[ACS-10100][Security] Remove npx usage from CI/CD and shell scripts to mitigate supply chain risks. [ACS-10117] Deprecate ADF Storybook and custom Docker builds (#11197)

2026-09-09 18:03:21 +00:00 · 2025-09-16 10:12:21 +02:00
parent 196b60a7d9
commit 10afe75e94
16 changed files with 47 additions and 236 deletions
@@ -13,6 +13,7 @@ on:
    branches:
      - master
      - master-patch-*
+
 env:
  BASE_REF: ${{ github.base_ref }}
  HEAD_REF: ${{ github.head_ref }}
@@ -31,13 +32,11 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  NPM_REGISTRY_ADDRESS: ${{ secrets.NPM_REGISTRY_ADDRESS }}
  NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
  BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -72,4 +71,3 @@ jobs:
        run: |
          git fetch --all --quiet
          BRANCH=${GITHUB_REF##*/} ./scripts/github/release/git-tag.sh ${{ steps.set-dryrun.outputs.dryrun }}
-
@@ -48,10 +48,8 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -81,7 +79,7 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
-         fetch-depth: 0
+          fetch-depth: 0

      - name: Get branch name
        uses: Alfresco/alfresco-build-tools/.github/actions/get-branch-name@62d25370db3ca229de518fab5b32ec014a061101 # v8.33.1
@@ -168,8 +166,8 @@ jobs:
      - name: install
        run: |
          npm ci
-          npx nx run js-api:bundle
-          npx nx run cli:bundle
+          npm run bundle:js-api
+          npm run bundle:cli
      - uses: ./.github/actions/upload-node-modules-and-artifacts

  unit-tests:
@@ -203,7 +201,7 @@ jobs:
      - uses: ./.github/actions/download-node-modules-and-artifacts
      - name: Run unit tests
        run: |
-          /usr/bin/xvfb-run --auto-servernum npx nx affected:test $NX_CALCULATION_FLAGS --exclude=${{ matrix.unit-tests.exclude }}
+          /usr/bin/xvfb-run --auto-servernum npm run test:affected -- $NX_CALCULATION_FLAGS --exclude=${{ matrix.unit-tests.exclude }}

  lint:
    # long timeout required when cache has to be recreated
@@ -218,7 +216,7 @@ jobs:
          fetch-depth: 0 # Fetch all history for all tags and branches
      - uses: ./.github/actions/setup
      - uses: ./.github/actions/download-node-modules-and-artifacts
-      - run: npx nx affected --target=lint $NX_CALCULATION_FLAGS
+      - run: npm run lint:affected -- $NX_CALCULATION_FLAGS

  build-libs:
    # long timeout required when cache has to be recreated
@@ -233,8 +231,7 @@ jobs:
          fetch-depth: 0 # Fetch all history for all tags and branches
      - uses: ./.github/actions/setup
      - uses: ./.github/actions/download-node-modules-and-artifacts
-      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npx nx affected:build $NX_CALCULATION_FLAGS --prod
-      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npx nx affected --target=build-storybook $NX_CALCULATION_FLAGS --configuration=ci
+      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npm run build:affected -- $NX_CALCULATION_FLAGS --prod
      - uses: ./.github/actions/upload-node-modules-and-artifacts

  PR-forbidden-labels:
@@ -28,11 +28,9 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -60,8 +58,8 @@ jobs:
      - name: install
        run: |
          npm ci
-          npx nx run js-api:bundle
-          npx nx run cli:bundle
+          nx run js-api:bundle
+          nx run cli:bundle
      - uses: ./.github/actions/upload-node-modules-and-artifacts

  release-npm:
@@ -97,15 +95,15 @@ jobs:
            setMigrations();
      - name: Build libraries
        run: |
-          npx nx run-many --target=build --prod --skip-nx-cache
-          npx nx run-many --target=build-schematics
+          nx run-many --target=build --prod --skip-nx-cache
+          nx run-many --target=build-schematics
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        name: release libraries GH registry
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch|| exit 1
+      - run: nx run-many -t npm-publish --tag=branch || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -114,7 +112,7 @@ jobs:
          node-version-file: '.nvmrc'
          registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
          scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch || exit 1
+      - run: nx run-many -t npm-publish --tag=branch || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}

@@ -40,11 +40,9 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -67,37 +65,10 @@ jobs:
      - name: install
        run: |
          npm ci
-          npx nx run js-api:bundle
-          npx nx run cli:bundle
+          nx run js-api:bundle
+          nx run cli:bundle
      - uses: ./.github/actions/upload-node-modules-and-artifacts

-  release-storybook:
-    needs: [setup]
-    timeout-minutes: 15
-    if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 1
-      - run: git fetch --all
-      - id: set-dryrun
-        uses: ./.github/actions/enable-dryrun
-        with:
-          dry-run-flag: ${{ inputs.dry-run-flag }}
-      - uses: ./.github/actions/setup
-        with:
-          enable-cache: false
-          enable-node-modules-cache: false
-          act: ${{ inputs.dry-run-flag }}
-      - uses: ./.github/actions/download-node-modules-and-artifacts
-      - name: release Storybook docker
-        run: |
-          npx nx run stories:build-storybook --configuration ci
-          . ./scripts/github/release/docker-tag.sh
-          ./scripts/github/release/release-storybook-docker.sh ${{ steps.set-dryrun.outputs.dryrun }}
-
  release-npm:
    needs: [setup]
    outputs:
@@ -135,15 +106,15 @@ jobs:
            setMigrations();
      - name: build libraries
        run: |
-          npx nx run-many -t build --prod --skip-nx-cache
-          npx nx run-many -t build-schematics
+          nx run-many -t build --prod --skip-nx-cache
+          nx run-many -t build-schematics
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        name: release libraries GH registry
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@alfresco'
-      - run: npx nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
+      - run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -152,7 +123,7 @@ jobs:
          node-version-file: '.nvmrc'
          registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
          scope: '@alfresco'
-      - run: npx nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
+      - run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}

@@ -223,15 +194,15 @@ jobs:
          CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}

  finalize:
-      if: always()
-      runs-on: ubuntu-latest
-      name: Final Results
-      needs: [release-storybook, release-npm, npm-check-bundle]
-      steps:
-        - name: Check job execution status
-          if: >-
-            ${{
-                contains(needs.*.result, 'failure')
-              || contains(needs.*.result, 'cancelled')
-            }}
-          run: exit 1
+    if: always()
+    runs-on: ubuntu-latest
+    name: Final Results
+    needs: [release-npm, npm-check-bundle]
+    steps:
+      - name: Check job execution status
+        if: >-
+          ${{
+              contains(needs.*.result, 'failure')
+            || contains(needs.*.result, 'cancelled')
+          }}
+        run: exit 1