@eeacms/volto-eea-website-policy 4.0.0 → 4.0.2

package/.eslintrc.js

@@ -16,16 +16,16 @@ if (configFile) {
     voltoPath = `./${jsConfig.baseUrl}/${pathsConfig['@plone/volto'][0]}`;
 }
 
-const AddonConfigurationRegistry = require(`${voltoPath}/addon-registry.js`);
-const reg = new AddonConfigurationRegistry(projectRootPath);
+const { AddonRegistry } = require('@plone/registry/addon-registry');
+const { registry } = AddonRegistry.init(projectRootPath);
 
 // Extends ESlint configuration for adding the aliases to `src` directories in Volto addons
-const addonAliases = Object.keys(reg.packages).map((o) => [
+const addonAliases = Object.keys(registry.packages).map((o) => [
   o,
-  reg.packages[o].modulePath,
+  registry.packages[o].modulePath,
 ]);
 
-const addonExtenders = reg.getEslintExtenders().map((m) => require(m));
+const addonExtenders = registry.getEslintExtenders().map((m) => require(m));
 
 const defaultConfig = {
   extends: `${voltoPath}/.eslintrc`,
@@ -34,7 +34,7 @@ const defaultConfig = {
       alias: {
         map: [
           ['@plone/volto', '@plone/volto/src'],
-          ['@plone/volto-slate', '@plone/volto/packages/volto-slate/src'],
+          ['@plone/volto-slate', '@plone/volto-slate/src'],
           ...addonAliases,
           ['@package', `${__dirname}/src`],
           ['@root', `${__dirname}/src`],

package/.github/workflows/betterleaks.yml

@@ -0,0 +1,133 @@
+name: Betterleaks
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: Scan for secrets
+    runs-on: ubuntu-latest
+    env:
+      SMTP_URL: ${{ secrets.SMTP_URL }}
+      SMTP_PORT: ${{ secrets.SMTP_PORT || '25' }}
+      SMTP_EMAIL: ${{ secrets.SMTP_EMAIL }}
+      SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Run Betterleaks
+        id: betterleaks
+        continue-on-error: true
+        uses: dortort/betterleaks-action@v0.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          scan-mode: dir
+          scan-path: .
+          config: .gitleaks.toml
+          report-format: json
+          report-path: betterleaks-report.json
+          redact: "true"
+          no-color: "true"
+          no-banner: "true"
+          fail-on-leak: "true"
+
+      - name: Upload Betterleaks report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: betterleaks-report
+          path: betterleaks-report.json
+          if-no-files-found: ignore
+
+      - name: Build Betterleaks email summary
+        id: leak_summary
+        if: steps.betterleaks.outcome == 'failure'
+        shell: bash
+        run: |
+          if [[ -s betterleaks-report.json ]]; then
+            jq -r '
+              def one_line:
+                tostring
+                | gsub("[\r\n]+"; " ")
+                | if length > 240 then .[0:240] + "..." else . end;
+
+              .[:20][]
+              | "- " + (.RuleID // "unknown-rule")
+                + " at " + (.File // "unknown-file")
+                + ":" + ((.StartLine // 0) | tostring)
+                + "\n  match: " + ((.Match // .Secret // "REDACTED") | one_line)
+            ' betterleaks-report.json > betterleaks-email-summary.txt
+
+            count="$(jq 'length' betterleaks-report.json)"
+            if (( count > 20 )); then
+              {
+                echo ""
+                echo "... and $((count - 20)) more finding(s). Download the artifact for full details."
+              } >> betterleaks-email-summary.txt
+            fi
+          else
+            echo "No JSON report was generated. Download the workflow logs for details." > betterleaks-email-summary.txt
+          fi
+
+          {
+            echo "text<<BETTERLEAKS_SUMMARY"
+            cat betterleaks-email-summary.txt
+            echo "BETTERLEAKS_SUMMARY"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Resolve committer email
+        id: committer
+        if: steps.betterleaks.outcome == 'failure'
+        shell: bash
+        run: |
+          committer_email="$(git log -1 --format='%ce')"
+          author_email="$(git log -1 --format='%ae')"
+          email="$committer_email"
+          if [[ -z "$email" || "$email" == *"noreply.github.com"* ]]; then
+            email="$author_email"
+          fi
+          if [[ "$email" =~ ^[^[:space:]@]+@[^[:space:]@]+\.[^[:space:]@]+$ && "$email" != *"noreply.github.com"* ]]; then
+            echo "email=$email" >> "$GITHUB_OUTPUT"
+          else
+            echo "No deliverable committer email found; skipping Betterleaks email notification."
+            echo "email=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Email committer on Betterleaks failure
+        if: steps.betterleaks.outcome == 'failure' && steps.committer.outputs.email != '' && env.SMTP_URL != '' && env.SMTP_EMAIL != ''
+        uses: dawidd6/action-send-mail@v18
+        with:
+          server_address: ${{ env.SMTP_URL }}
+          server_port: ${{ env.SMTP_PORT }}
+          secure: ${{ env.SMTP_PORT == '465' }}
+          username: ${{ env.SMTP_EMAIL }}
+          password: ${{ env.SMTP_PASSWORD }}
+          from: ${{ env.SMTP_EMAIL }}
+          to: ${{ steps.committer.outputs.email }}
+          subject: "[Betterleaks] Secret scan failed in ${{ github.repository }}"
+          body: |
+            Betterleaks detected one or more potential secrets.
+
+            Repository: ${{ github.repository }}
+            Branch: ${{ github.ref_name }}
+            Commit: ${{ github.sha }}
+            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            Findings:
+            ${{ steps.leak_summary.outputs.text }}
+
+            Download the betterleaks-report artifact from the workflow run for details.
+
+      - name: Fail if Betterleaks found leaks
+        if: steps.betterleaks.outcome == 'failure'
+        run: |
+          echo "Betterleaks detected one or more secrets. Download the betterleaks-report artifact from this workflow run for details."
+          exit 1

package/.gitleaks.toml

@@ -0,0 +1,89 @@
+title = "Betterleaks config"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "secret-literal-assignment"
+description = "Secret-like literal assignment in source, YAML, env and config files"
+regex = '''(?i)([A-Za-z0-9_.-]*(?:password|passwd|pwd|api[_-]?key|apikey|access[_-]?key|secret[_-]?access[_-]?key|private[_-]?key|client[_-]?secret|consumer[_-]?key|consumer[_-]?secret|(?:auth|access|refresh|session|api|bearer|id|jwt|csrf|xsrf|oauth)[_-]?token|translate[_-]?auth|translation[_-]?auth|auth[_-]?password|auth[_-]?key|auth[_-]?credentials|database[_-]?url|connection[_-]?string)[A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "password",
+  "passwd",
+  "pwd",
+  "api_key",
+  "apikey",
+  "access_key",
+  "private_key",
+  "client_secret",
+  "consumer_key",
+  "consumer_secret",
+  "auth_token",
+  "access_token",
+  "refresh_token",
+  "session_token",
+  "api_token",
+  "bearer_token",
+  "id_token",
+  "jwt_token",
+  "csrf_token",
+  "xsrf_token",
+  "oauth_token",
+  "translate_auth",
+  "translation_auth",
+  "auth_password",
+  "auth_key",
+  "auth_credentials",
+  "database_url",
+  "connection_string"
+]
+tags = ["literal-secret"]
+
+[[rules]]
+id = "env-short-secret-assignment"
+description = "Uppercase env-style PASS/TOKEN/SECRET assignment"
+regex = '''\b((?:PASS|TOKEN|SECRET|[A-Z0-9_]*(?:_PASS|_TOKEN|_SECRET|PASS_|TOKEN_|SECRET_)[A-Z0-9_]*))[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "PASS",
+  "TOKEN",
+  "SECRET"
+]
+tags = ["env", "literal-secret"]
+
+[[rules]]
+id = "standalone-sk-token"
+description = "Standalone sk-* token not attached to a secret-like variable name"
+regex = '''(?i)\b(sk-[A-Za-z0-9][A-Za-z0-9_-]{20,})\b'''
+secretGroup = 1
+entropy = 2.5
+keywords = ["sk-"]
+tags = ["standalone-token", "generic"]
+
+[[rules]]
+id = "dotenv-only-jest-setup"
+description = ".env may only contain the committed Jest setup lines"
+path = '''(?i)(^|/)\.env$'''
+regex = '''(?m)^(.+)$'''
+secretGroup = 1
+tags = ["file", "dotenv"]
+[[rules.allowlists]]
+regexTarget = "match"
+regexes = [
+  '''^JEST_USE_SETUP=OFF # Jest configuration variables: ON, OFF\r?$''',
+]
+
+[[rules]]
+id = "forbidden-secret-file"
+description = "Forbidden secret-bearing file committed to repository"
+path = '''(?i)(^|/)(\.env\..*|\.npmrc|\.pypirc|id_rsa|id_ed25519|.*\.(pem|key|p12|pfx|jks|kubeconfig))$'''
+regex = '''(?s).{1,}'''
+tags = ["file", "secret-file"]
+
+[[allowlists]]
+description = "Allow Jenkins SonarQube token environment variable reference"
+regexTarget = "match"
+regexes = [
+  '''SONAR_AUTH_TOKEN''',
+]

package/CHANGELOG.md

@@ -4,7 +4,30 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
-### [4.0.0](https://github.com/eea/volto-eea-website-policy/compare/3.0.0...4.0.0) - 25 March 2026
+### [4.0.2](https://github.com/eea/volto-eea-website-policy/compare/4.0.1...4.0.2) - 16 July 2026
+
+#### :bug: Bug Fixes
+
+- fix: Add betterleaks github action - refs #304517 [dobri1408 - [`d0f2fe4`](https://github.com/eea/volto-eea-website-policy/commit/d0f2fe4e6bf2e4b7839b83199906648fa0d3f1dc)]
+
+#### :house: Internal changes
+
+
+#### :hammer_and_wrench: Others
+
+- Fix syntax error in package.json dependencies [dobri1408 - [`e5f6b15`](https://github.com/eea/volto-eea-website-policy/commit/e5f6b150a86cd66dad5c00c29720a76ac6b0db97)]
+- Add volto-globalsearch to package.json [dobri1408 - [`f8ff6bd`](https://github.com/eea/volto-eea-website-policy/commit/f8ff6bd3f2e1f0c10cfa7137f8bbb82eb515154d)]
+- publication facets [Dobricean Ioan Dorian - [`2f233d7`](https://github.com/eea/volto-eea-website-policy/commit/2f233d71f83bdb6f74fd73624a27968dc670bb50)]
+- test: pin Chromium version 149 to work with Cypress [valentinab25 - [`362df3b`](https://github.com/eea/volto-eea-website-policy/commit/362df3b7f2ba297193f58d28b8d3aeaa375a3668)]
+### [4.0.1](https://github.com/eea/volto-eea-website-policy/compare/4.0.0...4.0.1) - 9 April 2026
+
+#### :bug: Bug Fixes
+
+- fix: make test [Alin V. (Claudiu) - [`d052416`](https://github.com/eea/volto-eea-website-policy/commit/d052416ff062c97e5ef9324bb776bdad0526fce7)]
+
+#### :hammer_and_wrench: Others
+
+## [4.0.0](https://github.com/eea/volto-eea-website-policy/compare/3.0.0...4.0.0) - 25 March 2026
 
 #### :rocket: New Features
 

package/README.md

@@ -95,6 +95,65 @@ See [RELEASE.md](https://github.com/eea/volto-eea-website-policy/blob/master/REL
 
 See [DEVELOP.md](https://github.com/eea/volto-eea-website-policy/blob/master/DEVELOP.md).
 
+## Secret Scanning
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+`.gitleaks.toml` and uploads a `betterleaks-report` artifact when a finding is
+detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- `SMTP_URL`
+- `SMTP_PORT` (optional, defaults to `25`)
+- `SMTP_EMAIL`
+- `SMTP_PASSWORD` (optional if the SMTP server does not require authentication)
+
+Port `465` is sent with direct TLS; other ports use the default SMTP handshake.
+The email includes a short finding summary from the redacted Betterleaks report,
+including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. **Everything is OK.** The `Betterleaks / Scan for secrets` check is green and
+   no action is needed. Regular references to runtime values are OK, for example:
+
+   ```js
+   const tokenFromCookie = req.universalCookies.get('auth_token');
+   ```
+
+2. **A real secret was found.** The check is red and the workflow log asks you to
+   download the `betterleaks-report` artifact. Open the artifact from the GitHub
+   Actions run and check the reported file, line and rule. Remove the committed
+   value, move it to the proper secret store, and rotate it if it was exposed.
+   A report entry looks like this:
+
+   ```json
+   {
+     "RuleID": "secret-literal-assignment",
+     "File": "src/config.js",
+     "StartLine": 12,
+     "Secret": "[REDACTED]"
+   }
+   ```
+
+3. **The finding is a false positive.** Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   `betterleaks:allow` on the same line and include a short explanation in the
+   pull request.
+
+   ```js
+   const testPassword = 'admin'; //betterleaks:allow
+   ```
+
+   ```yaml
+   password: "admin" #betterleaks:allow
+   ```
+
+Do not add `betterleaks:allow` to real credentials.
+
 ## Copyright and license
 
 The Initial Owner of the Original Code is European Environment Agency (EEA).

package/RELEASE.md

@@ -33,7 +33,7 @@ Release-it is a tool that automates 4 important steps in the release process:
 To configure the authentification, you need to export GITHUB_TOKEN for [GitHub](https://github.com/settings/tokens)
 
    ```
-   export GITHUB_TOKEN=XXX-XXXXXXXXXXXXXXXXXXXXXX
+   export GITHUB_TOKEN="${GITHUB_TOKEN}"
    ```
 
  To configure npm, you can use the `npm login` command or use a configuration file with a TOKEN :

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eeacms/volto-eea-website-policy",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "@eeacms/volto-eea-website-policy: Volto add-on",
   "main": "src/index.js",
   "author": "European Environment Agency: IDM2 A-Team",
@@ -18,11 +18,13 @@
   },
   "addons": [
     "@eeacms/volto-widget-dataprovenance",
+    "@eeacms/volto-globalsearch",
     "@plone-collective/volto-authomatic"
   ],
   "dependencies": {
     "@eeacms/volto-widget-dataprovenance": "*",
-    "@plone-collective/volto-authomatic": "*"
+    "@plone-collective/volto-authomatic": "*",
+    "@eeacms/volto-globalsearch": "*"
   },
   "devDependencies": {
     "@cypress/code-coverage": "^3.10.0",

package/src/customizations/volto/components/manage/Blocks/HTML/Edit.jsx

@@ -9,9 +9,9 @@ import PropTypes from 'prop-types';
 import { Button, Popup } from 'semantic-ui-react';
 import { defineMessages, injectIntl } from 'react-intl';
 import loadable from '@loadable/component';
-import { isEqual } from 'lodash';
+import isEqual from 'lodash/isEqual';
 
-import { Icon } from '@plone/volto/components';
+import Icon from '@plone/volto/components/theme/Icon/Icon';
 import { injectLazyLibs } from '@plone/volto/helpers/Loadable/Loadable';
 import showSVG from '@plone/volto/icons/show.svg';
 // import clearSVG from '@plone/volto/icons/clear.svg';

package/src/helpers.js

@@ -1,7 +1,7 @@
-import { isArray } from 'lodash';
+import isArray from 'lodash/isArray';
 import config from '@plone/volto/registry';
-import { getContent } from '@plone/volto/actions';
-import { flattenToAppURL } from '@plone/volto/helpers';
+import { getContent } from '@plone/volto/actions/content/content';
+import { flattenToAppURL } from '@plone/volto/helpers/Url/Url';
 import { serializeNodes } from '@plone/volto-slate/editor/render';
 
 export const createSlateParagraph = (text) => {

package/src/helpers.test.js

@@ -1,7 +1,7 @@
 import * as helpers from './helpers';
 import config from '@plone/volto/registry';
 import { serializeNodes } from '@plone/volto-slate/editor/render';
-import { isArray } from 'lodash';
+import isArray from 'lodash/isArray';
 import '@testing-library/jest-dom';
 
 jest.mock('@plone/volto/registry', () => ({

package/src/index.js

@@ -2,6 +2,37 @@ import { appendGroup, getAsyncData } from './helpers';
 import { FrequencyOfDissemination } from '@eeacms/volto-eea-website-policy/components/Widgets/FrequencyOfDissemination';
 import ErrorView from '@eeacms/volto-eea-website-policy/components/ErrorView/ErrorView';
 
+const publicationTypeValues = [
+  'briefing',
+  'report',
+  'corporate-report',
+  'joint-report',
+];
+
+const publicationTypeFacet = {
+  field: 'publication_type.keyword',
+  factory: 'MultiTermFacet',
+  label: 'Publication type',
+  showInFacetsList: true,
+  filterType: 'any',
+  isFilterable: false,
+  isMulti: true,
+  show: 10000,
+  whitelist: publicationTypeValues,
+  facetValues: publicationTypeValues,
+  sortOn: 'custom',
+  sortOrder: 'ascending',
+  showAllOptions: true,
+};
+
+const publicationTypeVocabulary = {
+  briefing: 'Briefing',
+  report: 'Report',
+  'corporate-report': 'Corporate report',
+  'joint-report': 'Joint report',
+  'technical-paper': 'Technical paper',
+};
+
 const restrictedBlocks = [
   'imagecards',
   // TODO: use what is needed from volto-datablocks after clean-up
@@ -170,6 +201,22 @@ const applyConfig = (config) => {
   ];
 
   // Done
+  const { searchui } = config.settings.searchlib;
+
+  ['globalsearch', 'globalsearchbase'].forEach((appName) => {
+    const searchConfig = searchui[appName];
+
+    if (
+      !searchConfig.facets.some(
+        (facet) => facet.field === publicationTypeFacet.field,
+      )
+    ) {
+      searchConfig.facets.push(publicationTypeFacet);
+    }
+
+    searchConfig.vocab[publicationTypeFacet.field] = publicationTypeVocabulary;
+  });
+
   return config;
 };