GitHub ci extend

[jacomago]

Add testing to github ci.

• Refactor the ci to be per type of action
• Add reusable sub workflows, unit-test, integration-test, ui-test, etc
• Rename JavaFX tests (they fail unless access to some kind of ui) have them run with ui-tests workflow
• Remove some unnecessary relying on Elasticsearch Config for some integration tests in save and restore
• Add dependabot for the github actions (could be expanded for the pom.xml)
• Remove the dead travis ci (was tied to a very old version of ubuntu)

Open questions:

• Add dependabot for pom.xml?
• Remove 'tests were run from PR template?

Checklist

• Testing:

  • [ x] The feature has automated tests
  • [x ] Tests were run
  • If not, explain how you tested your changes

• Documentation:

  • The feature is documented
  • The documentation is up to date
  • Release notes:
    • Added an entry if the change is breaking or significant
    • Added an entry when adding a new feature

[shroffk]

This looks broadly nice

I wish this had happened before I was cleaning them up for jdk 25 :)

[ralphlange]

I am impressed.

[minijackson]

I'm not personally a fan of having to review big changes, especially AI-assisted. GitHub actions are something that's quite easy to get wrong in very subtle, and insecure ways.

I can't review everything that this PR does, so I've run the tool zizmor to audit some common issues with GitHub actions. Here's some of the most important ones (see the linked audit rules for a more complete explanation):

• It's recommended to pin the hash of every use of an external action, to prevent supply chain attacks through actions

• In the same way, it's recommended to pin the hash of used Docker images

• It's recommended to set important / write permissions at the jobs level, instead of at the workflow level

• When using user-controlled strings inside commands, it's recommended to go through and environment variable to prevent command injection, for example by using:

      - name: Build with Maven
        run: mvn --batch-mode ${INPUTS_MAVEN_ARGS}
        env:
          INPUTS_MAVEN_ARGS: ${{ inputs.maven-args }}

• It's recommended to set a cooldown setting to the Dependabot upgrade

• Zizmor categorises the workflow_run trigger as fundamentally insecure, as they allow running unreviewed user-controlled code from forks in the context of the target repository (including configured secrets and permissions)

But there's more, here's the complete output of zizmor --persona auditor .github on my machine:

zizmor output

error[unpinned-uses]: unpinned action reference
  --> .github/actions/setup-java/action.yml:10:13
   |
10 |     - uses: actions/setup-java@v5
   |             ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
 --> .github/dependabot.yml:6:5
  |
6 |   - package-ecosystem: github-actions
  |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
  |
  = note: audit confidence → High
  = note: this finding has an auto-fix
  = help: audit documentation → https://docs.zizmor.sh/audits/#dependabot-cooldown

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_build.yml:22:7
   |
22 |     - uses: actions/checkout@v6
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_build.yml:22:13
   |
22 |     - uses: actions/checkout@v6
   |             ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_build.yml:29:13
   |
29 |       uses: actions/upload-artifact@v7
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/_build.yml:19:3
   |
19 |   build:
   |   ^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_docker-image.yml:27:7
   |
27 |     - uses: actions/checkout@v6
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[excessive-permissions]: overly broad permissions
  --> .github/workflows/_docker-image.yml:21:3
   |
21 |   packages: write
   |   ^^^^^^^^^^^^^^^ packages: write is overly broad at the workflow level
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

error[template-injection]: code injection via template expansion
  --> .github/workflows/_docker-image.yml:31:33
   |
31 |       run: mvn --batch-mode ${{ inputs.maven-args }}
   |       --- this run block        ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_docker-image.yml:27:13
   |
27 |     - uses: actions/checkout@v6
   |             ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_docker-image.yml:33:13
   |
33 |       uses: docker/login-action@v4
   |             ^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_docker-image.yml:40:13
   |
40 |       uses: docker/metadata-action@v6
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_docker-image.yml:44:13
   |
44 |       uses: docker/setup-buildx-action@v4
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_docker-image.yml:46:13
   |
46 |       uses: docker/build-push-action@v7
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/_docker-image.yml:21:3
   |
21 |   packages: write
   |   ^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/_docker-image.yml:24:3
   |
24 |   build-and-push-image:
   |   ^^^^^^^^^^^^^^^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_integration-test.yml:27:7
   |
27 |     - uses: actions/checkout@v6
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_integration-test.yml:27:13
   |
27 |     - uses: actions/checkout@v6
   |             ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_integration-test.yml:36:13
   |
36 |       uses: actions/upload-artifact@v7
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-images]: unpinned image references
  --> .github/workflows/_integration-test.yml:15:9
   |
15 |         image: docker.elastic.co/elasticsearch/elasticsearch:8.11.2
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ container image is not pinned to a SHA256 hash
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-images

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/_integration-test.yml:10:3
   |
10 |   integration-test:
   |   ^^^^^^^^^^^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_ui-test.yml:13:7
   |
13 |     - uses: actions/checkout@v6
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_ui-test.yml:13:13
   |
13 |     - uses: actions/checkout@v6
   |             ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_ui-test.yml:25:13
   |
25 |       uses: actions/upload-artifact@v7
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/_ui-test.yml:10:3
   |
10 |   ui-test:
   |   ^^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_unit-test.yml:13:7
   |
13 |     - uses: actions/checkout@v6
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_unit-test.yml:13:13
   |
13 |     - uses: actions/checkout@v6
   |             ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/_unit-test.yml:19:13
   |
19 |       uses: actions/upload-artifact@v7
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/_unit-test.yml:10:3
   |
10 |   unit-test:
   |   ^^^^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/merge.yml:31:7
   |
31 |       packages: write
   |       ^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/release.yml:15:7
   |
15 |       packages: write
   |       ^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/report.yml:14:3
   |
14 |   checks: write
   |   ^^^^^^^^^^^^^ checks: write is overly broad at the workflow level
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

error[excessive-permissions]: overly broad permissions
  --> .github/workflows/report.yml:15:3
   |
15 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ pull-requests: write is overly broad at the workflow level
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

error[dangerous-triggers]: use of fundamentally insecure workflow trigger
 --> .github/workflows/report.yml:3:1
  |
3 | / on:
4 | |   workflow_run:
5 | |     workflows:
6 | |       - PR
7 | |       - Merge to master
8 | |     types:
9 | |       - completed
  | |_________________^ workflow_run is almost always used insecurely
  |
  = note: audit confidence → Medium
  = help: audit documentation → https://docs.zizmor.sh/audits/#dangerous-triggers

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/report.yml:22:13
   |
22 |       uses: actions/download-artifact@v7
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/report.yml:28:13
   |
28 |       uses: mikepenz/action-junit-report@v6
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[undocumented-permissions]: permissions without explanatory comments
  --> .github/workflows/report.yml:13:3
   |
13 |   actions: read
   |   ^^^^^^^^^^^^^ needs an explanatory comment
14 |   checks: write
   |   ^^^^^^^^^^^^^ needs an explanatory comment
15 |   pull-requests: write
   |   ^^^^^^^^^^^^^^^^^^^^ needs an explanatory comment
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#undocumented-permissions

info[anonymous-definition]: workflow or action definition without a name
  --> .github/workflows/report.yml:18:3
   |
18 |   report:
   |   ^^^^^^ this job
   |
   = note: audit confidence → High
   = tip: use 'name: ...' to give this job a name
   = help: audit documentation → https://docs.zizmor.sh/audits/#anonymous-definition

help[concurrency-limits]: insufficient job-level concurrency limits
  --> .github/workflows/report.yml:3:1
   |
 3 | / on:
 4 | |   workflow_run:
 5 | |     workflows:
 6 | |       - PR
 7 | |       - Merge to master
 8 | |     types:
 9 | |       - completed
   | |_________________^ workflow is missing concurrency setting
...
18 |     report:
   |     ------ job affected by missing workflow concurrency
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#concurrency-limits

39 findings (1 safe fixes, 6 unsafe fixes): 6 informational, 10 low, 2 medium, 21 high

I recommend setting up the zizmor action so that those kind of issues are catched when modifying those jobs.

In the EPNix repository "Actions" settings, I've also restricted which actions can run, to limit which transitive action dependencies can be run in our CI

[jacomago]

Zizmor looks pretty cool. I'll fix all the warnings on Monday, unless someone wants to take over.

[ralphlange]

https://depmedicdev-byte.github.io/compare/ci-doctor-vs-zizmor.html

The workflow - running zizmor and ci-doctor side-by-side - looks pretty usable.

[shroffk]

to prevent this PR from becoming any bigger, added zizmor in a separate PR #3843

[kasemir]

Source changes look benign. Can't comment on the GitHub actions

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jacomago]

@minijackson Added zizmor via pre-commit, and fixed all the suggestions.

@georgweiss I altered Save and restore ElasticConfig, removed the initialized check to make testing easier. Seemed like it isn't necessary as there is an exists check on the elasticIndexValidation.