chore(release): nightly

moabu commented 4 days ago

The constant bleeding edge version

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

[x] I confirm that there is no impact on the docs due to the code changes in this PR.

dryrunsecurity[bot] commented 4 days ago

DryRun Security Summary

The provided code changes cover a wide range of updates to the Janssen project, including Helm chart version updates, container image tag changes, and various configuration adjustments, with a few areas requiring closer attention from an application security perspective, such as the use of nightly/pre-release versions, sensitive configuration settings, input validation and sanitization, dependency management, and secure coding practices.

Expand for full summary

**Summary:** The provided code changes cover a wide range of updates to the Janssen project, including Helm chart version updates, container image tag changes, and various configuration adjustments. While the majority of the changes appear to be routine version updates, there are a few areas that require closer attention from an application security perspective: 1. **Nightly/Pre-release Versions**: Several of the updates involve changing the version and image tags to "nightly" or "0.0.0-nightly" versions. These pre-release versions may contain unpatched vulnerabilities or security issues, and should be thoroughly tested before deployment to production environments. 2. **Sensitive Configuration Settings**: Some of the configuration files contain hardcoded or plaintext values for sensitive information, such as database credentials, API keys, and passwords. These should be properly secured, either through the use of a secrets management system or by ensuring they are not stored in the configuration files. 3. **Input Validation and Sanitization**: A few of the changes involve the use of raw SQL queries with user-supplied input, which could potentially lead to SQL injection vulnerabilities. It is important to ensure that all user input is properly validated and sanitized to prevent such issues. 4. **Dependency Management**: When updating to newer versions, it is crucial to review the dependencies and ensure that they are also up-to-date and do not contain any known security vulnerabilities. 5. **Secure Coding Practices**: While the changes do not directly introduce any obvious security vulnerabilities, it is important to maintain a vigilant approach to secure coding practices, such as proper error handling, secure authentication and authorization mechanisms, and regular security audits. **Files Changed:** 1. `agama/pom.xml`: Updates the project version to a "nightly" version, which should be reviewed for potential security risks. 2. `.github/workflows/build-nightly-build.yml`: Updates the nightly build release management process, with a focus on secure permissions and token management. 3. `.github/workflows/build-test.yml`: Modifies the build, test, and publication workflow, including several security-conscious practices such as commit signing and runner hardening. 4. `.github/workflows/build-docs.yml`: Updates the documentation deployment workflow, with a focus on secure Git operations and dependency management. 5. `charts/janssen-all-in-one/Chart.yaml`: Updates the container image tags to a "nightly" version, which should be reviewed for potential security risks. 6. `charts/janssen-all-in-one/README.md`: Updates the container image tags to a "nightly" version, which should be reviewed for potential security risks. 7. `charts/janssen/charts/` (multiple files): Updates various Janssen Helm charts to "nightly" versions, which should be reviewed for potential security risks, and includes several configuration changes that should be audited for security implications.