Merge branch 'main' into feat/1486-repo-date-fields-migration

Author: andypols

.github/workflows/cve.yml

@@ -0,0 +1,53 @@
+name: CVE Scanning
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: ['main']
+  pull_request:
+    branches: ['main']
+  schedule:
+    - cron: '0 6 * * 1' # Weekly Monday 6am UTC
+
+jobs:
+  grype:
+    name: Grype dependency scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Install Grype
+        id: grype
+        uses: anchore/scan-action/download-grype@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7
+        with:
+          cache-db: true
+
+      - name: Scan (table)
+        run: |
+          ${{ steps.grype.outputs.cmd }} dir:. \
+            --config .grype.yaml \
+            --output template
+
+      - name: Scan (SARIF)
+        if: ${{ always() }}
+        run: |
+          ${{ steps.grype.outputs.cmd }} dir:. \
+            --config .grype.yaml \
+            --output sarif --file grype-results.sarif || true
+
+      - name: Upload SARIF report
+        if: ${{ always() }}
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        with:
+          sarif_file: grype-results.sarif

.github/workflows/dependency-review.yml

@@ -23,4 +23,4 @@ jobs:
           fail-on-severity: high
           allow-licenses: MIT, MIT-0, Apache-2.0, BSD-3-Clause, BSD-3-Clause-Clear, ISC, BSD-2-Clause, Unlicense, CC0-1.0, 0BSD, X11, MPL-2.0, MPL-1.0, MPL-1.1, MPL-2.0, OFL-1.1, Zlib, BlueOak-1.0.0, LicenseRef-scancode-dco-1.1, Ubuntu-font-1.0, Artistic-2.0, Python-2.0, EPL-2.0
           fail-on-scopes: development, runtime
-          allow-dependencies-licenses: 'pkg:npm/caniuse-lite, pkg:npm/path-is-inside, pkg:npm/unicode-match-property-value-ecmascript, pkg:npm/unicode-property-aliases-ecmascript, pkg:npm/uri-js'
+          allow-dependencies-licenses: 'pkg:npm/caniuse-lite, pkg:npm/path-is-inside, pkg:npm/unicode-match-property-value-ecmascript, pkg:npm/unicode-property-aliases-ecmascript, pkg:npm/uri-js, pkg:npm/bowser, pkg:npm/focus-visible, pkg:npm/spdx-exceptions'

.github/workflows/lint.yml

@@ -29,7 +29,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Dependencies
-        run: npm ci --workspaces
+        run: npm ci
 
       - name: Code Linting
         run: |

.github/workflows/unused-dependencies.yml

@@ -21,7 +21,7 @@ jobs:
           node-version: '24.x'
       - name: 'Run depcheck'
         run: |
-          npx depcheck --skip-missing --ignores="tsx,@babel/*,@commitlint/*,eslint,eslint-*,husky,ts-node,concurrently,nyc,prettier,typescript,tsconfig-paths,vite-tsconfig-paths,quicktype,history,@types/domutils,@vitest/coverage-v8,cross-env,c8"
+          npx depcheck --skip-missing --ignores="tsx,@babel/*,@commitlint/*,eslint,eslint-*,husky,ts-node,concurrently,nyc,prettier,typescript,tsconfig-paths,vite-tsconfig-paths,quicktype,history,@types/domutils,@vitest/coverage-v8,cross-env,c8,tailwindcss,react-is"
           echo $?
           if [[ $? == 1 ]]; then
             echo "Unused dependencies or devDependencies found"

.grype-report.tmpl

@@ -0,0 +1,6 @@
+{{printf "%-8s | %-19s | %-50s | %-15s | %s" "SEVERITY" "ADVISORY" "PACKAGE" "FIXED IN" "SOURCE"}}
+{{printf "%-8s | %-19s | %-50s | %-15s | %s" "--------" "-------------------" "--------------------------------------------------" "---------------" "------"}}
+{{- range .Matches -}}
+{{- $loc := "" -}}{{- range .Artifact.Locations -}}{{- $loc = .RealPath -}}{{- end}}
+{{printf "%-8s | %-19s | %-50s | %-15s | %s" .Vulnerability.Severity .Vulnerability.ID (printf "%s@%s" .Artifact.Name .Artifact.Version) (join ", " .Vulnerability.Fix.Versions) $loc}}
+{{- end}}

.grype.yaml

@@ -0,0 +1,11 @@
+fail-on-severity: high
+sort-by: severity
+output-template-file: .grype-report.tmpl
+
+ignore:
+  - fix-state: 'wont-fix'
+  - fix-state: 'not-fixed'
+
+# Comment out to include scanning experimental license inventory
+exclude:
+  - './experimental/**'

AGENTS.md

@@ -383,6 +383,7 @@ This file is the canonical project guide. Tool-specific entry points:
 
 - **Delegate everything:** Use the Task tool with specialized subagents for all research, code exploration, code writing, testing, and analysis. The main agent should plan, coordinate, and summarize — not do the work itself.
 - **Maximize parallelism:** Launch multiple subagents concurrently whenever their tasks are independent. For example, when exploring code patterns AND analyzing tests AND checking dependencies, spawn all three agents in a single message rather than sequentially. Always send independent Task calls in a **single message** with multiple tool-use blocks.
+
 <!-- - **Use the right agent type:** Pick `Explore` for codebase search/understanding, `Plan` for architecture decisions, `Bash` for commands, and specialized agents (e.g., `code-reviewer`, `test-automator`, `debugger`) when they match the task.
 - **Keep the main context clean:** Offload large file reads, multi-file searches, and deep analysis to subagents so the main conversation stays focused on coordination and user communication.
 - **Hooks run automatically — use subagents to respond:** When a hook (Spotless, build verification, code review, or simplification) reports an issue, delegate the fix to a subagent rather than doing it inline. If multiple hooks fail simultaneously, spawn parallel subagents to address each issue concurrently. -->

README.md

@@ -3,10 +3,10 @@
   <a href="https://github.com/finos/git-proxy">
     <img src="./website/static/img/logo.png" alt="Logo" height="95">
   </a>
-  
+
   <br />
   <br />
-  
+
   <p align="center">
     Deploy custom push protections and policies<br />on top of Git
     <br />

cypress/e2e/autoApproved.cy.js

@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-import moment from 'moment';
-
 describe('Auto-Approved Push Test', () => {
   beforeEach(() => {
     cy.login('admin', 'admin');
@@ -55,34 +53,23 @@ describe('Auto-Approved Push Test', () => {
           },
         ],
         attestation: {
-          timestamp: '2023-10-01T12:00:00Z',
-          autoApproved: true,
+          timestamp: 1696161600000,
+          reviewer: {
+            username: 'system',
+            displayName: '',
+          },
         },
       },
     }).as('getPush');
   });
 
-  it('should display auto-approved message and verify tooltip contains the expected timestamp', () => {
+  it('should display auto-approved message', () => {
     cy.visit('/dashboard/push/123');
 
     cy.wait('@getPush');
 
     cy.contains('Auto-approved by system').should('be.visible');
 
-    cy.get('svg.MuiSvgIcon-root')
-      .filter((_, el) => getComputedStyle(el).fill === 'rgb(0, 128, 0)')
-      .invoke('attr', 'style')
-      .should('include', 'cursor: default')
-      .and('include', 'opacity: 0.5');
-
-    const expectedTooltipTimestamp = moment('2023-10-01T12:00:00Z')
-      .local()
-      .format('dddd, MMMM Do YYYY, h:mm:ss a');
-
-    cy.get('kbd').trigger('mouseover');
-
-    cy.get('.MuiTooltip-tooltip').should('contain', expectedTooltipTimestamp);
-
     cy.contains('approved this contribution').should('not.exist');
   });
 });

cypress/e2e/docker/pushActions.cy.js

@@ -126,7 +126,7 @@ describe('Push Actions (Approve, Reject, Cancel)', () => {
       cy.get('[data-testid="push-reject-confirm-btn"]').should('be.disabled');
 
       // Fill in rejection reason
-      cy.get('#reason').type('Rejecting for test purposes');
+      cy.get('#push-reject-reason').type('Rejecting for test purposes');
 
       // Confirm button should now be enabled
       cy.get('[data-testid="push-reject-confirm-btn"]').should('not.be.disabled');