[ACS-10100][Security] Remove npx usage from CI/CD and shell scripts to mitigate supply chain risks. [ACS-10117] Deprecate ADF Storybook and custom Docker builds (#11197)

2025-09-17 14:21:29 +00:00 · 2025-09-16 10:12:21 +02:00
parent 196b60a7d9
commit 10afe75e94
16 changed files with 47 additions and 236 deletions
--- a/.github/workflows/git-tag.yml
+++ b/.github/workflows/git-tag.yml
@@ -13,6 +13,7 @@ on:
    branches:
      - master
      - master-patch-*
+
 env:
  BASE_REF: ${{ github.base_ref }}
  HEAD_REF: ${{ github.head_ref }}
@@ -31,13 +32,11 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  NPM_REGISTRY_ADDRESS: ${{ secrets.NPM_REGISTRY_ADDRESS }}
  NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
  BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -72,4 +71,3 @@ jobs:
        run: |
          git fetch --all --quiet
          BRANCH=${GITHUB_REF##*/} ./scripts/github/release/git-tag.sh ${{ steps.set-dryrun.outputs.dryrun }}
-
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -48,10 +48,8 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -168,8 +166,8 @@ jobs:
      - name: install
        run: |
          npm ci
-          npx nx run js-api:bundle
-          npx nx run cli:bundle
+          npm run bundle:js-api
+          npm run bundle:cli
      - uses: ./.github/actions/upload-node-modules-and-artifacts

  unit-tests:
@@ -203,7 +201,7 @@ jobs:
      - uses: ./.github/actions/download-node-modules-and-artifacts
      - name: Run unit tests
        run: |
-          /usr/bin/xvfb-run --auto-servernum npx nx affected:test $NX_CALCULATION_FLAGS --exclude=${{ matrix.unit-tests.exclude }}
+          /usr/bin/xvfb-run --auto-servernum npm run test:affected -- $NX_CALCULATION_FLAGS --exclude=${{ matrix.unit-tests.exclude }}

  lint:
    # long timeout required when cache has to be recreated
@@ -218,7 +216,7 @@ jobs:
          fetch-depth: 0 # Fetch all history for all tags and branches
      - uses: ./.github/actions/setup
      - uses: ./.github/actions/download-node-modules-and-artifacts
-      - run: npx nx affected --target=lint $NX_CALCULATION_FLAGS
+      - run: npm run lint:affected -- $NX_CALCULATION_FLAGS

  build-libs:
    # long timeout required when cache has to be recreated
@@ -233,8 +231,7 @@ jobs:
          fetch-depth: 0 # Fetch all history for all tags and branches
      - uses: ./.github/actions/setup
      - uses: ./.github/actions/download-node-modules-and-artifacts
-      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npx nx affected:build $NX_CALCULATION_FLAGS --prod
-      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npx nx affected --target=build-storybook $NX_CALCULATION_FLAGS --configuration=ci
+      - run: NX_REJECT_UNKNOWN_LOCAL_CACHE=0 npm run build:affected -- $NX_CALCULATION_FLAGS --prod
      - uses: ./.github/actions/upload-node-modules-and-artifacts

  PR-forbidden-labels:
--- a/.github/workflows/release-branch.yml
+++ b/.github/workflows/release-branch.yml
@@ -28,11 +28,9 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -60,8 +58,8 @@ jobs:
      - name: install
        run: |
          npm ci
-          npx nx run js-api:bundle
-          npx nx run cli:bundle
+          nx run js-api:bundle
+          nx run cli:bundle
      - uses: ./.github/actions/upload-node-modules-and-artifacts

  release-npm:
@@ -97,15 +95,15 @@ jobs:
            setMigrations();
      - name: Build libraries
        run: |
-          npx nx run-many --target=build --prod --skip-nx-cache
-          npx nx run-many --target=build-schematics
+          nx run-many --target=build --prod --skip-nx-cache
+          nx run-many --target=build-schematics
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        name: release libraries GH registry
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch|| exit 1
+      - run: nx run-many -t npm-publish --tag=branch || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -114,7 +112,7 @@ jobs:
          node-version-file: '.nvmrc'
          registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
          scope: '@alfresco'
-      - run: npx nx run-many --target=npm-publish --tag=branch || exit 1
+      - run: nx run-many -t npm-publish --tag=branch || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}

--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -40,11 +40,9 @@ env:
  DOCKER_REPOSITORY_DOMAIN: ${{ secrets.DOCKER_REPOSITORY_DOMAIN }}
  DOCKER_REPOSITORY_USER: ${{ secrets.DOCKER_USERNAME }}
  DOCKER_REPOSITORY_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  DOCKER_REPOSITORY_STORYBOOK: "${{ secrets.DOCKER_REPOSITORY_DOMAIN }}/alfresco/storybook"
  GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
  REPO_OWNER: "Alfresco"
  REPO_NAME: "alfresco-ng2-components"
-  STORYBOOK_DIR: "./dist/storybook/stories"
  BUILT_LIBS_DIR: "./dist/libs"
  NODE_MODULES_DIR: "./node_modules"
  REDIRECT_URI: /
@@ -67,37 +65,10 @@ jobs:
      - name: install
        run: |
          npm ci
-          npx nx run js-api:bundle
-          npx nx run cli:bundle
+          nx run js-api:bundle
+          nx run cli:bundle
      - uses: ./.github/actions/upload-node-modules-and-artifacts

-  release-storybook:
-    needs: [setup]
-    timeout-minutes: 15
-    if: github.event.pull_request.merged == true || github.ref_name == 'master' || github.ref_name == 'master-patch-*'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 1
-      - run: git fetch --all
-      - id: set-dryrun
-        uses: ./.github/actions/enable-dryrun
-        with:
-          dry-run-flag: ${{ inputs.dry-run-flag }}
-      - uses: ./.github/actions/setup
-        with:
-          enable-cache: false
-          enable-node-modules-cache: false
-          act: ${{ inputs.dry-run-flag }}
-      - uses: ./.github/actions/download-node-modules-and-artifacts
-      - name: release Storybook docker
-        run: |
-          npx nx run stories:build-storybook --configuration ci
-          . ./scripts/github/release/docker-tag.sh
-          ./scripts/github/release/release-storybook-docker.sh ${{ steps.set-dryrun.outputs.dryrun }}
-
  release-npm:
    needs: [setup]
    outputs:
@@ -135,15 +106,15 @@ jobs:
            setMigrations();
      - name: build libraries
        run: |
-          npx nx run-many -t build --prod --skip-nx-cache
-          npx nx run-many -t build-schematics
+          nx run-many -t build --prod --skip-nx-cache
+          nx run-many -t build-schematics
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
        name: release libraries GH registry
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://npm.pkg.github.com'
          scope: '@alfresco'
-      - run: npx nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
+      - run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.PAT_WRITE_PKG }}
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -152,7 +123,7 @@ jobs:
          node-version-file: '.nvmrc'
          registry-url: 'https://${{ vars.NPM_REGISTRY_ADDRESS }}'
          scope: '@alfresco'
-      - run: npx nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
+      - run: nx run-many -t npm-publish --tag=$TAG_NPM || exit 1
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}

@@ -226,7 +197,7 @@ jobs:
    if: always()
    runs-on: ubuntu-latest
    name: Final Results
-      needs: [release-storybook, release-npm, npm-check-bundle]
+    needs: [release-npm, npm-check-bundle]
    steps:
      - name: Check job execution status
        if: >-
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,4 +1,4 @@
 #!/bin/sh

 export NODE_OPTIONS=--max_old_space_size=8192
-npx lint-staged
+lint-staged
--- a/lib/content-services/project.json
+++ b/lib/content-services/project.json
@@ -38,48 +38,12 @@
        "lintFilePatterns": ["lib/content-services/**/*.ts", "lib/content-services/**/*.html"]
      }
    },
-    "storybook": {
-      "executor": "@storybook/angular:start-storybook",
-      "options": {
-        "port": 4400,
-        "browserTarget": "content-services:storybook",
-        "configDir": "lib/content-services/.storybook",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
-    "build-storybook": {
-      "executor": "@storybook/angular:build-storybook",
-      "options": {
-        "browserTarget": "content-services:build-storybook",
-        "configDir": "lib/content-services/.storybook",
-        "outputDir": "dist/storybook/content-services",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
    "stylelint": {
      "executor": "nx:run-commands",
      "options": {
        "commands": [
          {
-            "command": "npx stylelint lib/content-services/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/content-services/**/*.scss --config stylelint-config.json"
          }
        ]
      }
--- a/lib/core/project.json
+++ b/lib/core/project.json
@@ -64,52 +64,12 @@
        ]
      }
    },
-    "storybook": {
-      "executor": "@storybook/angular:start-storybook",
-      "options": {
-        "port": 4400,
-        "browserTarget": "core:build",
-        "configDir": "lib/core/.storybook",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
-    "build-storybook": {
-      "executor": "@storybook/angular:build-storybook",
-      "options": {
-        "browserTarget": "core:build",
-        "configDir": "lib/core/.storybook",
-        "outputDir": "dist/storybook/core",
-        "compodoc": false,
-        "styles": [
-          "node_modules/cropperjs/dist/cropper.min.css",
-          "node_modules/pdfjs-dist/web/pdf_viewer.css",
-          "node_modules/@angular/material/prebuilt-themes/indigo-pink.css"
-        ],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
    "stylelint": {
      "executor": "nx:run-commands",
      "options": {
        "commands": [
          {
-            "command": "npx stylelint lib/core/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/core/**/*.scss --config stylelint-config.json"
          }
        ]
      }
@@ -119,7 +79,7 @@
      "options": {
        "commands": [
          {
-            "command": "npx license-checker --production  --failOn 'GPL;GPL-2.0' > licenses.txt"
+            "command": "license-checker --production --failOn 'GPL;GPL-2.0' > licenses.txt"
          }
        ]
      }
--- a/lib/insights/project.json
+++ b/lib/insights/project.json
@@ -43,7 +43,7 @@
      "options": {
        "commands": [
          {
-            "command": "npx stylelint lib/insights/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/insights/**/*.scss --config stylelint-config.json"
          }
        ]
      }
--- a/lib/process-services-cloud/project.json
+++ b/lib/process-services-cloud/project.json
@@ -38,48 +38,12 @@
        "lintFilePatterns": ["lib/process-services-cloud/**/*.ts", "lib/process-services-cloud/**/*.html"]
      }
    },
-    "storybook": {
-      "executor": "@storybook/angular:start-storybook",
-      "options": {
-        "port": 4400,
-        "browserTarget": "process-services-cloud:storybook",
-        "configDir": "lib/process-services-cloud/.storybook",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
-    "build-storybook": {
-      "executor": "@storybook/angular:build-storybook",
-      "options": {
-        "browserTarget": "process-services-cloud:build-storybook",
-        "configDir": "lib/process-services-cloud/.storybook",
-        "outputDir": "dist/storybook/process-services-cloud",
-        "compodoc": false,
-        "styles": ["node_modules/cropperjs/dist/cropper.min.css", "node_modules/pdfjs-dist/web/pdf_viewer.css"],
-        "stylePreprocessorOptions": {
-          "includePaths": ["lib", "lib/core/src/lib"]
-        }
-      },
-      "configurations": {
-        "ci": {
-          "quiet": true
-        }
-      }
-    },
    "e2e-playwright": {
      "executor": "nx:run-commands",
      "options": {
        "commands": [
          {
-            "command": "npx playwright test --config='e2e-playwright/playwright.config.ts'"
+            "command": "playwright test --config='e2e-playwright/playwright.config.ts'"
          }
        ]
      }
@@ -89,7 +53,7 @@
      "options": {
        "commands": [
          {
-            "command": "npx stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
          }
        ]
      }
--- a/lib/process-services/project.json
+++ b/lib/process-services/project.json
@@ -43,7 +43,7 @@
      "options": {
        "commands": [
          {
-            "command": "npx stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
+            "command": "stylelint lib/process-services-cloud/**/*.scss --config stylelint-config.json"
          }
        ]
      }
--- a/nx.json
+++ b/nx.json
@@ -6,9 +6,6 @@
      "inputs": ["production", "^production"],
      "cache": true
    },
-    "build-storybook": {
-      "inputs": ["default", "^production", "{projectRoot}/.storybook/**/*", "{projectRoot}/tsconfig.storybook.json"]
-    },
    "lint": {
      "cache": true
    },
--- a/package.json
+++ b/package.json
@@ -7,8 +7,12 @@
    "prepare": "husky install",
    "build-doc-tools": "tsc -p ./tools/doc/tsconfig.json",
    "docbuild": "(cd ./tools/doc; npm i) && node tools/doc/node_modules/typedoc/bin/typedoc --tsconfig lib/tsconfig.doc.json && node tools/doc/buildYamlSourceInfo.js docs/docs.json && node ./tools/doc/docProcessor.js",
+    "bundle:js-api": "nx run js-api:bundle",
+    "bundle:cli": "nx run cli:bundle",
+    "test:affected": "nx affected:test",
+    "lint:affected": "nx affected:lint",
+    "build:affected": "nx affected:build",
    "affected:libs": "nx affected:libs",
-    "affected:lint": "nx affected:lint",
    "clean": "rimraf dist node_modules dist/libs"
  },
  "repository": {
--- a/scripts/github/affected-contains.sh
+++ b/scripts/github/affected-contains.sh
@@ -11,7 +11,7 @@ if [ "${GITHUB_EVENT_NAME}" == "schedule" ]; then
  exit 0
 fi
 isAffected=false
-AFFECTED_LIBS=$(npx nx show projects --affected ${NX_CALCULATION_FLAGS} --plain)
+AFFECTED_LIBS=$(nx show projects --affected ${NX_CALCULATION_FLAGS} --plain)
 #echo "Verify if affected build contains $1"
 #echo "Affected libs:$AFFECTED_LIBS"
 if [[  $AFFECTED_LIBS =~ $verifyLib ]]; then
--- a/scripts/github/release/docker-tag.sh
+++ b/scripts/github/release/docker-tag.sh
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $DIR/../../../
-BRANCH=${GITHUB_REF##*/}
-if [[ $BRANCH =~ ^master(-patch.*)?$ ]]; then
-    export TAGS=$(grep -m1 version package.json | awk '{ print $2 }' | sed 's/[", ]//g')
-else
-    if [[ "${GITHUB_BASE_REF}" != "" ]];
-    then
-        export TAGS="${GITHUB_BASE_REF}-$GH_BUILD_NUMBER"
-    else
-        export TAGS="$GITHUB_BASE_REF-$GH_BUILD_NUMBER,$GITHUB_BASE_REF"
-    fi;
-fi;
-
-if [[ -n "$GITHUB_ACTIONS" ]]; then
-    echo "TAGS=$TAGS" >> $GITHUB_ENV;
-fi
-echo "$TAGS"
--- a/scripts/github/release/release-storybook-docker.sh
+++ b/scripts/github/release/release-storybook-docker.sh
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $DIR/../../../
-
-echo "ℹ️ storybook-shell: Running the docker with tag" $TAGS
-
-DOCKER_PROJECT_ARGS="PROJECT_NAME=storybook/stories"
-
-echo "{}" > $DIR/../../../dist/storybook/stories/app.config.json
-
-# Publish Image to docker
-./node_modules/@alfresco/adf-cli/bin/adf-cli docker \
-    --loginCheck \
-    --loginUsername "$DOCKER_REPOSITORY_USER" \
-    --loginPassword "$DOCKER_REPOSITORY_PASSWORD" \
-    --loginRepo "$DOCKER_REPOSITORY_DOMAIN" \
-    --dockerRepo "$DOCKER_REPOSITORY_STORYBOOK" \
-    --buildArgs "$DOCKER_PROJECT_ARGS" \
-    --dockerTags "$TAGS" \
-    --pathProject "$(pwd)" \
-    "$@"
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -39,7 +39,7 @@ LICENSE_GREP_RESULT=`grep "$LICENSE_GREP" "$LICENSE_README"`;
 if [ -z "$LICENSE_GREP_RESULT" ];
 then
    echo -e "\e[33mAdding third party license info for version: $VERSION\e[0m"
-    npx @alfresco/adf-cli licenses
+    adf-cli licenses
    mv "$ROOTDIR/license-info-$VERSION.md" "$ROOTDIR/docs/license-info/license-info-$VERSION.md"
    echo $LICENSE_ROW >> $LICENSE_README
 else
@@ -54,7 +54,7 @@ VULNERABILITY_GREP_RESULT=`grep "$VULNERABILITY_GREP" "$VULNERABILITY_README"`;
 if [ -z "$VULNERABILITY_GREP_RESULT" ];
 then
    echo -e "\e[33mAdding vulnerability info for version: $VERSION\e[0m"
-    npx @alfresco/adf-cli@alpha audit
+    adf-cli audit
    mv "$ROOTDIR/audit-info-$VERSION.md" "$ROOTDIR/docs/vulnerability/audit-info-$VERSION.md"
    echo $VULNERABILITY_ROW >> $VULNERABILITY_README
 else