Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions .github/labels.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
---
# Labels names are important as they are used by Release Drafter to decide
# regarding where to record them in changelog or if to skip them.
#
# The repository labels will be automatically configured using this file and
# the GitHub Action https://github.com/marketplace/actions/github-labeler.
- name: breaking
description: Breaking Changes
color: bfd4f2
- name: bug
description: Something isn't working
color: d73a4a
- name: build
description: Build System and Dependencies
color: bfdadc
- name: ci
description: Continuous Integration
color: 4a97d6
- name: dependencies
description: Pull requests that update a dependency file
color: 0366d6
- name: documentation
description: Improvements or additions to documentation
color: 0075ca
- name: duplicate
description: This issue or pull request already exists
color: cfd3d7
- name: enhancement
description: New feature or request
color: a2eeef
- name: github_actions
description: Pull requests that update Github_actions code
color: "000000"
- name: good first issue
description: Good for newcomers
color: 7057ff
- name: help wanted
description: Extra attention is needed
color: "008672"
- name: invalid
description: This doesn't seem right
color: e4e669
- name: performance
description: Performance
color: "016175"
- name: question
description: Further information is requested
color: d876e3
- name: refactoring
description: Refactoring
color: ef67c4
- name: removal
description: Removals and Deprecations
color: 9ae7ea
- name: style
description: Style
color: c120e5
- name: testing
description: Testing
color: b1fc6f
- name: wontfix
description: This will not be worked on
color: ffffff
59 changes: 59 additions & 0 deletions .github/release-drafter.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
categories:
- title: ":boom: Breaking Changes"
label: "breaking"
- title: ":rocket: Features"
label: "enhancement"
- title: ":fire: Removals and Deprecations"
label: "removal"
- title: ":beetle: Fixes"
label: "bug"
- title: ":racehorse: Performance"
label: "performance"
- title: ":rotating_light: Testing"
label: "testing"
- title: ":construction_worker: Continuous Integration"
label: "ci"
- title: ":books: Documentation"
label: "documentation"
- title: ":hammer: Refactoring"
label: "refactoring"
- title: ":lipstick: Style"
label: "style"
- title: ":package: Dependencies"
labels:
- "dependencies"
- "build"

autolabeler:
- label: 'documentation'
branch:
- '/docs{0,1}\/.+/'
- label: 'bug'
branch:
- '/fix\/.+/'
title:
- '/fix/i'
- label: 'enhancement'
branch:
- '/feat\/.+/'
body:
- '/JIRA-[0-9]{1,4}/'
- label: 'refactoring'
branch:
- '/refactor\/.+/'
title:
- '/^refactor/i'
- label: 'testing'
branch:
- '/test\/.+/'
- label: 'breaking'
title:
- '/breaking change/i'
- label: 'ci'
files:
- '.github/*'

template: |
## Changes

$CHANGES
19 changes: 19 additions & 0 deletions .github/workflows/labeler.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: Labeler

on:
push:
branches:
- master

jobs:
labeler:
runs-on: ubuntu-latest
steps:
- name: Check out the repository
uses: actions/checkout@v4

# Reads labels from .github/labels.yml
- name: Run Labeler
uses: crazy-max/ghaction-github-labeler@v5
with:
skip-delete: true
Comment on lines +10 to +19

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 10 days ago

In general, the fix is to add an explicit permissions block that grants only the scopes required for this workflow. The crazy-max/ghaction-github-labeler action manages labels via the GitHub API, which requires write access to repository metadata and read access to repository contents. A minimal, appropriate set is typically contents: read and metadata: read, plus issues: write and pull-requests: write if labels are applied to issues/PRs. However, this particular action updates repository labels configuration, which is controlled via repository administration APIs; GitHub models that as contents: write is sufficient for most repo‑level write operations through GITHUB_TOKEN. To keep the fix conservative and avoid breaking existing behavior while still complying with CodeQL’s requirement, we can safely add at least contents: read and, if we want to keep behavior unchanged for a label‑management workflow, contents: write. Since we are instructed not to change functionality, we should not arbitrarily reduce possible write permissions that may be in use. The cleanest, least invasive fix in the given snippet is to add a permissions block at the job level under labeler: specifying at least contents: read. Given the action’s role (managing labels in the repo), we will set contents: write to avoid any risk of breaking it while still making permissions explicit.

Concretely: edit .github/workflows/labeler.yml and, under labeler: and before runs-on: ubuntu-latest, insert a permissions: section with contents: write. No imports or additional methods are needed; this is purely a YAML configuration change.

Suggested changeset 1
.github/workflows/labeler.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -7,6 +7,8 @@
 
 jobs:
   labeler:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Check out the repository
EOF
@@ -7,6 +7,8 @@

jobs:
labeler:
permissions:
contents: write
runs-on: ubuntu-latest
steps:
- name: Check out the repository
Copilot is powered by AI and may make mistakes. Always verify output.
100 changes: 100 additions & 0 deletions .github/workflows/mvn-release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,100 @@
name: Release

on:
push:
branches:
- release

jobs:
release:
runs-on: ubuntu-latest
# Do not run workflow if the triggering commit created the 'release' branch
if: ${{github.event.created}} == false
permissions:
contents: write
id-token: write
packages: write

steps:
- name: Create DaplaBot app token
uses: actions/create-github-app-token@v1
id: app-token
with:
app-id: ${{ secrets.DAPLA_BOT_APP_ID }}
private-key: ${{ secrets.DAPLA_BOT_PRIVATE_KEY }}

- uses: actions/checkout@v4
with:
token: ${{ steps.app-token.outputs.token }}
ref: refs/heads/master

- name: Set up JDK
uses: actions/setup-java@v4
with:
java-version: 17
distribution: temurin
cache: maven
overwrite-settings: false

- name: Get bot variables
id: get-bot-vars
run: |
bot_name="dapla-bot"
bot_id=$(curl -s https://api.github.com/users/${bot_name}%5Bbot%5D | jq '.id')
bot_email="${dapla_bot_id}+${bot_name}[bot]@users.noreply.github.com"

echo "bot_name=${bot_name}[bot]" >> $GITHUB_OUTPUT
echo "bot_email=${bot_email}" >> $GITHUB_OUTPUT

- name: Configure Git user
run: |
git config user.email ${{steps.get-bot-vars.outputs.bot_email}}
git config user.name ${{steps.get-bot-vars.outputs.bot_name}}

- name: Setup Maven authentication to GitHub packages
uses: s4u/maven-settings-action@v3.0.0
with:
override: true
githubServer: false
servers: >-
[{"id": "github","username": "${{steps.get-bot-vars.outputs.bot_email}}","password": "${{steps.app-token.outputs.token}}",
"configuration": {"httpHeaders": {"property": {"name": "Authorization","value": "Bearer ${{ secrets.GITHUB_TOKEN }}"}}}}]

- name: Maven release and deploy to GitHub packages
id: release-artifact
run: |
# Get the release version from the pom.xml before the next snapshot increment
VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout | sed "s/-SNAPSHOT//")
echo "version=${VERSION}" >> $GITHUB_OUTPUT
# Perform the release/deploy and increment the version to the next snapshot
mvn --batch-mode release:prepare -P github -Darguments="-Dmaven.test.skip=true -Dmaven.deploy.skip=true"
mvn --batch-mode release:perform
TAG=$(git describe --abbrev=0 --tags)
echo "tag=${TAG}" >> $GITHUB_OUTPUT

- name: Create GitHub release draft
uses: release-drafter/release-drafter@v6
id: create-github-release
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
with:
tag: ${{ steps.release-artifact.outputs.tag }}

- name: Upload assets to GitHub release draft
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
ARTIFACT_ID=$(mvn help:evaluate -Dexpression=project.artifactId -q -DforceStdout)
# Get all files matching the artifact id and version (source, javadoc, etc.)
ARTIFACT_GLOB=(./target/$ARTIFACT_ID-${{ steps.release-artifact.outputs.version }}*.jar)
for file in "${ARTIFACT_GLOB[@]}"; do
echo "Uploading $file"
gh release upload ${{ steps.create-github-release.outputs.tag_name }} $file
done

- name: Publish GitHub release
uses: eregon/publish-release@v1
env:
GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
with:
release_id: ${{ steps.create-github-release.outputs.id }}
31 changes: 31 additions & 0 deletions .github/workflows/release-drafter.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: Release Drafter

on:
push:
branches:
- master
# pull_request event is required only for autolabeler
pull_request:
types:
- opened
- reopened
- synchronize

permissions:
contents: read

jobs:
update_release_draft:
permissions:
# write permission is required to create a GitHub release
contents: write
# write permission is required for autolabeler
# otherwise, read permission is required at least
pull-requests: write
runs-on: ubuntu-latest
steps:
# Draft the next Release notes as Pull Requests are merged into main

- uses: release-drafter/release-drafter@v5
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28 changes: 0 additions & 28 deletions .github/workflows/release.yml

This file was deleted.

10 changes: 10 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,16 @@ default: | help
help:
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'


.PHONY: release
release:
@set -e ; \
git checkout master && \
git pull && \
git checkout release && \
git merge master && \
git push

.PHONY: build-klass-forvaltning
build-klass-forvaltning:
pushd klass-forvaltning && \
Expand Down
15 changes: 15 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,21 @@ Run `mvn install` to build the project.

Klass is hosted on the Nais application platform. Deploy configuration may be found in the [.nais](.nais) directory. Deploy workflows may be found in the [.github/workflows](.github/workflows) directory.

## Release

The release process is automated. It can be triggered by following these steps:

1. Check that you are on the default branch.
1. Check that you don't have any local commits or changes.
1. Run `make release`. This command creates a branch called `release` and triggers the further release process like so:
1. The version number is bumped for a minor release.
2. The artifacts are deployed
3. A tag is pushed
4. The project is reset for the next development iteration
5. A GitHub release is created which triggers deploy to the prod environment

This command pushes the current state of origin/master as well as locally committed changes to the release branch. This starts a workflow that performs a minor version bump, a GitHub release, and a deployment to the NAIS production environment.

## Database

Klass uses PostgreSQL for its database.
Expand Down
13 changes: 4 additions & 9 deletions pom.xml
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>no.ssb.klass</groupId>
Expand All @@ -11,7 +12,7 @@
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>3.5.10</version>
<relativePath />
<relativePath/>
</parent>

<modules>
Expand All @@ -24,7 +25,6 @@
<scm>
<developerConnection>scm:git:https://github.com/${github.repository}.git</developerConnection>
<url>https://github.com/${github.repository}</url>
<tag>v4.0.0</tag>
</scm>

<properties>
Expand Down Expand Up @@ -65,7 +65,7 @@
<name>GitHub Packages</name>
<url>https://maven.pkg.github.com/${github.repository}</url>
<snapshots>
<enabled>true</enabled>
<enabled>false</enabled>
</snapshots>
</repository>
</distributionManagement>
Expand Down Expand Up @@ -106,11 +106,6 @@
<arguments>-Pdocumentation -Dmaven.javadoc.skip=true -pl :klass-api -am</arguments>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-deploy-plugin</artifactId>
<version>3.1.4</version>
</plugin>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
Expand Down
Loading