@eeacms/volto-arcgis-block 0.1.460 → 0.1.462
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.env +1 -3
- package/.github/workflows/betterleaks.yml +133 -0
- package/.github/workflows/scorecard.yml +43 -0
- package/.github/workflows/semgrep.yml +38 -0
- package/.gitleaks.toml +89 -0
- package/CHANGELOG.md +14 -24
- package/Dockerfile +35 -1
- package/README.md +60 -1
- package/RELEASE.md +1 -1
- package/cypress/support/commands.js +2 -2
- package/package.json +1 -1
- package/src/components/MapViewer/MenuWidget.jsx +2 -2
- package/src/components/MapViewer/css/ArcgisMap.css +0 -10
package/.env
CHANGED
|
@@ -0,0 +1,133 @@
|
|
|
1
|
+
name: Betterleaks
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
pull_request:
|
|
6
|
+
|
|
7
|
+
permissions:
|
|
8
|
+
contents: read
|
|
9
|
+
|
|
10
|
+
jobs:
|
|
11
|
+
scan:
|
|
12
|
+
name: Scan for secrets
|
|
13
|
+
runs-on: ubuntu-latest
|
|
14
|
+
env:
|
|
15
|
+
SMTP_URL: ${{ secrets.SMTP_URL }}
|
|
16
|
+
SMTP_PORT: ${{ secrets.SMTP_PORT || '25' }}
|
|
17
|
+
SMTP_EMAIL: ${{ secrets.SMTP_EMAIL }}
|
|
18
|
+
SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
|
|
19
|
+
steps:
|
|
20
|
+
- name: Checkout repository
|
|
21
|
+
uses: actions/checkout@v4
|
|
22
|
+
with:
|
|
23
|
+
fetch-depth: 1
|
|
24
|
+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
25
|
+
|
|
26
|
+
- name: Run Betterleaks
|
|
27
|
+
id: betterleaks
|
|
28
|
+
continue-on-error: true
|
|
29
|
+
uses: dortort/betterleaks-action@v0.1.0
|
|
30
|
+
with:
|
|
31
|
+
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
32
|
+
scan-mode: dir
|
|
33
|
+
scan-path: .
|
|
34
|
+
config: .gitleaks.toml
|
|
35
|
+
report-format: json
|
|
36
|
+
report-path: betterleaks-report.json
|
|
37
|
+
redact: "true"
|
|
38
|
+
no-color: "true"
|
|
39
|
+
no-banner: "true"
|
|
40
|
+
fail-on-leak: "true"
|
|
41
|
+
|
|
42
|
+
- name: Upload Betterleaks report
|
|
43
|
+
if: always()
|
|
44
|
+
uses: actions/upload-artifact@v4
|
|
45
|
+
with:
|
|
46
|
+
name: betterleaks-report
|
|
47
|
+
path: betterleaks-report.json
|
|
48
|
+
if-no-files-found: ignore
|
|
49
|
+
|
|
50
|
+
- name: Build Betterleaks email summary
|
|
51
|
+
id: leak_summary
|
|
52
|
+
if: steps.betterleaks.outcome == 'failure'
|
|
53
|
+
shell: bash
|
|
54
|
+
run: |
|
|
55
|
+
if [[ -s betterleaks-report.json ]]; then
|
|
56
|
+
jq -r '
|
|
57
|
+
def one_line:
|
|
58
|
+
tostring
|
|
59
|
+
| gsub("[\r\n]+"; " ")
|
|
60
|
+
| if length > 240 then .[0:240] + "..." else . end;
|
|
61
|
+
|
|
62
|
+
.[:20][]
|
|
63
|
+
| "- " + (.RuleID // "unknown-rule")
|
|
64
|
+
+ " at " + (.File // "unknown-file")
|
|
65
|
+
+ ":" + ((.StartLine // 0) | tostring)
|
|
66
|
+
+ "\n match: " + ((.Match // .Secret // "REDACTED") | one_line)
|
|
67
|
+
' betterleaks-report.json > betterleaks-email-summary.txt
|
|
68
|
+
|
|
69
|
+
count="$(jq 'length' betterleaks-report.json)"
|
|
70
|
+
if (( count > 20 )); then
|
|
71
|
+
{
|
|
72
|
+
echo ""
|
|
73
|
+
echo "... and $((count - 20)) more finding(s). Download the artifact for full details."
|
|
74
|
+
} >> betterleaks-email-summary.txt
|
|
75
|
+
fi
|
|
76
|
+
else
|
|
77
|
+
echo "No JSON report was generated. Download the workflow logs for details." > betterleaks-email-summary.txt
|
|
78
|
+
fi
|
|
79
|
+
|
|
80
|
+
{
|
|
81
|
+
echo "text<<BETTERLEAKS_SUMMARY"
|
|
82
|
+
cat betterleaks-email-summary.txt
|
|
83
|
+
echo "BETTERLEAKS_SUMMARY"
|
|
84
|
+
} >> "$GITHUB_OUTPUT"
|
|
85
|
+
|
|
86
|
+
- name: Resolve committer email
|
|
87
|
+
id: committer
|
|
88
|
+
if: steps.betterleaks.outcome == 'failure'
|
|
89
|
+
shell: bash
|
|
90
|
+
run: |
|
|
91
|
+
committer_email="$(git log -1 --format='%ce')"
|
|
92
|
+
author_email="$(git log -1 --format='%ae')"
|
|
93
|
+
email="$committer_email"
|
|
94
|
+
if [[ -z "$email" || "$email" == *"noreply.github.com"* ]]; then
|
|
95
|
+
email="$author_email"
|
|
96
|
+
fi
|
|
97
|
+
if [[ "$email" =~ ^[^[:space:]@]+@[^[:space:]@]+\.[^[:space:]@]+$ && "$email" != *"noreply.github.com"* ]]; then
|
|
98
|
+
echo "email=$email" >> "$GITHUB_OUTPUT"
|
|
99
|
+
else
|
|
100
|
+
echo "No deliverable committer email found; skipping Betterleaks email notification."
|
|
101
|
+
echo "email=" >> "$GITHUB_OUTPUT"
|
|
102
|
+
fi
|
|
103
|
+
|
|
104
|
+
- name: Email committer on Betterleaks failure
|
|
105
|
+
if: steps.betterleaks.outcome == 'failure' && steps.committer.outputs.email != '' && env.SMTP_URL != '' && env.SMTP_EMAIL != ''
|
|
106
|
+
uses: dawidd6/action-send-mail@v18
|
|
107
|
+
with:
|
|
108
|
+
server_address: ${{ env.SMTP_URL }}
|
|
109
|
+
server_port: ${{ env.SMTP_PORT }}
|
|
110
|
+
secure: ${{ env.SMTP_PORT == '465' }}
|
|
111
|
+
username: ${{ env.SMTP_EMAIL }}
|
|
112
|
+
password: ${{ env.SMTP_PASSWORD }}
|
|
113
|
+
from: ${{ env.SMTP_EMAIL }}
|
|
114
|
+
to: ${{ steps.committer.outputs.email }}
|
|
115
|
+
subject: "[Betterleaks] Secret scan failed in ${{ github.repository }}"
|
|
116
|
+
body: |
|
|
117
|
+
Betterleaks detected one or more potential secrets.
|
|
118
|
+
|
|
119
|
+
Repository: ${{ github.repository }}
|
|
120
|
+
Branch: ${{ github.ref_name }}
|
|
121
|
+
Commit: ${{ github.sha }}
|
|
122
|
+
Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
|
123
|
+
|
|
124
|
+
Findings:
|
|
125
|
+
${{ steps.leak_summary.outputs.text }}
|
|
126
|
+
|
|
127
|
+
Download the betterleaks-report artifact from the workflow run for details.
|
|
128
|
+
|
|
129
|
+
- name: Fail if Betterleaks found leaks
|
|
130
|
+
if: steps.betterleaks.outcome == 'failure'
|
|
131
|
+
run: |
|
|
132
|
+
echo "Betterleaks detected one or more secrets. Download the betterleaks-report artifact from this workflow run for details."
|
|
133
|
+
exit 1
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
name: OpenSSF Scorecard
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
branch_protection_rule:
|
|
5
|
+
schedule:
|
|
6
|
+
- cron: '30 1 * * 6'
|
|
7
|
+
push:
|
|
8
|
+
branches: ["master"]
|
|
9
|
+
workflow_dispatch:
|
|
10
|
+
|
|
11
|
+
permissions: read-all
|
|
12
|
+
|
|
13
|
+
jobs:
|
|
14
|
+
analysis:
|
|
15
|
+
name: Scorecard analysis
|
|
16
|
+
runs-on: ubuntu-latest
|
|
17
|
+
permissions:
|
|
18
|
+
security-events: write
|
|
19
|
+
id-token: write
|
|
20
|
+
steps:
|
|
21
|
+
- name: "Checkout code"
|
|
22
|
+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
23
|
+
with:
|
|
24
|
+
persist-credentials: false
|
|
25
|
+
|
|
26
|
+
- name: "Run analysis"
|
|
27
|
+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
|
|
28
|
+
with:
|
|
29
|
+
results_file: results.sarif
|
|
30
|
+
results_format: sarif
|
|
31
|
+
publish_results: true
|
|
32
|
+
|
|
33
|
+
- name: "Upload artifact"
|
|
34
|
+
uses: actions/upload-artifact@v4
|
|
35
|
+
with:
|
|
36
|
+
name: SARIF-scorecard
|
|
37
|
+
path: results.sarif
|
|
38
|
+
retention-days: 5
|
|
39
|
+
|
|
40
|
+
- name: "Upload to code-scanning"
|
|
41
|
+
uses: github/codeql-action/upload-sarif@v3
|
|
42
|
+
with:
|
|
43
|
+
sarif_file: results.sarif
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
name: Semgrep SAST
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
branches: ["master"]
|
|
6
|
+
pull_request:
|
|
7
|
+
schedule:
|
|
8
|
+
- cron: '0 6 * * 1'
|
|
9
|
+
workflow_dispatch:
|
|
10
|
+
|
|
11
|
+
permissions:
|
|
12
|
+
security-events: write
|
|
13
|
+
contents: read
|
|
14
|
+
|
|
15
|
+
jobs:
|
|
16
|
+
semgrep:
|
|
17
|
+
name: Semgrep scan
|
|
18
|
+
runs-on: ubuntu-latest
|
|
19
|
+
steps:
|
|
20
|
+
- name: Checkout code
|
|
21
|
+
uses: actions/checkout@v4
|
|
22
|
+
with:
|
|
23
|
+
persist-credentials: false
|
|
24
|
+
|
|
25
|
+
- name: Install Semgrep
|
|
26
|
+
run: pip install semgrep
|
|
27
|
+
|
|
28
|
+
- name: Run Semgrep
|
|
29
|
+
run: |
|
|
30
|
+
semgrep scan --config p/javascript --config p/react --config p/security-audit --config p/secrets \
|
|
31
|
+
--sarif --output semgrep.sarif \
|
|
32
|
+
--error || true
|
|
33
|
+
|
|
34
|
+
- name: Upload SARIF to GitHub Code Scanning
|
|
35
|
+
uses: github/codeql-action/upload-sarif@v3
|
|
36
|
+
if: always()
|
|
37
|
+
with:
|
|
38
|
+
sarif_file: semgrep.sarif
|
package/.gitleaks.toml
ADDED
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
title = "Betterleaks config"
|
|
2
|
+
|
|
3
|
+
[extend]
|
|
4
|
+
useDefault = true
|
|
5
|
+
|
|
6
|
+
[[rules]]
|
|
7
|
+
id = "secret-literal-assignment"
|
|
8
|
+
description = "Secret-like literal assignment in source, YAML, env and config files"
|
|
9
|
+
regex = '''(?i)([A-Za-z0-9_.-]*(?:password|passwd|pwd|api[_-]?key|apikey|access[_-]?key|secret[_-]?access[_-]?key|private[_-]?key|client[_-]?secret|consumer[_-]?key|consumer[_-]?secret|(?:auth|access|refresh|session|api|bearer|id|jwt|csrf|xsrf|oauth)[_-]?token|translate[_-]?auth|translation[_-]?auth|auth[_-]?password|auth[_-]?key|auth[_-]?credentials|database[_-]?url|connection[_-]?string)[A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
|
|
10
|
+
secretGroup = 2
|
|
11
|
+
keywords = [
|
|
12
|
+
"password",
|
|
13
|
+
"passwd",
|
|
14
|
+
"pwd",
|
|
15
|
+
"api_key",
|
|
16
|
+
"apikey",
|
|
17
|
+
"access_key",
|
|
18
|
+
"private_key",
|
|
19
|
+
"client_secret",
|
|
20
|
+
"consumer_key",
|
|
21
|
+
"consumer_secret",
|
|
22
|
+
"auth_token",
|
|
23
|
+
"access_token",
|
|
24
|
+
"refresh_token",
|
|
25
|
+
"session_token",
|
|
26
|
+
"api_token",
|
|
27
|
+
"bearer_token",
|
|
28
|
+
"id_token",
|
|
29
|
+
"jwt_token",
|
|
30
|
+
"csrf_token",
|
|
31
|
+
"xsrf_token",
|
|
32
|
+
"oauth_token",
|
|
33
|
+
"translate_auth",
|
|
34
|
+
"translation_auth",
|
|
35
|
+
"auth_password",
|
|
36
|
+
"auth_key",
|
|
37
|
+
"auth_credentials",
|
|
38
|
+
"database_url",
|
|
39
|
+
"connection_string"
|
|
40
|
+
]
|
|
41
|
+
tags = ["literal-secret"]
|
|
42
|
+
|
|
43
|
+
[[rules]]
|
|
44
|
+
id = "env-short-secret-assignment"
|
|
45
|
+
description = "Uppercase env-style PASS/TOKEN/SECRET assignment"
|
|
46
|
+
regex = '''\b((?:PASS|TOKEN|SECRET|[A-Z0-9_]*(?:_PASS|_TOKEN|_SECRET|PASS_|TOKEN_|SECRET_)[A-Z0-9_]*))[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
|
|
47
|
+
secretGroup = 2
|
|
48
|
+
keywords = [
|
|
49
|
+
"PASS",
|
|
50
|
+
"TOKEN",
|
|
51
|
+
"SECRET"
|
|
52
|
+
]
|
|
53
|
+
tags = ["env", "literal-secret"]
|
|
54
|
+
|
|
55
|
+
[[rules]]
|
|
56
|
+
id = "standalone-sk-token"
|
|
57
|
+
description = "Standalone sk-* token not attached to a secret-like variable name"
|
|
58
|
+
regex = '''(?i)\b(sk-[A-Za-z0-9][A-Za-z0-9_-]{20,})\b'''
|
|
59
|
+
secretGroup = 1
|
|
60
|
+
entropy = 2.5
|
|
61
|
+
keywords = ["sk-"]
|
|
62
|
+
tags = ["standalone-token", "generic"]
|
|
63
|
+
|
|
64
|
+
[[rules]]
|
|
65
|
+
id = "dotenv-only-jest-setup"
|
|
66
|
+
description = ".env may only contain the committed Jest setup lines"
|
|
67
|
+
path = '''(?i)(^|/)\.env$'''
|
|
68
|
+
regex = '''(?m)^(.+)$'''
|
|
69
|
+
secretGroup = 1
|
|
70
|
+
tags = ["file", "dotenv"]
|
|
71
|
+
[[rules.allowlists]]
|
|
72
|
+
regexTarget = "match"
|
|
73
|
+
regexes = [
|
|
74
|
+
'''^JEST_USE_SETUP=OFF # Jest configuration variables: ON, OFF\r?$''',
|
|
75
|
+
]
|
|
76
|
+
|
|
77
|
+
[[rules]]
|
|
78
|
+
id = "forbidden-secret-file"
|
|
79
|
+
description = "Forbidden secret-bearing file committed to repository"
|
|
80
|
+
path = '''(?i)(^|/)(\.env\..*|\.npmrc|\.pypirc|id_rsa|id_ed25519|.*\.(pem|key|p12|pfx|jks|kubeconfig))$'''
|
|
81
|
+
regex = '''(?s).{1,}'''
|
|
82
|
+
tags = ["file", "secret-file"]
|
|
83
|
+
|
|
84
|
+
[[allowlists]]
|
|
85
|
+
description = "Allow Jenkins SonarQube token environment variable reference"
|
|
86
|
+
regexTarget = "match"
|
|
87
|
+
regexes = [
|
|
88
|
+
'''SONAR_AUTH_TOKEN''',
|
|
89
|
+
]
|
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,20 @@ All notable changes to this project will be documented in this file. Dates are d
|
|
|
4
4
|
|
|
5
5
|
Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
6
6
|
|
|
7
|
+
### [0.1.462](https://github.com/eea/volto-arcgis-block/compare/0.1.461...0.1.462) - 14 July 2026
|
|
8
|
+
|
|
9
|
+
#### :bug: Bug Fixes
|
|
10
|
+
|
|
11
|
+
- fix: Add betterleaks github action - refs #304517 [dobri1408 - [`708109a`](https://github.com/eea/volto-arcgis-block/commit/708109a97a7a5bbefb816b694672594079e5845c)]
|
|
12
|
+
|
|
13
|
+
#### :hammer_and_wrench: Others
|
|
14
|
+
|
|
15
|
+
- ci: fix Semgrep workflow — use CLI with SARIF output [anton16 - [`d116408`](https://github.com/eea/volto-arcgis-block/commit/d1164086caed81549559ef617d504b248d148c81)]
|
|
16
|
+
- ci: add Semgrep SAST workflow [anton16 - [`d242b5c`](https://github.com/eea/volto-arcgis-block/commit/d242b5cee00b7a3d37fad292a2524e3ef6477281)]
|
|
17
|
+
- ci: add OpenSSF Scorecard workflow [anton16 - [`217ca11`](https://github.com/eea/volto-arcgis-block/commit/217ca11071e68aaf9183d058f49d928d8add7fac)]
|
|
18
|
+
- test: pin Chromium version 149 to work with Cypress [valentinab25 - [`9a729f9`](https://github.com/eea/volto-arcgis-block/commit/9a729f9fc40ddcbfed74ea8a18572e59f49be08f)]
|
|
19
|
+
### [0.1.461](https://github.com/eea/volto-arcgis-block/compare/0.1.460...0.1.461) - 2 July 2026
|
|
20
|
+
|
|
7
21
|
### [0.1.460](https://github.com/eea/volto-arcgis-block/compare/0.1.459...0.1.460) - 2 July 2026
|
|
8
22
|
|
|
9
23
|
### [0.1.459](https://github.com/eea/volto-arcgis-block/compare/0.1.458...0.1.459) - 1 July 2026
|
|
@@ -12,7 +26,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
12
26
|
|
|
13
27
|
#### :house: Internal changes
|
|
14
28
|
|
|
15
|
-
- chore: [JENKINSFILE] sanitize sonarqube command [valentinab25 - [`773ec5d`](https://github.com/eea/volto-arcgis-block/commit/773ec5d35da8a1ba0c93c243ca5c11fc29145ab3)]
|
|
16
29
|
|
|
17
30
|
#### :hammer_and_wrench: Others
|
|
18
31
|
|
|
@@ -127,7 +140,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
127
140
|
|
|
128
141
|
#### :house: Internal changes
|
|
129
142
|
|
|
130
|
-
- chore: [JENKINSFILE] use sonarqube [valentinab25 - [`ec5e822`](https://github.com/eea/volto-arcgis-block/commit/ec5e8229c968e8cb5239e493537e0559435fe67e)]
|
|
131
143
|
|
|
132
144
|
#### :hammer_and_wrench: Others
|
|
133
145
|
|
|
@@ -143,9 +155,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
143
155
|
|
|
144
156
|
#### :house: Internal changes
|
|
145
157
|
|
|
146
|
-
- chore: [JENKINSFILE] add package version in sonarqube [valentinab25 - [`78addd9`](https://github.com/eea/volto-arcgis-block/commit/78addd9908a5a16eb8b8c984b6d98fe992af4449)]
|
|
147
|
-
- chore: [JENKINSFILE] add package version in sonarqube [EEA Jenkins - [`3001a9d`](https://github.com/eea/volto-arcgis-block/commit/3001a9d84c1ceb2072d2c8fdf42b75b0fa2a36c7)]
|
|
148
|
-
- chore: [JENKINSFILE] add sonarqube branches Refs #293878 [EEA Jenkins - [`3430596`](https://github.com/eea/volto-arcgis-block/commit/34305966fc548b9213d2a914cdd61fdb4ef3a973)]
|
|
149
158
|
|
|
150
159
|
### [0.1.430](https://github.com/eea/volto-arcgis-block/compare/0.1.429...0.1.430) - 19 February 2026
|
|
151
160
|
|
|
@@ -455,7 +464,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
455
464
|
|
|
456
465
|
#### :hammer_and_wrench: Others
|
|
457
466
|
|
|
458
|
-
- Add Sonarqube tag using clms-frontend addons list [EEA Jenkins - [`fa8e13d`](https://github.com/eea/volto-arcgis-block/commit/fa8e13da184b9a9146cb65aca7a89c05fb0261ba)]
|
|
459
467
|
### [0.1.372](https://github.com/eea/volto-arcgis-block/compare/0.1.371...0.1.372) - 26 June 2025
|
|
460
468
|
|
|
461
469
|
#### :hammer_and_wrench: Others
|
|
@@ -482,11 +490,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
482
490
|
|
|
483
491
|
#### :house: Internal changes
|
|
484
492
|
|
|
485
|
-
- chore: [JENKINS] fix variable, uncomment tests [valentinab25 - [`00d88b5`](https://github.com/eea/volto-arcgis-block/commit/00d88b52265cba983d1d5e21a49c051004b705b5)]
|
|
486
|
-
- chore: [JENKINS] use clms-theme pipeline [valentinab25 - [`52b392c`](https://github.com/eea/volto-arcgis-block/commit/52b392cc993f3767099525ed39249e574ce2b421)]
|
|
487
|
-
- chore: [JENKINS] use volto 16 pipeline [valentinab25 - [`a676671`](https://github.com/eea/volto-arcgis-block/commit/a676671186aa227f4c77a766b9ca852028168b5c)]
|
|
488
|
-
- chore: [JENKINS] fix Dockerfile to use eea frontend-builder [valentinab25 - [`980608c`](https://github.com/eea/volto-arcgis-block/commit/980608cc867ace42896831791a55c535838250ee)]
|
|
489
|
-
- chore: [JENKINS] update Makefile for Jenkins [valentinab25 - [`021267e`](https://github.com/eea/volto-arcgis-block/commit/021267e620d6529327a730f122a39f7fec53b293)]
|
|
490
493
|
|
|
491
494
|
#### :hammer_and_wrench: Others
|
|
492
495
|
|
|
@@ -531,7 +534,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
531
534
|
- Merge pull request #945 from eea/CLMS-285178-ISOLATED-SWIPE-WIDGET-FIX [Unai Bolivar - [`617b4c4`](https://github.com/eea/volto-arcgis-block/commit/617b4c43ad4363267c4df34c72e64314ee42afb4)]
|
|
532
535
|
- CLMS-285178 (bug): Separated swipe from other tickets and can push now going [Unai Bolivar - [`84efe24`](https://github.com/eea/volto-arcgis-block/commit/84efe24d964b79f54ddf17f69e389a3f57e3f867)]
|
|
533
536
|
- CLMS-285178 (bug): Separated swipe from other tickets and can push [Unai Bolivar - [`3e94fd6`](https://github.com/eea/volto-arcgis-block/commit/3e94fd6d2f92817d6b0220155a7e8a0ed5d8dfdb)]
|
|
534
|
-
- Add Sonarqube tag using clms-frontend addons list [EEA Jenkins - [`fdd39ce`](https://github.com/eea/volto-arcgis-block/commit/fdd39ce6c0d848b33f3b6d033e4b35e9bd4f2002)]
|
|
535
537
|
### [0.1.356](https://github.com/eea/volto-arcgis-block/compare/0.1.355...0.1.356) - 6 May 2025
|
|
536
538
|
|
|
537
539
|
#### :hammer_and_wrench: Others
|
|
@@ -730,7 +732,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
730
732
|
|
|
731
733
|
#### :house: Internal changes
|
|
732
734
|
|
|
733
|
-
- chore: [JENKINSFILE] remove unused code [valentinab25 - [`c62af37`](https://github.com/eea/volto-arcgis-block/commit/c62af37e5c81f7b6b1d204de8a724499d00420d9)]
|
|
734
735
|
|
|
735
736
|
#### :house: Documentation changes
|
|
736
737
|
|
|
@@ -1049,13 +1050,10 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
1049
1050
|
#### :hammer_and_wrench: Others
|
|
1050
1051
|
|
|
1051
1052
|
- CLMS-2916 (bug): Map Viewer / Products and Datasets tab / Layer - The information icon links to localhost in demo environment [Unai Bolivar - [`eda000a`](https://github.com/eea/volto-arcgis-block/commit/eda000a72278ab073033e520b868ded75dcc2904)]
|
|
1052
|
-
- test: [JENKINS] fix jest config, fail with logs on coverage [valentinab25 - [`8a0855d`](https://github.com/eea/volto-arcgis-block/commit/8a0855dfe47ec58a596ae0ec360ba8f8d075e991)]
|
|
1053
|
-
- test: [JENKINS] fix jest config, fail with logs on coverage [valentinab25 - [`3cfe9be`](https://github.com/eea/volto-arcgis-block/commit/3cfe9be4c6d4ace0ef83b452ebdd5b06025123aa)]
|
|
1054
1053
|
### [0.1.245](https://github.com/eea/volto-arcgis-block/compare/0.1.244...0.1.245) - 4 January 2024
|
|
1055
1054
|
|
|
1056
1055
|
#### :hammer_and_wrench: Others
|
|
1057
1056
|
|
|
1058
|
-
- test: [JENKINS] fix jest config, fail with logs on coverage [valentinab25 - [`a93b081`](https://github.com/eea/volto-arcgis-block/commit/a93b0819eaa765c92bc25cf195f7a43fcd1dddbd)]
|
|
1059
1057
|
### [0.1.244](https://github.com/eea/volto-arcgis-block/compare/0.1.243...0.1.244) - 19 December 2023
|
|
1060
1058
|
|
|
1061
1059
|
### [0.1.243](https://github.com/eea/volto-arcgis-block/compare/0.1.242...0.1.243) - 15 December 2023
|
|
@@ -1095,7 +1093,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
1095
1093
|
|
|
1096
1094
|
#### :hammer_and_wrench: Others
|
|
1097
1095
|
|
|
1098
|
-
- test: [JENKINS] Use java17 for sonarqube scanner [valentinab25 - [`f45d4bf`](https://github.com/eea/volto-arcgis-block/commit/f45d4bf42061d13d9c18554bef692cb40b3a6fb7)]
|
|
1099
1096
|
### [0.1.235](https://github.com/eea/volto-arcgis-block/compare/0.1.234...0.1.235) - 16 November 2023
|
|
1100
1097
|
|
|
1101
1098
|
### [0.1.234](https://github.com/eea/volto-arcgis-block/compare/0.1.233...0.1.234) - 15 November 2023
|
|
@@ -2169,13 +2166,10 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
2169
2166
|
#### :hammer_and_wrench: Others
|
|
2170
2167
|
|
|
2171
2168
|
- Merge pull request #148 from eea/develop [KCarpinteroBM - [`24266fb`](https://github.com/eea/volto-arcgis-block/commit/24266fb3a0c1662d22ae0529dc1d5a25c711cf97)]
|
|
2172
|
-
- Revert "[JENKINS] Use eeacms/plone-backend and Volto alpha version- Refs #151967" [Mikel Larreategi - [`f751f69`](https://github.com/eea/volto-arcgis-block/commit/f751f69f652f0340ae55af6a4dab89d6bdc80906)]
|
|
2173
2169
|
- Revert "Revert "Mapviewer menu and map viewer options persistence"" [Mikel Larreategi - [`ad6e440`](https://github.com/eea/volto-arcgis-block/commit/ad6e440cdc160cffb1e86e1b26e501dbe648476c)]
|
|
2174
2170
|
- Revert "code coverage removal" [Mikel Larreategi - [`376f2d1`](https://github.com/eea/volto-arcgis-block/commit/376f2d1cd6e4e5110b3b63d5114af1bcfebe094b)]
|
|
2175
2171
|
- Revert "Update cypress.json" [Mikel Larreategi - [`43d01a0`](https://github.com/eea/volto-arcgis-block/commit/43d01a0a95a58ef5215c6cbf18223ca30a11b9cc)]
|
|
2176
2172
|
- Revert "Update cypress.json" [Mikel Larreategi - [`054c4ae`](https://github.com/eea/volto-arcgis-block/commit/054c4ae1767e1f26e6ec7e96a0e26a9711f29f04)]
|
|
2177
|
-
- Revert "revert [JENKINS] Use eeacms/plone-backend and Volto alpha version- Refs #151967" [Mikel Larreategi - [`64ab56e`](https://github.com/eea/volto-arcgis-block/commit/64ab56e0f1f8dddc26f26039509a028e34653e64)]
|
|
2178
|
-
- revert [JENKINS] Use eeacms/plone-backend and Volto alpha version- Refs #151967 [Mikel Larreategi - [`85ee194`](https://github.com/eea/volto-arcgis-block/commit/85ee1941e029df2b7dc910bf75231c75ffeca8c2)]
|
|
2179
2173
|
- Update cypress.json [KCarpinteroBM - [`be285ff`](https://github.com/eea/volto-arcgis-block/commit/be285fff0c53e06a0180d5318cce81195eabcf80)]
|
|
2180
2174
|
- Update cypress.json [KCarpinteroBM - [`a7f2118`](https://github.com/eea/volto-arcgis-block/commit/a7f2118acb7b048b4cef85aa9663c2244a1c9ca0)]
|
|
2181
2175
|
- linting fix [KCarpinteroBM - [`27e969a`](https://github.com/eea/volto-arcgis-block/commit/27e969a7a411fd4646e0e742ce846efc0d79703e)]
|
|
@@ -2235,7 +2229,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
2235
2229
|
- UX improvements [rodriama - [`151dc4b`](https://github.com/eea/volto-arcgis-block/commit/151dc4b02d0a73fdd66de9d594620ac0fa5f1dbf)]
|
|
2236
2230
|
- deleted failing tests [KCarpinteroBM - [`ddaa9e6`](https://github.com/eea/volto-arcgis-block/commit/ddaa9e6f06db6960a4c214d3be2420c48b26715d)]
|
|
2237
2231
|
- cleaning unnecessary files [KCarpinteroBM - [`2c02199`](https://github.com/eea/volto-arcgis-block/commit/2c021990912beb02b603a1de89aecd62e0063769)]
|
|
2238
|
-
- Reverting to Automated release 0.1.39 [KCarpinteroBM - [`fb9f317`](https://github.com/eea/volto-arcgis-block/commit/fb9f3176ccdea18fceb329eaac13ced0566ee648)]
|
|
2239
2232
|
- commands added [KCarpinteroBM - [`049e60b`](https://github.com/eea/volto-arcgis-block/commit/049e60b7d124d1c05abd0b2775b510795f4ed59f)]
|
|
2240
2233
|
- Mapviewer testing implementation [KCarpinteroBM - [`0103002`](https://github.com/eea/volto-arcgis-block/commit/0103002869eea108e16e3b5ff2e77a725dcc7c4b)]
|
|
2241
2234
|
### [0.1.39](https://github.com/eea/volto-arcgis-block/compare/0.1.38...0.1.39) - 24 March 2022
|
|
@@ -2255,7 +2248,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
2255
2248
|
- ESLint fix [rodriama - [`75dae9b`](https://github.com/eea/volto-arcgis-block/commit/75dae9b5bba18ab6d9624f6c99714b4bd2179003)]
|
|
2256
2249
|
- Remove section title [rodriama - [`ece860e`](https://github.com/eea/volto-arcgis-block/commit/ece860eae3519c7e611abac16e8d53c9a9408b34)]
|
|
2257
2250
|
- Es-Lint [manuelmartinezbilbomatica - [`39d8d11`](https://github.com/eea/volto-arcgis-block/commit/39d8d11b9096fd603df8510c119d2e12817415d6)]
|
|
2258
|
-
- Add Sonarqube tag using clms-frontend addons list [EEA Jenkins - [`bf9f683`](https://github.com/eea/volto-arcgis-block/commit/bf9f683dd35a9edb4cfd9111affcb8f8edbeae89)]
|
|
2259
2251
|
- FEAT: Parser Time implemented [manuelmartinezbilbomatica - [`689c99e`](https://github.com/eea/volto-arcgis-block/commit/689c99e55221fee6c7c7fafc4ab95ae7a646d3dd)]
|
|
2260
2252
|
### [0.1.38](https://github.com/eea/volto-arcgis-block/compare/0.1.37...0.1.38) - 18 March 2022
|
|
2261
2253
|
|
|
@@ -2350,7 +2342,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
2350
2342
|
- ESLint fix [rodriama - [`5fd3772`](https://github.com/eea/volto-arcgis-block/commit/5fd3772f197a3a380067962a5638dbf901a4624e)]
|
|
2351
2343
|
- Pixel info [rodriama - [`1ccef39`](https://github.com/eea/volto-arcgis-block/commit/1ccef39a9adcc3ee94655c77a5a166b613600a08)]
|
|
2352
2344
|
- NUTS bug fix [rodriama - [`37fe7f3`](https://github.com/eea/volto-arcgis-block/commit/37fe7f3fad2c005e3b7c234b3b0564d5df92fa8c)]
|
|
2353
|
-
- Add Sonarqube tag using freshwater-frontend addons list [EEA Jenkins - [`ea5af8b`](https://github.com/eea/volto-arcgis-block/commit/ea5af8b02a5f2ee25b9b0be67cf3792bbbe84ed7)]
|
|
2354
2345
|
### [0.1.23](https://github.com/eea/volto-arcgis-block/compare/0.1.22...0.1.23) - 17 December 2021
|
|
2355
2346
|
|
|
2356
2347
|
#### :hammer_and_wrench: Others
|
|
@@ -2595,7 +2586,6 @@ Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
|
|
|
2595
2586
|
- Trying to delay ArcGIS modules load [gonzalezsd - [`ff16985`](https://github.com/eea/volto-arcgis-block/commit/ff169858e42d30bfcacc423ffc27762bb9ef05a4)]
|
|
2596
2587
|
- Run bootstrap to fix files [valentinab25 - [`236893f`](https://github.com/eea/volto-arcgis-block/commit/236893f03314eb638b7667f81b1f91491a98ee17)]
|
|
2597
2588
|
- fix git_name [valentinab25 - [`c7806c3`](https://github.com/eea/volto-arcgis-block/commit/c7806c312964425dc23e5d4c6973de8b81ddaeac)]
|
|
2598
|
-
- Add Sonarqube tag using frontend addons list [EEA Jenkins - [`e3afb51`](https://github.com/eea/volto-arcgis-block/commit/e3afb515dda459ee03e2b5d4b56465d2d4ad1503)]
|
|
2599
2589
|
- Trying to change imports [gonzalezsd - [`d83d7e2`](https://github.com/eea/volto-arcgis-block/commit/d83d7e2f68da4b2a284735847f93c0763a7e13b6)]
|
|
2600
2590
|
- default design [bipoza - [`88fbe0b`](https://github.com/eea/volto-arcgis-block/commit/88fbe0b2bc73e732e2993324a567f53902e85506)]
|
|
2601
2591
|
- cleanup of unused code [bipoza - [`b167677`](https://github.com/eea/volto-arcgis-block/commit/b1676771f637f056cad50cb0bc186f2ea79e8517)]
|
package/Dockerfile
CHANGED
|
@@ -1,13 +1,47 @@
|
|
|
1
1
|
# syntax=docker/dockerfile:1
|
|
2
2
|
ARG VOLTO_VERSION
|
|
3
|
-
FROM
|
|
3
|
+
FROM plone/frontend-builder:${VOLTO_VERSION}
|
|
4
4
|
|
|
5
5
|
ARG ADDON_NAME
|
|
6
6
|
ARG ADDON_PATH
|
|
7
|
+
ARG CHROMIUM_VERSION=149.0.7827.196-1~deb12u1
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
ENV HOST="0.0.0.0"
|
|
11
|
+
ENV CHROME_BIN="/usr/bin/chromium"
|
|
12
|
+
ENV CHROMIUM_BIN="/usr/bin/chromium"
|
|
13
|
+
ENV CYPRESS_BROWSER_PATH="/usr/bin/chromium"
|
|
14
|
+
|
|
15
|
+
# Install Cypress dependencies (matching eeacms/frontend-builder)
|
|
16
|
+
USER root
|
|
17
|
+
RUN apt-get update -q \
|
|
18
|
+
&& apt-get install -qy --no-install-recommends \
|
|
19
|
+
libgtk2.0-0 libgtk-3-0 libgbm-dev libnotify-dev libgconf-2-4 libnss3 libxss1 libasound2 libxtst6 xauth xvfb \
|
|
20
|
+
&& rm -rf /var/lib/apt/lists/*
|
|
21
|
+
|
|
22
|
+
RUN set -eux; \
|
|
23
|
+
mkdir -p /etc/apt/sources.list.d /etc/apt/preferences.d /etc/apt/apt.conf.d; \
|
|
24
|
+
printf '%s\n' \
|
|
25
|
+
'Acquire::Check-Valid-Until "false";' \
|
|
26
|
+
> /etc/apt/apt.conf.d/99snapshot-no-check-valid-until; \
|
|
27
|
+
printf '%s\n' \
|
|
28
|
+
'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/20260630T000000Z bookworm-security main' \
|
|
29
|
+
'deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/20260630T000000Z bookworm main' \
|
|
30
|
+
> /etc/apt/sources.list.d/bookworm-chromium149-snapshot.list; \
|
|
31
|
+
apt-get update -q; \
|
|
32
|
+
apt-get install -qy --no-install-recommends \
|
|
33
|
+
"chromium=${CHROMIUM_VERSION}" \
|
|
34
|
+
"chromium-common=${CHROMIUM_VERSION}" \
|
|
35
|
+
; \
|
|
36
|
+
apt-mark hold chromium chromium-common ; \
|
|
37
|
+
rm -rf /var/lib/apt/lists/*
|
|
38
|
+
|
|
39
|
+
USER node
|
|
7
40
|
|
|
8
41
|
COPY --chown=node:node ./ /app/src/addons/${ADDON_PATH}/
|
|
9
42
|
|
|
10
43
|
RUN /setupAddon
|
|
44
|
+
RUN yarn add jest-junit
|
|
11
45
|
RUN yarn install
|
|
12
46
|
|
|
13
47
|
ENTRYPOINT ["yarn"]
|
package/README.md
CHANGED
|
@@ -119,7 +119,7 @@ Release-it is a tool that automates 4 important steps in the release process:
|
|
|
119
119
|
To configure the authentification, you need to export GITHUB_TOKEN for [GitHub](https://github.com/settings/tokens)
|
|
120
120
|
|
|
121
121
|
```
|
|
122
|
-
export GITHUB_TOKEN=
|
|
122
|
+
export GITHUB_TOKEN="${GITHUB_TOKEN}"
|
|
123
123
|
```
|
|
124
124
|
|
|
125
125
|
To configure npm, you can use the `npm login` command or use a configuration file with a TOKEN :
|
|
@@ -163,3 +163,62 @@ Generic command, does not automatically add the `beta` to version, but you can s
|
|
|
163
163
|
|
|
164
164
|
See [DEVELOP.md](https://github.com/eea/volto-arcgis-block/blob/master/DEVELOP.md).
|
|
165
165
|
|
|
166
|
+
## Secret Scanning
|
|
167
|
+
|
|
168
|
+
This repository uses the Betterleaks GitHub Action to scan the current
|
|
169
|
+
repository content on every push and pull request. The scan uses the rules in
|
|
170
|
+
`.gitleaks.toml` and uploads a `betterleaks-report` artifact when a finding is
|
|
171
|
+
detected.
|
|
172
|
+
|
|
173
|
+
If the optional SMTP secrets are configured, failed scans also send an email to
|
|
174
|
+
the last commit committer. The workflow expects these repository or
|
|
175
|
+
organization secrets:
|
|
176
|
+
|
|
177
|
+
- `SMTP_URL`
|
|
178
|
+
- `SMTP_PORT` (optional, defaults to `25`)
|
|
179
|
+
- `SMTP_EMAIL`
|
|
180
|
+
- `SMTP_PASSWORD` (optional if the SMTP server does not require authentication)
|
|
181
|
+
|
|
182
|
+
Port `465` is sent with direct TLS; other ports use the default SMTP handshake.
|
|
183
|
+
The email includes a short finding summary from the redacted Betterleaks report,
|
|
184
|
+
including the redacted matched line from each finding.
|
|
185
|
+
|
|
186
|
+
There are three common outcomes:
|
|
187
|
+
|
|
188
|
+
1. **Everything is OK.** The `Betterleaks / Scan for secrets` check is green and
|
|
189
|
+
no action is needed. Regular references to runtime values are OK, for example:
|
|
190
|
+
|
|
191
|
+
```js
|
|
192
|
+
const tokenFromCookie = req.universalCookies.get('auth_token');
|
|
193
|
+
```
|
|
194
|
+
|
|
195
|
+
2. **A real secret was found.** The check is red and the workflow log asks you to
|
|
196
|
+
download the `betterleaks-report` artifact. Open the artifact from the GitHub
|
|
197
|
+
Actions run and check the reported file, line and rule. Remove the committed
|
|
198
|
+
value, move it to the proper secret store, and rotate it if it was exposed.
|
|
199
|
+
A report entry looks like this:
|
|
200
|
+
|
|
201
|
+
```json
|
|
202
|
+
{
|
|
203
|
+
"RuleID": "secret-literal-assignment",
|
|
204
|
+
"File": "src/config.js",
|
|
205
|
+
"StartLine": 12,
|
|
206
|
+
"Secret": "[REDACTED]"
|
|
207
|
+
}
|
|
208
|
+
```
|
|
209
|
+
|
|
210
|
+
3. **The finding is a false positive.** Keep the value only if it is clearly not
|
|
211
|
+
sensitive, such as a test fixture, placeholder, or public example. Add
|
|
212
|
+
`betterleaks:allow` on the same line and include a short explanation in the
|
|
213
|
+
pull request.
|
|
214
|
+
|
|
215
|
+
```js
|
|
216
|
+
const testPassword = 'admin'; //betterleaks:allow
|
|
217
|
+
```
|
|
218
|
+
|
|
219
|
+
```yaml
|
|
220
|
+
password: "admin" #betterleaks:allow
|
|
221
|
+
```
|
|
222
|
+
|
|
223
|
+
Do not add `betterleaks:allow` to real credentials.
|
|
224
|
+
|
package/RELEASE.md
CHANGED
|
@@ -33,7 +33,7 @@ Release-it is a tool that automates 4 important steps in the release process:
|
|
|
33
33
|
To configure the authentification, you need to export GITHUB_TOKEN for [GitHub](https://github.com/settings/tokens)
|
|
34
34
|
|
|
35
35
|
```
|
|
36
|
-
export GITHUB_TOKEN=
|
|
36
|
+
export GITHUB_TOKEN="${GITHUB_TOKEN}"
|
|
37
37
|
```
|
|
38
38
|
|
|
39
39
|
To configure npm, you can use the `npm login` command or use a configuration file with a TOKEN :
|
|
@@ -5,14 +5,14 @@ Cypress.Commands.add('autologin', () => {
|
|
|
5
5
|
let api_url, user, password;
|
|
6
6
|
api_url = Cypress.env('API_PATH') || 'http://localhost:8080/Plone';
|
|
7
7
|
user = 'admin';
|
|
8
|
-
password = 'admin';
|
|
8
|
+
password = 'admin'; //betterleaks:allow
|
|
9
9
|
|
|
10
10
|
return cy
|
|
11
11
|
.request({
|
|
12
12
|
method: 'POST',
|
|
13
13
|
url: `${api_url}/@login`,
|
|
14
14
|
headers: { Accept: 'application/json' },
|
|
15
|
-
body: { login: user, password: password },
|
|
15
|
+
body: { login: user, password: password }, //betterleaks:allow
|
|
16
16
|
})
|
|
17
17
|
.then((response) => cy.setCookie('auth_token', response.body.token));
|
|
18
18
|
});
|
package/package.json
CHANGED
|
@@ -852,7 +852,7 @@ class MenuWidget extends React.Component {
|
|
|
852
852
|
this.zoomTooltips();
|
|
853
853
|
// }
|
|
854
854
|
|
|
855
|
-
let authToken = this.getAuthToken();
|
|
855
|
+
let authToken = this.getAuthToken(); //betterleaks:allow
|
|
856
856
|
let timeSliderTag = sessionStorage.getItem('timeSliderTag');
|
|
857
857
|
let downloadTag = sessionStorage.getItem('downloadButtonClicked');
|
|
858
858
|
let checkedLayers = JSON.parse(sessionStorage.getItem('checkedLayers'));
|
|
@@ -2354,7 +2354,7 @@ class MenuWidget extends React.Component {
|
|
|
2354
2354
|
});
|
|
2355
2355
|
return `https://land.copernicus.eu/cdse/wms/${
|
|
2356
2356
|
collectionMatch[1]
|
|
2357
|
-
}?${legendParams.toString()}`;
|
|
2357
|
+
}?${legendParams.toString()}&WIDTH=500&HEIGHT=400`;
|
|
2358
2358
|
}
|
|
2359
2359
|
|
|
2360
2360
|
parseWMSLayers(xml) {
|
|
@@ -924,16 +924,6 @@ div.upload-container
|
|
|
924
924
|
}
|
|
925
925
|
}
|
|
926
926
|
|
|
927
|
-
@media only screen and (max-width: 400px) {
|
|
928
|
-
.map-menu.tab-container {
|
|
929
|
-
width: 170px !important;
|
|
930
|
-
}
|
|
931
|
-
|
|
932
|
-
.esri-search {
|
|
933
|
-
width: 205px !important;
|
|
934
|
-
}
|
|
935
|
-
}
|
|
936
|
-
|
|
937
927
|
/* Login */
|
|
938
928
|
.login-panel {
|
|
939
929
|
position: absolute;
|