Release 2.4.0

.github/workflows/build-images.yml

@@ -72,6 +72,8 @@ env:
   IGNORE_UNFIXED: 'true'
   SEVERITY: 'CRITICAL,HIGH'
   IMAGE_REPO: 'coreoasis/github-actions'
+  TRIVY_SKIP_DB_UPDATE: true
+  TRIVY_SKIP_JAVA_DB_UPDATE: true
 
 jobs:
   build:
@@ -163,7 +165,7 @@ jobs:
 
     - name: Store image size report
       if: success() || failure()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.dive }}
         path: ${{ matrix.dive }}
@@ -201,7 +203,7 @@ jobs:
 
     - name: Store CVE report
       if: success() || failure() && env.SEVERITY != 'SKIP'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.report }}
         path: ${{ matrix.report }}

.github/workflows/build-schema.yml

@@ -39,17 +39,17 @@ jobs:
     steps:
     - uses: actions/checkout@v3
 
-    - name: Set up Python 3.10
+    - name: Set up Python 3.12
       uses: actions/setup-python@v4
       with:
-        python-version: '3.10'
+        python-version: '3.12'
 
     - name: Install requirments
       run: pip install -r requirements-server.txt
 
     - name: Download package
       if: needs.ods_tools.outputs.whl_filename != ''
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: bin_package
         path: ${{ github.workspace }}/
@@ -83,21 +83,21 @@ jobs:
         OASIS_GEN_SWAGGER_V2: 1
 
     - name: Store OpenAPI schema
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: openapi-schema
         path: ${{ env.SCHEMA_ALL }}
         retention-days: 3
 
     - name: Store OpenAPI schema (only v1)
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: v1-openapi-schema
         path: ${{ env.SCHEMA_V1 }}
         retention-days: 3
 
     - name: Store OpenAPI schema (only v2)
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: v2-openapi-schema
         path: ${{ env.SCHEMA_V2 }}

.github/workflows/code-quality.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Set up Python 
         uses: actions/setup-python@v4
         with:
-          python-version: "3.10"
+          python-version: "3.12"
 
       - name: install pip tools
         run: |

.github/workflows/project-PR.yml

@@ -6,6 +6,7 @@ on:
 jobs:
   track_pr:
     runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.fork == false
     steps:
       - name: Get project data
         env:

.github/workflows/project-issue.yml

@@ -6,6 +6,7 @@ on:
 jobs:
   track_issue:
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'OasisLMF'
     steps:
       - name: Get project data
         env:

.github/workflows/publish.yml

@@ -330,21 +330,21 @@ jobs:
         docker run --entrypoint "eve" ${{ needs.build_images.outputs.worker_image }} '-v' 2> KTOOLS_VERSION
 
     - name: 'store OASISLMF_VERSION'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: OASISLMF_VERSION
         path: OASISLMF_VERSION
         retention-days: 5
 
     - name: 'store ODS_VERSION'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ODS_VERSION
         path: ODS_VERSION
         retention-days: 5
 
     - name: 'store KTOOLS_VERSION'
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: KTOOLS_VERSION
         path: KTOOLS_VERSION
@@ -362,19 +362,19 @@ jobs:
         test "v$KTOOL_VER" = ${{ env.ktools_release }} || exit 1
 
     - name: Download API schema
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: openapi-schema
         path: ${{ github.workspace }}/
 
     - name: Download API schema (v1)
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: v1-openapi-schema
         path: ${{ github.workspace }}/
 
     - name: Download API schema (v2)
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: v2-openapi-schema
         path: ${{ github.workspace }}/

.github/workflows/scan-db-cache.yml

@@ -0,0 +1,37 @@
+name: Update Trivy Cache
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Run daily at midnight UTC
+  workflow_dispatch:  # Allow manual triggering
+
+jobs:
+  update-trivy-db:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup oras
+        uses: oras-project/setup-oras@v1
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Download and extract the vulnerability DB
+        run: |
+          mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
+          oras pull ghcr.io/aquasecurity/trivy-db:2
+          tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
+          rm db.tar.gz
+
+      - name: Download and extract the Java DB
+        run: |
+          mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db
+          oras pull ghcr.io/aquasecurity/trivy-java-db:1
+          tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db
+          rm javadb.tar.gz
+
+      - name: Cache DBs
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ github.workspace }}/.cache/trivy
+          key: cache-trivy-${{ steps.date.outputs.date }}

.github/workflows/scan-external.yml

@@ -1,13 +1,6 @@
 name: External Vulnerability Scanning
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - stable**
-
   workflow_dispatch:
     inputs:
       cve_severity:
@@ -22,6 +15,8 @@ on:
 env:
   SEVERITY: 'HIGH,CRITICAL'
   IGNORE_UNFIXED: 'true'
+  TRIVY_SKIP_DB_UPDATE: true
+  TRIVY_SKIP_JAVA_DB_UPDATE: true
 
 jobs:
   scan_external_images:
@@ -102,7 +97,7 @@ jobs:
 
     - name: Store report
       if: success() || failure()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.report }}
         path: ${{ matrix.report }}

.github/workflows/scan.yml

@@ -8,8 +8,6 @@ on:
     branches:
       - main
       - stable**  
-  schedule:
-    - cron:  '0 */6 * * *' # Run scan every 6 hours
 
   workflow_dispatch:
     inputs:
@@ -47,6 +45,9 @@ jobs:
       REPORT: 'repo-results.sarif'
       IGNORE_UNFIXED: 'true'
       EXIT_CODE: '1'
+      TRIVY_SKIP_DB_UPDATE: true
+      TRIVY_SKIP_JAVA_DB_UPDATE: true
+
     runs-on: ubuntu-latest
     steps:
     - name: Adding code-scanning URL
@@ -103,7 +104,7 @@ jobs:
 
     - name: Store CVE report
       if: success() || failure()
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ env.REPORT }}
         path: ${{ env.REPORT }}

.github/workflows/test-db-migration.yml

@@ -0,0 +1,62 @@
+name: DB migration Test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      prev_release_tag:
+        description: 'OasisPlatform tag [semvar]'
+        required: false
+
+  workflow_call:
+    inputs:
+      prev_release_tag:
+        description: 'Platform tag to set the DB migration from'
+        required: false
+        type: string
+      platform_branch:
+        description: "Platform branch to migrate to (remote trigger) [git ref]"
+        required: True
+        type: string
+
+jobs:
+  DB_migrate:
+    runs-on: ubuntu-22.04
+    env:
+      PLAT_BRANCH: ${{ github.ref }}
+      PREV_RELEASE_TAG: ${{ inputs.prev_release_tag }}
+
+    steps:
+    - name: Branch selection (remote trigger)
+      if: inputs.platform_branch != ''
+      run: echo "PLAT_BRANCH=${{ inputs.platform_branch }}" >> $GITHUB_ENV
+
+    - name: Checkout
+      uses: actions/checkout@v3
+      with:
+        repository: OasisLMF/OasisPlatform
+        ref: ${{ env.PLAT_BRANCH }}
+        fetch-depth: 0
+
+    - name: Find 'prev_release_tag'
+      if: inputs.prev_release_tag == ''
+      run: |
+        tag=$( ./scripts/find_release.sh -t 1)
+        echo "PREV_RELEASE_TAG=$tag" >> $GITHUB_ENV
+
+    - name: Create DB to migrate from
+      run: |
+        ./scripts/create-db-sqlite3.sh ${{ env.PREV_RELEASE_TAG }}
+
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.12'
+    - run: pip install -r requirements-server.txt
+
+    - name: Run Migration
+      run: |
+        python ./manage.py migrate