Merge branch 'develop' into fix/correction-round-absent-parameter

Author: krusche

.github/workflows/ci-build.yml

@@ -318,7 +318,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: ls1intum/.github/.github/workflows/build-and-push-docker-image.yml@v1.2.0
+    uses: ls1intum/.github/.github/workflows/build-and-push-docker-image.yml@ee1b52f07891ed489887681c09c52b4a83fa9fb2  # v1.2.0
     with:
       # Check out the exact commit the sha-<commit> tag names (not the mutable branch tip), so image
       # content and the tag stay pinned to the same commit. The `type=ref` tags come from the event

.github/workflows/ci-quality.yml

@@ -229,8 +229,15 @@ jobs:
           total_violations=$((entitygraph_violations + query_violations))
 
           # Thresholds are technical debt; lower as violations are fixed.
+          #
+          # NOTE on max_query: the detector counts JOIN FETCHes without distinguishing what is being fetched. The risk it
+          # exists to catch is fetching several collections in one query, which multiplies rows. Fetching a to-one
+          # association does not: it adds columns, and it replaces a secondary select that Hibernate would otherwise
+          # issue anyway, once per repository call, because no transaction spans two of them. Four participation queries
+          # deliberately fetch their eager to-one chain (exercise, course, exercise group, exam, exam course) for that
+          # reason, which is why this is 29 rather than 25.
           max_entitygraph=11
-          max_query=25
+          max_query=29
           max_total=$((max_entitygraph + max_query))
 
           fail=false

.github/workflows/ci-workflows.yml

@@ -43,15 +43,21 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Run actionlint
-        # Pin the install script to a release tag, not `main` — it executes a downloaded
-        # binary. `-shellcheck=` disables integrated shellcheck, which flags pre-existing
-        # style issues in the legacy deploy workflows.
+        # The install script is pinned to a release tag AND to its SHA-256, because piping it
+        # straight into bash would execute whatever that URL returns. A tag can be moved; the
+        # checksum cannot, so verify before running. Bump both together when raising the version.
+        # `-shellcheck=` disables integrated shellcheck, which flags pre-existing style issues
+        # in the legacy deploy workflows.
         env:
           ACTIONLINT_VERSION: '1.7.12'
+          ACTIONLINT_INSTALLER_SHA256: '72fa3e45ac20f3c3a512d6747b4fcf719e21f890e8c43e78d48a41fdfb900c4e'
         run: |
-          bash <(curl --silent --location \
-            "https://raw.githubusercontent.com/rhysd/actionlint/v${ACTIONLINT_VERSION}/scripts/download-actionlint.bash") \
-            "${ACTIONLINT_VERSION}"
+          curl --silent --show-error --fail --location \
+            "https://raw.githubusercontent.com/rhysd/actionlint/v${ACTIONLINT_VERSION}/scripts/download-actionlint.bash" \
+            --output download-actionlint.bash
+          echo "${ACTIONLINT_INSTALLER_SHA256}  download-actionlint.bash" | sha256sum --check --strict
+          bash download-actionlint.bash "${ACTIONLINT_VERSION}"
+          rm download-actionlint.bash
           ./actionlint -color -shellcheck=
 
       - name: Check version pins are in sync

.github/workflows/scorecard.yml

@@ -3,8 +3,16 @@
 # vulnerability handling, and so on).
 #
 # It reports on practices Artemis already follows, which is the point: it turns them into an
-# externally computed, checkable number instead of a claim in a document. Findings land in the
-# code-scanning UI next to CodeQL, and `publish_results: true` feeds the badge in README.md.
+# externally computed, checkable number instead of a claim in a document. `publish_results: true`
+# feeds the badge in README.md and makes the score independently verifiable via
+# api.securityscorecards.dev; the full findings are attached to each run as `results.sarif`.
+#
+# The results are deliberately NOT uploaded to code scanning. Scorecard measures repository
+# posture, not exploitable defects: it reports passing scores ("28/30 changesets approved") and
+# not-applicable checks ("project is not fuzzed") as `error`-severity alerts, ~155 of them. Next
+# to CodeQL that buries the findings that describe an actual vulnerability, which is the one thing
+# the code-scanning tab has to stay useful for. Its fingerprints also embed the changing score
+# text, so dismissed findings reappear as new alerts on the next run.
 #
 # This is advisory. It never gates a pull request, and it does not run on pull requests at all:
 # the analysis needs repository-level metadata that a fork PR token cannot read.
@@ -33,8 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
-      security-events: write  # upload the SARIF result to code scanning
-      id-token: write         # Sigstore OIDC, required to publish the result
+      id-token: write  # Sigstore OIDC, required to publish the result
       contents: read
     steps:
       - name: Checkout
@@ -51,14 +58,10 @@ jobs:
           # the README badge and lets anyone re-check the score without access to this repository.
           publish_results: true
 
+      # The full findings live here rather than in the code-scanning tab (see the header comment).
       - name: Upload artifact
         uses: actions/upload-artifact@v7
         with:
           name: scorecard-results
           path: results.sarif
-          retention-days: 5
-
-      - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@v4
-        with:
-          sarif_file: results.sarif
+          retention-days: 30

.github/workflows/test-android.yml

@@ -36,6 +36,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions: {}  # default-deny; the job grants only what it needs
+
 jobs:
   e2e-tests:
     name: Android E2E Tests
@@ -50,6 +52,9 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository
     runs-on: [self-hosted, ase-large-android-sdk-34]
     timeout-minutes: 60
+    permissions:
+      contents: read  # check out this repo and the public artemis-android repo
+      checks: write   # dorny/test-reporter publishes the Android E2E results as a check run
 
     steps:
       - name: Checkout Main Artemis Repo (this repo)

.github/workflows/testserver-deployment.yml

@@ -132,7 +132,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: ls1intum/.github/.github/workflows/build-and-push-docker-image.yml@v1.2.0
+    uses: ls1intum/.github/.github/workflows/build-and-push-docker-image.yml@ee1b52f07891ed489887681c09c52b4a83fa9fb2  # v1.2.0
     with:
       ref: ${{ needs.determine-build-context.outputs.head_sha }}
       image-name: ls1intum/artemis

.github/workflows/validate-pr-title.yml

@@ -8,10 +8,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions: {}  # default-deny; the job grants only what it needs
+
 jobs:
   validate-pr-title:
     runs-on: ubuntu-latest
     timeout-minutes: 1
+    permissions:
+      contents: read
     steps:
       - uses: Slashgear/action-check-pr-title@161cede0311ec624ae3ee76a2c27522f7b6fa2d8  # v5.0.1
         with:

docker/artemis/Dockerfile

@@ -22,7 +22,7 @@ ARG WAR_FILE_STAGE="builder"
 #-----------------------------------------------------------------------------------------------------------------------
 # build stage
 #-----------------------------------------------------------------------------------------------------------------------
-FROM --platform=$BUILDPLATFORM docker.io/library/eclipse-temurin:25.0.3_9-jdk AS builder
+FROM --platform=$BUILDPLATFORM docker.io/library/eclipse-temurin:25.0.3_9-jdk@sha256:32861ec22e54af9597a3875c69001f57c0954648f5e3fcb6be601b4e35290ab5 AS builder
 
 # python3/build-essential were previously installed defensively for npm deps that
 # trigger node-gyp; no current Artemis dep needs that. If a future dep does, the
@@ -77,7 +77,7 @@ RUN \
 #-----------------------------------------------------------------------------------------------------------------------
 # external build stage
 #-----------------------------------------------------------------------------------------------------------------------
-FROM docker.io/library/alpine:3.23.5 AS external_builder
+FROM docker.io/library/alpine:3.23.5@sha256:fd791d74b68913cbb027c6546007b3f0d3bc45125f797758156952bc2d6daf40 AS external_builder
 
 #default path of the built .war files
 ARG WAR_FILE_PATH="/opt/artemis/build/libs"
@@ -97,7 +97,7 @@ FROM ${WAR_FILE_STAGE} AS war_file
 #-----------------------------------------------------------------------------------------------------------------------
 # extract stage (explode the WAR so the runtime image runs from a flat classpath -> faster startup)
 #-----------------------------------------------------------------------------------------------------------------------
-FROM --platform=$BUILDPLATFORM docker.io/library/eclipse-temurin:25.0.3_9-jdk AS extractor
+FROM --platform=$BUILDPLATFORM docker.io/library/eclipse-temurin:25.0.3_9-jdk@sha256:32861ec22e54af9597a3875c69001f57c0954648f5e3fcb6be601b4e35290ab5 AS extractor
 
 #default path of the built .war files
 ARG WAR_FILE_PATH="/opt/artemis/build/libs"
@@ -113,7 +113,7 @@ RUN java -Djarmode=tools -jar Artemis.war extract --destination /extract/app
 #-----------------------------------------------------------------------------------------------------------------------
 # runtime stage
 #-----------------------------------------------------------------------------------------------------------------------
-FROM docker.io/library/eclipse-temurin:25.0.3_9-jdk AS runtime
+FROM docker.io/library/eclipse-temurin:25.0.3_9-jdk@sha256:32861ec22e54af9597a3875c69001f57c0954648f5e3fcb6be601b4e35290ab5 AS runtime
 
 #default path of the built .war files
 ARG WAR_FILE_PATH="/opt/artemis/build/libs"

docker/jenkins/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/jenkins/jenkins:lts
+FROM docker.io/jenkins/jenkins:lts@sha256:8547df3b0db2803d158ecc9499207a056bb30c23fddc18bb5b4a4dc14e77dd09
 
 LABEL description="Jenkins with plugins pre-installed for Artemis"
 

docker/nginx/artemis-nginx.conf

@@ -35,6 +35,10 @@ map $rate_limit_exempt $rate_limit_key {
 
 # Rate limit for the login REST call, at most one request every two seconds
 limit_req_zone $rate_limit_key zone=loginlimit:10m rate=30r/m;
+# Rate limit for the login-options lookup that drives the identifier-first login form. The client calls it once per
+# login attempt, right before POST authenticate, so it gets the same budget as the login zone - but in a zone of its
+# own, so that consuming it does not halve the number of logins a shared campus address can perform.
+limit_req_zone $rate_limit_key zone=loginoptionslimit:10m rate=30r/m;
 # Rate limit for account recovery and registration (password reset init/finish, register).
 # Stricter than the login zone: these endpoints send mail and mutate credentials, and no
 # legitimate client calls them repeatedly.