@asyncapi/java-spring-cloud-stream-template - npm Package Compare versions

Comparing version 0.13.2 to 0.13.3

.github/workflows/automerge-for-humans-merging.yml

@@ -24,2 +24,23 @@ # This workflow is centrally managed in https://github.com/asyncapi/.github/
     steps:
+      - name: Get list of authors
+        uses: sergeysova/jq-action@v2
+        id: authors
+        with:
+          # This cmd does following (line by line):
+          # 1. CURL querying the list of commits of the current PR via GH API. Why? Because the current event payload does not carry info about the commits.
+          # 2. Iterates over the previous returned payload, and creates an array with the filtered results (see below) so we can work wit it later. An example of payload can be found in https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#webhook-payload-example-34.
+          # 3. Grabs the data we need for adding the `Co-authored-by: ...` lines later and puts it into objects to be used later on.
+          # 4. Filters the results by excluding the current PR sender. We don't need to add it as co-author since is the PR creator and it will become by default the main author.
+          # 5. Removes repeated authors (authors can have more than one commit in the PR).
+          # 6. Builds the `Co-authored-by: ...` lines with actual info.
+          # 7. Transforms the array into plain text. Thanks to this, the actual stdout of this step can be used by the next Workflow step (wich is basically the automerge).
+          cmd: | 
+            curl -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.GH_TOKEN }}" "${{github.event.pull_request._links.commits.href}}?per_page=100" | 
+              jq -r '[.[] 
+                | {name: .commit.author.name, email: .commit.author.email, login: .author.login}] 
+                | map(select(.login != "${{github.event.pull_request.user.login}}")) 
+                | unique 
+                | map("Co-authored-by: " + .name + " <" + .email + ">") 
+                | join("\n")'
+          multiline: true
       - name: Automerge PR
@@ -31,4 +52,6 @@ uses: pascalgn/automerge-action@v0.14.3
           MERGE_METHOD: "squash"
-          MERGE_COMMIT_MESSAGE: "{pullRequest.title} (#{pullRequest.number})"
+          # Using the output of the previous step (`Co-authored-by: ...` lines) as commit description.
+          # Important to keep 2 empty lines as https://docs.github.com/en/pull-requests/committing-changes-to-your-project/creating-and-editing-commits/creating-a-commit-with-multiple-authors#creating-co-authored-commits-on-the-command-line mentions
+          MERGE_COMMIT_MESSAGE: "{pullRequest.title} (#{pullRequest.number})\n\n\n${{ steps.authors.outputs.value }}" 
           MERGE_RETRIES: "20"
-          MERGE_RETRY_SLEEP: "30000"
+          MERGE_RETRY_SLEEP: "30000"

.github/workflows/if-nodejs-release.yml

@@ -12,8 +12,8 @@ # This action is centrally managed in https://github.com/asyncapi/.github/
       # below lines are not enough to have release supported for these branches
-      # make sure configuration of `semantic-release` package mentiones these branches
-      - next
+      # make sure configuration of `semantic-release` package mentions these branches
+      - next-spec
       - next-major
+      - next-major-spec
       - beta
       - alpha
-      - '**-release' # custom
 
@@ -52,2 +52,11 @@ jobs:
         run: npm test
+      - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel
+        name: Report workflow run status to Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          status: ${{ job.status }}
+          fields: repo,action,workflow
+          text: 'Release workflow failed in testing job'
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CI_FAIL_NOTIFY }}
 
@@ -89,1 +98,10 @@ release:
         run: npm run release
+      - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel
+        name: Report workflow run status to Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          status: ${{ job.status }}
+          fields: repo,action,workflow
+          text: 'Release workflow failed in release job'
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CI_FAIL_NOTIFY }}

.github/workflows/link-check-cron.yml

@@ -21,3 +21,3 @@ # This workflow is centrally managed in https://github.com/asyncapi/.github/
     - name: Check links
-      uses: gaurav-nelson/github-action-markdown-link-check@v1
+      uses: gaurav-nelson/github-action-markdown-link-check@0a51127e9955b855a9bbfa1ff5577f1d1338c9a5 #1.0.14 but pointing to commit for security reasons
       with:
@@ -24,0 +24,0 @@ use-quiet-mode: 'yes'

.github/workflows/link-check-pr.yml

@@ -19,3 +19,3 @@ # This workflow is centrally managed in https://github.com/asyncapi/.github/
     - name: Check links
-      uses: gaurav-nelson/github-action-markdown-link-check@v1
+      uses: gaurav-nelson/github-action-markdown-link-check@0a51127e9955b855a9bbfa1ff5577f1d1338c9a5 #1.0.14 but pointing to commit for security reasons
       with:
@@ -22,0 +22,0 @@ use-quiet-mode: 'yes'

.github/workflows/lint-pr-title.yml

 # This action is centrally managed in https://github.com/asyncapi/.github/
 # Don't make changes to this file in this repo as they will be overwritten with changes made to the same file in above mentioned repo
 
+
+
 name: Lint PR title
@@ -9,13 +11,14 @@
     types: [opened, reopened, synchronize, edited, ready_for_review]
-
+    
 jobs:
   lint-pr-title:
-    name: Lint PR title
-    runs-on: ubuntu-latest
-    steps:
+   name: Lint PR title
+   runs-on: ubuntu-latest
+   steps:
       # Since this workflow is REQUIRED for a PR to be mergable, we have to have this 'if' statement in step level instead of job level.
       - if: ${{ !contains(fromJson('["asyncapi-bot", "dependabot[bot]", "dependabot-preview[bot]", "allcontributors"]'), github.actor) }}
-        uses: amannn/action-semantic-pull-request@v3.2.5
+        uses: amannn/action-semantic-pull-request@505e44b4f33b4c801f063838b3f053990ee46ea7      #version 4.6.0
+        id: lint_pr_title
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN}}
         with:
@@ -25,1 +28,24 @@ subjectPattern: ^(?![A-Z]).+$
             The subject "{subject}" found in the pull request title "{title}" should start with a lowercase character.
+            
+      # Comments the error message from the above lint_pr_title action 
+      - if: ${{ always() && steps.lint_pr_title.outputs.error_message != null && !contains(fromJson('["asyncapi-bot", "dependabot[bot]", "dependabot-preview[bot]", "allcontributors"]'), github.actor)}}
+        name: Comment on PR
+        uses: marocchino/sticky-pull-request-comment@39c5b5dc7717447d0cba270cd115037d32d28443    #version 2.2
+        with:
+          header: pr-title-lint-error
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN}}
+          message: |
+                   
+                   We require all PRs to follow [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/). 
+                   More details 👇🏼
+                   ```
+                    ${{ steps.lint_pr_title.outputs.error_message}}
+                   ```
+       # deletes the error comment if the title is correct            
+      - if: ${{ steps.lint_pr_title.outputs.error_message == null }}
+        name: delete the comment
+        uses: marocchino/sticky-pull-request-comment@39c5b5dc7717447d0cba270cd115037d32d28443    #version 2.2
+        with:   
+          header: pr-title-lint-error
+          delete: true
+          GITHUB_TOKEN: ${{ secrets.GH_TOKEN}}

.github/workflows/stale-issues-prs.yml

@@ -16,3 +16,3 @@ # This action is centrally managed in https://github.com/asyncapi/.github/
     steps:
-    - uses: actions/stale@v5.1.0
+    - uses: actions/stale@99b6c709598e2b0d0841cd037aaf1ba07a4410bd #v5.2.0 but pointing to commit for security reasons
       with:
@@ -19,0 +19,0 @@ repo-token: ${{ secrets.GITHUB_TOKEN }}

filters/all.js

@@ -343,8 +343,3 @@ const filter = module.exports;
     } else {
-      // check to see if it's a ref to another schema.
-      typeName = property.ext('x-parser-schema-id');
-
-      if (!typeName) {
-        throw new Error(`Can't determine the type of property ${  name}`);
-      }
+      throw new Error(`Can't determine the type of property ${  name  }`);
     }
@@ -351,0 +346,0 @@ } else if (type === 'array') {

package.json

 {
   "name": "@asyncapi/java-spring-cloud-stream-template",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Java Spring Cloud Stream template for AsyncAPI generator.",
@@ -5,0 +5,0 @@ "scripts": {

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

291213

1.57%

Worsened metrics

Lines of code

1825

-0.22%

Number of low supply chain risk alerts

7

16.67%

No dependency changes