diff --git a/.gitattributes b/.gitattributes index c498408ab..f72c204bd 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,10 +1,10 @@ * text=auto eol=lf # Ignore all JavaScript files in a directory -src/main/resources/static/pdfjs/* linguist-vendored -src/main/resources/static/pdfjs/** linguist-vendored -src/main/resources/static/pdfjs-legacy/* linguist-vendored -src/main/resources/static/pdfjs-legacy/** linguist-vendored -src/main/resources/static/css/bootstrap-icons.css linguist-vendored -src/main/resources/static/css/bootstrap.min.css linguist-vendored -src/main/resources/static/css/fonts/* linguist-vendored +stirling-pdf/src/main/resources/static/pdfjs/* linguist-vendored +stirling-pdf/src/main/resources/static/pdfjs/** linguist-vendored +stirling-pdf/src/main/resources/static/pdfjs-legacy/* linguist-vendored +stirling-pdf/src/main/resources/static/pdfjs-legacy/** linguist-vendored +stirling-pdf/src/main/resources/static/css/bootstrap-icons.css linguist-vendored +stirling-pdf/src/main/resources/static/css/bootstrap.min.css linguist-vendored +stirling-pdf/src/main/resources/static/css/fonts/* linguist-vendored diff --git a/.github/labeler-config-srvaroa.yml b/.github/labeler-config-srvaroa.yml new file mode 100644 index 000000000..2fb9365e4 --- /dev/null +++ b/.github/labeler-config-srvaroa.yml @@ -0,0 +1,139 @@ +version: 1 +labels: + + - label: "Bugfix" + title: '^fix:.*' + + - label: "enhancement" + title: '^feat:.*' + + - label: "build" + title: '^build:.*' + + - label: "chore" + title: '^chore:.*' + + - label: "ci" + title: '^ci:.*' + + - label: "perf" + title: '^perf:.*' + + - label: "refactor" + title: '^refactor:.*' + + - label: "revert" + title: '^revert:.*' + + - label: "style" + title: '^style:.*' + + - label: "Documentation" + title: '^docs:.*' + + - label: 'API' + title: '.*openapi.*' + + - label: 'Translation' + files: + - 'stirling-pdf/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}.properties' + - 'scripts/ignore_translation.toml' + - 'stirling-pdf/src/main/resources/templates/fragments/languages.html' + - '.github/scripts/check_language_properties.py' + + - label: 'Front End' + files: + - 'stirling-pdf/src/main/resources/templates/.*' + - 'proprietary/src/main/resources/templates/.*' + - 'stirling-pdf/src/main/resources/static/.*' + - 'proprietary/src/main/resources/static/.*' + - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/.*' + - 'stirling-pdf/src/main/java/stirling/software/SPDF/UI/.*' + + - label: 'Java' + files: + - 'common/src/main/java/.*.java' + - 'proprietary/src/main/java/.*.java' + - 'stirling-pdf/src/main/java/.*.java' + + - label: 'Back End' + files: + - 'stirling-pdf/src/main/java/stirling/software/SPDF/config/.*' + - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/.*' + - 'stirling-pdf/src/main/resources/settings.yml.template' + - 'stirling-pdf/src/main/resources/application.properties' + - 'stirling-pdf/src/main/resources/banner.txt' + - 'scripts/png_to_webp.py' + - 'split_photos.py' + - 'application.properties' + + - label: 'Security' + files: + - 'proprietary/src/main/java/stirling/software/proprietary/security/.*' + - 'scripts/download-security-jar.sh' + - '.github/workflows/dependency-review.yml' + - '.github/workflows/scorecards.yml' + + - label: 'API' + files: + - 'stirling-pdf/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java' + - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java' + - 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/api/.*' + - 'stirling-pdf/src/main/java/stirling/software/SPDF/model/api/.*' + - 'scripts/png_to_webp.py' + - 'split_photos.py' + - '.github/workflows/swagger.yml' + + - label: 'Documentation' + files: + - '.*.md' + - 'scripts/counter_translation.py' + - 'scripts/ignore_translation.toml' + + - label: 'Docker' + files: + - '.github/workflows/build.yml' + - '.github/workflows/push-docker.yml' + - 'Dockerfile' + - 'Dockerfile.fat' + - 'Dockerfile.ultra-lite' + - 'exampleYmlFiles/*.yml' + - 'scripts/download-security-jar.sh' + - 'scripts/init.sh' + - 'scripts/init-without-ocr.sh' + - 'scripts/installFonts.sh' + - 'test.sh' + - 'test2.sh' + + - label: 'Devtools' + files: + - '.devcontainer/.*' + - 'Dockerfile.dev' + - '.vscode/.*' + - '.editorconfig' + - '.pre-commit-config' + - '.github/workflows/pre_commit.yml' + - 'HowToAddNewLanguage.md' + + - label: 'Test' + files: + - 'common/src/test/.*' + - 'proprietary/src/test/.*' + - 'stirling-pdf/src/test/.*' + - 'testing/.*' + - '.github/workflows/scorecards.yml' + + - label: 'Github' + files: + - '.github/.*' + + - label: 'Gradle' + files: + - 'gradle/.*' + - 'gradlew' + - 'gradlew.bat' + - 'settings.gradle' + - 'build.gradle' + - 'common/build.gradle' + - 'proprietary/build.gradle' + - 'stirling-pdf/build.gradle' diff --git a/.github/labeler-config.yml b/.github/labeler-config.yml index bb52c7b85..d1a340065 100644 --- a/.github/labeler-config.yml +++ b/.github/labeler-config.yml @@ -1,60 +1,45 @@ Translation: - changed-files: - - any-glob-to-any-file: 'src/main/resources/messages_*_*.properties' + - any-glob-to-any-file: 'stirling-pdf/src/main/resources/messages_*_*.properties' - any-glob-to-any-file: 'scripts/ignore_translation.toml' - - any-glob-to-any-file: 'src/main/resources/templates/fragments/languages.html' + - any-glob-to-any-file: 'stirling-pdf/src/main/resources/templates/fragments/languages.html' Front End: - changed-files: - - any-glob-to-any-file: 'src/main/resources/templates/**/*' - - any-glob-to-any-file: 'src/main/resources/static/**/*' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/web/**' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/UI/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/main/resources/templates/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/main/resources/static/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/**' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/UI/**/*' Java: - changed-files: - - any-glob-to-any-file: 'src/main/java/**/*.java' + - any-glob-to-any-file: 'common/src/main/java/**/*.java' + - any-glob-to-any-file: 'proprietary/src/main/java/**/*.java' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/**/*.java' Back End: - changed-files: - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/config/**/*' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/**/*' - - any-glob-to-any-file: 'src/main/resources/settings.yml.template' - - any-glob-to-any-file: 'src/main/resources/application.properties' - - any-glob-to-any-file: 'src/main/resources/banner.txt' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/config/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/main/resources/settings.yml.template' + - any-glob-to-any-file: 'stirling-pdf/src/main/resources/application.properties' + - any-glob-to-any-file: 'stirling-pdf/src/main/resources/banner.txt' - any-glob-to-any-file: 'scripts/png_to_webp.py' - any-glob-to-any-file: 'split_photos.py' Security: - changed-files: - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/config/interfaces/DatabaseInterface.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/config/security/**/*' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/api/DatabaseController.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/api/EmailController.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/api/H2SQLController.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/web/AccountWebController.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/web/DatabaseWebController.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/api/UserController.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/api/Email.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/exception/BackupNotFoundException.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/exception/NoProviderFoundExceptionjava' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/provider/**/*' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/AuthenticationType.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/ApiKeyAuthenticationToken.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/AttemptCounter.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/Authority.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/PersistentLogin.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/SessionEntity.java' + - any-glob-to-any-file: 'proprietary/src/main/java/stirling/software/proprietary/security/**/*' - any-glob-to-any-file: 'scripts/download-security-jar.sh' - any-glob-to-any-file: '.github/workflows/dependency-review.yml' - any-glob-to-any-file: '.github/workflows/scorecards.yml' API: - changed-files: - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/config/OpenApiConfig.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/web/MetricsController.java' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/controller/api/**/*' - - any-glob-to-any-file: 'src/main/java/stirling/software/SPDF/model/api/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/config/OpenApiConfig.java' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/web/MetricsController.java' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/controller/api/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/main/java/stirling/software/SPDF/model/api/**/*' - any-glob-to-any-file: 'scripts/png_to_webp.py' - any-glob-to-any-file: 'split_photos.py' - any-glob-to-any-file: '.github/workflows/swagger.yml' @@ -88,7 +73,9 @@ Devtools: Test: - changed-files: - any-glob-to-any-file: 'cucumber/**/*' - - any-glob-to-any-file: 'src/test/**/*' + - any-glob-to-any-file: 'common/src/test/**/*' + - any-glob-to-any-file: 'proprietary/src/test/**/*' + - any-glob-to-any-file: 'stirling-pdf/src/test/**/*' - any-glob-to-any-file: 'src/testing/**/*' - any-glob-to-any-file: '.pre-commit-config' - any-glob-to-any-file: '.github/workflows/pre_commit.yml' diff --git a/.github/labels.yml b/.github/labels.yml index f4e077f0a..b7f5642e7 100644 --- a/.github/labels.yml +++ b/.github/labels.yml @@ -111,3 +111,67 @@ - name: "Devtools" color: "FF9E1F" description: "Development tools" +- name: "Bugfix" + color: "FF9E1F" + description: "Pull requests that fix bugs" +- name: "Gradle" + color: "FF9E1F" + description: "Pull requests that update Gradle code" +- name: "build" + color: "1E90FF" + description: "Changes that affect the build system or external dependencies" +- name: "chore" + color: "FFD700" + description: "Routine tasks or maintenance that don't modify src or test files" +- name: "ci" + color: "4682B4" + description: "Changes to CI configuration files and scripts" +- name: "perf" + color: "FF69B4" + description: "Changes that improve performance" +- name: "refactor" + color: "9932CC" + description: "Code changes that neither fix a bug nor add a feature" +- name: "revert" + color: "DC143C" + description: "Reverts a previous commit" +- name: "style" + color: "FFA500" + description: "Changes that do not affect the meaning of the code (formatting, etc.)" +- name: "admin" + color: "195055" +- name: "codex" + color: "ededed" + description: null +- name: "Github" + color: "0052CC" +- name: "github_actions" + color: "000000" + description: "Pull requests that update GitHub Actions code" +- name: "needs-changes" + color: "A65A86" +- name: "on-hold" + color: "2526F9" +- name: "python" + color: "2b67c6" + description: "Pull requests that update Python code" +- name: "size:L" + color: "eb9500" + description: "This PR changes 100-499 lines ignoring generated files." +- name: "size:M" + color: "ebb800" + description: "This PR changes 30-99 lines ignoring generated files." +- name: "size:S" + color: "77b800" + description: "This PR changes 10-29 lines ignoring generated files." +- name: "size:XL" + color: "ff823f" + description: "This PR changes 500-999 lines ignoring generated files." +- name: "size:XS" + color: "00ff00" + description: "This PR changes 0-9 lines ignoring generated files." +- name: "size:XXL" + color: "ffb8b8" + description: "This PR changes 1000+ lines ignoring generated files." +- name: "to research" + color: "FBCA04" diff --git a/.github/scripts/check_language_properties.py b/.github/scripts/check_language_properties.py index 10e6fb650..659ff7027 100644 --- a/.github/scripts/check_language_properties.py +++ b/.github/scripts/check_language_properties.py @@ -196,7 +196,9 @@ def check_for_differences(reference_file, file_list, branch, actor): if len(file_list) == 1: file_arr = file_list[0].split() - base_dir = os.path.abspath(os.path.join(os.getcwd(), "src", "main", "resources")) + base_dir = os.path.abspath( + os.path.join(os.getcwd(), "stirling-pdf", "src", "main", "resources") + ) for file_path in file_arr: file_normpath = os.path.normpath(file_path) @@ -216,10 +218,19 @@ def check_for_differences(reference_file, file_list, branch, actor): or ( # only local windows command not file_normpath.startswith( - os.path.join("", "src", "main", "resources", "messages_") + os.path.join( + "", "stirling-pdf", "src", "main", "resources", "messages_" + ) ) and not file_normpath.startswith( - os.path.join(os.getcwd(), "src", "main", "resources", "messages_") + os.path.join( + os.getcwd(), + "stirling-pdf", + "src", + "main", + "resources", + "messages_", + ) ) ) or not file_normpath.endswith(".properties") @@ -317,7 +328,7 @@ def check_for_differences(reference_file, file_list, branch, actor): report.append("## ❌ Overall Check Status: **_Failed_**") report.append("") report.append( - f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/src/main/resources/messages_en_GB.properties)" + f"@{actor} please check your translation if it conforms to the standard. Follow the format of [messages_en_GB.properties](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/stirling-pdf/src/main/resources/messages_en_GB.properties)" ) else: report.append("## ✅ Overall Check Status: **_Success_**") @@ -377,7 +388,12 @@ if __name__ == "__main__": else: file_list = glob.glob( os.path.join( - os.getcwd(), "src", "main", "resources", "messages_*.properties" + os.getcwd(), + "stirling-pdf", + "src", + "main", + "resources", + "messages_*.properties", ) ) update_missing_keys(args.reference_file, file_list) diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml index 14566855b..874081068 100644 --- a/.github/workflows/PR-Demo-Comment-with-react.yml +++ b/.github/workflows/PR-Demo-Comment-with-react.yml @@ -37,11 +37,12 @@ jobs: pr_repository: ${{ steps.get-pr-info.outputs.repository }} pr_ref: ${{ steps.get-pr-info.outputs.ref }} comment_id: ${{ github.event.comment.id }} - enable_security: ${{ steps.check-security-flag.outputs.enable_security }} - + disable_security: ${{ steps.check-security-flag.outputs.disable_security }} + enable_pro: ${{ steps.check-pro-flag.outputs.enable_pro }} + enable_enterprise: ${{ steps.check-pro-flag.outputs.enable_enterprise }} steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -84,7 +85,7 @@ jobs: core.setOutput('repository', repository); core.setOutput('ref', pr.head.ref); - + - name: Check for security/login flag id: check-security-flag env: @@ -92,10 +93,29 @@ jobs: run: | if [[ "$COMMENT_BODY" == *"security"* ]] || [[ "$COMMENT_BODY" == *"login"* ]]; then echo "Security flags detected in comment" - echo "enable_security=true" >> $GITHUB_OUTPUT + echo "disable_security=false" >> $GITHUB_OUTPUT else echo "No security flags detected in comment" - echo "enable_security=false" >> $GITHUB_OUTPUT + echo "disable_security=true" >> $GITHUB_OUTPUT + fi + + - name: Check for pro flag + id: check-pro-flag + env: + COMMENT_BODY: ${{ github.event.comment.body }} + run: | + if [[ "$COMMENT_BODY" == *"pro"* ]] || [[ "$COMMENT_BODY" == *"premium"* ]]; then + echo "pro flags detected in comment" + echo "enable_pro=true" >> $GITHUB_OUTPUT + echo "enable_enterprise=false" >> $GITHUB_OUTPUT + elif [[ "$COMMENT_BODY" == *"enterprise"* ]]; then + echo "enterprise flags detected in comment" + echo "enable_enterprise=true" >> $GITHUB_OUTPUT + echo "enable_pro=true" >> $GITHUB_OUTPUT + else + echo "No pro or enterprise flags detected in comment" + echo "enable_pro=false" >> $GITHUB_OUTPUT + echo "enable_enterprise=false" >> $GITHUB_OUTPUT fi - name: Add 'in_progress' reaction to comment @@ -129,7 +149,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -155,17 +175,17 @@ jobs: - name: Run Gradle Command run: | - if [ "${{ needs.check-comment.outputs.enable_security }}" == "true" ]; then - export DOCKER_ENABLE_SECURITY=true + if [ "${{ needs.check-comment.outputs.disable_security }}" == "true" ]; then + export DISABLE_ADDITIONAL_FEATURES=true else - export DOCKER_ENABLE_SECURITY=false + export DISABLE_ADDITIONAL_FEATURES=false fi ./gradlew clean build env: STIRLING_PDF_DESKTOP_UI: false - name: Set up Docker Buildx - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - name: Get version number id: versionNumber @@ -180,7 +200,7 @@ jobs: password: ${{ secrets.DOCKER_HUB_API }} - name: Build and push PR-specific image - uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0 + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: context: . file: ./Dockerfile @@ -199,16 +219,31 @@ jobs: id: deploy run: | # Set security settings based on flags - if [ "${{ needs.check-comment.outputs.enable_security }}" == "true" ]; then - DOCKER_SECURITY="true" + if [ "${{ needs.check-comment.outputs.disable_security }}" == "false" ]; then + DISABLE_ADDITIONAL_FEATURES="false" LOGIN_SECURITY="true" SECURITY_STATUS="🔒 Security Enabled" else - DOCKER_SECURITY="false" + DISABLE_ADDITIONAL_FEATURES="true" LOGIN_SECURITY="false" SECURITY_STATUS="Security Disabled" fi + # Set pro/enterprise settings (enterprise implies pro) + if [ "${{ needs.check-comment.outputs.enable_enterprise }}" == "true" ]; then + PREMIUM_ENABLED="true" + PREMIUM_KEY="${{ secrets.ENTERPRISE_KEY }}" + PREMIUM_PROFEATURES_AUDIT_ENABLED="true" + elif [ "${{ needs.check-comment.outputs.enable_pro }}" == "true" ]; then + PREMIUM_ENABLED="true" + PREMIUM_KEY="${{ secrets.PREMIUM_KEY }}" + PREMIUM_PROFEATURES_AUDIT_ENABLED="true" + else + PREMIUM_ENABLED="false" + PREMIUM_KEY="" + PREMIUM_PROFEATURES_AUDIT_ENABLED="false" + fi + # First create the docker-compose content locally cat > docker-compose.yml << EOF version: '3.3' @@ -223,7 +258,7 @@ jobs: - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/config:/configs:rw - /stirling/PR-${{ needs.check-comment.outputs.pr_number }}/logs:/logs:rw environment: - DOCKER_ENABLE_SECURITY: "${DOCKER_SECURITY}" + DISABLE_ADDITIONAL_FEATURES: "${DISABLE_ADDITIONAL_FEATURES}" SECURITY_ENABLELOGIN: "${LOGIN_SECURITY}" SYSTEM_DEFAULTLOCALE: en-GB UI_APPNAME: "Stirling-PDF PR#${{ needs.check-comment.outputs.pr_number }}" @@ -232,6 +267,9 @@ jobs: SYSTEM_MAXFILESIZE: "100" METRICS_ENABLED: "true" SYSTEM_GOOGLEVISIBILITY: "false" + PREMIUM_KEY: "${PREMIUM_KEY}" + PREMIUM_ENABLED: "${PREMIUM_ENABLED}" + PREMIUM_PROFEATURES_AUDIT_ENABLED: "${PREMIUM_PROFEATURES_AUDIT_ENABLED}" restart: on-failure:5 EOF @@ -250,7 +288,7 @@ jobs: docker-compose pull docker-compose up -d ENDSSH - + # Set output for use in PR comment echo "security_status=${SECURITY_STATUS}" >> $GITHUB_ENV diff --git a/.github/workflows/PR-Demo-cleanup.yml b/.github/workflows/PR-Demo-cleanup.yml index 1962bb83d..ae17ee7c8 100644 --- a/.github/workflows/PR-Demo-cleanup.yml +++ b/.github/workflows/PR-Demo-cleanup.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit diff --git a/.github/workflows/auto-labeler.yml b/.github/workflows/auto-labeler.yml index 5f350d2d4..5828a2556 100644 --- a/.github/workflows/auto-labeler.yml +++ b/.github/workflows/auto-labeler.yml @@ -13,7 +13,7 @@ jobs: pull-requests: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit diff --git a/.github/workflows/auto-labelerV2.yml b/.github/workflows/auto-labelerV2.yml new file mode 100644 index 000000000..dec73ddac --- /dev/null +++ b/.github/workflows/auto-labelerV2.yml @@ -0,0 +1,35 @@ +name: "Auto Pull Request Labeler V2" +on: + pull_request_target: + types: [opened, synchronize] + +permissions: + contents: read + +jobs: + labeler: + runs-on: ubuntu-latest + permissions: + pull-requests: write + steps: + - name: Harden Runner + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Setup GitHub App Bot + id: setup-bot + uses: ./.github/actions/setup-bot + with: + app-id: ${{ secrets.GH_APP_ID }} + private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} + + - uses: srvaroa/labeler@0a20eccb8c94a1ee0bed5f16859aece1c45c3e55 # v1.13.0 + with: + config_path: .github/labeler-config-srvaroa.yml + use_local_config: false + fail_on_error: true + env: + GITHUB_TOKEN: "${{ steps.setup-bot.outputs.token }}" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 1d5016ca8..365676294 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -21,10 +21,11 @@ jobs: fail-fast: false matrix: jdk-version: [17, 21] + spring-security: [true, false] steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -37,32 +38,59 @@ jobs: java-version: ${{ matrix.jdk-version }} distribution: "temurin" - - name: Build with Gradle and no spring security + - name: Build with Gradle and spring security ${{ matrix.spring-security }} run: ./gradlew clean build env: - DOCKER_ENABLE_SECURITY: false + DISABLE_ADDITIONAL_FEATURES: ${{ matrix.spring-security }} - - name: Build with Gradle and with spring security - run: ./gradlew clean build - env: - DOCKER_ENABLE_SECURITY: true + - name: Check Test Reports Exist + id: check-reports + if: always() + run: | + declare -a dirs=( + "stirling-pdf/build/reports/tests/" + "stirling-pdf/build/test-results/" + "common/build/reports/tests/" + "common/build/test-results/" + "proprietary/build/reports/tests/" + "proprietary/build/test-results/" + ) + missing_reports=() + for dir in "${dirs[@]}"; do + if [ ! -d "$dir" ]; then + missing_reports+=("$dir") + fi + done + if [ ${#missing_reports[@]} -gt 0 ]; then + echo "ERROR: The following required test report directories are missing:" + printf '%s\n' "${missing_reports[@]}" + exit 1 + fi + echo "All required test report directories are present" - name: Upload Test Reports if: always() uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: - name: test-reports-jdk-${{ matrix.jdk-version }} + name: test-reports-jdk-${{ matrix.jdk-version }}-spring-security-${{ matrix.spring-security }} path: | - build/reports/tests/ - build/test-results/ - build/reports/problems/ + stirling-pdf/build/reports/tests/ + stirling-pdf/build/test-results/ + stirling-pdf/build/reports/problems/ + common/build/reports/tests/ + common/build/test-results/ + common/build/reports/problems/ + proprietary/build/reports/tests/ + proprietary/build/test-results/ + proprietary/build/reports/problems/ retention-days: 3 + if-no-files-found: warn check-licence: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -106,7 +134,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -120,7 +148,7 @@ jobs: distribution: "adopt" - name: Set up Docker Buildx - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - name: Install Docker Compose run: | diff --git a/.github/workflows/check_properties.yml b/.github/workflows/check_properties.yml index c8640ff37..c1032d00c 100644 --- a/.github/workflows/check_properties.yml +++ b/.github/workflows/check_properties.yml @@ -4,7 +4,7 @@ on: pull_request_target: types: [opened, synchronize, reopened] paths: - - "src/main/resources/messages_*.properties" + - "stirling-pdf/src/main/resources/messages_*.properties" permissions: contents: read # Allow read access to repository content @@ -18,7 +18,7 @@ jobs: pull-requests: write # Allow writing to pull requests steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -36,6 +36,7 @@ jobs: id: get-pr-data uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: + github-token: ${{ steps.setup-bot.outputs.token }} script: | const prNumber = context.payload.pull_request.number; const repoOwner = context.payload.repository.owner.login; @@ -56,16 +57,30 @@ jobs: - name: Fetch PR changed files id: fetch-pr-changes env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.setup-bot.outputs.token }} run: | echo "Fetching PR changed files..." echo "Getting list of changed files from PR..." - gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt # Filter only matching property files + # Check if PR number exists + if [ -z "${{ steps.get-pr-data.outputs.pr_number }}" ]; then + echo "Error: PR number is empty" + exit 1 + fi + # Get changed files and filter for properties files, handle case where no matches are found + gh pr view ${{ steps.get-pr-data.outputs.pr_number }} --json files -q ".files[].path" | grep -E '^stirling-pdf/src/main/resources/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$' > changed_files.txt || echo "No matching properties files found in PR" + # Check if any files were found + if [ ! -s changed_files.txt ]; then + echo "No properties files changed in this PR" + echo "Workflow will exit early as no relevant files to check" + exit 0 + fi + echo "Found $(wc -l < changed_files.txt) matching properties files" - name: Determine reference file test id: determine-file uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: + github-token: ${{ steps.setup-bot.outputs.token }} script: | const fs = require("fs"); const path = require("path"); @@ -100,8 +115,11 @@ jobs: // Filter for relevant files based on the PR changes const changedFiles = files - .map(file => file.filename) - .filter(file => /^src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file)); + .filter(file => + file.status !== "removed" && + /^stirling-pdf\/src\/main\/resources\/messages_[a-zA-Z_]{2}_[a-zA-Z_]{2,7}\.properties$/.test(file.filename) + ) + .map(file => file.filename); console.log("Changed files:", changedFiles); @@ -139,12 +157,12 @@ jobs: // Determine reference file let referenceFilePath; - if (changedFiles.includes("src/main/resources/messages_en_GB.properties")) { + if (changedFiles.includes("stirling-pdf/src/main/resources/messages_en_GB.properties")) { console.log("Using PR branch reference file."); const { data: fileContent } = await github.rest.repos.getContent({ owner: prRepoOwner, repo: prRepoName, - path: "src/main/resources/messages_en_GB.properties", + path: "stirling-pdf/src/main/resources/messages_en_GB.properties", ref: branch, }); @@ -156,7 +174,7 @@ jobs: const { data: fileContent } = await github.rest.repos.getContent({ owner: repoOwner, repo: repoName, - path: "src/main/resources/messages_en_GB.properties", + path: "stirling-pdf/src/main/resources/messages_en_GB.properties", ref: "main", }); @@ -206,6 +224,7 @@ jobs: if: env.SCRIPT_OUTPUT != '' uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 with: + github-token: ${{ steps.setup-bot.outputs.token }} script: | const { GITHUB_REPOSITORY, SCRIPT_OUTPUT } = process.env; const [repoOwner, repoName] = GITHUB_REPOSITORY.split('/'); diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 5a662f423..4f44295f7 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit diff --git a/.github/workflows/licenses-update.yml b/.github/workflows/licenses-update.yml index e040e5436..227948288 100644 --- a/.github/workflows/licenses-update.yml +++ b/.github/workflows/licenses-update.yml @@ -19,7 +19,7 @@ jobs: repository-projects: write # Required for enabling automerge steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -42,7 +42,7 @@ jobs: distribution: "adopt" - name: Setup Gradle - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0 + uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1 - name: Check licenses for compatibility run: ./gradlew clean checkLicense @@ -57,11 +57,11 @@ jobs: - name: Move and rename license file run: | - mv build/reports/dependency-license/index.json src/main/resources/static/3rdPartyLicenses.json + mv build/reports/dependency-license/index.json stirling-pdf/src/main/resources/static/3rdPartyLicenses.json - name: Commit changes run: | - git add src/main/resources/static/3rdPartyLicenses.json + git add stirling-pdf/src/main/resources/static/3rdPartyLicenses.json git diff --staged --quiet || echo "CHANGES_DETECTED=true" >> $GITHUB_ENV - name: Create Pull Request @@ -78,7 +78,7 @@ jobs: title: "Update 3rd Party Licenses" body: | Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot] - labels: licenses,github-actions + labels: Licenses,github-actions draft: false delete-branch: true sign-commits: true diff --git a/.github/workflows/manage-label.yml b/.github/workflows/manage-label.yml index 73ece41ae..3f123afbd 100644 --- a/.github/workflows/manage-label.yml +++ b/.github/workflows/manage-label.yml @@ -15,7 +15,7 @@ jobs: issues: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml index dd8f54a9b..e2f33fae0 100644 --- a/.github/workflows/multiOSReleases.yml +++ b/.github/workflows/multiOSReleases.yml @@ -21,7 +21,7 @@ jobs: versionMac: ${{ steps.versionNumberMac.outputs.versionNumberMac }} steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -48,15 +48,15 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - enable_security: [true, false] + disable_security: [true, false] include: - - enable_security: true + - disable_security: false file_suffix: "-with-login" - - enable_security: false + - disable_security: true file_suffix: "" steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -68,14 +68,14 @@ jobs: java-version: "21" distribution: "temurin" - - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0 + - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1 with: gradle-version: 8.14 - - name: Generate jar (With Security=${{ matrix.enable_security }}) + - name: Generate jar (Disable Security=${{ matrix.disable_security }}) run: ./gradlew clean createExe env: - DOCKER_ENABLE_SECURITY: ${{ matrix.enable_security }} + DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }} STIRLING_PDF_DESKTOP_UI: false - name: Rename binaries @@ -98,15 +98,15 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - enable_security: [true, false] + disable_security: [true, false] include: - - enable_security: true + - disable_security: false file_suffix: "with-login-" - - enable_security: false + - disable_security: true file_suffix: "" steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -144,7 +144,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -156,7 +156,7 @@ jobs: java-version: "21" distribution: "temurin" - - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0 + - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1 with: gradle-version: 8.14 @@ -171,7 +171,7 @@ jobs: - name: Build Installer run: ./gradlew build jpackage -x test --info env: - DOCKER_ENABLE_SECURITY: false + DISABLE_ADDITIONAL_FEATURES: true STIRLING_PDF_DESKTOP_UI: true BROWSER_OPEN: true @@ -234,7 +234,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -248,7 +248,7 @@ jobs: - name: Install Cosign if: matrix.os == 'windows-latest' - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2 + uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0 - name: Generate key pair if: matrix.os == 'windows-latest' @@ -297,7 +297,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -306,7 +306,7 @@ jobs: - name: Display structure of downloaded files run: ls -R - name: Upload binaries, attestations and signatures to Release and create GitHub Release - uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0 + uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2 with: tag_name: v${{ needs.read_versions.outputs.version }} generate_release_notes: true diff --git a/.github/workflows/pre_commit.yml b/.github/workflows/pre_commit.yml index 5cca4e76e..1190c49cd 100644 --- a/.github/workflows/pre_commit.yml +++ b/.github/workflows/pre_commit.yml @@ -16,7 +16,7 @@ jobs: pull-requests: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml index ab45d3a52..39f022586 100644 --- a/.github/workflows/push-docker.yml +++ b/.github/workflows/push-docker.yml @@ -18,7 +18,7 @@ jobs: id-token: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -30,25 +30,25 @@ jobs: java-version: "17" distribution: "temurin" - - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0 + - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1 with: gradle-version: 8.14 - name: Run Gradle Command run: ./gradlew clean build env: - DOCKER_ENABLE_SECURITY: false + DISABLE_ADDITIONAL_FEATURES: true STIRLING_PDF_DESKTOP_UI: false - name: Install cosign if: github.ref == 'refs/heads/master' - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2 + uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0 with: cosign-release: "v2.4.1" - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - name: Get version number id: versionNumber @@ -90,7 +90,7 @@ jobs: - name: Build and push main Dockerfile id: build-push-regular - uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0 + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: builder: ${{ steps.buildx.outputs.name }} context: . @@ -135,7 +135,7 @@ jobs: - name: Build and push Dockerfile-ultra-lite id: build-push-lite - uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0 + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 if: github.ref != 'refs/heads/main' with: context: . @@ -166,7 +166,7 @@ jobs: - name: Build and push main Dockerfile fat id: build-push-fat - uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0 + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 if: github.ref != 'refs/heads/main' with: builder: ${{ steps.buildx.outputs.name }} diff --git a/.github/workflows/releaseArtifacts.yml b/.github/workflows/releaseArtifacts.yml index 71be7b03a..76c711734 100644 --- a/.github/workflows/releaseArtifacts.yml +++ b/.github/workflows/releaseArtifacts.yml @@ -13,17 +13,17 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - enable_security: [true, false] + disable_security: [true, false] include: - - enable_security: true + - disable_security: false file_suffix: "-with-login" - - enable_security: false + - disable_security: true file_suffix: "" outputs: version: ${{ steps.versionNumber.outputs.versionNumber }} steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -35,14 +35,14 @@ jobs: java-version: "17" distribution: "temurin" - - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0 + - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1 with: gradle-version: 8.14 - - name: Generate jar (With Security=${{ matrix.enable_security }}) + - name: Generate jar (Disable Security=${{ matrix.disable_security }}) run: ./gradlew clean createExe env: - DOCKER_ENABLE_SECURITY: ${{ matrix.enable_security }} + DISABLE_ADDITIONAL_FEATURES: ${{ matrix.disable_security }} STIRLING_PDF_DESKTOP_UI: false - name: Get version number @@ -75,15 +75,15 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - enable_security: [true, false] + disable_security: [true, false] include: - - enable_security: true + - disable_security: false file_suffix: "-with-login" - - enable_security: false + - disable_security: true file_suffix: "" steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -95,7 +95,7 @@ jobs: run: ls -R - name: Install Cosign - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2 + uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # v3.9.0 - name: Generate key pair run: cosign generate-key-pair @@ -153,15 +153,15 @@ jobs: contents: write strategy: matrix: - enable_security: [true, false] + disable_security: [true, false] include: - - enable_security: true + - disable_security: false file_suffix: "-with-login" - - enable_security: false + - disable_security: true file_suffix: "" steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -171,7 +171,7 @@ jobs: name: signed${{ matrix.file_suffix }} - name: Upload binaries, attestations and signatures to Release and create GitHub Release - uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0 + uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2 with: tag_name: v${{ needs.build.outputs.version }} generate_release_notes: true diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 8c6485b7b..a79dc0ec2 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -44,7 +44,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1 + uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2 with: results_file: results.sarif results_format: sarif @@ -74,6 +74,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18 + uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0 with: sarif_file: results.sarif diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml index f9ab27ecc..187e823ae 100644 --- a/.github/workflows/sonarqube.yml +++ b/.github/workflows/sonarqube.yml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -27,13 +27,13 @@ jobs: fetch-depth: 0 - name: Setup Gradle - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0 + uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1 - name: Build and analyze with Gradle env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - DOCKER_ENABLE_SECURITY: true + DISABLE_ADDITIONAL_FEATURES: false STIRLING_PDF_DESKTOP_UI: true run: | ./gradlew clean build sonar \ diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 4000f0e6f..17d81412a 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -16,7 +16,7 @@ jobs: pull-requests: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml index 0e06cb1ee..6b9307887 100644 --- a/.github/workflows/swagger.yml +++ b/.github/workflows/swagger.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -26,7 +26,7 @@ jobs: java-version: "17" distribution: "temurin" - - uses: gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326 # v4.4.0 + - uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1 - name: Generate Swagger documentation run: ./gradlew generateOpenApiDocs diff --git a/.github/workflows/sync_files.yml b/.github/workflows/sync_files.yml index 72aff82f1..f89f36b2a 100644 --- a/.github/workflows/sync_files.yml +++ b/.github/workflows/sync_files.yml @@ -8,8 +8,8 @@ on: paths: - "build.gradle" - "README.md" - - "src/main/resources/messages_*.properties" - - "src/main/resources/static/3rdPartyLicenses.json" + - "stirling-pdf/src/main/resources/messages_*.properties" + - "stirling-pdf/src/main/resources/static/3rdPartyLicenses.json" - "scripts/ignore_translation.toml" permissions: @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -30,7 +30,7 @@ jobs: id: setup-bot uses: ./.github/actions/setup-bot with: - app-id: ${{ vars.GH_APP_ID }} + app-id: ${{ secrets.GH_APP_ID }} private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} - name: Set up Python @@ -41,11 +41,11 @@ jobs: - name: Sync translation property files run: | - python .github/scripts/check_language_properties.py --reference-file "src/main/resources/messages_en_GB.properties" --branch main + python .github/scripts/check_language_properties.py --reference-file "stirling-pdf/src/main/resources/messages_en_GB.properties" --branch main - name: Commit translation files run: | - git add src/main/resources/messages_*.properties + git add stirling-pdf/src/main/resources/messages_*.properties git diff --staged --quiet || git commit -m ":memo: Sync translation files" || echo "No changes detected" - name: Install dependencies @@ -101,4 +101,4 @@ jobs: sign-commits: true add-paths: | README.md - src/main/resources/messages_*.properties + stirling-pdf/src/main/resources/messages_*.properties diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml index 07a23defe..d0244619d 100644 --- a/.github/workflows/testdriver.yml +++ b/.github/workflows/testdriver.yml @@ -12,7 +12,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -28,10 +28,10 @@ jobs: - name: Build with Gradle run: ./gradlew clean build env: - DOCKER_ENABLE_SECURITY: false + DISABLE_ADDITIONAL_FEATURES: true - name: Set up Docker Buildx - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - name: Get version number id: versionNumber @@ -46,7 +46,7 @@ jobs: password: ${{ secrets.DOCKER_HUB_API }} - name: Build and push test image - uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0 + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 with: context: . file: ./Dockerfile @@ -76,7 +76,7 @@ jobs: - /stirling/test-${{ github.sha }}/config:/configs:rw - /stirling/test-${{ github.sha }}/logs:/logs:rw environment: - DOCKER_ENABLE_SECURITY: "false" + DISABLE_ADDITIONAL_FEATURES: "true" SECURITY_ENABLELOGIN: "false" SYSTEM_DEFAULTLOCALE: en-GB UI_APPNAME: "Stirling-PDF Test" @@ -105,7 +105,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit @@ -134,7 +134,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0 + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 with: egress-policy: audit diff --git a/.gitignore b/.gitignore index 90d48ccea..ca949e769 100644 --- a/.gitignore +++ b/.gitignore @@ -13,6 +13,7 @@ local.properties .recommenders .classpath .project +*.local.json version.properties #### Stirling-PDF Files ### @@ -124,6 +125,9 @@ SwaggerDoc.json *.rar *.db /build +/stirling-pdf/build +/common/build +/proprietary/build # Byte-compiled / optimized / DLL files __pycache__/ @@ -193,4 +197,3 @@ id_ed25519.pub # node_modules node_modules/ -*.mjs diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index beec5eb99..b4b3841e6 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -20,7 +20,7 @@ repos: - --skip="./.*,*.csv,*.json,*.ambr" - --quiet-level=2 files: \.(html|css|js|py|md)$ - exclude: (.vscode|.devcontainer|src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js) + exclude: (.vscode|.devcontainer|stirling-pdf/src/main/resources|Dockerfile|.*/pdfjs.*|.*/thirdParty.*|bootstrap.*|.*\.min\..*|.*diff\.js) - repo: https://github.com/gitleaks/gitleaks rev: v8.26.0 hooks: diff --git a/src/main/java/stirling/software/SPDF/UnoconvServer.java b/.src/main/java/stirling/software/SPDF/UnoconvServer.java similarity index 100% rename from src/main/java/stirling/software/SPDF/UnoconvServer.java rename to .src/main/java/stirling/software/SPDF/UnoconvServer.java diff --git a/src/main/java/stirling/software/SPDF/controller/api/misc/RepairController.java b/.src/main/java/stirling/software/SPDF/controller/api/misc/RepairController.java similarity index 100% rename from src/main/java/stirling/software/SPDF/controller/api/misc/RepairController.java rename to .src/main/java/stirling/software/SPDF/controller/api/misc/RepairController.java diff --git a/src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java b/.src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java similarity index 100% rename from src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java rename to .src/main/java/stirling/software/SPDF/controller/api/misc/StampController.java diff --git a/src/main/resources/settings.yml.template b/.src/main/resources/settings.yml.template similarity index 100% rename from src/main/resources/settings.yml.template rename to .src/main/resources/settings.yml.template diff --git a/.vscode/settings.json b/.vscode/settings.json index e45bc4dd9..a2f0da613 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -50,8 +50,10 @@ ".vscode/", "bin/", "common/bin/", + "proprietary/bin/", "build/", "common/build/", + "proprietary/build/", "configs/", "customFiles/", "docs/", @@ -66,6 +68,7 @@ ".gitattributes", ".gitignore", "common/.gitignore", + "proprietary/.gitignore", ".pre-commit-config.yaml", ], // Enables signature help in Java. @@ -83,4 +86,9 @@ "spring.initializr.defaultLanguage": "Java", "spring.initializr.defaultGroupId": "stirling.software.SPDF", "spring.initializr.defaultArtifactId": "SPDF", + "java.project.sourcePaths": [ + "stirling-pdf/src/main/java", + "common/src/main/java", + "proprietary/src/main/java" + ], } diff --git a/DeveloperGuide.md b/DeveloperGuide.md index 32d480f5c..d2c9ddb2a 100644 --- a/DeveloperGuide.md +++ b/DeveloperGuide.md @@ -55,7 +55,7 @@ Stirling-PDF uses Lombok to reduce boilerplate code. Some IDEs, like Eclipse, do Visit the [Lombok website](https://projectlombok.org/setup/) for installation instructions specific to your IDE. 5. Add environment variable -For local testing, you should generally be testing the full 'Security' version of Stirling-PDF. To do this, you must add the environment flag DOCKER_ENABLE_SECURITY=true to your system and/or IDE build/run step. +For local testing, you should generally be testing the full 'Security' version of Stirling PDF. To do this, you must add the environment flag DISABLE_ADDITIONAL_FEATURES=false to your system and/or IDE build/run step. ## 4. Project Structure @@ -114,9 +114,9 @@ Stirling-PDF offers several Docker versions: Stirling-PDF provides several example Docker Compose files in the `exampleYmlFiles` directory, such as: -- `docker-compose-latest.yml`: Latest version without security features -- `docker-compose-latest-security.yml`: Latest version with security features enabled -- `docker-compose-latest-fat-security.yml`: Fat version with security features enabled +- `docker-compose-latest.yml`: Latest version without login and security features +- `docker-compose-latest-security.yml`: Latest version with login and security features enabled +- `docker-compose-latest-fat-security.yml`: Fat version with login and security features enabled These files provide pre-configured setups for different scenarios. For example, here's a snippet from `docker-compose-latest-security.yml`: @@ -137,11 +137,11 @@ services: ports: - "8080:8080" volumes: - - /stirling/latest/data:/usr/share/tessdata:rw - - /stirling/latest/config:/configs:rw - - /stirling/latest/logs:/logs:rw + - ./stirling/latest/data:/usr/share/tessdata:rw + - ./stirling/latest/config:/configs:rw + - ./stirling/latest/logs:/logs:rw environment: - DOCKER_ENABLE_SECURITY: "true" + DISABLE_ADDITIONAL_FEATURES: "false" SECURITY_ENABLELOGIN: "true" PUID: 1002 PGID: 1002 @@ -170,7 +170,7 @@ Stirling-PDF uses different Docker images for various configurations. The build 1. Set the security environment variable: ```bash - export DOCKER_ENABLE_SECURITY=false # or true for security-enabled builds + export DISABLE_ADDITIONAL_FEATURES=true # or false for to enable login and security features for builds ``` 2. Build the project with Gradle: @@ -193,10 +193,10 @@ Stirling-PDF uses different Docker images for various configurations. The build docker build --no-cache --pull --build-arg VERSION_TAG=alpha -t stirlingtools/stirling-pdf:latest-ultra-lite -f ./Dockerfile.ultra-lite . ``` - For the fat version (with security enabled): + For the fat version (with login and security features enabled): ```bash - export DOCKER_ENABLE_SECURITY=true + export DISABLE_ADDITIONAL_FEATURES=false docker build --no-cache --pull --build-arg VERSION_TAG=alpha -t stirlingtools/stirling-pdf:latest-fat -f ./Dockerfile.fat . ``` @@ -332,7 +332,7 @@ Thymeleaf is a server-side Java HTML template engine. It is used in Stirling-PDF ### Thymeleaf overview -In Stirling-PDF, Thymeleaf is used to create HTML templates that are rendered on the server side. These templates are located in the `src/main/resources/templates` directory. Thymeleaf templates use a combination of HTML and special Thymeleaf attributes to dynamically generate content. +In Stirling-PDF, Thymeleaf is used to create HTML templates that are rendered on the server side. These templates are located in the `stirling-pdf/src/main/resources/templates` directory. Thymeleaf templates use a combination of HTML and special Thymeleaf attributes to dynamically generate content. Some examples of this are: @@ -384,7 +384,7 @@ This would generate n entries of tr for each person in exampleData ### Adding a New Feature to the Backend (API) 1. **Create a New Controller:** - - Create a new Java class in the `src/main/java/stirling/software/SPDF/controller/api` directory. + - Create a new Java class in the `stirling-pdf/src/main/java/stirling/software/SPDF/controller/api` directory. - Annotate the class with `@RestController` and `@RequestMapping` to define the API endpoint. - Ensure to add API documentation annotations like `@Tag(name = "General", description = "General APIs")` and `@Operation(summary = "Crops a PDF document", description = "This operation takes an input PDF file and crops it according to the given coordinates. Input:PDF Output:PDF Type:SISO")`. @@ -411,7 +411,7 @@ This would generate n entries of tr for each person in exampleData ``` 2. **Define the Service Layer:** (Not required but often useful) - - Create a new service class in the `src/main/java/stirling/software/SPDF/service` directory. + - Create a new service class in the `stirling-pdf/src/main/java/stirling/software/SPDF/service` directory. - Implement the business logic for the new feature. ```java @@ -463,7 +463,7 @@ This would generate n entries of tr for each person in exampleData ### Adding a New Feature to the Frontend (UI) 1. **Create a New Thymeleaf Template:** - - Create a new HTML file in the `src/main/resources/templates` directory. + - Create a new HTML file in the `stirling-pdf/src/main/resources/templates` directory. - Use Thymeleaf attributes to dynamically generate content. - Use `extract-page.html` as a base example for the HTML template, which is useful to ensure importing of the general layout, navbar, and footer. @@ -507,7 +507,7 @@ This would generate n entries of tr for each person in exampleData ``` 2. **Create a New Controller for the UI:** - - Create a new Java class in the `src/main/java/stirling/software/SPDF/controller/ui` directory. + - Create a new Java class in the `stirling-pdf/src/main/java/stirling/software/SPDF/controller/ui` directory. - Annotate the class with `@Controller` and `@RequestMapping` to define the UI endpoint. ```java @@ -537,7 +537,7 @@ This would generate n entries of tr for each person in exampleData 3. **Update the Navigation Bar:** - Add a link to the new feature page in the navigation bar. - - Update the `src/main/resources/templates/fragments/navbar.html` file. + - Update the `stirling-pdf/src/main/resources/templates/fragments/navbar.html` file. ```html