -393,11 +387,6 @@ fi docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml index a99d1622b2..2f39f3f500 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.circleci/config.yml @@ -172,8 +172,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -536,10 +536,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -550,7 +546,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -570,7 +565,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -580,6 +574,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml index 0a6c5602ad..e09c708962 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.github/workflows/build-test-deploy.yml @@ -19,10 +19,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - security: + database: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -415,7 +405,6 @@ + if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -380,7 +370,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -30,7 +30,7 @@ - name: Provision site run: | -@@ -429,11 +418,6 @@ +@@ -394,11 +383,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 @@ -42,7 +42,7 @@ - name: Test with PHPUnit if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: docker compose exec -T cli vendor/bin/phpunit -@@ -493,18 +477,6 @@ +@@ -458,18 +442,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml index 01fbeec259..8651ac3435 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.circleci/config.yml @@ -166,8 +166,8 @@ jobs: name: Lint code with Gherkin Lint command: docker compose exec -T cli vendor/bin/gherkinlint lint tests/behat/features || [ "${VORTEX_CI_GHERKIN_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -518,10 +518,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -532,7 +528,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -552,7 +547,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -562,6 +556,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml index 3561b2e6b5..507938be10 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat/.github/workflows/build-test-deploy.yml @@ -9,7 +9,7 @@ - name: Lint module code with NodeJS linters run: docker compose exec -T cli bash -c "yarn run lint" continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} -@@ -505,20 +501,6 @@ +@@ -470,20 +466,6 @@ exit 1 fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml index 78e93e472a..3ea99bfcfb 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.circleci/config.yml @@ -173,8 +173,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -532,10 +532,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -546,7 +542,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -566,7 +561,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -576,6 +570,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_behat_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml index 8a00b7a998..42fc8602e4 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.circleci/config.yml @@ -173,8 +173,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -542,10 +542,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -556,7 +552,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -576,7 +571,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -586,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_dclint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml index edc9cd8573..8d314cfe3f 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.circleci/config.yml @@ -166,8 +166,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -535,10 +535,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -549,7 +545,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -569,7 +564,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -579,6 +573,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_docker_linters_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml index 27edbcbe2a..e56e5e7e92 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.circleci/config.yml @@ -172,8 +172,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -541,10 +541,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -555,7 +551,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -575,7 +570,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -585,6 +579,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml index 8d86d31f75..121be3d419 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.github/workflows/build-test-deploy.yml @@ -19,10 +19,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - security: + database: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -493,18 +483,6 @@ + if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -458,18 +448,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml index 6d60a7efcf..58f544d582 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.circleci/config.yml @@ -170,8 +170,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -539,10 +539,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -553,7 +549,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -573,7 +568,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -583,6 +577,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_hadolint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml index 1e10fa800b..ff261ccb0d 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -415,7 +415,6 @@ +@@ -380,7 +380,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -6,7 +6,7 @@ - name: Provision site run: | -@@ -428,11 +427,6 @@ +@@ -393,11 +392,6 @@ fi docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml index 2a7a81572f..9bb4c72557 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -541,10 +541,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -555,7 +551,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -575,7 +570,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -585,6 +579,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_jest_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml index 337e43e0d3..13fcd63fa7 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.circleci/config.yml @@ -173,8 +173,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -542,10 +542,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -556,7 +552,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -576,7 +571,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -586,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpcs_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml index 143778f54c..37096d90be 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.circleci/config.yml @@ -173,8 +173,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -542,10 +542,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -556,7 +552,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -576,7 +571,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -586,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpstan_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml index 014ed56c5e..f1513693dd 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit/.github/workflows/build-test-deploy.yml @@ -1,4 +1,4 @@ -@@ -434,66 +434,6 @@ +@@ -399,66 +399,6 @@ run: docker compose exec -T cli bash -c "yarn test" continue-on-error: ${{ vars.VORTEX_CI_JEST_IGNORE_FAILURE == '1' }} @@ -65,7 +65,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -536,16 +476,6 @@ +@@ -501,16 +441,6 @@ path: .logs include-hidden-files: true if-no-files-found: error diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml index 05ff76ed51..7061984551 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -506,10 +506,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -520,7 +516,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -540,7 +535,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -550,6 +544,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_phpunit_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml index ed6fae2658..af309a5903 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.circleci/config.yml @@ -173,8 +173,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -542,10 +542,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -556,7 +552,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -576,7 +571,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -586,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_rector_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml index d4eec64072..534ea16a8a 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.circleci/config.yml @@ -177,8 +177,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -546,10 +546,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -560,7 +556,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -580,7 +575,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -590,6 +584,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml index 592519a4ec..f55d606329 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.github/workflows/build-test-deploy.yml @@ -7,10 +7,10 @@ - run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" - continue-on-error: ${{ vars.VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE == '1' }} - - security: + database: runs-on: ubuntu-latest - if: ${{ !inputs.deploy_target && github.event_name != 'schedule' && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} -@@ -493,18 +488,6 @@ + if: ${{ !inputs.deploy_target && (github.event_name == 'push' || !startsWith(github.head_ref, 'project/')) }} +@@ -458,18 +453,6 @@ fi env: VORTEX_CI_CODE_COVERAGE_THRESHOLD: ${{ vars.VORTEX_CI_CODE_COVERAGE_THRESHOLD || '90' }} diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml index 376c8ee3dd..5cca5bc539 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.circleci/config.yml @@ -173,8 +173,8 @@ jobs: [ "${VORTEX_FRONTEND_BUILD_SKIP:-0}" -eq 1 ] && exit 0 docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" || [ "${VORTEX_CI_NODEJS_LINT_IGNORE_FAILURE:-0}" -eq 1 ] - # Security job runs in parallel with lint, database and build jobs. - security: + # Audit job runs in its own workflow, independently of the commit workflow. + audit: <<: *runner_config steps: - checkout @@ -542,10 +542,6 @@ workflows: filters: tags: only: /.*/ - - security: - filters: - tags: - only: /.*/ - build: requires: - database @@ -556,7 +552,6 @@ workflows: requires: - build - lint - - security filters: branches: # Allowed branches: @@ -576,7 +571,6 @@ workflows: requires: - build - lint - - security filters: branches: ignore: /.*/ @@ -586,6 +580,15 @@ workflows: # - 2023-04-17, 2023-04-17.123 (date-based) only: /^[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/ + # Security audit workflow. Runs for every commit push to the remote repository, + # independently of the commit workflow. + audit: + jobs: + - audit: + filters: + tags: + only: /.*/ + # Nightly database workflow runs overnight to capture fresh database and cache it. nightly-db: triggers: diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.github/workflows/-audit.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_no_twig_circleci/.github/workflows/-audit.yml new file mode 100644 index 0000000000..e69de29bb2 diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml index bb3ea913bb..ff12849029 100644 --- a/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml +++ b/.vortex/installer/tests/Fixtures/handler_process/tools_none/.github/workflows/build-test-deploy.yml @@ -53,7 +53,7 @@ - name: Lint theme code with NodeJS linters if: ${{ vars.VORTEX_FRONTEND_BUILD_SKIP != '1' }} run: docker compose exec -T cli bash -c "yarn --cwd=\${WEBROOT}/themes/custom/\${DRUPAL_THEME} run lint" -@@ -415,7 +379,6 @@ +@@ -380,7 +344,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli bash -c " \ if [ -n \"\${PACKAGE_TOKEN:-}\" ]; then composer config --global --auth github-oauth.github.com \"\${PACKAGE_TOKEN}\"; fi && \ COMPOSER_MEMORY_LIMIT=-1 composer --ansi install --prefer-dist" @@ -61,7 +61,7 @@ - name: Provision site run: | -@@ -429,71 +392,6 @@ +@@ -394,71 +357,6 @@ docker compose exec $(env | cut -f1 -d= | sed 's/^/-e /') -T cli ./vendor/bin/vortex-provision timeout-minutes: 30 @@ -133,7 +133,7 @@ - name: Validate Single Directory Components if: ${{ matrix.instance == 0 || strategy.job-total == 1 }} run: | -@@ -506,20 +404,6 @@ +@@ -471,20 +369,6 @@ fi continue-on-error: ${{ vars.VORTEX_CI_SDC_DEVEL_IGNORE_FAILURE == '1' }} @@ -154,7 +154,7 @@ - name: Process test logs and artifacts if: always() run: | -@@ -536,16 +420,6 @@ +@@ -501,16 +385,6 @@ path: .logs include-hidden-files: true if-no-files-found: error From bfe185c6cf7c527d767e2b054f34ff5d8d0b8650 Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 07:40:11 +1000 Subject: [PATCH 7/8] [#2885] Corrected that a failing audit does not gate the build. --- .vortex/docs/content/development/composer.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.vortex/docs/content/development/composer.mdx b/.vortex/docs/content/development/composer.mdx index 0d3e12a3b5..1c2d0b3d1d 100644 --- a/.vortex/docs/content/development/composer.mdx +++ b/.vortex/docs/content/development/composer.mdx @@ -453,4 +453,4 @@ Check your dependencies for security issues manually: **Vortex** runs `composer audit --locked` in the [security audit workflow](/docs/continuous-integration#security-audit), so the audited set is exactly what `composer.lock` pins. Because `advisories.audit` is `fail`, the audit reports vulnerabilities and the workflow fails when any are found - even though installs and updates are not blocked. -By default that failure gates the build. Set the repository variable `VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE` to `1` to make the audit step run and report without failing the build - useful as a one-off bypass while a known advisory is being addressed. +That failure is reported by the audit workflow, which runs independently of the build. Set the repository variable `VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE` to `1` to make the audit step run and report without failing that workflow - useful as a one-off bypass while a known advisory is being addressed. From 71ad2bcf9e0578851d57bd1d010862d25233eb68 Mon Sep 17 00:00:00 2001 From: Alex Skrypnyk Date: Wed, 5 Aug 2026 07:58:39 +1000 Subject: [PATCH 8/8] [#2885] Resolved dependencies without platform checks when creating the lock file. --- .circleci/config.yml | 7 ++++--- .github/workflows/audit.yml | 7 ++++--- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 51eba0b298..15d9f4dac4 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -224,11 +224,12 @@ jobs: #;> CI_GITLEAKS #;< VORTEX_DEV - #; Vortex does not track 'composer.lock', so the audit below has nothing to - #; read until the dependencies are resolved. + #; Vortex does not track 'composer.lock', so resolve dependencies to give + #; the audit below something to read. Nothing is installed, so the runner + #; does not need to provide the platform extensions Drupal requires. - run: name: Create Composer lock file - command: composer update --no-install --no-audit + command: composer update --no-install --no-audit --ignore-platform-reqs #;> VORTEX_DEV - run: diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml index 4678b9016b..e9e4347a1f 100644 --- a/.github/workflows/audit.yml +++ b/.github/workflows/audit.yml @@ -94,10 +94,11 @@ jobs: #;> CI_GITLEAKS #;< VORTEX_DEV - #; Vortex does not track 'composer.lock', so the audit below has nothing - #; to read until the dependencies are resolved. + #; Vortex does not track 'composer.lock', so resolve dependencies to give + #; the audit below something to read. Nothing is installed, so the runner + #; does not need to provide the platform extensions Drupal requires. - name: Create Composer lock file - run: composer update --no-install --no-audit + run: composer update --no-install --no-audit --ignore-platform-reqs #;> VORTEX_DEV - name: Audit Composer packages