Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GHA: Docker build caching and other speed improvements #3659

Merged
merged 48 commits into from Jan 20, 2021

Conversation

valentijnscholten
Copy link
Member

TL;DR;
All tests in GitHub Actions have become a lot faster.

Integration tests before:
image

After:
image

Others are also a couple of minutes faster each.

Changes:

  • Use Docker Layer Caching. If we only change some code, all the expensive build steps are cached (pip install -r requirements.txt etc)
  • Build images in parallel and use artifact upload/download to pass on to the next job (in the same workflow)
  • Use dummy image for initializer, celery(worker|beat) and nginx on unit tests
  • Finetune Dockerfile.xxxx to make sure as much layers as possible can be cached
  • Don't start any containers that are not needed for unit tests

@valentijnscholten valentijnscholten merged commit 77f241a into DefectDojo:master Jan 20, 2021
valentijnscholten added a commit that referenced this pull request Jan 20, 2021
master-to-dev: GHA: Docker build caching and other speed improvements (#3659)
FallenAtticus added a commit to idealo/django-DefectDojo that referenced this pull request Jan 28, 2021
* Fix popup message on SLA displays (DefectDojo#3477)

* Fix popup message on SLA displays

* Fix typo

Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro.local>

* chore(deps): update stefanzweifel/git-auto-commit-action action from v4.7.2 to v4.8.0 (.github/workflows/plantuml.yml) (DefectDojo#3476)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* logging: add DD_LOG_LEVEL setting (DefectDojo#3439)

* jira: don't add notes when creating/linking findings (DefectDojo#3481)

* Fix exception during excess duplicate deletion tasks (DefectDojo#3480)

* delete duplicates: use default for max dupes value

* delete duplicates: check max dupes value, prevent overlapping runs

* delete duplicates: check max dupes value, prevent overlapping runs

* jira: add api test for adding note/comment (DefectDojo#3482)

* chore(deps): update rabbitmq:3.8.9 docker digest from 3.8.9 to 3.8.9 (docker-compose.yml) (DefectDojo#3487)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* tagulous/reports: fix old prefetch fields (DefectDojo#3486)

* reports: remove old tagged_items prefetch

* reports: remove old tagged_items prefetch

* Bump requests from 2.25.0 to 2.25.1 (DefectDojo#3484)

Bumps [requests](https://github.com/psf/requests) from 2.25.0 to 2.25.1.
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/master/HISTORY.md)
- [Commits](psf/requests@v2.25.0...v2.25.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* tagulous/reports: fix old prefetch fields - take 2 (DefectDojo#3491)

* reports: remove old tagged_items prefetch

* reports: remove old tagged_items prefetch

* reports: remove old tagged_items prefetch

* reports: remove old tagged_items prefetch

* Fix reports: print test names instead of test types - DefectDojo#3252 (DefectDojo#3402)

* Attempt to fix Issue DefectDojo#3252

* Better fix for issue DefectDojo#3252 + fixed product_type_pdf_report template

* Update pull_request_template.md

Add check to rebase

* WebInspect Parser fails to process Issues without CWE and ReportSection with an empty SectionText (DefectDojo#3492)

* Fixing WebInspect parser mentioned in issue 3470
* Adding test cases to verify the fix for 3470

* securityContext related updates to Helm chart (DefectDojo#3343)

Also added in ability to generate an OpenShift SCC for nonroot if required.

OpenShift.enabled flag can be used at install time as follows: helm install <release_name> --set OpenShift.enabled=true

* Jira: Allow status changes from dojo to jira (DefectDojo#3483)

* Jira: Allow status changes from dojo to jira

* Broken linter

* Add Unit Tests

* Add debug statements

* Fix Flake8

Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro.local>

* Tag filtering + general search improvements (DefectDojo#3449)

* tags: add testcases

* tags: add testcases

* tags: add testcases

* tags: add testcases

* tags: add testcases

* tags: add testcases

* require django-tagulous

* tagulous: draft migration

* tagulous: first steps working

* tagulous: somewhat working

* tagulous: remove more django-tagging

* tagulous: remove more django-tagging

* tagulous: ui fixes

* tagulous: ui fixes

* tagulous: lots of things

* jira: set jira_project on jirafindingform

* tagulous: lots of things

* tagulous: experiment with pickle and filtering

* tagulous: more filter stuff

* tagulous: more filtering

* tagulous: more filtering

* tagulous: migrations

* tagulous: migrations

* tagulous: more filter stuff

* tagulous: fixtures

* tagulous: remove old tests

* tagulous: install from git develop for now

* tagulous: fix serializers DRF

* Revert "tagulous: fix serializers DRF"

This reverts commit d07da16.

* tagulous: fix drf clean

* tagulous: fix drf more

* tagulous: fix drf put/patch

* tagulous: fix celery model by id

* tagulous: fix model deletion

* tagulous: re-add crazy $=jquery assignment

* tagulous: fix tags assignment

* tagulous: fix styling for filters

* tagulous: cleanup, fix finding template forms

* tagulous: cleanup, fix finding template forms

* tagulous: make notifications dojo_async compatible

* tagulous: make notifications dojo_async compatible

* tagulous: make notifications dojo_async compatible

* tagulous: make notifications dojo_async compatible

* tagulous: filter on multiple tags in APIv2

* tagulous: add testcase for api filtering

* tagulous: fix bug in autocomplete filters and search

* search/filter by parent object tags

* search/filter by parent object tags

* search/filter by parent object tags

* tag search improvements

* tag search improvements

* tag search improvements

* tag search improvements

* tag search improvements

* tag search improvements

* tag search improvements

* tag search improvements

* use parent tags in parent lists

* tags search: fix in query

* tags search: fix in query

* fix test-tag query

* add tests

* add reverse relation search

* fix search tests

* Bump datatables.net-bs from 1.10.22 to 1.10.23 in /components (DefectDojo#3498)

Bumps [datatables.net-bs](https://github.com/DataTables/Dist-DataTables-Bootstrap) from 1.10.22 to 1.10.23.
- [Release notes](https://github.com/DataTables/Dist-DataTables-Bootstrap/releases)
- [Commits](DataTables/Dist-DataTables-Bootstrap@1.10.22...1.10.23)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump datatables.net-dt from 1.10.22 to 1.10.23 in /components (DefectDojo#3496)

Bumps [datatables.net-dt](https://github.com/DataTables/Dist-DataTables-DataTables) from 1.10.22 to 1.10.23.
- [Release notes](https://github.com/DataTables/Dist-DataTables-DataTables/releases)
- [Commits](DataTables/Dist-DataTables-DataTables@1.10.22...1.10.23)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* enable search tests (DefectDojo#3495)

* enable search tests

* enable search tests

* enable search tests

* enable search tests

* Create cancel-outdated-workflow-runs.yml

* Update cancel-outdated-workflow-runs.yml

* Update cancel-outdated-workflow-runs.yml

* Update cancel-outdated-workflow-runs.yml

* Update cancel-outdated-workflow-runs.yml

* Update cancel-outdated-workflow-runs.yml

* Update cancel-outdated-workflow-runs.yml

* Update cancel-outdated-workflow-runs.yml

* Add BlackDuck import functionality for License Risks that should be reviewed (DefectDojo#3247)

* Adding license risks for review, enhancing license risk descriptions

* syntax error fix

* syntax error fix

* Parsing potential license risk levels

* Added check for "License Risk" field in CSV before referencing.

* Added try-except for "License Risk" mapping

* Resolving minor whitespace checks

* Modified license component dictionary references to use get() for error avoidance.

* Added parsing of source.csv to pull Path and Archive Context into License Finding descriptions.

* Added some comments around new parsing of sources.csv

* Fixing minor whitespace checks.

* another whitespace fix

* Added try:except and empty dictionary default value for references to source.csv data for error checking.

* trailing whitespace fix

* Included Scan field from sources.csv for additional license finding context.

Co-authored-by: WheelsVT <sawalker@gmail.com>
Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>

* move renovate.json (DefectDojo#3503)

* Create renovate.json

* Delete renovate.json

* Update unit-tests.yml

* Update manusa/actions-setup-minikube action from v2.1.0 to v2.2.0 (.github/workflows/k8s-testing.yml) (DefectDojo#3505)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Update unit-tests.yml

* Bug fix: Add more unit tests for MobSF import DefectDojo#3479 (DefectDojo#3490)

* Allow use of ptvsd debugger when using k8s deployment (DefectDojo#3418)

* ptvsd ftw

* fix typo

* add link

* First shot

* Add more data

* Fix formatting

* Fix formatting

* Fix formatting

* fix formatting

* fix formatting

* fix formatting

* Add a title for the test

* Add more tests

* add more tests

* fix severity

* fix rules not in the report

* Add more unit tests

* Add CWE management

* Add better text management

* Fix Python formatting

* Fix unit tests

* Fix unit tests

* Add check on description in unit test

* Add more unit test

* Add more unit tests

* Create test-valentijn.yml

* Bump nginx from 1.19.5-alpine to 1.19.6-alpine (DefectDojo#3510)

Bumps nginx from 1.19.5-alpine to 1.19.6-alpine.

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump coverage from 5.3 to 5.3.1 (DefectDojo#3509)

Bumps [coverage](https://github.com/nedbat/coveragepy) from 5.3 to 5.3.1.
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](nedbat/coveragepy@coverage-5.3...coverage-5.3.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* gha: switch to pull_request from pull_request_target

* Update test-valentijn.yml

* gha: switch to pull_request from pull_request_target

* gha: switch to pull_request from pull_request_target (DefectDojo#3512)

* gha: switch to pull_request from pull_request_target

* gha: switch to pull_request from pull_request_target

* Update cancel-outdated-workflow-runs.yml

* Allow to specify the `Environment` when importing data (DefectDojo#3450)

This commit add the ability to specify the `Environment`
(prod, dev, ...) when importing scan data from both
the APIv2 and from the UI.

* Update k8s-testing.yml

* k8s testing workflow: remove docker secrets

* Update k8s-testing.yml

* [fix/helm-rabbitMQ]: Fix incorrect YAML key for RabbitMQ chart (DefectDojo#3508)

* fix: Remove tailing whitespaces
* fix: RabbitMQ chart now using replicaCount (https://github.com/bitnami/charts/blob/master/bitnami/rabbitmq/values.yaml#L308)

* product list: fix last assessed displaying (DefectDojo#3493)

* Add PyJWT to requirements.txt (DefectDojo#3536)

* Add PyJWT to requirements.txt

PyJWT 2.0.0 renamed some of the exceptions, which breaks social_core 3.4.0 that is used by social-auth-app-django 4.0.0. This causes new installations or container builds to throw a 500 error on attempting to log in.

From PyJWT 2.0.0 CHANGELOG:
`Removed `ExpiredSignature`, `InvalidAudience`, and `InvalidIssuer`. Use `ExpiredSignatureError`, `InvalidAudienceError`, and `InvalidIssuerError` instead.`

Requiring pyjwt==1.7.1 resolves the issue.

* Match case to actual PyPi name

Co-authored-by: Fred Blaise <madchap@users.noreply.github.com>

* chore(deps): update mysql:5.7.32 docker digest from 5.7.32 to 5.7.32 (docker-compose.yml) (DefectDojo#3540)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* chore(deps): update manusa/actions-setup-minikube action from v2.2.0 to v2.3.0 (.github/workflows/k8s-testing.yml) (DefectDojo#3541)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Various Bug Fixes. Make 'Active' Default On Scan Import Forms (DefectDojo#3521)

* Various Bug Fixes. Make 'Active' Default On Scan Import Forms

* Bug Fixes for Reupload & Duplicate Findings in Metrics

* Removed Extra Unintended Debugging Lines

* Requirements Fix to Restore Build Functionality

* Converts All Reupload References to ID Rather Than Object

* Logger Debugging

* Removed Debugging Statements

* Filters Correction

* Bump pytz from 2020.4 to 2020.5 (DefectDojo#3552)

Bumps [pytz](https://github.com/stub42/pytz) from 2020.4 to 2020.5.
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](stub42/pytz@release_2020.4...release_2020.5)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump pygithub from 1.54 to 1.54.1 (DefectDojo#3551)

Bumps [pygithub](https://github.com/PyGithub/PyGithub) from 1.54 to 1.54.1.
- [Release notes](https://github.com/PyGithub/PyGithub/releases)
- [Commits](PyGithub/PyGithub@v1.54...v1.54.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): update rabbitmq:3.8.9 docker digest from 3.8.9 to 3.8.9 (docker-compose.yml) (DefectDojo#3553)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Use full absolute url in notifications (DefectDojo#3538)

* adaptations (DefectDojo#3561)

* adaptation to release drafter notes (DefectDojo#3560)

* Bump pdfmake from 0.1.68 to 0.1.69 in /components (DefectDojo#3558)

Bumps [pdfmake](https://github.com/bpampuch/pdfmake) from 0.1.68 to 0.1.69.
- [Release notes](https://github.com/bpampuch/pdfmake/releases)
- [Changelog](https://github.com/bpampuch/pdfmake/blob/master/CHANGELOG.md)
- [Commits](bpampuch/pdfmake@0.1.68...0.1.69)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add missing modifications for SARIF format (DefectDojo#3559)

* add note about initializer duration (DefectDojo#3499)

* calculate sla the same (DefectDojo#3525)

* Add JIRA_Issue in related fields of Finding (DefectDojo#3407)

* calendar: speedup and security fix (DefectDojo#3543)

* celery entrypoints: support all settings related mounts (DefectDojo#3545)

* Test suite and scripts cleanup (DefectDojo#3500)

* (product) metrics: fixes and speedup (DefectDojo#3549)

* Fix issue 3527 while importing some Twistlock scans (DefectDojo#3532)

* Reupload bug fixes (DefectDojo#3531)

* Bugfix for reimport non file selection and multiple endpoints

* Bugfix for reimport non file selection and multiple endpoints

* Dependency requires PyJWT 1.6 to operate

* Adding sonar exclusion to uploads

* Flake

* Flake8

* Update views.py

Co-authored-by: Aaron Weaver <aweaver@Aarons-MBP.localdomain>
Co-authored-by: Aaron Weaver <aweaver@users.noreply.github.com>
Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>

* fix(risk_acceptance): remove hard coded user_id (DefectDojo#3469)

* fix(risk_acceptance): remove hard coded user_id

Code will cause an error if user with id does not exist.

On behalf of DB Systel

* fix(risk_acceptance): rename owner_id to owner because owner_id doesn't exist in risk_acceptance

Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>
Co-authored-by: Fred Blaise <madchap@users.noreply.github.com>

* Only mitigate finding if previously active (DefectDojo#3523)

* Update release-drafter.yml

adding apiv2 label

* Update release-drafter.yml

adding documentation

* Update release-drafter.yml

* Update release-drafter.yml

* Update release-drafter.yml

* Update release-drafter.yml

* Fix(helm-unittests): add secret key and credential key  (DefectDojo#3489)

* refacotor(helm-tests): create the name in the same manner than the other templates
* fix(helm-tests): add secret key and credential key because they are not allowed to be empty; add resources
* remove resources because there are already addressed in PR#3343

* Add support for GitLab Dependency Scanning reports (DefectDojo#3534)

* Add redis transit encryption (DefectDojo#3473)

* Update versions in application files

* Update new-release-master-into-dev.yml

* Update versions in application files

* Bump busybox from 1.32.0-musl to 1.33.0-musl (DefectDojo#3577)

Bumps busybox from 1.32.0-musl to 1.33.0-musl.

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump mysqlclient from 2.0.2 to 2.0.3 (DefectDojo#3576)

Bumps [mysqlclient](https://github.com/PyMySQL/mysqlclient) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/PyMySQL/mysqlclient/releases)
- [Changelog](https://github.com/PyMySQL/mysqlclient/blob/master/HISTORY.rst)
- [Commits](https://github.com/PyMySQL/mysqlclient/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump pillow from 8.0.1 to 8.1.0 (DefectDojo#3575)

Bumps [pillow](https://github.com/python-pillow/Pillow) from 8.0.1 to 8.1.0.
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst)
- [Commits](python-pillow/Pillow@8.0.1...8.1.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Add unit tests for Bandit parser (DefectDojo#3568)

* Bump jsonlines from 1.2.0 to 2.0.0 (DefectDojo#3581)

Bumps [jsonlines](https://github.com/wbolster/jsonlines) from 1.2.0 to 2.0.0.
- [Release notes](https://github.com/wbolster/jsonlines/releases)
- [Commits](wbolster/jsonlines@1.2.0...2.0.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* remove unused custom_field dependency (DefectDojo#3574)

* pin sqlalchemy (DefectDojo#3583)

* Swtich to official django-tagulous release (DefectDojo#3579)

* Component enhancements (DefectDojo#3578)

* Add the close_old_findings parameter also to reimport API (DefectDojo#3572)

* Add the close_old_findings parameter also to reimport API
* Introduce the close_old_findings as a parameter into the reimport form to keep the functionality in sync with the API
* Add the close_old_findings field to ReImportScanForm
* Add test to validate the reimport of findings without closing old findings

* renovate: allow automatic creation of PRs

* Update rabbitmq:3.8.9 Docker digest from 3.8.9 to 3.8.9 (docker-compose.yml) (DefectDojo#3595)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* feat(alerts): automated cleanup of alerts per user (DefectDojo#3598)

* feat(alerts): automated cleanup of alerts per user

Some users receives a lot of alerts but never reads or deletes them. This feature deletes the oldest x (default 999) alerts per user. The feature can be disabled by set DD_MAX_ALERTS_PER_USER to -1.

On behalf of DB Systel GmbH

* tags: preserve on reimport scan/test (DefectDojo#3596)

* Send status changes from re-import to jira (DefectDojo#3592)

* Send status changes from re-import to jira

When re-uploading scan files, changes in status such as mitigated and reactive findings were not being updated in jira despite push all issues being set or just pushing individual imports.

* Add unit test

* Fix Flake8

Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro-2.local>

* Update sample data fixture file (DefectDojo#3580)

* Parameter confidence is optional and CWE's are not always numerical in GitLab SAST (DefectDojo#3567)

* system settings through apiv2 (DefectDojo#3562)

* fix(qualys-parser): map qid to vuln_id_from_tool (DefectDojo#3601)

The qid in Qualys is not unique.

On behalf of DB Systel GmbH

* feat(clair parser): parse componet name and version (DefectDojo#3600)

On behalf of DB Systel GmbH

* Initial parser doc (DefectDojo#3603)

* Adding retry into the k8s workflow (DefectDojo#3614)

Co-authored-by: Dubravko Sever <dubravko.sever@pan-net.eu>

* sync master to dev: workflow changes + renovate settings (DefectDojo#3618)

* renovate: allow automatic creation of PRs

* Adding retry into the k8s workflow (DefectDojo#3614)

Co-authored-by: Dubravko Sever <dubravko.sever@pan-net.eu>

Co-authored-by: Sever <dubravko.sever@gmail.com>
Co-authored-by: Dubravko Sever <dubravko.sever@pan-net.eu>

* chore(deps): update styfle/cancel-workflow-action action from 0.6.0 to v0.7.0 (.github/workflows/cancel-outdated-workflow-runs.yml) (DefectDojo#3620)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* chore(deps): update mysql:5.7.32 docker digest from 5.7.32 to 5.7.32 (docker-compose.yml) (DefectDojo#3617)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Improve Micro Focus Webinspect parser

* Add unique_id_from_tool management

* Add more tests

* Fix error in imports

* Update parser.py

* Update test_microfocus_webinspect_parser.py

* Update parser.py

* Snyk parser fixes (DefectDojo#3615)

* Snyk parser: [Bugfix] unique_id var can generate duplications

* Snyk parser: [Bugfix] fixed cvss ranges to meet CVSS3.x severity according to NVD

* Add more tests

* Fix endpoints

* Add Scantist Vulnerability Scan Parser (DefectDojo#3610)

* renovate: allow automatic creation of PRs

* updating to add scanting parser

* updating to make review changes and run test cases

* updating to make review changes and run test cases

Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>

* Security: Prevent XEE in parsers, Prevent open redirect (DefectDojo#3622)

* security: fix xee, identifyview, openredirect

* Update versions in application files

* Update versions in application files

* Fix unit tests

* pin release drafter

* allow manual run release drafter

* pin release drafter

* Import Gitlab projects as DefectDojo products fix Issue DefectDojo#1984 (DefectDojo#2211)

* Update pipeline.py to fix Issue DefectDojo#1984

* Param to enable Gitlab project import as product

* Useless import

* create and assign a product type to our product

* add python-gitlab requirement

* fix python-gitlab version

* update to python 3.6

* update to python 3.6

* add update_product_access in social auth pipeline

* social auth pipeline: add update_product_access

* add comments in pipeline.py

* add comment in modify_permissions

* Update python-gitlab version to 2.4.0

* Update pipeline.py

Add add_test permission

* add missing whitespace after ,

* change comment

* Update pipeline.py

* Update pipeline.py

* Update pipeline.py

* Add products with correct product type

* Add white space

* Modify comment

* Fix ptvsd version

Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>

* Update to release workflow (DefectDojo#3591)

* update to branch

* text amendments

Signed-off-by: Fred Blaise <fred.blaise@protonmail.com>

* patch versions from master he says

* APIv1: disable by default (DefectDojo#3608)

* APIv1: Disable by default

* Added OSSIndex Devaudit scanner import functionality (DefectDojo#3570)

 Added OSSIndex Devaudit scanner import functionality

* Bump python-gitlab from 2.4.0 to 2.5.0 (DefectDojo#3627)

Bumps [python-gitlab](https://github.com/python-gitlab/python-gitlab) from 2.4.0 to 2.5.0.
- [Release notes](https://github.com/python-gitlab/python-gitlab/releases)
- [Changelog](https://github.com/python-gitlab/python-gitlab/blob/master/ChangeLog.rst)
- [Commits](python-gitlab/python-gitlab@v2.4.0...v2.5.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Display Active and Verified counts (DefectDojo#3590)

* active and verified counts

* fix anchore reimport, sync reimport logic API<->UI, add unit tests (DefectDojo#3629)

* unit tests: test import/reimport also on UI
* import/reimport: fix anchore matching

* Update rabbitmq:3.8.9 Docker digest from 3.8.9 to 3.8.9 (docker-compose.yml) (DefectDojo#3633)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Snyk parser enhancements (DefectDojo#3616)

* Snyk parser: Added support for multi module reports (--all-projects)
* Snyk parser: Added missing Finding fields and minor visual changes.
* Snyk parser: [Bugfix] unique_id var can generate duplications
* Snyk parser: [Bugfix] fixed cvss ranges to meet CVSS3.x severity according to NVD
* Snyk parser: Removed HTML tags
* Snyk parser: CWE parsing refactor

* ScoutSuite parser (DefectDojo#3602)

* ScoutSuite implementation

* jira webhook: fix incoming author name check (DefectDojo#3606)

* jira: fix author check on incoming comments

* Fix JFrog Xray JSON parser for CWE and CVSS v3 (DefectDojo#3597 fix) (DefectDojo#3585)

* Fix Django static import (DefectDojo#3637)

* Add more unit tests for AppSpider report parser (DefectDojo#3634)

* Importer: Burp REST API (Fix DefectDojo#3447) (DefectDojo#3542)

* Add swagger schema test with tagged test cases (DefectDojo#3528)

* remove old/dead/left-behind code (DefectDojo#3635)

* Exposing additional securityContext settings in parent values.yaml (DefectDojo#3582)

To enable postgresql to work with restricted SCC in OpenShift and setting some resource specifications too, to work with limit ranges.

* Remove use of vendoring six (DefectDojo#3649)

* Bump pdfmake from 0.1.69 to 0.1.70 in /components (DefectDojo#3646)

Bumps [pdfmake](https://github.com/bpampuch/pdfmake) from 0.1.69 to 0.1.70.
- [Release notes](https://github.com/bpampuch/pdfmake/releases)
- [Changelog](https://github.com/bpampuch/pdfmake/blob/master/CHANGELOG.md)
- [Commits](bpampuch/pdfmake@0.1.69...0.1.70)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update mysql Docker tag from 5.7.32 to v5.7.33 (docker-compose.yml) (DefectDojo#3651)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Bump mysql-connector-python from 8.0.22 to 8.0.23 (DefectDojo#3652)

Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html) from 8.0.22 to 8.0.23.

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump cvss from 2.1 to 2.2 (DefectDojo#3645)

Bumps [cvss](https://github.com/skontar/cvss) from 2.1 to 2.2.
- [Release notes](https://github.com/skontar/cvss/releases)
- [Commits](RedHatProductSecurity/cvss@v2.1...v2.2)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix celery task config for sonarcube issue sync (DefectDojo#3619)

* [APIv2] Prefetch Mixins + Composable Swagger Schema (DefectDojo#3516)

* Fix impact bug on Burp REST API parser and add more unit tests (DefectDojo#3657)

* Add more unit tests

* Fix impact bug

* Add Arbitrary File Uploads (DefectDojo#3566)

* Pre-rebase commit

* Add unit tests

* Pre-rebase commit

* Add unit tests

* Add EOL message for finding images

* Fix flake8

* Fix migrations conflicts

* Fix migration typos

* Remove messy merge lines

* Small fixes

* Change test ordering

* Tweak unit tets

* Add 404 file exceptions

Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro.local>
Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro-2.local>

* add product: fix missing error messages (DefectDojo#3658)

* Findings list: Display jira key instead of jira bug icon (DefectDojo#3605)

* revert to jirakey display

* same to view_test

* Update rabbitmq Docker tag from 3.8.9 to v3.8.10 (docker-compose.yml) (DefectDojo#3660)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* GHA: Docker build caching and other speed improvements (DefectDojo#3659)

* GHA: docker caching & other speedups

* Update busybox Docker tag from 1.32.0-musl to v1.33.0 (docker-compose.override.unit_tests_cicd.yml) (DefectDojo#3665)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Bump django-celery-results from 2.0.0 to 2.0.1 (DefectDojo#3661)

Bumps [django-celery-results](https://github.com/celery/django-celery-results) from 2.0.0 to 2.0.1.
- [Release notes](https://github.com/celery/django-celery-results/releases)
- [Changelog](https://github.com/celery/django-celery-results/blob/master/Changelog)
- [Commits](celery/django-celery-results@v2.0.0...v2.0.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Snyk findings: deduplication enhancements (DefectDojo#3662)

* Snyk findings: deduplication enhancements

* Snyk findings: use vuln_id_from_tool instead of unique_id_from_tool

* Snyk findings: updated unit test

* Jira: fix support for epic as default issuetype + error handling (DefectDojo#3609)

* jira: support epic name

Co-authored-by: Fred Blaise <madchap@users.noreply.github.com>

* jira: fix broken author check for cloud (DefectDojo#3668)

* jira: fix broken author check for cloud

* jira: fix broken author check for cloud

* fix engagement styling bug from PR 3566 (DefectDojo#3669)

* Bump bleach from 3.2.1 to 3.2.2 (DefectDojo#3672)

Bumps [bleach](https://github.com/mozilla/bleach) from 3.2.1 to 3.2.2.
- [Release notes](https://github.com/mozilla/bleach/releases)
- [Changelog](https://github.com/mozilla/bleach/blob/master/CHANGES)
- [Commits](mozilla/bleach@v3.2.1...v3.2.2)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* risk acceptance: enhance! (DefectDojo#3529)

risk acceptance enhancements and simpliciations :-)
Co-authored-by: Fred Blaise <fred.blaise@protonmail.com>
Co-authored-by: Fred Blaise <madchap@users.noreply.github.com>

* Update rabbitmq:3.8.10 Docker digest from 3.8.10 to 3.8.10 (docker-compose.yml) (DefectDojo#3670)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Update WRAPPERS.md

* Update WRAPPERS.md

* notification: make them synchronous (DefectDojo#3678)

* Update release-drafter.yml

* master-into-dev: docs + release drafter (DefectDojo#3685)

* Update WRAPPERS.md

* Update WRAPPERS.md

* Update release-drafter.yml

* Fix bug in redirect function call (DefectDojo#3673)

* Fix redirects in views

* Fix redirect in reports views

* Fix imports

* Update release-drafter.yml

* Update release-drafter.yml

* Create release_drafter_valentijn.yml

* Update release-drafter.yml

* Update release-drafter.yml

* Update rabbitmq Docker tag from 3.8.10 to v3.8.11 (docker-compose.yml) (DefectDojo#3688)

Co-authored-by: Renovate Bot <bot@renovateapp.com>

* Fix tag migration for legacy products (DefectDojo#3684)

* tagulous migration: add debug logging for migration errors

* Create release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release-drafter.yml

* Update release_drafter_valentijn.yml

* Update release_drafter_valentijn.yml

* Update release-drafter.yml

* Update release-drafter.yml

* files upload: remove from filters (DefectDojo#3690)

* Update release-drafter.yml

* add product via prod_type: use normal add product logic (DefectDojo#3692)

* add product: add test for prod_type route

* add product: add test for prod_type route

* add product: add test for prod_type route

* add product: add test for prod_type route

* add product: add test for prod_type route

* add product: add test for prod_type route

* add product: add test for prod_type route

* add product: add test for prod_type route

* add product: add test for prod_type route

* dependency track parser: fix dedupe, set hash code fields (DefectDojo#3667)

* dependency track parser: fix dedupe, set hash code fields

* dependency track parser: fix dedupe, set hash code fields

* dependency track parser: fix dedupe, set hash code fields

* Update dojo/forms.py

Co-authored-by: Damien Carol <damiencarol@voodoo.io>

* Update dojo/forms.py

Co-authored-by: Damien Carol <damiencarol@voodoo.io>

* Fix date format on Fortify parser (DefectDojo#3696)

* Fix date format

* Add unit tests

Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro-2.local>

* cleanup old comments / commented out code (DefectDojo#3697)

as discussed / promised a PR to cleanup some (logging) code that has been commented out for a long time, or just left overs from exciting debuging sessions.

* integration tests: wait for findings datatable (DefectDojo#3704)

* it dedupe: wait for datatables

* it dedupe: wait for datatables

* it dedupe: wait for datatables

* Fix access typo in 403 page(DefectDojo#3706)

* Increase alert field size to 250 (DefectDojo#3682)

* increase alert field size to 200

* bump to 250

* ajust truncation to 250

* remove url truncate

* Update versions in application files

* add demo info

Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro.local>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: valentijnscholten <valentijnscholten@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Yassine Ilmi <9211413+yilmi@users.noreply.github.com>
Co-authored-by: Fred Blaise <madchap@users.noreply.github.com>
Co-authored-by: Matt <30868661+namloc2001@users.noreply.github.com>
Co-authored-by: WheelsVT <WheelsVT@users.noreply.github.com>
Co-authored-by: WheelsVT <sawalker@gmail.com>
Co-authored-by: Damien Carol <damiencarol@voodoo.io>
Co-authored-by: Damien Carol <damien.carol@gmail.com>
Co-authored-by: Romain Aviolat <r.aviolat@gmail.com>
Co-authored-by: Nate Wangsutthitham <nate.bwangsut@gmail.com>
Co-authored-by: Jake <github@squirrelly.anonaddy.com>
Co-authored-by: Greg Anderson <greg.anderson@owasp.org>
Co-authored-by: Marcos Valle <5929526+marcosValle@users.noreply.github.com>
Co-authored-by: Romain <romain.jufer@gmail.com>
Co-authored-by: Guilherme Macedo <guilherme@gmacedo.com>
Co-authored-by: Aaron Weaver <aaronweaver@users.noreply.github.com>
Co-authored-by: Aaron Weaver <aweaver@Aarons-MBP.localdomain>
Co-authored-by: Aaron Weaver <aweaver@users.noreply.github.com>
Co-authored-by: alles-klar <jannik.juergens@deutschebahn.com>
Co-authored-by: Karsten Siemer <karsten.siemer@sda.se>
Co-authored-by: DefectDojo release bot <dojo-release-bot@users.noreply.github.com>
Co-authored-by: Ricardo Meulendijks <mail@ricardomeulendijks.nl>
Co-authored-by: Cosmin Cojocar <ccojocar@cloudbees.com>
Co-authored-by: Maffooch <codymaffucci@Codys-MacBook-Pro-2.local>
Co-authored-by: Stefan Fleckenstein <stefan.fleckenstein@maibornwolff.de>
Co-authored-by: manuel-sommer <47991713+manuel-sommer@users.noreply.github.com>
Co-authored-by: Sever <dubravko.sever@gmail.com>
Co-authored-by: Dubravko Sever <dubravko.sever@pan-net.eu>
Co-authored-by: Roi Moldes <77276572+rmoldesc@users.noreply.github.com>
Co-authored-by: mohcer <msayyed456@gmail.com>
Co-authored-by: christophe226 <61734671+christophe226@users.noreply.github.com>
Co-authored-by: Saurabh <skumar1@mt.iitr.ac.in>
Co-authored-by: BP <bp4151@gmail.com>
Co-authored-by: Hasan Tayyar BEŞİK <tayyar.besik@gmail.com>
Co-authored-by: Joe Siewert <joe.siewert@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant