diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..13f8d2d --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,11 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "gradle" # See documentation for possible values + directory: "/" # Location of package manifests + schedule: + interval: "daily" diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml new file mode 100644 index 0000000..752ecc8 --- /dev/null +++ b/.github/workflows/codacy.yml @@ -0,0 +1,60 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow checks out code, performs a Codacy security scan +# and integrates the results with the +# GitHub Advanced Security code scanning feature. For more information on +# the Codacy security scan action usage and parameters, see +# https://github.com/codacy/codacy-analysis-cli-action. +# For more information on Codacy Analysis CLI in general, see +# https://github.com/codacy/codacy-analysis-cli. + +name: Codacy Security Scan + +on: + push: + branches: [ main ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ main ] + schedule: + - cron: '41 23 * * 3' + +permissions: + contents: read + +jobs: + codacy-security-scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Codacy Security Scan + runs-on: ubuntu-latest + steps: + # Checkout the repository to the GitHub Actions runner + - name: Checkout code + uses: actions/checkout@v2 + + # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis + - name: Run Codacy Analysis CLI + uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b + with: + # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository + # You can also omit the token and run the tools that support default configurations + project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} + verbose: true + output: results.sarif + format: sarif + # Adjust severity of non-security issues + gh-code-scanning-compat: true + # Force 0 exit code to allow SARIF file generation + # This will handover control about PR rejection to the GitHub side + max-allowed-issues: 2147483647 + + # Upload the SARIF file generated in the previous step + - name: Upload SARIF results file + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: results.sarif diff --git a/README.md b/README.md index b98835a..6678b8e 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,6 @@ - Sambo Chea ### Language and Framework -- Spring Boot: 2.6.2 -- Kotlin: 1.6.10 -- Gradle: 7.3.2 \ No newline at end of file +- Spring Boot: 2.6.6 +- Kotlin: 1.6.20 +- Gradle: 7.4.1 diff --git a/api/build.gradle.kts b/api/build.gradle.kts index 45bb519..792b047 100644 --- a/api/build.gradle.kts +++ b/api/build.gradle.kts @@ -7,8 +7,8 @@ plugins { kotlin("plugin.spring") } -val kotlinVersion = "1.6.10" -val springBootVersion = "2.6.2" +val kotlinVersion = "1.6.20" +val springBootVersion = "2.6.6" // find the last commit fun getGitHashLastCommit(): String { @@ -33,7 +33,7 @@ springBoot { dependencies { // Migrating from SpringFox - implementation("org.springdoc:springdoc-openapi-ui:1.6.2") + implementation("org.springdoc:springdoc-openapi-ui:1.6.7") // SPRING FRAMEWORK AND CORE implementation("org.springframework.boot:spring-boot-starter-web") diff --git a/build.gradle.kts b/build.gradle.kts index 23cb808..416fbe7 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -1,10 +1,10 @@ import org.jetbrains.kotlin.gradle.tasks.KotlinCompile plugins { - id("org.springframework.boot") version "2.6.2" apply false + id("org.springframework.boot") version "2.6.6" apply false id("io.spring.dependency-management") version "1.0.11.RELEASE" apply false - kotlin("jvm") version "1.6.10" apply false - kotlin("plugin.spring") version "1.6.10" apply false + kotlin("jvm") version "1.6.20" apply false + kotlin("plugin.spring") version "1.6.20" apply false // kotlin("plugin.jpa") version "1.6.10" apply false } @@ -18,6 +18,7 @@ allprojects { ext["logback.version"] = "1.2.9" repositories { + mavenCentral() maven("https://m.ctdn.net") } diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties index 0606a35..72e3dee 100644 --- a/gradle/wrapper/gradle-wrapper.properties +++ b/gradle/wrapper/gradle-wrapper.properties @@ -1,5 +1,5 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https://mirror.ctdn.net/gradle/gradle-7.3.2-bin.zip +distributionUrl=https://mirror.ctdn.net/gradle/gradle-7.4.1-bin.zip zipStoreBase=GRADLE_USER_HOME -zipStorePath=wrapper/dists \ No newline at end of file +zipStorePath=wrapper/dists