Merge branch 'release/v0.3.1'

.github/workflows/build.yml

@@ -10,9 +10,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - uses: subosito/flutter-action@v1.5.3
+      - uses: subosito/flutter-action@v2.8.0
         with:
           flutter-version: '2.2.0'
 
@@ -21,7 +21,7 @@ jobs:
           cd ui
           ./install_ui
 
-      - uses: actions/upload-artifact@v2.3.1
+      - uses: actions/upload-artifact@v3
         with:
           name: frontend
           path: |
@@ -34,15 +34,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
-      - uses: actions/setup-java@v2
+      - uses: actions/setup-java@v3
         with:
           java-version: '15'
           distribution: 'zulu'
 
       - name: Setup python
-        uses: actions/setup-python@v2.3.1
+        uses: actions/setup-python@v4
         with:
           python-version: '3.9'
 
@@ -53,7 +53,7 @@ jobs:
           extractcode --version
 
       - name: Download fronted from the frontend job
-        uses: actions/download-artifact@v2.1.0
+        uses: actions/download-artifact@v3
         with:
           name: frontend
           path: frontend
@@ -70,7 +70,7 @@ jobs:
       - name: Test with Maven
         run: mvn --no-transfer-progress test
 
-      - uses: actions/upload-artifact@v2.3.1
+      - uses: actions/upload-artifact@v3
         with:
           name: backend
           path: |
@@ -83,27 +83,34 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    permissions:
+      id-token: write
+
     if: success()
 
     env:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      REGISTRY_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      REGISTRY_TOKEN: ${{ secrets.DOCKER_PASSWORD }}
       DOCKER_ORGANIZATION: philipssoftware
       GITHUB_ORGANIZATION: philips-software
+      KEYLESS: true
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Download backend from the backend job
-        uses: actions/download-artifact@v2.1.0
+        uses: actions/download-artifact@v3
         with:
           name: backend
           path: target
 
       - name: Build Docker Images
-        uses: philips-software/docker-ci-scripts@v3.3.2
+        uses: philips-software/docker-ci-scripts@v5.0.0
         with:
           dockerfile: docker/Dockerfile
           image-name: bom-base
-          tags: 0 0.3 0.3.0 v0.3.0 latest ${{ github.sha }}
+          tags: 0 0.3 0.3.1 v0.3.1 latest ${{ github.sha }}
+          sign: true
+          slsa-provenance: true
+          sbom: true

.github/workflows/licenses.yml

@@ -7,8 +7,8 @@ jobs:
   scanLicenses:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions/setup-java@v2
+    - uses: actions/checkout@v3
+    - uses: actions/setup-java@v3
       with:
         java-version: '11.0.13'
         distribution: 'zulu'
@@ -24,14 +24,14 @@ jobs:
 
     - name: Create spdx-file
       id: spdx-builder
-      uses: philips-software/[email protected].1.1
+      uses: philips-software/[email protected].2
       with:
         project: bom-base
         mode: 'tree'
         tree: dependencies.txt
         format: maven
 
-    - uses: actions/upload-artifact@v2.3.1
+    - uses: actions/upload-artifact@v3
       with:
         name: licenses
         path: ${{ steps.spdx-builder.outputs.spdx-file }}

CONTRIBUTING.md

@@ -51,7 +51,7 @@ This needs to be improved in the future, but for now:
 Change version into new version in file / linenumber:
 
 - `pom.xml` : line 13.
-- `.github/workflows/build.yml` : line 109. (docker tags)
+- `.github/workflows/build.yml` : line 113. (docker tags)
 
 Commit changes:
 

pom.xml

@@ -5,12 +5,12 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>2.6.1</version>
+        <version>2.7.5</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <groupId>com.philips.research</groupId>
     <artifactId>BOM-base</artifactId>
-    <version>0.3.0-SNAPSHOT</version>
+    <version>0.3.1-SNAPSHOT</version>
     <name>BOM-base</name>
     <description>FOSS metadata repository</description>
 
@@ -73,13 +73,13 @@
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
             <artifactId>mockwebserver</artifactId>
-            <version>${okhttp3.version}</version>
+            <version>${okhttp.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>nl.jqno.equalsverifier</groupId>
             <artifactId>equalsverifier</artifactId>
-            <version>3.8.1</version>
+            <version>3.10.1</version>
             <scope>test</scope>
         </dependency>
     </dependencies>