Merge branch 'master' into default-micromamba-v2-template

Author: pditommaso

.github/actions/deploy/action.yml

@@ -25,14 +25,14 @@ runs:
   using: "composite"
   steps:
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v1
+      uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
       with:
         aws-access-key-id: ${{ inputs.aws-access-key-id }}
         aws-secret-access-key: ${{ inputs.aws-secret-access-key }}
         aws-region: ${{ inputs.aws-region }}
 
     - name: Deploy to prod
-      uses: kodermax/kubectl-aws-eks@master
+      uses: kodermax/kubectl-aws-eks@ebad7507329396261acc8b118807b81727314058 # master
       env:
         KUBE_CONFIG_DATA: ${{ inputs.kube-config-data }}
       with:

.github/workflows/build-plugin-scanner.yml

@@ -17,14 +17,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Docker Login
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: public.cr.seqera.io
           username: ${{ vars.SEQERA_PUBLIC_CR_USERNAME  }}

.github/workflows/build-singularity.yml

@@ -13,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Docker Login
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: public.cr.seqera.io
           username: ${{ vars.SEQERA_PUBLIC_CR_USERNAME  }}

.github/workflows/build.yml

@@ -33,19 +33,39 @@ jobs:
         java_version: [21]
     permissions:
       contents: write
+      id-token: write
 
     steps:
       - name: Environment
         run: env | sort
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
         with:
           fetch-depth: 1
           submodules: true
 
+      - name: Detect release commit
+        id: detect-release
+        env:
+          COMMIT_MSG: ${{ github.event.head_commit.message }}
+        run: |
+          # Only direct pushes whose first line tags `[release]` should publish.
+          # Squash merges append "(#NNN)" and merge commits start with "Merge pull request #NNN" —
+          # both must be excluded so a PR body mentioning [release] does not trigger a release.
+          first_line=$(printf '%s\n' "$COMMIT_MSG" | head -n1)
+          if [[ "$first_line" == *"[release]"* ]] \
+             && [[ ! "$first_line" =~ \(#[0-9]+\)$ ]] \
+             && [[ ! "$first_line" =~ ^Merge\ pull\ request\ #[0-9]+ ]]; then
+            echo "Detected release commit — release steps will run"
+            echo "is_release=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "Not a release commit — release steps will be skipped"
+            echo "is_release=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Setup Java ${{ matrix.java_version }}
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # ratchet:actions/setup-java@v5.2.0
         with:
           java-version: ${{matrix.java_version}}
           distribution: 'temurin'
@@ -79,12 +99,66 @@ jobs:
         run: |
           sudo rm -rf /home/runner/work/wave/wave/build-workspace
 
+      - name: Login to legacy ECR
+        if: "steps.detect-release.outputs.is_release == 'true'"
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # ratchet:docker/login-action@v4.2.0
+        with:
+          registry: 195996028523.dkr.ecr.eu-west-1.amazonaws.com
+          username: ${{ secrets.TOWER_CI_AWS_ACCESS }}
+          password: ${{ secrets.TOWER_CI_AWS_SECRET }}
+        env:
+          AWS_REGION: eu-west-1
+
+      - name: Configure AWS credentials for platform pusher
+        if: "steps.detect-release.outputs.is_release == 'true'"
+        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5 # ratchet:aws-actions/configure-aws-credentials@v6.1.2
+        with:
+          aws-region: eu-west-2
+          role-to-assume: arn:aws:iam::232933512461:role/wave-ecr-pusher
+          role-session-name: GitHubActions-${{ github.run_id }}
+
+      - name: Login to enterprise Amazon ECR
+        if: "steps.detect-release.outputs.is_release == 'true'"
+        uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # ratchet:aws-actions/amazon-ecr-login@v2.1.5
+
       - name: Release
-        if: "contains(github.event.head_commit.message, '[release]')"
+        id: release
+        if: "steps.detect-release.outputs.is_release == 'true'"
         run: |
+          set -e
+          set -x
+          # Drop the session token injected by configure-aws-credentials so publish.sh / gradle
+          # sign maven S3 uploads with the static TOWER_CI keys only (mixing static keys with a
+          # session token from a different role produces SignatureDoesNotMatch).
+          unset AWS_SESSION_TOKEN
           bash publish.sh wave-api
           bash publish.sh wave-utils
-          bash tag-and-push.sh
+
+          TAG=v$(cat VERSION)
+
+          # Tag repo
+          REMOTE=https://oauth:$GITHUB_TOKEN@github.com/${GITHUB_REPOSITORY}.git
+          git tag $TAG
+          git push $REMOTE $TAG
+
+          # Build container image locally with a generic name
+          ./gradlew -PjibRepo=wave/server:$TAG jibDockerBuild
+
+          # Push nf-tower-enterprise/wave to legacy ECR
+          LEGACY_ECR=195996028523.dkr.ecr.eu-west-1.amazonaws.com
+          docker tag wave/server:$TAG $LEGACY_ECR/nf-tower-enterprise/wave:$TAG
+          docker push $LEGACY_ECR/nf-tower-enterprise/wave:$TAG
+
+          # Push to enterprise ECR (new central registry)
+          ENTERPRISE_ECR=232933512461.dkr.ecr.eu-west-2.amazonaws.com
+          docker tag wave/server:$TAG $ENTERPRISE_ECR/wave/server:$TAG
+          docker push $ENTERPRISE_ECR/wave/server:$TAG
+
+          # Create GitHub release (draft for alpha/beta/RC tags)
+          grep -Ei '.*-(A[0-9]+|B[0-9]+|RC[0-9]+)$' VERSION &>/dev/null && DRAFT='--draft' || DRAFT=''
+          gh release create $TAG --generate-notes $DRAFT
+
+          echo "version=$TAG" >> $GITHUB_OUTPUT
         env:
           GRADLE_OPTS: '-Dorg.gradle.daemon=false'
           AWS_ACCESS_KEY_ID: ${{secrets.TOWER_CI_AWS_ACCESS}}
@@ -99,16 +173,16 @@ jobs:
 
       - name: Publish tests report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # ratchet:actions/upload-artifact@v7.0.1
         with:
           name: test-reports-jdk-${{ matrix.java_version }}
           path: |
             **/build/reports/tests/test
 
-      - name : Publish code coverage report
+      - name: Publish code coverage report
         if: success()
-        uses : actions/upload-artifact@v4
-        with :
-          name : code-coverage-reports-jdk-${{ matrix.java_version }}
-          path : |
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # ratchet:actions/upload-artifact@v7.0.1
+        with:
+          name: code-coverage-reports-jdk-${{ matrix.java_version }}
+          path: |
             **/build/reports/jacoco/test

.github/workflows/claude.yml

@@ -25,12 +25,12 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 1
 
       - name: Run Claude PR Action
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@28f83620103c48a57093dcc2837eec89e036bb9f # beta
         with:
           anthropic_api_key: ${{ secrets.ENG_ANTHROPIC_API_KEY }}
           # Or use OAuth token instead:

.github/workflows/codespell.yml

@@ -10,14 +10,14 @@ jobs:
   dependency-submission:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         distribution: temurin
         java-version: 17
 
     - name: Generate and submit dependency graph for wave
-      uses: gradle/actions/dependency-submission@v4
+      uses: gradle/actions/dependency-submission@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
       with:
         dependency-resolution-task: "dependencies"
         additional-arguments: "--configuration runtimeClasspath"

.github/workflows/security-submit-dependecy-graph.yml

@@ -24,12 +24,12 @@ jobs:
 
     steps:
       - name : Checkout
-        uses : actions/checkout@v4
+        uses : actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name : Setup Node.js environment
-        uses : actions/setup-node@v4
+        uses : actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with :
-          node-version : '20.9.0'
+          node-version : '24.15.0'
 
       - name : Install tsp
         run : npm install -g @typespec/compiler@0.64.0
@@ -39,19 +39,3 @@ jobs:
           cd typespec
           tsp install
           tsp compile .
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-access-key-id: ${{secrets.TOWER_CI_AWS_ACCESS}}
-          aws-secret-access-key: ${{secrets.TOWER_CI_AWS_SECRET}}
-          aws-region: eu-west-1
-
-      - name : Login to Amazon ECR
-        id : login-ecr
-        uses : aws-actions/amazon-ecr-login@v1
-
-      - name: Release OpenAPI docs
-        if: "contains(github.event.head_commit.message, '[release]')"
-        run: |
-          bash typespec/tag-and-push-openapi.sh

.github/workflows/typespec.yml

@@ -1 +1 @@
-1.33.1
+1.33.6