Replace #105, with non fork #111

RossBugginsNHS · 2025-11-17T10:36:31Z

Description

This is 301 lines of addition, the rest are package locks getting reordered.

Context

Type of changes

Refactoring (non-breaking change)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would change existing functionality)
Bug fix (non-breaking change which fixes an issue)

Checklist

I am familiar with the contributing guidelines
I have followed the code style of the project
I have added tests to cover my changes
I have updated the documentation accordingly
This PR is a result of pair or mob programming

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

.github/workflows/disabled/docs-stage-1-commit.yaml

.github/workflows/disabled/docs-stage-3-build.yaml

.github/workflows/disabled/docs-stage-5-publish.yaml

.github/workflows/cicd-2-publish.yaml

- Add test_schema_handling.py to cover previously uncovered error paths - Test bundled schema copy errors and data schema handling - Test schema parsing errors and missing file scenarios - Test relationship update edge cases with missing files - Test import_all edge cases (missing dir, combined files, errors) - Test event content generation with various schema combinations - Coverage improved from 87% to 96% on import_asyncapi.py - Addresses SonarCloud coverage failure on new code in PR #111

- Replace [ with [[ for safer conditional tests (7 HIGH RELIABILITY issues) - Redirect error messages to stderr with >&2 (5 MEDIUM MAINTAINABILITY issues) - Add explicit return statements to all functions (7 MEDIUM MAINTAINABILITY issues) All changes follow SonarCloud shell script best practices for improved reliability and maintainability.

The Python coverage.xml files were being generated but not downloaded in the static analysis step. This adds a step to download the python-coverage-reports artifact so SonarCloud can see the coverage for eventcatalogasyncapiimporter, asyncapigenerator, and other Python projects.

When using a glob pattern like 'src/**/coverage.xml', upload-artifact strips the leading directory structure. This causes the coverage files to be uploaded without the 'src/' prefix, so when SonarCloud looks for 'src/eventcatalogasyncapiimporter/coverage.xml', the file isn't there. Fixed by explicitly listing each coverage.xml file path to preserve the full directory structure.

.github/workflows/stage-5-publish.yaml

+    name: "Publish Docs"
    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
+    timeout-minutes: 15
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v5
-
-      - name: "Get artifacts: jekyll docs"
-        uses: actions/download-artifact@v5
+      - name: "Publish docs"
+        uses: ./.github/actions/publish-docs
        with:
-          path: ./artifacts/jekyll-docs-${{ inputs.version }}
-          name: jekyll-docs-${{ inputs.version }}
+          version: "${{ inputs.version }}"
+          is_version_prerelease: "${{ inputs.is_version_prerelease }}"

-      - name: "Get artifacts: schema"
-        uses: actions/download-artifact@v5
-        with:
-          path: ./artifacts/schemas-${{ inputs.version }}
-          name: schemas-${{ inputs.version }}
+  # publish:
+  #   name: "Publish packages"
+  #   runs-on: ubuntu-latest
+  #   timeout-minutes: 10
+
+  #   steps:
+  #     - name: "Checkout code"
+  #       uses: actions/checkout@v5
+
+  #     - name: "Get artifacts: jekyll docs"
+  #       uses: actions/download-artifact@v5
+  #       with:
+  #         path: ./artifacts/jekyll-docs-${{ inputs.version }}
+  #         name: jekyll-docs-${{ inputs.version }}
+
+  #     - name: "Get artifacts: schema"
+  #       uses: actions/download-artifact@v5
+  #       with:
+  #         path: ./artifacts/schemas-${{ inputs.version }}
+  #         name: schemas-${{ inputs.version }}


-      - name: Draft Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          gh release create \
-          "${{ inputs.version }}" \
-          --draft \
-          --latest \
-          --title "${{ inputs.version }}" \
-          --notes "Release of ${{ inputs.version }}" \
-          ${{ inputs.is_version_prerelease == 'true' && '--prerelease' || '' }}
+  #     - name: Draft Release
+  #       env:
+  #         GH_TOKEN: ${{ github.token }}
+  #         GH_REPO: ${{ github.repository }}
+  #       run: |
+  #         gh release create \
+  #         "${{ inputs.version }}" \
+  #         --draft \
+  #         --latest \
+  #         --title "${{ inputs.version }}" \
+  #         --notes "Release of ${{ inputs.version }}" \
+  #         ${{ inputs.is_version_prerelease == 'true' && '--prerelease' || '' }}

-      - name: "Upload jeykll docs release asset"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          cp ./artifacts/jekyll-docs-${{ inputs.version }}/artifact.tar $RUNNER_TEMP/jekyll-docs-${{ inputs.version }}.tar
-          gh release upload \
-          "${{ inputs.version }}" \
-          $RUNNER_TEMP/jekyll-docs-${{ inputs.version }}.tar#jekyll-docs-${{ inputs.version }}
+  #     - name: "Upload jeykll docs release asset"
+  #       env:
+  #         GH_TOKEN: ${{ github.token }}
+  #         GH_REPO: ${{ github.repository }}
+  #       run: |
+  #         cp ./artifacts/jekyll-docs-${{ inputs.version }}/artifact.tar $RUNNER_TEMP/jekyll-docs-${{ inputs.version }}.tar
+  #         gh release upload \
+  #         "${{ inputs.version }}" \
+  #         $RUNNER_TEMP/jekyll-docs-${{ inputs.version }}.tar#jekyll-docs-${{ inputs.version }}

-      - name: "Upload schema release asset"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          cp ./artifacts/schemas-${{ inputs.version }}/artifact.tar $RUNNER_TEMP/schemas-${{ inputs.version }}.tar
-          gh release upload \
-          "${{ inputs.version }}" \
-          $RUNNER_TEMP/schemas-${{ inputs.version }}.tar#schemas-${{ inputs.version }}
+  #     - name: "Upload schema release asset"
+  #       env:
+  #         GH_TOKEN: ${{ github.token }}
+  #         GH_REPO: ${{ github.repository }}
+  #       run: |
+  #         cp ./artifacts/schemas-${{ inputs.version }}/artifact.tar $RUNNER_TEMP/schemas-${{ inputs.version }}.tar
+  #         gh release upload \
+  #         "${{ inputs.version }}" \
+  #         $RUNNER_TEMP/schemas-${{ inputs.version }}.tar#schemas-${{ inputs.version }}


-      - name: Publish Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: gh release edit "${{ inputs.version }}" --draft=false
+  #     - name: Publish Release
+  #       env:
+  #         GH_TOKEN: ${{ github.token }}
+  #         GH_REPO: ${{ github.repository }}
+  #       run: gh release edit "${{ inputs.version }}" --draft=false


To fix this problem, an explicit permissions block should be added to the workflow, scoped appropriately to the job (or to the root of the workflow if every job has the same needs). Since the publish-docs job just checks out code and runs a documentation publishing action, it is likely that it only needs contents: read permission for the GITHUB_TOKEN. Therefore, add a permissions block with contents: read under the publish-docs job (line 39–40). This change is enough to ensure that the GITHUB_TOKEN exposed to that job is appropriately constrained. No imports or method definitions are needed.

…curity hotspots - Move all GitHub Actions inputs to environment variables to prevent command injection (S7630) - Add non-root user to Docker test image (S6471) - Pin peter-evans/create-pull-request to full commit SHA (S7637) Fixed 27 BLOCKER vulnerabilities and 2 security hotspots identified by SonarCloud. All inputs from GitHub Actions are now passed via env variables and properly quoted in shell commands to prevent potential command injection attacks.

- Add checkout step before downloading artifacts in test-report job This fixes 'fatal: not a git repository' error from dorny/test-reporter - Pin dorny/test-reporter to v1.9.1 commit SHA for security The test-reporter action requires git to create check runs properly.

.github/actions/publish-docs/action.yml

- Add test_schema_handling.py to cover previously uncovered error paths - Test bundled schema copy errors and data schema handling - Test schema parsing errors and missing file scenarios - Test relationship update edge cases with missing files - Test import_all edge cases (missing dir, combined files, errors) - Test event content generation with various schema combinations - Coverage improved from 87% to 96% on import_asyncapi.py - Addresses SonarCloud coverage failure on new code in PR NHSDigital#111

RossBugginsNHS requested review from a team as code owners November 17, 2025 10:36

RossBugginsNHS mentioned this pull request Nov 17, 2025

tools versions & cicd publish-stage & codespace devcontainer #105

Closed

RossBugginsNHS marked this pull request as draft November 17, 2025 12:20

github-advanced-security bot found potential problems Nov 17, 2025

View reviewed changes

RossBugginsNHS closed this Nov 17, 2025

RossBugginsNHS reopened this Nov 17, 2025

github-advanced-security bot found potential problems Nov 18, 2025

View reviewed changes

.github/workflows/cicd-2-publish.yaml Fixed Show fixed Hide fixed

.github/workflows/cicd-2-publish.yaml Fixed Show fixed Hide fixed

RossBugginsNHS force-pushed the rossbugginsnhs/2025-11-17/post-schema-merge-changes-001 branch 2 times, most recently from b43a8e3 to dd1312d Compare November 19, 2025 16:18

updates.

f7c72eb

RossBugginsNHS force-pushed the rossbugginsnhs/2025-11-17/post-schema-merge-changes-001 branch from dd1312d to f7c72eb Compare November 19, 2025 16:20

RossBugginsNHS added 7 commits November 19, 2025 16:22

remove disabled publish workflow.

268e7df

Tests for other python.

f69fc2e

Python coverage from anywhere.

5be0388

RossBugginsNHS closed this Nov 20, 2025

RossBugginsNHS reopened this Nov 20, 2025

RossBugginsNHS added 9 commits November 20, 2025 16:03

Correct spellings, remove duplicate dependencies file.

1ef90fc

skipping dynamic and sonar via env vars.

eaefc8d

use not cancelled

11aa83a

use not cancelled

d1e6a8d

skip scan deps

b92ad6c

add in needs.

2bdfbcd

quote true and falses.

5d1d90d

remove needs.

61f1741

invert check

1a3ca79

RossBugginsNHS added 21 commits November 21, 2025 09:44

checks without strings.

8db5c7c

all from initial metadata.

f9e0186

all from initial metadata.

2be6dd5

pass correctly.

bfc9d79

remove quotes.

bc68a64

remove more quotes.

7431acb

outputs appear to always be strings.

37c43e5

composite actions dont support any types apart from strings.

00ca80e

add warning when sonar check disabled.

626242d

make publish docs a composite action

26363fa

put watning on dep scan being skipped

39d66a9

add shells.

a2756c4

add summary step warnings.

9d0b640

add summary step warnings.

78255e9

add summary step warnings.

f6f0c8e

improve warning messages.

999c282

improve warning messages.

03a45f9

try out test results.

e4b1219

adding python too.

ebed2b3

checks write for test reports.

c5a2901

set permissions

e6f3c09

github-advanced-security bot found potential problems Nov 21, 2025

View reviewed changes

RossBugginsNHS added 2 commits November 21, 2025 12:28

github-advanced-security bot found potential problems Nov 21, 2025

View reviewed changes

RossBugginsNHS added 4 commits November 21, 2025 13:47

Set url for sonar.

abeb4cd

Set bypass of docs.

12942e1

Correct check for make docs existing.

ee7c474

add check on tests.sh not existing in docs from main unit test.

d3dce52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Replace #105, with non fork #111

Replace #105, with non fork #111

Uh oh!

RossBugginsNHS commented Nov 17, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

@@ -38,6 +38,8 @@
             jobs:
               publish-docs:
                 name: "Publish Docs"
+                permissions:
+                  contents: read
                 runs-on: ubuntu-latest
                 timeout-minutes: 15
                 steps:

Replace #105, with non fork #111

Are you sure you want to change the base?

Replace #105, with non fork #111

Uh oh!

Conversation

RossBugginsNHS commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Context

Type of changes

Checklist

Sensitive Information Declaration

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

RossBugginsNHS commented Nov 17, 2025 •

edited

Loading