fix(fe): Security mitigation for CVE-2024-45811 #8155
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pull Request Open | |
| on: | |
| pull_request: | |
| concurrency: | |
| # PR open and close use the same group, allowing only one at a time | |
| group: pr-${{ github.event.number }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| vars: | |
| name: Variables | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| url: ${{ steps.calculate.outputs.url }} | |
| steps: | |
| # steps.calculate.outputs.url => needs.vars.outputs.url | |
| - name: Calculate the deployment number | |
| id: calculate | |
| run: | | |
| echo "url=${{ github.event.repository.name }}-$((${{ github.event.number }} % 50))-frontend.apps.silver.devops.gov.bc.ca" >> $GITHUB_OUTPUT | |
| echo "url=${{ github.event.repository.name }}-$((${{ github.event.number }} % 50))-frontend.apps.silver.devops.gov.bc.ca" | |
| builds: | |
| name: Builds | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| strategy: | |
| matrix: | |
| package: [backend, database, frontend, legacy, processor] | |
| steps: | |
| - name: Build (backend) with Sectigo PEM | |
| if: ${{ matrix.package == 'backend' }} | |
| uses: bcgov/action-builder-ghcr@cb2629351c87dd1c2130073e4ebb7233a9653a63 # v4.4.1 | |
| with: | |
| package: backend | |
| tag_fallback: latest | |
| triggers: ('backend/') | |
| # Pass the PEM as a build-arg from GitHub Secrets; DO NOT commit the PEM file to repo | |
| build_args: | | |
| --build-arg SECTIGO_R46_PEM=${{ secrets.SECTIGO_R46_PEM }} | |
| - name: Build (other packages) | |
| if: ${{ matrix.package != 'backend' }} | |
| uses: bcgov/action-builder-ghcr@cb2629351c87dd1c2130073e4ebb7233a9653a63 # v4.4.1 | |
| with: | |
| package: ${{ matrix.package }} | |
| tag_fallback: latest | |
| triggers: ('${{ matrix.package }}/') | |
| deploy: | |
| name: Deploy (${{ github.event.number }}) | |
| needs: [builds] | |
| secrets: inherit | |
| uses: ./.github/workflows/.deploy.yml | |
| with: | |
| oracledb-port: 1521 | |
| oracledb-servicename: PR_${{ github.event.number }} | |
| oracledb-username: THE | |
| configmap-backend: |- | |
| features: | |
| staff: | |
| match: true | |
| info: | |
| app: | |
| component: backend | |
| ca: | |
| bc: | |
| gov: | |
| nrs: | |
| idirMaxSubmissions: 65535 | |
| otherMaxSubmissions: 65535 | |
| configmap-frontend: |- | |
| window.localStorage.setItem(\"VITE_FEATURE_FLAGS\",'{}'); | |
| tests: | |
| name: Tests | |
| needs: [deploy, vars] | |
| uses: ./.github/workflows/.automated-tests.yml | |
| permissions: | |
| pull-requests: write | |
| secrets: inherit | |
| with: | |
| url: ${{ needs.vars.outputs.url }} | |
| # ========================================================================== | |
| # WARNING: This job acts as the required merge gate for this workflow. | |
| # If you add a new job to this workflow, you MUST add its ID to the 'needs' | |
| # array below, otherwise its failure or cancellation will not block the PR! | |
| # ========================================================================== | |
| results: | |
| name: PR Results | |
| needs: [builds, deploy, tests] | |
| if: always() | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 1 | |
| steps: | |
| - name: Log Job Results Context | |
| run: | | |
| echo "=== Upstream Job Statuses ===" | |
| echo '${{ toJson(needs) }}' | |
| - name: Evaluate Overall Status | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') | |
| run: | | |
| echo "❌ Critical Check Failure: At least one required job has failed or was cancelled." | |
| exit 1 | |
| - name: Success Message | |
| run: echo "✅ All critical checks passed or were intentionally skipped!" |