@eeacms/volto-bise-policy 1.3.2 → 1.3.4

package/.github/workflows/betterleaks.yml

@@ -0,0 +1,133 @@
+name: Betterleaks
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: Scan for secrets
+    runs-on: ubuntu-latest
+    env:
+      SMTP_URL: ${{ secrets.SMTP_URL }}
+      SMTP_PORT: ${{ secrets.SMTP_PORT || '25' }}
+      SMTP_EMAIL: ${{ secrets.SMTP_EMAIL }}
+      SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Run Betterleaks
+        id: betterleaks
+        continue-on-error: true
+        uses: dortort/betterleaks-action@v0.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          scan-mode: dir
+          scan-path: .
+          config: .gitleaks.toml
+          report-format: json
+          report-path: betterleaks-report.json
+          redact: "true"
+          no-color: "true"
+          no-banner: "true"
+          fail-on-leak: "true"
+
+      - name: Upload Betterleaks report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: betterleaks-report
+          path: betterleaks-report.json
+          if-no-files-found: ignore
+
+      - name: Build Betterleaks email summary
+        id: leak_summary
+        if: steps.betterleaks.outcome == 'failure'
+        shell: bash
+        run: |
+          if [[ -s betterleaks-report.json ]]; then
+            jq -r '
+              def one_line:
+                tostring
+                | gsub("[\r\n]+"; " ")
+                | if length > 240 then .[0:240] + "..." else . end;
+
+              .[:20][]
+              | "- " + (.RuleID // "unknown-rule")
+                + " at " + (.File // "unknown-file")
+                + ":" + ((.StartLine // 0) | tostring)
+                + "\n  match: " + ((.Match // .Secret // "REDACTED") | one_line)
+            ' betterleaks-report.json > betterleaks-email-summary.txt
+
+            count="$(jq 'length' betterleaks-report.json)"
+            if (( count > 20 )); then
+              {
+                echo ""
+                echo "... and $((count - 20)) more finding(s). Download the artifact for full details."
+              } >> betterleaks-email-summary.txt
+            fi
+          else
+            echo "No JSON report was generated. Download the workflow logs for details." > betterleaks-email-summary.txt
+          fi
+
+          {
+            echo "text<<BETTERLEAKS_SUMMARY"
+            cat betterleaks-email-summary.txt
+            echo "BETTERLEAKS_SUMMARY"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Resolve committer email
+        id: committer
+        if: steps.betterleaks.outcome == 'failure'
+        shell: bash
+        run: |
+          committer_email="$(git log -1 --format='%ce')"
+          author_email="$(git log -1 --format='%ae')"
+          email="$committer_email"
+          if [[ -z "$email" || "$email" == *"noreply.github.com"* ]]; then
+            email="$author_email"
+          fi
+          if [[ "$email" =~ ^[^[:space:]@]+@[^[:space:]@]+\.[^[:space:]@]+$ && "$email" != *"noreply.github.com"* ]]; then
+            echo "email=$email" >> "$GITHUB_OUTPUT"
+          else
+            echo "No deliverable committer email found; skipping Betterleaks email notification."
+            echo "email=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Email committer on Betterleaks failure
+        if: steps.betterleaks.outcome == 'failure' && steps.committer.outputs.email != '' && env.SMTP_URL != '' && env.SMTP_EMAIL != ''
+        uses: dawidd6/action-send-mail@v18
+        with:
+          server_address: ${{ env.SMTP_URL }}
+          server_port: ${{ env.SMTP_PORT }}
+          secure: ${{ env.SMTP_PORT == '465' }}
+          username: ${{ env.SMTP_EMAIL }}
+          password: ${{ env.SMTP_PASSWORD }}
+          from: ${{ env.SMTP_EMAIL }}
+          to: ${{ steps.committer.outputs.email }}
+          subject: "[Betterleaks] Secret scan failed in ${{ github.repository }}"
+          body: |
+            Betterleaks detected one or more potential secrets.
+
+            Repository: ${{ github.repository }}
+            Branch: ${{ github.ref_name }}
+            Commit: ${{ github.sha }}
+            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            Findings:
+            ${{ steps.leak_summary.outputs.text }}
+
+            Download the betterleaks-report artifact from the workflow run for details.
+
+      - name: Fail if Betterleaks found leaks
+        if: steps.betterleaks.outcome == 'failure'
+        run: |
+          echo "Betterleaks detected one or more secrets. Download the betterleaks-report artifact from this workflow run for details."
+          exit 1

package/.gitleaks.toml

@@ -0,0 +1,89 @@
+title = "Betterleaks config"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "secret-literal-assignment"
+description = "Secret-like literal assignment in source, YAML, env and config files"
+regex = '''(?i)([A-Za-z0-9_.-]*(?:password|passwd|pwd|api[_-]?key|apikey|access[_-]?key|secret[_-]?access[_-]?key|private[_-]?key|client[_-]?secret|consumer[_-]?key|consumer[_-]?secret|(?:auth|access|refresh|session|api|bearer|id|jwt|csrf|xsrf|oauth)[_-]?token|translate[_-]?auth|translation[_-]?auth|auth[_-]?password|auth[_-]?key|auth[_-]?credentials|database[_-]?url|connection[_-]?string)[A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "password",
+  "passwd",
+  "pwd",
+  "api_key",
+  "apikey",
+  "access_key",
+  "private_key",
+  "client_secret",
+  "consumer_key",
+  "consumer_secret",
+  "auth_token",
+  "access_token",
+  "refresh_token",
+  "session_token",
+  "api_token",
+  "bearer_token",
+  "id_token",
+  "jwt_token",
+  "csrf_token",
+  "xsrf_token",
+  "oauth_token",
+  "translate_auth",
+  "translation_auth",
+  "auth_password",
+  "auth_key",
+  "auth_credentials",
+  "database_url",
+  "connection_string"
+]
+tags = ["literal-secret"]
+
+[[rules]]
+id = "env-short-secret-assignment"
+description = "Uppercase env-style PASS/TOKEN/SECRET assignment"
+regex = '''\b((?:PASS|TOKEN|SECRET|[A-Z0-9_]*(?:_PASS|_TOKEN|_SECRET|PASS_|TOKEN_|SECRET_)[A-Z0-9_]*))[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "PASS",
+  "TOKEN",
+  "SECRET"
+]
+tags = ["env", "literal-secret"]
+
+[[rules]]
+id = "standalone-sk-token"
+description = "Standalone sk-* token not attached to a secret-like variable name"
+regex = '''(?i)\b(sk-[A-Za-z0-9][A-Za-z0-9_-]{20,})\b'''
+secretGroup = 1
+entropy = 2.5
+keywords = ["sk-"]
+tags = ["standalone-token", "generic"]
+
+[[rules]]
+id = "dotenv-only-jest-setup"
+description = ".env may only contain the committed Jest setup lines"
+path = '''(?i)(^|/)\.env$'''
+regex = '''(?m)^(.+)$'''
+secretGroup = 1
+tags = ["file", "dotenv"]
+[[rules.allowlists]]
+regexTarget = "match"
+regexes = [
+  '''^JEST_USE_SETUP=OFF # Jest configuration variables: ON, OFF\r?$''',
+]
+
+[[rules]]
+id = "forbidden-secret-file"
+description = "Forbidden secret-bearing file committed to repository"
+path = '''(?i)(^|/)(\.env\..*|\.npmrc|\.pypirc|id_rsa|id_ed25519|.*\.(pem|key|p12|pfx|jks|kubeconfig))$'''
+regex = '''(?s).{1,}'''
+tags = ["file", "secret-file"]
+
+[[allowlists]]
+description = "Allow Jenkins SonarQube token environment variable reference"
+regexTarget = "match"
+regexes = [
+  '''SONAR_AUTH_TOKEN''',
+]

package/CHANGELOG.md

@@ -4,11 +4,25 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
-### [1.3.2](https://github.com/eea/volto-bise-policy/compare/1.3.1...1.3.2) - 24 June 2026
+### [1.3.4](https://github.com/eea/volto-bise-policy/compare/1.3.3...1.3.4) - 9 July 2026
 
 #### :hammer_and_wrench: Others
 
-- remove CountryFlag customization from volto-bise-policy [Claudia Ifrim - [`b30ebf9`](https://github.com/eea/volto-bise-policy/commit/b30ebf985814b68aba43ee4f08586106e133d939)]
+- enable attributions for osm [Claudia Ifrim - [`de583af`](https://github.com/eea/volto-bise-policy/commit/de583af4eff7c7a3a91a9845eb372e2bfa86fec1)]
+### [1.3.3](https://github.com/eea/volto-bise-policy/compare/1.3.2...1.3.3) - 9 July 2026
+
+#### :house: Internal changes
+
+- chore: [JENKINSFILE] sanitize sonarqube command [valentinab25 - [`8e2dc1a`](https://github.com/eea/volto-bise-policy/commit/8e2dc1a14f3230f197f009a76bf87587724b6e3a)]
+
+#### :hammer_and_wrench: Others
+
+- test: pin Chromium version 149 to work with Cypress [valentinab25 - [`5841387`](https://github.com/eea/volto-bise-policy/commit/5841387ae59380ee15af8c82a4df81c4767e1b7c)]
+- Update Betterleaks email notification [Dobricean Ioan Dorian - [`45fae4c`](https://github.com/eea/volto-bise-policy/commit/45fae4cea316af3d3b846d4d7754e63bd7baeaac)]
+- Update Betterleaks config documentation [Dobricean Ioan Dorian - [`e6742c2`](https://github.com/eea/volto-bise-policy/commit/e6742c23bffe88fef239354723dc8ae9aba94469)]
+- Fix betterleaks findings [Dobricean Ioan Dorian - [`b9ef9ba`](https://github.com/eea/volto-bise-policy/commit/b9ef9baf5f6b1036e8d83f90a582298c3688a7ba)]
+### [1.3.2](https://github.com/eea/volto-bise-policy/compare/1.3.1...1.3.2) - 24 June 2026
+
 ### [1.3.1](https://github.com/eea/volto-bise-policy/compare/1.3.0...1.3.1) - 23 June 2026
 
 ### [1.3.0](https://github.com/eea/volto-bise-policy/compare/1.3.0-beta.2...1.3.0) - 22 June 2026

package/README.md

@@ -80,6 +80,65 @@ See [RELEASE.md](https://github.com/eea/volto-bise-policy/blob/master/RELEASE.md
 
 See [DEVELOP.md](https://github.com/eea/volto-bise-policy/blob/master/DEVELOP.md).
 
+## Secret Scanning
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+`.gitleaks.toml` and uploads a `betterleaks-report` artifact when a finding is
+detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- `SMTP_URL`
+- `SMTP_PORT` (optional, defaults to `25`)
+- `SMTP_EMAIL`
+- `SMTP_PASSWORD` (optional if the SMTP server does not require authentication)
+
+Port `465` is sent with direct TLS; other ports use the default SMTP handshake.
+The email includes a short finding summary from the redacted Betterleaks report,
+including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. **Everything is OK.** The `Betterleaks / Scan for secrets` check is green and
+   no action is needed. Regular references to runtime values are OK, for example:
+
+   ```js
+   const tokenFromCookie = req.universalCookies.get('auth_token');
+   ```
+
+2. **A real secret was found.** The check is red and the workflow log asks you to
+   download the `betterleaks-report` artifact. Open the artifact from the GitHub
+   Actions run and check the reported file, line and rule. Remove the committed
+   value, move it to the proper secret store, and rotate it if it was exposed.
+   A report entry looks like this:
+
+   ```json
+   {
+     "RuleID": "secret-literal-assignment",
+     "File": "src/config.js",
+     "StartLine": 12,
+     "Secret": "[REDACTED]"
+   }
+   ```
+
+3. **The finding is a false positive.** Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   `betterleaks:allow` on the same line and include a short explanation in the
+   pull request.
+
+   ```js
+   const testPassword = 'admin'; //betterleaks:allow
+   ```
+
+   ```yaml
+   password: "admin" #betterleaks:allow
+   ```
+
+Do not add `betterleaks:allow` to real credentials.
+
 ## Copyright and license
 
 The Initial Owner of the Original Code is European Environment Agency (EEA).

package/RELEASE.md

@@ -33,7 +33,7 @@ Release-it is a tool that automates 4 important steps in the release process:
 To configure the authentification, you need to export GITHUB_TOKEN for [GitHub](https://github.com/settings/tokens)
 
    ```
-   export GITHUB_TOKEN=XXX-XXXXXXXXXXXXXXXXXXXXXX
+   export GITHUB_TOKEN="${GITHUB_TOKEN}"
    ```
 
  To configure npm, you can use the `npm login` command or use a configuration file with a TOKEN :

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eeacms/volto-bise-policy",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "@eeacms/volto-bise-policy: Volto add-on",
   "main": "src/index.js",
   "author": "European Environment Agency: IDM2 A-Team",

package/src/components/Widgets/GeolocationWidgetMapContainer.jsx

@@ -9,6 +9,7 @@ import {
 } from '@eeacms/volto-openlayers-map/api';
 import React, { useState } from 'react';
 import { useMapContext } from '@eeacms/volto-openlayers-map/hocs';
+import { GISCO_OSM_ATTRIBUTION } from '@eeacms/volto-bise-policy/constants';
 
 function PinInteraction({ longitude, latitude, onChange, ol }) {
   const mapContext = useMapContext();
@@ -77,6 +78,7 @@ const TileSetLoader = (props) => {
     setTileWMSSources([
       new ol.source.TileWMS({
         url: 'https://gisco-services.ec.europa.eu/maps/service',
+        attributions: GISCO_OSM_ATTRIBUTION,
         params: {
           LAYERS: 'OSMBlossomComposite',
           TILED: true,
@@ -102,10 +104,13 @@ const MapContainer = (props) => {
         zoom: 15,
       }}
       pixelRatio={1}
-      controls={ol.control.defaults({ attribution: false })}
     >
       <Layers>
-        <Controls attribution={false} zoom={false} />
+        <Controls
+          attribution={true}
+          attributionOptions={{ collapsible: false }}
+          zoom={false}
+        />
         <PinInteraction
           ol={ol}
           latitude={latitude}

package/src/components/manage/Blocks/CaseStudyExplorer/CaseStudyMap.jsx

@@ -10,6 +10,7 @@ import {
   useMapContext,
 } from '@eeacms/volto-openlayers-map/api';
 import { withOpenLayers } from '@eeacms/volto-openlayers-map';
+import { GISCO_OSM_ATTRIBUTION } from '@eeacms/volto-bise-policy/constants';
 
 import InfoOverlay from './InfoOverlay';
 import FeatureInteraction from './FeatureInteraction';
@@ -45,6 +46,7 @@ function CaseStudyMap(props) {
   const [tileWMSSources] = React.useState([
     new ol.source.TileWMS({
       url: 'https://gisco-services.ec.europa.eu/maps/service',
+      attributions: GISCO_OSM_ATTRIBUTION,
       params: {
         // LAYERS: 'OSMBlossomComposite', OSMCartoComposite, OSMPositronComposite
         LAYERS: 'OSMPositronComposite',
@@ -130,9 +132,11 @@ function CaseStudyMap(props) {
           zoom: 4,
         }}
         pixelRatio={1}
-        // controls={ol.control.defaults({ attribution: false })}
       >
-        <Controls attribution={false} />
+        <Controls
+          attribution={true}
+          attributionOptions={{ collapsible: false }}
+        />
         <Layers>
           {hideFilters ? null : (
             <button

package/src/constants.js

@@ -0,0 +1,7 @@
+// Basemap attribution strings. OpenStreetMap-derived basemaps (GISCO OSM*
+// composites) must credit "© OpenStreetMap contributors" per the ODbL —
+// https://www.openstreetmap.org/copyright
+export const OSM_ATTRIBUTION =
+  '© <a href="https://www.openstreetmap.org/copyright" target="_blank" rel="noopener noreferrer">OpenStreetMap</a> contributors';
+
+export const GISCO_OSM_ATTRIBUTION = `${OSM_ATTRIBUTION}, © <a href="https://ec.europa.eu/eurostat/web/gisco" target="_blank" rel="noopener noreferrer">Eurostat/GISCO</a>`;