Merge branch 'main' into test-semgrep-on-merge

.github/FUNDING.yml

@@ -1 +1 @@
-custom: https://owasp.org/donate/?reponame=www-project-webgoat&title=OWASP+WebGoat
+custom: https://owasp.org/donate/?reponame=www-project-webgoat&title=OWASP+WebGoat

.github/dependabot.yml

@@ -1,7 +1,14 @@
 version: 2
 updates:
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"
+    -   package-ecosystem: "github-actions"
+        directory: "/"
+        schedule:
+            interval: "weekly"
+    -   package-ecosystem: "maven"
+        directory: "/"
+        schedule:
+            interval: "weekly"
+    -   package-ecosystem: "docker"
+        directory: "/"
+        schedule:
+            interval: "weekly"

.github/workflows/branchbuild.txt

@@ -0,0 +1,54 @@
+name: "Branch build"
+on:
+    push:
+      branches:
+        - "*"
+        - "!main"
+
+jobs:
+    branch-build:
+        runs-on: ${{ matrix.os }}
+        strategy:
+            matrix:
+                os: [ ubuntu-latest, windows-latest, macos-latest ]
+                java-version: [ 17, 21 ]
+        steps:
+            -   uses: actions/checkout@v3
+            -   name: Set up JDK ${{ matrix.java-version }}
+                uses: actions/setup-java@v4
+                with:
+                    distribution: 'temurin'
+                    java-version: ${{ matrix.java-version }}
+                    architecture: x64
+            -   name: Cache Maven packages
+                uses: actions/cache@v3.3.1
+                with:
+                    path: ~/.m2
+                    key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+                    restore-keys: ${{ runner.os }}-m2-
+            -   name: Build with Maven
+                run: mvn --no-transfer-progress verify
+            -   name: "Set up QEMU"
+                if: runner.os == 'Linux'
+                uses: docker/setup-qemu-action@v2.2.0
+            -   name: "Set up Docker Buildx"
+                if: runner.os == 'Linux'
+                uses: docker/setup-buildx-action@v2
+            -   name: "Verify Docker WebGoat build"
+                if: runner.os == 'Linux'
+                uses: docker/build-push-action@v5.1.0
+                with:
+                    context: ./
+                    file: ./Dockerfile
+                    push: false
+                    build-args: |
+                        webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}
+            -   name: "Verify Docker WebGoat desktop build"
+                uses: docker/build-push-action@v5.1.0
+                if: runner.os == 'Linux'
+                with:
+                    context: ./
+                    file: ./Dockerfile_desktop
+                    push: false
+                    build-args: |
+                        webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}

.github/workflows/build.yml

@@ -1,68 +1,34 @@
-name: "Build"
+name: "Main / Pull requests build"
 on:
-  pull_request:
-    paths-ignore:
-      - '.txt'
-      - 'LICENSE'
-      - 'docs/**'
-  push:
-    branches:
-      - main
-      - develop
-      - release/*
-    tags-ignore:
-      - '*'
-    paths-ignore:
-      - '.txt'
-      - 'LICENSE'
-      - 'docs/**'
+    pull_request:
+        paths-ignore:
+            - '.txt'
+            - 'LICENSE'
+            - 'docs/**'
+        branches: [main]
+    push:
+        branches:
+            - main
 
 jobs:
-  pr-build:
-    if: >
-      github.event_name == 'pull_request' && !github.event.pull_request.draft && (
-        github.event.action == 'opened' ||
-        github.event.action == 'reopened' ||
-        github.event.action == 'synchronize' 
-      )
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up JDK 17
-        uses: actions/setup-java@v3
-        with:
-          distribution: 'temurin'
-          java-version: 17
-          architecture: x64
-      - name: Cache Maven packages
-        uses: actions/cache@v3.2.3
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2-
-      - name: Build with Maven
-        run: mvn --no-transfer-progress verify
-
-  build:
-    if: github.repository == 'WebGoat/WebGoat' && github.event_name == 'push'
-    runs-on: ubuntu-latest
-    name: "Branch build"
-    steps:
-        - uses: actions/checkout@v3
-        - name: set up JDK 17
-          uses: actions/setup-java@v3
-          with:
-              distribution: 'temurin'
-              java-version: 17
-              architecture: x64
-        - name: Cache Maven packages
-          uses: actions/cache@v3.2.3
-          with:
-              path: ~/.m2
-              key: ubuntu-latest-m2-${{ hashFiles('**/pom.xml') }}
-              restore-keys: ubuntu-latest-m2-
-        - name: Test with Maven
-          run: mvn --no-transfer-progress verify
+    build:
+        runs-on: ${{ matrix.os }}
+        strategy:
+            matrix:
+                os: [ ubuntu-latest, windows-latest, macos-latest ]
+        steps:
+            -   uses: actions/checkout@v3
+            -   name: Set up JDK 17
+                uses: actions/setup-java@v4
+                with:
+                    distribution: 'temurin'
+                    java-version: 17
+                    architecture: x64
+            -   name: Cache Maven packages
+                uses: actions/cache@v4.0.0
+                with:
+                    path: ~/.m2
+                    key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
+                    restore-keys: ${{ runner.os }}-m2-
+            -   name: Build with Maven
+                run: mvn --no-transfer-progress verify

.github/workflows/pre-commit.yaml

@@ -0,0 +1,29 @@
+name: Pre-commit check
+
+on:
+    pull_request:
+        branches: [main]
+    workflow_dispatch:
+
+permissions:
+    contents: read
+jobs:
+    pre-commit:
+        name: Pre-commit check
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout git repository
+              uses: actions/checkout@v4
+            - name: Setup python
+              uses: actions/setup-python@v5
+              with:
+                    python-version: "3.9"
+            - uses: actions/setup-java@v4
+              with:
+                  distribution: 'temurin'
+                  java-version: '17'
+            - name: Pre-commit checks
+              uses: pre-commit/action@v3.0.0
+            - name: pre-commit-ci-lite
+              uses: pre-commit-ci/lite-action@v1.0.1
+              if: always()

.github/workflows/release.yml

@@ -8,24 +8,22 @@ jobs:
     if: github.repository == 'WebGoat/WebGoat'
     name: Release WebGoat
     runs-on: ubuntu-latest
+    permissions:
+        contents: write
     environment:
       name: release
     steps:
       - uses: actions/checkout@v3
 
-      - name: "Get tag name"
-        id: tag
-        uses: dawidd6/action-get-tag@v1
-
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
-          distribution: 'zulu'
+          distribution: 'temurin'
           java-version: 17
           architecture: x64
 
       - name: Cache Maven packages
-        uses: actions/cache@v3.2.3
+        uses: actions/cache@v4.0.0
         with:
           path: ~/.m2
           key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
@@ -33,8 +31,8 @@ jobs:
 
       - name: "Set labels for ${{ github.ref }}"
         run: |
-          echo "WEBGOAT_TAG_VERSION=${{ steps.tag.outputs.tag }}" >> $GITHUB_ENV
-          WEBGOAT_MAVEN_VERSION=${{ steps.tag.outputs.tag }}
+          echo "WEBGOAT_TAG_VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
+          WEBGOAT_MAVEN_VERSION=${{ github.ref_name }}
           echo "WEBGOAT_MAVEN_VERSION=${WEBGOAT_MAVEN_VERSION:1}" >> $GITHUB_ENV
       - name: Build with Maven
         run: |
@@ -48,7 +46,7 @@ jobs:
           files: |
             target/webgoat-${{ env.WEBGOAT_MAVEN_VERSION }}.jar
           body: |
-            ## Version ${{ steps.tag.outputs.tag }}
+           ## Version ${{ github.ref_name }}
 
             ### New functionality
 
@@ -57,8 +55,8 @@ jobs:
             ### Bug fixes
 
             - [#743 - Character encoding errors](https://github.com/WebGoat/WebGoat/issues/743)
-              
-            Full change log: https://github.com/WebGoat/WebGoat/compare/${{ steps.tag.outputs.tag }}...${{ steps.tag.outputs.tag }}  
+
+            Full change log: https://github.com/WebGoat/WebGoat/compare/${{ github.ref_name }}...${{ github.ref_name }}
 
 
             ## Contributors
@@ -76,63 +74,76 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: "Set up QEMU"
-        uses: docker/setup-qemu-action@v2.1.0
+        uses: docker/setup-qemu-action@v2.2.0
         with:
           platforms: all
 
       - name: "Set up Docker Buildx"
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: "Login to dockerhub"
-        uses: docker/login-action@v2.1.0
+        uses: docker/login-action@v3.0.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: "Build and push"
-        uses: docker/build-push-action@v3.2.0
+      - name: "Build and push WebGoat"
+        uses: docker/build-push-action@v5.1.0
         with:
           context: ./
           file: ./Dockerfile
-          push: true 
-          platforms: linux/amd64, linux/arm64, linux/arm/v7
+          push: true
+          platforms: linux/amd64, linux/arm64
           tags: |
             webgoat/webgoat:${{ env.WEBGOAT_TAG_VERSION }}
             webgoat/webgoat:latest
           build-args: |
             webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}
 
-      - name: "Image digest"
-        run: echo ${{ steps.docker_build.outputs.digest }}
+      - name: "Build and push WebGoat desktop"
+        uses: docker/build-push-action@v5.1.0
+        with:
+          context: ./
+          file: ./Dockerfile_desktop
+          push: true
+          platforms: linux/amd64, linux/arm64
+          tags: |
+            webgoat/webgoat-desktop:${{ env.WEBGOAT_TAG_VERSION }}
+            webgoat/webgoat-desktop:latest
+          build-args: |
+            webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}
   new_version:
-    permissions:
-      contents: write  # for Git to git push
     if: github.repository == 'WebGoat/WebGoat'
-    name: Update development version
+    name: Update to next SNAPSHOT version
     needs: [ release ]
     runs-on: ubuntu-latest
-    environment:
-      name: release
     steps:
       - uses: actions/checkout@v3
         with:
-          ref: develop
-          token: ${{ secrets.WEBGOAT_DEPLOYER_TOKEN }}
+          fetch-depth: 0
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
+          distribution: 'temurin'
           java-version: 17
           architecture: x64
 
       - name: Set version to next snapshot
         run: |
-          mvn build-helper:parse-version versions:set -DnewVersion=\${parsedVersion.majorVersion}.\${parsedVersion.minorVersion}.\${parsedVersion.nextIncrementalVersion}-SNAPSHOT versions:commit
+          mvn build-helper:parse-version versions:set -DnewVersion=\${parsedVersion.majorVersion}.\${parsedVersion.minorVersion}-SNAPSHOT versions:commit
 
-      - name: Commit pom.xml
-        run: |
-          git config user.name webgoat-github
-          git config user.email owasp.webgoat@gmail.com
-          find . -name 'pom.xml' | xargs git add
-          git commit -m "Updating to the new development version"
-          git push
+      - name: Push the changes to new branch
+        uses: devops-infra/action-commit-push@v0.9.2
+        with:
+            github_token: "${{ secrets.GITHUB_TOKEN }}"
+            add_timestamp: true
+            commit_message: "Updating to the new development version"
+            force: false
+
+      - name: Create PR
+        uses: devops-infra/action-pull-request@v0.5.5
+        with:
+            github_token: "${{ secrets.GITHUB_TOKEN }}"
+            title: ${{ github.event.commits[0].message }}
+            target_branch: main

.github/workflows/test.yml

@@ -2,14 +2,11 @@ name: "UI-Test"
 on:
     pull_request:
         paths-ignore:
-            - '.txt'
-            - '*.MD'
-            - '*.md'
             - 'LICENSE'
             - 'docs/**'
     push:
-#        tags-ignore:
-#            - '*'
+        tags-ignore:
+            - 'v*'
         paths-ignore:
             - '.txt'
             - '*.MD'
@@ -24,45 +21,47 @@ jobs:
         name: "Robot framework test"
         steps:
             # Uses an default action to checkout the code
-            - uses: actions/checkout@v3
+            -   uses: actions/checkout@v3
             # Uses an action to add Python to the VM
-            - name: Setup Pyton
-              uses: actions/setup-python@v4
-              with:
-                  python-version: '3.7'
-                  architecture: x64
+            -   name: Setup Python
+                uses: actions/setup-python@v5
+                with:
+                    python-version: '3.7'
+                    architecture: x64
             # Uses an action to add JDK 17 to the VM (and mvn?)
-            - name: set up JDK 17
-              uses: actions/setup-java@v3
-              with:
-                  distribution: 'temurin'
-                  java-version: 17
-                  architecture: x64
+            -   name: set up JDK 17
+                uses: actions/setup-java@v4
+                with:
+                    distribution: 'temurin'
+                    java-version: 17
+                    architecture: x64
             #Uses an action to set up a cache using a certain key based on the hash of the dependencies
-            - name: Cache Maven packages
-              uses: actions/cache@v3.2.3
-              with:
-                  path: ~/.m2
-                  key: ubuntu-latest-m2-${{ hashFiles('**/pom.xml') }}
-                  restore-keys: ubuntu-latest-m2-
-            - uses: BSFishy/pip-action@v1
-              with:
-                  packages: |
-                      robotframework
-                      robotframework-SeleniumLibrary
-                      webdriver-manager
-            - name: Run with Maven
-              run: mvn --no-transfer-progress spring-boot:run &
-            - name: Wait to start
-              uses: ifaxity/wait-on-action@v1
-              with:
-                  resource: http://127.0.0.1:8080/WebGoat
-            - name: Test with Robotframework
-              run: python3 -m robot --variable HEADLESS:"1" --outputdir robotreport robot/goat.robot
+            -   name: Cache Maven packages
+                uses: actions/cache@v4.0.0
+                with:
+                    path: ~/.m2
+                    key: ubuntu-latest-m2-${{ hashFiles('**/pom.xml') }}
+                    restore-keys: ubuntu-latest-m2-
+            -   uses: BSFishy/pip-action@v1
+                with:
+                    packages: |
+                        robotframework
+                        robotframework-SeleniumLibrary
+                        webdriver-manager
+                        selenium==4.9.1
+                    # TODO https://github.com/robotframework/SeleniumLibrary/issues/1835
+            -   name: Run with Maven
+                run: mvn --no-transfer-progress spring-boot:run &
+            -   name: Wait to start
+                uses: ifaxity/wait-on-action@v1
+                with:
+                    resource: http://127.0.0.1:8080/WebGoat
+            -   name: Test with Robotframework
+                run: python3 -m robot --variable HEADLESS:"1" --outputdir robotreport robot/goat.robot
             # send report to forks only due to limits on permission tokens
-            - name: Send report to commit
-              if: github.repository != 'WebGoat/WebGoat' && github.event_name == 'push'
-              uses: joonvena/robotframework-reporter-action@v2.1
-              with:
-                  gh_access_token: ${{ secrets.GITHUB_TOKEN }}
-                  report_path: 'robotreport'
+            -   name: Send report to commit
+                if: github.repository != 'WebGoat/WebGoat' && github.event_name == 'push'
+                uses: joonvena/robotframework-reporter-action@v2.2
+                with:
+                    gh_access_token: ${{ secrets.GITHUB_TOKEN }}
+                    report_path: 'robotreport'

.github/workflows/welcome.yml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository == 'WebGoat/WebGoat'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/first-interaction@v1.1.1
+      - uses: actions/first-interaction@v1.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           issue-message: 'Thanks for submitting your first issue, we will have a look as quickly as possible.'