[ACS-10100][Security] Remove npx usage from CI/CD and shell scripts to mitigate supply chain risks. [ACS-10117] Deprecate ADF Storybook and custom Docker builds (#11197)

.github/workflows/git-tag.yml

@@ -13,6 +13,7 @@ on:
     branches:
       - master
       - master-patch-*
+
 env:
   BASE_REF: ${{ github.base_ref }}
   HEAD_REF: ${{ github.head_ref }}
@@ -31,13 +32,11 @@ env:
   DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
   DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
   DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
   NPM_REGISTRY_ADDRESS: ${{ secrets.NPM_REGISTRY_ADDRESS }}
   NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
   BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
   REPO_OWNER: "Alfresco"
   REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
   BUILT_LIBS_DIR: "./dist/libs"
   NODE_MODULES_DIR: "./node_modules"
   REDIRECT_URI: /
@@ -72,4 +71,3 @@ jobs:
         run: |
           git fetch --all --quiet
           BRANCH=${GITHUB_REF##*/} ./scripts/github/release/git-tag.sh ${{ steps.set-dryrun.outputs.dryrun }}
-

.github/workflows/pull-request.yml

@@ -48,10 +48,8 @@ env:
   DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
   DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
   DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
   REPO_OWNER: "Alfresco"
   REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
   BUILT_LIBS_DIR: "./dist/libs"
   NODE_MODULES_DIR: "./node_modules"
   REDIRECT_URI: /
@@ -81,7 +79,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
-         fetch-depth: 0
+          fetch-depth: 0
 
       - name: Get branch name
         uses: Alfresco/alfresco-build-tools/.github/actions/get-branch-name@62d25370db3ca229de518fab5b32ec014a061101 # v8.33.1
@@ -168,8 +166,8 @@ jobs:
       - name: install
         run: |
           npm ci
-          npx nx run js-api:bundle
+          npm run bundle:js-api
-          npx nx run cli:bundle
+          npm run bundle:cli
       - uses: ./.github/actions/upload-node-modules-and-artifacts
 
   unit-tests:
@@ -203,7 +201,7 @@ jobs:
       - uses: ./.github/actions/download-node-modules-and-artifacts
       - name: Run unit tests
         run: |
-          /usr/bin/xvfb-run --auto-servernum npx nx affected:test $NX_CALCULATION_FLAGS --exclude=${{ matrix.unit-tests.exclude }}
+          /usr/bin/xvfb-run --auto-servernum npm run test:affected -- $NX_CALCULATION_FLAGS --exclude=${{ matrix.unit-tests.exclude }}
 
   lint:
     # long timeout required when cache has to be recreated
@@ -218,7 +216,7 @@ jobs:
           fetch-depth: 0 # Fetch all history for all tags and branches
       - uses: ./.github/actions/setup
       - uses: ./.github/actions/download-node-modules-and-artifacts
-      - run: npx nx affected --target=lint $NX_CALCULATION_FLAGS
+      - run: npm run lint:affected -- $NX_CALCULATION_FLAGS
 
   build-libs:
     # long timeout required when cache has to be recreated
@@ -233,8 +231,7 @@ jobs:
           fetch-depth: 0 # Fetch all history for all tags and branches
       - uses: ./.github/actions/setup
       - uses: ./.github/actions/download-node-modules-and-artifacts
-      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npx nx affected:build $NX_CALCULATION_FLAGS --prod
+      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npm run build:affected -- $NX_CALCULATION_FLAGS --prod
-      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npx nx affected --target=build-storybook $NX_CALCULATION_FLAGS --configuration=ci
       - uses: ./.github/actions/upload-node-modules-and-artifacts
 
   PR-forbidden-labels:

.github/workflows/release-branch.yml

@@ -28,11 +28,9 @@ env:
   DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
   DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
   DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
   GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
   REPO_OWNER: "Alfresco"
   REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
   BUILT_LIBS_DIR: "./dist/libs"
   NODE_MODULES_DIR: "./node_modules"
   REDIRECT_URI: /
@@ -60,8 +58,8 @@ jobs:
       - name: install
         run: |
           npm ci
-          npx nx run js-api:bundle
+          nx run js-api:bundle
-          npx nx run cli:bundle
+          nx run cli:bundle
       - uses: ./.github/actions/upload-node-modules-and-artifacts
 
   release-npm:
@@ -97,15 +95,15 @@ jobs:
             setMigrations();
       - name: Build libraries
         run: |
-          npx nx run-many --target=build --prod --skip-nx-cache
+          nx run-many --target=build --prod --skip-nx-cache
-          npx nx run-many --target=build-schematics
+          nx run-many --target=build-schematics
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         name: release libraries GH registry
         with:
           node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch|| exit 1
+      - run: nx run-many -t npm-publish --tag=branch || exit 1
         env:
           NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -114,7 +112,7 @@ jobs:
           node-version-file: '.nvmrc'
           registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
           scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch || exit 1
+      - run: nx run-many -t npm-publish --tag=branch || exit 1
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
 

.github/workflows/release.yml

@@ -40,11 +40,9 @@ env:
   DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
   DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
   DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
   GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
   REPO_OWNER: "Alfresco"
   REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
   BUILT_LIBS_DIR: "./dist/libs"
   NODE_MODULES_DIR: "./node_modules"
   REDIRECT_URI: /
@@ -67,37 +65,10 @@ jobs:
       - name: install
         run: |
           npm ci
-          npx nx run js-api:bundle
+          nx run js-api:bundle
-          npx nx run cli:bundle
+          nx run cli:bundle
       - uses: ./.github/actions/upload-node-modules-and-artifacts
 
-  release-storybook:
-    needs: [setup]
-    timeout-minutes: 15
-    if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 1
-      - run: git fetch --all
-      - id: set-dryrun
-        uses: ./.github/actions/enable-dryrun
-        with:
-          dry-run-flag: ${{ inputs.dry-run-flag }}
-      - uses: ./.github/actions/setup
-        with:
-          enable-cache: false
-          enable-node-modules-cache: false
-          act: ${{ inputs.dry-run-flag }}
-      - uses: ./.github/actions/download-node-modules-and-artifacts
-      - name: release Storybook docker
-        run: |
-          npx nx run stories:build-storybook --configuration ci
-          . ./scripts/github/release/docker-tag.sh
-          ./scripts/github/release/release-storybook-docker.sh ${{ steps.set-dryrun.outputs.dryrun }}
-
   release-npm:
     needs: [setup]
     outputs:
@@ -135,15 +106,15 @@ jobs:
             setMigrations();
       - name: build libraries
         run: |
-          npx nx run-many -t build --prod --skip-nx-cache
+          nx run-many -t build --prod --skip-nx-cache
-          npx nx run-many -t build-schematics
+          nx run-many -t build-schematics
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         name: release libraries GH registry
         with:
           node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@alfresco'
-      - run: npx nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
+      - run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
         env:
           NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -152,7 +123,7 @@ jobs:
           node-version-file: '.nvmrc'
           registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
           scope: '@alfresco'
-      - run: npx nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
+      - run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
 
@@ -223,15 +194,15 @@ jobs:
           CROWDIN_TOKEN: ${{ secrets.CROWDIN_TRANSLATIONS_TOKEN }}
 
   finalize:
-      if: always()
+    if: always()
-      runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
-      name: Final Results
+    name: Final Results
-      needs: [release-storybook, release-npm, npm-check-bundle]
+    needs: [release-npm, npm-check-bundle]
-      steps:
+    steps:
-        - name: Check job execution status
+      - name: Check job execution status
-          if: >-
+        if: >-
-            ${{
+          ${{
-                contains(needs.*.result, 'failure')
+              contains(needs.*.result, 'failure')
-              || contains(needs.*.result, 'cancelled')
+            || contains(needs.*.result, 'cancelled')
-            }}
+          }}
-          run: exit 1
+        run: exit 1

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/bin/sh
 
 export NODE_OPTIONS=--max_old_space_size=8192
-npx lint-staged
+lint-staged

lib/content-services/project.json

@@ -38,48 +38,12 @@
         "lintFilePatterns": ["lib/content-services/**/*.ts", "lib/content-services/**/*.html"]
       }
     },
-    "storybook": {
-      "executor": "@storybook/angular:start-storybook",
-      "options": {
-        "port": 4400,
-        "browserTarget": "content-services:storybook",
-        "configDir": "lib/content-services/.storybook",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
-    "build-storybook": {
-      "executor": "@storybook/angular:build-storybook",
-      "options": {
-        "browserTarget": "content-services:build-storybook",
-        "configDir": "lib/content-services/.storybook",
-        "outputDir": "dist/storybook/content-services",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
     "stylelint": {
       "executor": "nx:run-commands",
       "options": {
         "commands": [
           {
-            "command": "npx stylelint lib/content-services/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/content-services/**/*.scss --config stylelint-config.json"
           }
         ]
       }

lib/core/project.json

@@ -64,52 +64,12 @@
         ]
       }
     },
-    "storybook": {
-      "executor": "@storybook/angular:start-storybook",
-      "options": {
-        "port": 4400,
-        "browserTarget": "core:build",
-        "configDir": "lib/core/.storybook",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
-    "build-storybook": {
-      "executor": "@storybook/angular:build-storybook",
-      "options": {
-        "browserTarget": "core:build",
-        "configDir": "lib/core/.storybook",
-        "outputDir": "dist/storybook/core",
-        "compodoc": false,
-        "styles": [
-          "node_modules/cropperjs/dist/cropper.min.css",
-          "node_modules/pdfjs-dist/web/pdf_viewer.css",
-          "node_modules/@angular/material/prebuilt-themes/indigo-pink.css"
-        ],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
     "stylelint": {
       "executor": "nx:run-commands",
       "options": {
         "commands": [
           {
-            "command": "npx stylelint lib/core/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/core/**/*.scss --config stylelint-config.json"
           }
         ]
       }
@@ -119,7 +79,7 @@
       "options": {
         "commands": [
           {
-            "command": "npx license-checker --production  --failOn 'GPL;GPL-2.0' > licenses.txt"
+            "command": "license-checker --production --failOn 'GPL;GPL-2.0' > licenses.txt"
           }
         ]
       }

lib/insights/project.json

@@ -43,7 +43,7 @@
       "options": {
         "commands": [
           {
-            "command": "npx stylelint lib/insights/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/insights/**/*.scss --config stylelint-config.json"
           }
         ]
       }

lib/process-services-cloud/project.json

@@ -38,48 +38,12 @@
         "lintFilePatterns": ["lib/process-services-cloud/**/*.ts", "lib/process-services-cloud/**/*.html"]
       }
     },
-    "storybook": {
-      "executor": "@storybook/angular:start-storybook",
-      "options": {
-        "port": 4400,
-        "browserTarget": "process-services-cloud:storybook",
-        "configDir": "lib/process-services-cloud/.storybook",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
-    "build-storybook": {
-      "executor": "@storybook/angular:build-storybook",
-      "options": {
-        "browserTarget": "process-services-cloud:build-storybook",
-        "configDir": "lib/process-services-cloud/.storybook",
-        "outputDir": "dist/storybook/process-services-cloud",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
     "e2e-playwright": {
       "executor": "nx:run-commands",
       "options": {
         "commands": [
           {
-            "command": "npx playwright test --config='e2e-playwright/playwright.config.ts'"
+            "command": "playwright test --config='e2e-playwright/playwright.config.ts'"
           }
         ]
       }
@@ -89,7 +53,7 @@
       "options": {
         "commands": [
           {
-            "command": "npx stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
           }
         ]
       }

lib/process-services/project.json

@@ -43,7 +43,7 @@
       "options": {
         "commands": [
           {
-            "command": "npx stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
           }
         ]
       }

nx.json

@@ -6,9 +6,6 @@
       "inputs": ["production", "^production"],
       "cache": true
     },
-    "build-storybook": {
-      "inputs": ["default", "^production", "{projectRoot}/.storybook/**/*", "{projectRoot}/tsconfig.storybook.json"]
-    },
     "lint": {
       "cache": true
     },

package.json

@@ -7,8 +7,12 @@
     "prepare": "husky install",
     "build-doc-tools": "tsc -p ./tools/doc/tsconfig.json",
     "docbuild": "(cd ./tools/doc; npm i) && node tools/doc/node_modules/typedoc/bin/typedoc --tsconfig lib/tsconfig.doc.json && node tools/doc/buildYamlSourceInfo.js docs/docs.json && node ./tools/doc/docProcessor.js",
+    "bundle:js-api": "nx run js-api:bundle",
+    "bundle:cli": "nx run cli:bundle",
+    "test:affected": "nx affected:test",
+    "lint:affected": "nx affected:lint",
+    "build:affected": "nx affected:build",
     "affected:libs": "nx affected:libs",
-    "affected:lint": "nx affected:lint",
     "clean": "rimraf dist node_modules dist/libs"
   },
   "repository": {

scripts/github/affected-contains.sh

@@ -11,7 +11,7 @@ if [ "${GITHUB_EVENT_NAME}" == "schedule" ]; then
   exit 0
 fi
 isAffected=false
-AFFECTED_LIBS=$(npx nx show projects --affected ${NX_CALCULATION_FLAGS} --plain)
+AFFECTED_LIBS=$(nx show projects --affected ${NX_CALCULATION_FLAGS} --plain)
 #echo "Verify if affected build contains $1"
 #echo "Affected libs:$AFFECTED_LIBS"
 if [[  $AFFECTED_LIBS =~ $verifyLib ]]; then

scripts/github/release/docker-tag.sh

@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $DIR/../../../
-BRANCH=${GITHUB_REF##*/}
-if [[ $BRANCH =~ ^master(-patch.*)?$ ]]; then
-    export TAGS=$(grep -m1 version package.json | awk '{ print $2 }' | sed 's/[", ]//g')
-else
-    if [[ "${GITHUB_BASE_REF}" != "" ]];
-    then
-        export TAGS="${GITHUB_BASE_REF}-$GH_BUILD_NUMBER"
-    else
-        export TAGS="$GITHUB_BASE_REF-$GH_BUILD_NUMBER,$GITHUB_BASE_REF"
-    fi;
-fi;
-
-if [[ -n "$GITHUB_ACTIONS" ]]; then
-    echo "TAGS=$TAGS" >> $GITHUB_ENV;
-fi
-echo "$TAGS"

scripts/github/release/release-storybook-docker.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $DIR/../../../
-
-echo "ℹ️ storybook-shell: Running the docker with tag" $TAGS
-
-DOCKER_PROJECT_ARGS="PROJECT_NAME=storybook/stories"
-
-echo "{}" > $DIR/../../../dist/storybook/stories/app.config.json
-
-# Publish Image to docker
-./node_modules/@alfresco/adf-cli/bin/adf-cli docker \
-    --loginCheck \
-    --loginUsername "$DOCKER_REPOSITORY_USER" \
-    --loginPassword "$DOCKER_REPOSITORY_PASSWORD" \
-    --loginRepo "$DOCKER_REPOSITORY_DOMAIN" \
-    --dockerRepo "$DOCKER_REPOSITORY_STORYBOOK" \
-    --buildArgs "$DOCKER_PROJECT_ARGS" \
-    --dockerTags "$TAGS" \
-    --pathProject "$(pwd)" \
-    "$@"

scripts/release.sh

@@ -39,7 +39,7 @@ LICENSE_GREP_RESULT=`grep "$LICENSE_GREP" "$LICENSE_README"`;
 if [ -z "$LICENSE_GREP_RESULT" ];
 then
     echo -e "\e[33mAdding third party license info for version: $VERSION\e[0m"
-    npx @alfresco/adf-cli licenses
+    adf-cli licenses
     mv "$ROOTDIR/license-info-$VERSION.md" "$ROOTDIR/docs/license-info/license-info-$VERSION.md"
     echo $LICENSE_ROW >> $LICENSE_README
 else
@@ -54,7 +54,7 @@ VULNERABILITY_GREP_RESULT=`grep "$VULNERABILITY_GREP" "$VULNERABILITY_README"`;
 if [ -z "$VULNERABILITY_GREP_RESULT" ];
 then
     echo -e "\e[33mAdding vulnerability info for version: $VERSION\e[0m"
-    npx @alfresco/adf-cli@alpha audit
+    adf-cli audit
     mv "$ROOTDIR/audit-info-$VERSION.md" "$ROOTDIR/docs/vulnerability/audit-info-$VERSION.md"
     echo $VULNERABILITY_ROW >> $VULNERABILITY_README
 else