Merge branch 'main' into main

.github/pull_request_template.md

@@ -1,4 +1,4 @@
-This repository contains configuration for what users see when they click on the `Actions` tab.
+This repository contains configuration for what users see when they click on the `Actions` tab and the setup page for Code Scanning.
 
 It is not:
 * A playground to try out scripts
@@ -6,7 +6,7 @@ It is not:
 
 ---
 
-**Please note that we are not accepting new starter workflows at this time. Updates to existing starter workflows are fine.**
+**Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.**
 
 ---
 
@@ -21,16 +21,17 @@ In the workflow and properties files:
 - [ ] Include comments in the workflow for any parts that are not obvious or could use clarification.
 - [ ] CI workflows should run on `push` to `branches: [ $default-branch ]` and `pull_request` to `branches: [ $default-branch ]`.
 - [ ] Packaging workflows should run on `release` with `types: [ created ]`.
+- [ ] Code Scanning workflows should run on `push` to `branches: [ $default-branch, $protected-branches ]` and `pull_request` to `branches: [ $default-branch ]`. We also recommend a `schedule` trigger of `cron: $cron-weekly`.
 
 Some general notes:
 
 - [ ] This workflow must only use actions that are produced by GitHub, [in the `actions` organization](https://github.com/actions), **or**
-- [ ] This workflow must only use actions that are produced by the language or ecosystem that the workflow supports.  These actions must be [published to the GitHub Marketplace](https://github.com/marketplace?type=actions).  Workflows using these actions must reference the action using the full 40 character hash of the action's commit instead of a tag.  Additionally, workflows must include the following comment at the top of the workflow file:
+- [ ] This workflow must only use actions that are produced by the language or ecosystem that the workflow supports.  These actions must be [published to the GitHub Marketplace](https://github.com/marketplace?type=actions).  We recommend that these actions be referenced using the full 40 character hash of the action's commit instead of a tag.  Additionally, workflows must include the following comment at the top of the workflow file:
     ```
     # This workflow uses actions that are not certified by GitHub.
     # They are provided by a third-party and are governed by
     # separate terms of service, privacy policy, and support
     # documentation.
     ```
-- [ ] This workflow must not send data to any 3rd party service except for the purposes of installing dependencies.
-- [ ] This workflow must not use a paid service or product.
+- [ ] Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
+- [ ] Automation and CI workflows cannot be dependent on a paid service or product.

.github/workflows/label-feature.yml

@@ -0,0 +1,19 @@
+name: Close as a feature
+on:
+  issues:
+    types: [labeled]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Close Issue
+      uses: peter-evans/close-issue@v1
+      if: contains(github.event.issue.labels.*.name, 'feature')
+      with:
+        comment: |
+          Thank you 🙇 for this request. This request has been classified as a feature by the maintainers.
+          
+          We take all the requests for features seriously and have passed this on to the internal teams for their consideration.
+          
+          Because any feature requires further maintenance and support in the long term by this team, we would like to exercise caution into adding new features. If this feature is something that can be implemented independently, please consider forking this repository and adding the feature.

.github/workflows/stale.yml

@@ -0,0 +1,20 @@
+name: Mark stale issues and pull requests
+
+on:
+  schedule:
+  - cron: "21 4 * * *"
+
+jobs:
+  stale:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/stale@v3
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        stale-issue-message: 'This issue has become stale and will be closed automatically within a period of time. Sorry about that.'
+        stale-pr-message: 'This pull request has become stale and will be closed automatically within a period of time. Sorry about that.'
+        stale-issue-label: 'no-issue-activity'
+        stale-pr-label: 'no-pr-activity'
+        days-before-stale: 90 

CODEOWNERS

@@ -0,0 +1,3 @@
+* @actions/actions-experience
+
+/code-scanning/ @actions/advanced-security-code-scanning

CONTRIBUTING.md

@@ -9,7 +9,7 @@ Contributions to this project are [released](https://help.github.com/articles/gi
 Please note that this project is released with a [Contributor Code of Conduct](
 https://github.com/actions/.github/blob/main/CODE_OF_CONDUCT.md). By participating in this project you agree to abide by its terms.
 
-**At this time we are not accepting any new starter workflows**
+**At this time we are only accepting new starter workflows for Code Scanning**
 
 ### Previous guidelines for new starter workflows.
 
@@ -17,8 +17,8 @@ Before merging a new workflow, the following requirements need to be met:
 
 - Should be as simple as is needed for the service.
 - There are many programming languages and tools out there. Right now we don't have a page that allows for a really large number of workflows, so we do have to be a little choosy about what we accept. Less popular tools or languages might not be accepted.
-- Should not send data to any 3rd party service except for the purposes of installing dependencies.
-- Cannot use an Action that isn't in the `actions` organization.
-- Cannot be to a paid service or product.
+- Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
+- Automation and CI workflows cannot be dependent on a paid service or product.
+- We recommend that Actions outside of the `actions` organization be pinned to a specific SHA.
 
 Thank you

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 GitHub
+Copyright (c) 2020 GitHub
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -18,4 +18,5 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE. THIS LICENSE DOES NOT GRANT YOU RIGHTS TO USE ANY CONTRIBUTORS'
+NAME, LOGO, OR TRADEMARKS.

README.md

@@ -13,11 +13,12 @@ These are the workflow files for helping people get started with GitHub Actions.
 **Directory structure:**
 * [ci](ci): solutions for Continuous Integration
 * [automation](automation): solutions for automating workflows.
+* [code-scanning](code-scanning): starter workflows for [Code Scanning](https://github.com/features/security)
 * [icons](icons): svg icons for the relevant template
 
 Each workflow must be written in YAML and have a `.yml` extension. They also need a corresponding `.properties.json` file that contains extra metadata about the workflow (this is displayed in the GitHub.com UI).
 
-For example: `ci/python-django.yml` and `ci/properties/python-django.properties.json`.
+For example: `ci/django.yml` and `ci/properties/django.properties.json`.
 
 **Valid properties:**
 * `name`: the name shown in onboarding

automation/properties/manual.properties.json

@@ -1,6 +1,6 @@
 {
     "name": "Manual workflow",
     "description": "Simple workflow that is manually triggered.",
-    "iconName": "blank",
+    "iconName": "octicon person",
     "categories": ["Automation"]
 }

automation/stale.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/stale@v1
+    - uses: actions/stale@v3
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'Stale issue message'

ci/android.yml

@@ -17,5 +17,7 @@ jobs:
       uses: actions/setup-java@v1
       with:
         java-version: 1.8
+    - name: Grant execute permission for gradlew
+      run: chmod +x gradlew
     - name: Build with Gradle
       run: ./gradlew build

ci/azure.yml

@@ -5,10 +5,13 @@
 #
 # To configure this workflow:
 #
-# 1. Set up a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE with the value of your Azure publish profile.
+# 1. For Linux apps, add an app setting called WEBSITE_WEBDEPLOY_USE_SCM and set it to true in your app **before downloading the file**.
+#      For more instructions see: https://docs.microsoft.com/azure/app-service/configure-common#configure-app-settings
+#
+# 2. Set up a secret in your repository named AZURE_WEBAPP_PUBLISH_PROFILE with the value of your Azure publish profile.
 #    For instructions on obtaining the publish profile see: https://docs.microsoft.com/azure/app-service/deploy-github-actions#configure-the-github-secret
 #
-# 2. Change the values for the AZURE_WEBAPP_NAME, AZURE_WEBAPP_PACKAGE_PATH and NODE_VERSION environment variables  (below).
+# 3. Change the values for the AZURE_WEBAPP_NAME, AZURE_WEBAPP_PACKAGE_PATH and NODE_VERSION environment variables  (below).
 #
 # For more information on GitHub Actions for Azure, refer to https://github.com/Azure/Actions
 # For more samples to get started with GitHub Action workflows to deploy to Azure, refer to https://github.com/Azure/actions-workflow-samples

ci/blank.yml

@@ -2,14 +2,17 @@
 
 name: CI
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the $default-branch branch
+# Controls when the action will run. 
 on:
+  # Triggers the workflow on push or pull request events but only for the $default-branch branch
   push:
     branches: [ $default-branch ]
   pull_request:
     branches: [ $default-branch ]
 
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
   # This workflow contains a single job called "build"

ci/dart.yml

@@ -1,4 +1,4 @@
-name: Dart CI
+name: Dart
 
 on:
   push:
@@ -8,15 +8,34 @@ on:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
+    # Note that this workflow uses the latest stable version of the Dart SDK.
+    # Docker images for other release channels - like dev and beta - are also
+    # available. See https://hub.docker.com/r/google/dart/ for the available
+    # images.
     container:
       image:  google/dart:latest
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Install dependencies
-      run: pub get
-    - name: Run tests
-      run: pub run test
+      - uses: actions/checkout@v2
+
+      - name: Print Dart SDK version
+        run: dart --version
+
+      - name: Install dependencies
+        run: dart pub get
+
+      # Uncomment this step to verify the use of 'dart format' on each commit.
+      # - name: Verify formatting
+      #   run: dart format --output=none --set-exit-if-changed .
+
+      # Consider passing '--fatal-infos' for slightly stricter analysis.
+      - name: Analyze project source
+        run: dart analyze
+
+      # Your project will need to have tests in test/ and a dependency on
+      # package:test for this step to succeed. Note that Flutter projects will
+      # want to change this to 'flutter test'.
+      - name: Run tests
+        run: dart test

ci/django.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       max-parallel: 4
       matrix:
-        python-version: [3.6, 3.7, 3.8]
+        python-version: [3.7, 3.8, 3.9]
 
     steps:
     - uses: actions/checkout@v2

ci/docker-publish.yml

@@ -50,13 +50,12 @@ jobs:
       - name: Build image
         run: docker build . --file Dockerfile --tag $IMAGE_NAME
 
-      - name: Log into GitHub Container Registry
-      # TODO: Create a PAT with `read:packages` and `write:packages` scopes and save it as an Actions secret `CR_PAT`
-        run: echo "${{ secrets.CR_PAT }}" | docker login https://ghcr.io -u ${{ github.actor }} --password-stdin
+      - name: Log into registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login docker.pkg.github.com -u ${{ github.actor }} --password-stdin
 
-      - name: Push image to GitHub Container Registry
+      - name: Push image
         run: |
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID=docker.pkg.github.com/${{ github.repository }}/$IMAGE_NAME
 
           # Change all uppercase to lowercase
           IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')

ci/dotnet.yml

@@ -1,4 +1,4 @@
-name: .NET Core
+name: .NET
 
 on:
   push:
@@ -13,13 +13,13 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Setup .NET Core
+    - name: Setup .NET
       uses: actions/setup-dotnet@v1
       with:
         dotnet-version: 3.1.301
-    - name: Install dependencies
+    - name: Restore dependencies
       run: dotnet restore
     - name: Build
-      run: dotnet build --configuration Release --no-restore
+      run: dotnet build --no-restore
     - name: Test
-      run: dotnet test --no-restore --verbosity normal
+      run: dotnet test --no-build --verbosity normal

ci/go.yml

@@ -30,7 +30,7 @@ jobs:
         fi
 
     - name: Build
-      run: go build -v .
+      run: go build -v ./...
 
     - name: Test
-      run: go test -v .
+      run: go test -v ./...

ci/google.yml

@@ -8,7 +8,7 @@
 #
 # 3. Change the values for the GKE_ZONE, GKE_CLUSTER, IMAGE, and DEPLOYMENT_NAME environment variables (below).
 #
-# For more support on how to run the workflow, please visit https://github.com/GoogleCloudPlatform/github-actions/tree/master/example-workflows/gke
+# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke
 
 name: Build and Deploy to GKE
 
@@ -33,7 +33,7 @@ jobs:
       uses: actions/checkout@v2
 
     # Setup gcloud CLI
-    - uses: GoogleCloudPlatform/github-actions/setup-gcloud@0.1.3
+    - uses: google-github-actions/setup-gcloud@v0.2.0
       with:
         service_account_key: ${{ secrets.GKE_SA_KEY }}
         project_id: ${{ secrets.GKE_PROJECT }}
@@ -44,8 +44,11 @@ jobs:
         gcloud --quiet auth configure-docker
 
     # Get the GKE credentials so we can deploy to the cluster
-    - run: |-
-        gcloud container clusters get-credentials "$GKE_CLUSTER" --zone "$GKE_ZONE"
+    - uses: google-github-actions/[email protected]
+      with:
+        cluster_name: ${{ env.GKE_CLUSTER }}
+        location: ${{ env.GKE_ZONE }}
+        credentials: ${{ secrets.GKE_SA_KEY }}
 
     # Build the Docker image
     - name: Build

ci/haskell.yml

@@ -15,8 +15,8 @@ jobs:
     - uses: actions/checkout@v2
     - uses: actions/setup-haskell@v1
       with:
-        ghc-version: '8.8.2'
-        cabal-version: '3.0'
+        ghc-version: '8.10.3'
+        cabal-version: '3.2'
 
     - name: Cache
       uses: actions/cache@v1

ci/laravel.yml

@@ -12,6 +12,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+    - uses: shivammathur/setup-php@b7d1d9c9a92d8d8463ce36d7f60da34d461724f8
+      with:
+        php-version: '8.0'
     - uses: actions/checkout@v2
     - name: Copy .env
       run: php -r "file_exists('.env') || copy('.env.example', '.env');"

ci/msbuild.yml

@@ -0,0 +1,32 @@
+name: MSBuild
+
+on: [push]
+
+env:
+  # Path to the solution file relative to the root of the project.
+  SOLUTION_FILE_PATH: .
+
+  # Configuration type to build.
+  # You can convert this to a build matrix if you need coverage of multiple configuration types.
+  # https://docs.github.com/actions/learn-github-actions/managing-complex-workflows#using-a-build-matrix
+  BUILD_CONFIGURATION: Release
+
+jobs:
+  build:
+    runs-on: windows-latest
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Add MSBuild to PATH
+      uses: microsoft/setup-msbuild@v1
+
+    - name: Restore NuGet packages
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      run: nuget restore ${{env.SOLUTION_FILE_PATH}}
+
+    - name: Build
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      # Add additional options to the MSBuild command line here (like platform or verbosity level).
+      # See https://docs.microsoft.com/visualstudio/msbuild/msbuild-command-line-reference
+      run: msbuild /m /p:Configuration=${{env.BUILD_CONFIGURATION}} ${{env.SOLUTION_FILE_PATH}}

ci/node.js.yml

@@ -16,7 +16,8 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [10.x, 12.x, 14.x]
+        node-version: [10.x, 12.x, 14.x, 15.x]
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:
     - uses: actions/checkout@v2

ci/openshift.yml

@@ -1,48 +1,152 @@
-# This workflow will set up the oc CLI in your GitHub Action workflow and deploy your application to your OpenShift cluster.
-#
-# This workflow assumes you already have access to an OpenShift cluster.
-# For instructions to get started with OpenShift see https://www.openshift.com/try
-#
-# To configure this workflow:
-#
-# 1. Set up a secret in your repository named OPENSHIFT_SERVER_URL with the value of your OpenShift server URL.
-# 
-# 2. Set up another secret named API_TOKEN with the value of a valid token to authenticate to OpenShift.
-#
-# 3. Change the values for the PROJECT and APP_NAME environment variables  (below).
-#
-# For more information on the OpenShift Action, refer to https://github.com/redhat-developer/openshift-actions
-name: Build and Deploy to OpenShift
-on:
-  push:
-    branches:
-      - $default-branch
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
 
-# Environment variables available to all jobs and steps in this workflow
+### The OpenShift Starter workflow will:
+# - Checkout your repository
+# - Perform a Docker build
+# - Push the built image to an image registry
+# - Log in to your OpenShift cluster
+# - Create an OpenShift app from the image and expose it to the internet.
+
+### Before you begin:
+# - Have write access to a container image registry such as quay.io or Dockerhub.
+# - Have access to an OpenShift cluster.
+#   - For instructions to get started with OpenShift see https://www.openshift.com/try
+# - The project you wish to add this workflow to should have a Dockerfile.
+#   - If you don't have a Dockerfile at the repository root, see the buildah-build step.
+#   - Builds from scratch are also available, but require more configuration.
+
+### To get the workflow running:
+# 1. Add this workflow to your repository.
+# 2. Edit the top-level 'env' section, which contains a list of environment variables that must be configured.
+# 3. Create the secrets referenced in the 'env' section under your repository Settings.
+# 4. Edit the 'branches' in the 'on' section to trigger the workflow on a push to your branch.
+# 5. Commit and push your changes.
+
+# For a more sophisticated example, see https://github.com/redhat-actions/spring-petclinic/blob/main/.github/workflows/petclinic-sample.yaml
+# Also see our GitHub organization, https://github.com/redhat-actions/
+
+name: OpenShift
+
+# ⬇️  Modify the fields marked with ⬇️ to fit your project, and create any secrets that are referenced.
+# https://docs.github.com/en/free-pro-team@latest/actions/reference/encrypted-secrets
 env:
-  PROJECT: myproject
-  APP_NAME: myapp
+  # ⬇️ EDIT with your registry and registry path.
+  REGISTRY: quay.io/<username>
+  # ⬇️ EDIT with your registry username.
+  REGISTRY_USER: <username>
+  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+
+  # ⬇️ EDIT to log into your OpenShift cluster and set up the context.
+  # See https://github.com/redhat-actions/oc-login#readme for how to retrieve these values.
+  OPENSHIFT_SERVER: ${{ secrets.OPENSHIFT_SERVER }}
+  OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
+
+  # ⬇️ EDIT with the port your application should be accessible on.
+  APP_PORT: 8080
+
+  # ⬇️ EDIT if you wish to set the kube context's namespace after login. Leave blank to use the default namespace.
+  OPENSHIFT_NAMESPACE: ""
+
+  # If you wish to manually provide the APP_NAME and TAG, set them here, otherwise they will be auto-detected.
+  APP_NAME: ""
+  TAG: ""
+
+on:
+  # https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
+  push:
+    # Edit to the branch(es) you want to build and deploy on each push.
+    branches: [ $default-branch ]
 
 jobs:
-  build:
-    name: Setup and Deploy
-    runs-on: ubuntu-latest
+  openshift-ci-cd:
+    name: Build and deploy to OpenShift
+    runs-on: ubuntu-20.04
 
     steps:
-    - name: Checkout
-      uses: actions/checkout@v2
+    - uses: actions/checkout@v2
 
-    # Set up the oc CLI, authenticate and deploy to OpenShift
-    - name: Set up oc CLI and deploy to OpenShift
-      uses: redhat-developer/[email protected]
-      with:
-        version: '4.3'
-        openshift_server_url: ${{ secrets.OPENSHIFT_SERVER_URL }}
-        parameters: '{"apitoken": "${{ secrets.API_TOKEN }}", "acceptUntrustedCerts": "true"}'
-        cmd: |
-          oc project ${PROJECT}
-          oc new-app ${GITHUB_WORKSPACE} --name ${APP_NAME}
-    # Expose the service created by using the oc CLI installed previously
-    - name: Execute additional oc commands
+    - name: Determine app name
+      if: env.APP_NAME == ''
       run: |
-        oc expose svc/${{ env.APP_NAME }}
+        echo "APP_NAME=$(basename $PWD)" | tee -a $GITHUB_ENV
+
+    - name: Determine tag
+      if: env.TAG == ''
+      run: |
+        echo "TAG=${GITHUB_SHA::7}" | tee -a $GITHUB_ENV
+
+    # https://github.com/redhat-actions/buildah-build#readme
+    - name: Build from Dockerfile
+      uses: redhat-actions/buildah-build@v1
+      with:
+        image: ${{ env.APP_NAME }}
+        tag: ${{ env.TAG }}
+        # If you don't have a dockerfile, see:
+        # https://github.com/redhat-actions/buildah-build#building-from-scratch
+        # Otherwise, point this to your Dockerfile relative to the repository root.
+        dockerfiles: |
+          ./Dockerfile
+
+    # https://github.com/redhat-actions/push-to-registry#readme
+    - name: Push to registry
+      id: push-to-registry
+      uses: redhat-actions/push-to-registry@v1
+      with:
+        image: ${{ env.APP_NAME }}
+        tag: ${{ env.TAG }}
+        registry: ${{ env.REGISTRY }}
+        username: ${{ env.REGISTRY_USER }}
+        password: ${{ env.REGISTRY_PASSWORD }}
+
+    # The path the image was pushed to is now stored in ${{ steps.push-to-registry.outputs.registry-path }}
+
+    # oc-login works on all platforms, but oc must be installed first.
+    # The GitHub Ubuntu runner already includes oc.
+    # Otherwise, https://github.com/redhat-actions/oc-installer#readme is available.
+
+    # https://github.com/redhat-actions/oc-login#readme
+    - name: Log in to OpenShift
+      uses: redhat-actions/oc-login@v1
+      with:
+        openshift_server_url: ${{ env.OPENSHIFT_SERVER }}
+        openshift_token: ${{ env.OPENSHIFT_TOKEN }}
+        insecure_skip_tls_verify: true
+        namespace: ${{ env.OPENSHIFT_NAMESPACE }}
+
+    # This step should create a deployment, service, and route to run your app and expose it to the internet.
+    # Feel free to replace this with 'oc apply', 'helm install', or however you like to deploy your app.
+    - name: Create and expose app
+      run: |
+        export IMAGE="${{ steps.push-to-registry.outputs.registry-path }}"
+        export PORT=${{ env.APP_PORT }}
+
+        export SELECTOR="app=${{ env.APP_NAME }}"
+        echo "SELECTOR=$SELECTOR" >> $GITHUB_ENV
+
+        set -x
+        # Take down any old deployment
+        oc delete all --selector="$SELECTOR"
+        oc new-app --name $APP_NAME --docker-image="$IMAGE"
+
+        # Make sure the app port is exposed
+        oc patch svc $APP_NAME -p "{ \"spec\": { \"ports\": [{ \"name\": \"$PORT-tcp\", \"port\": $PORT }] } }"
+        oc expose service $APP_NAME --port=$PORT
+
+        oc get all --selector="$SELECTOR"
+        set +x
+
+        export ROUTE="$(oc get route $APP_NAME -o jsonpath='{.spec.host}')"
+        echo "$APP_NAME is exposed at $ROUTE"
+        echo "ROUTE=$ROUTE" >> $GITHUB_ENV
+
+    - name: View application route
+      run: |
+        [[ -n ${{ env.ROUTE }} ]] || (echo "Determining application route failed in previous step"; exit 1)
+        echo "======================== Your application is available at: ========================"
+        echo ${{ env.ROUTE }}
+        echo "==================================================================================="
+        echo
+        echo "Your app can be taken down with: \"oc delete all --selector='${{ env.SELECTOR }}'\""

ci/properties/dotnet-core.properties.json

@@ -1,6 +0,0 @@
-{
-    "name": ".NET Core",
-    "description": "Build and test a .NET Core or ASP.NET Core project.",
-    "iconName": "dotnetcore",
-    "categories": ["C#", "F#", "Visual Basic", "ASP", "ASP.NET", ".NET"]
-}

ci/properties/dotnet-desktop.properties.json

@@ -1,6 +1,6 @@
 {
-    "name": ".NET Core Desktop",
-    "description": "Build, test, sign and publish a desktop application built on .NET Core.",
-    "iconName": "dotnetcore",
+    "name": ".NET Desktop",
+    "description": "Build, test, sign and publish a desktop application built on .NET.",
+    "iconName": "dotnet",
     "categories": ["C#", "Visual Basic", "WPF", ".NET"]
 }

ci/properties/dotnet.properties.json

@@ -0,0 +1,6 @@
+{
+    "name": ".NET",
+    "description": "Build and test a .NET or ASP.NET Core project.",
+    "iconName": "dotnet",
+    "categories": ["C#", "F#", "Visual Basic", "ASP", "ASP.NET", ".NET"]
+}

ci/properties/msbuild.properties.json

@@ -0,0 +1,6 @@
+{
+    "name": "MSBuild based projects",
+    "description": "Build a MSBuild based project.",
+    "iconName": "c-cpp",
+    "categories": ["C", "C++"]
+}

ci/properties/openshift.properties.json

@@ -1,7 +1,7 @@
 {
     "name": "OpenShift",
-    "description": "Set up the oc CLI in your GitHub Actions workflow and deploy your application to OpenShift.",
+    "description": "Build a Docker-based project and deploy it to OpenShift.",
     "creator": "Red Hat",
     "iconName": "openshift",
-    "categories": null
-}
+    "categories": [ "Dockerfile" ]
+}

ci/python-app.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up Python 3.8
+    - name: Set up Python 3.9
       uses: actions/setup-python@v2
       with:
-        python-version: 3.8
+        python-version: 3.9
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip

ci/python-package-conda.yml

@@ -14,18 +14,21 @@ jobs:
       uses: actions/setup-python@v2
       with:
         python-version: 3.8
-    - name: Install dependencies
+    - name: Add conda to system path
       run: |
         # $CONDA is an environment variable pointing to the root of the miniconda directory
-        $CONDA/bin/conda env update --file environment.yml --name base
+        echo $CONDA/bin >> $GITHUB_PATH
+    - name: Install dependencies
+      run: |
+        conda env update --file environment.yml --name base
     - name: Lint with flake8
       run: |
-        $CONDA/bin/conda install flake8
+        conda install flake8
         # stop the build if there are Python syntax errors or undefined names
-        $CONDA/bin/flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
+        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
         # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        $CONDA/bin/flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
     - name: Test with pytest
       run: |
         conda install pytest
-        $CONDA/bin/pytest
+        pytest

ci/python-package.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [3.5, 3.6, 3.7, 3.8]
+        python-version: [3.7, 3.8, 3.9]
 
     steps:
     - uses: actions/checkout@v2
@@ -26,7 +26,7 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install flake8 pytest
+        python -m pip install flake8 pytest
         if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
     - name: Lint with flake8
       run: |

ci/ruby.yml

@@ -24,7 +24,7 @@ jobs:
     # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby,
     # change this to (see https://github.com/ruby/setup-ruby#versioning):
     # uses: ruby/setup-ruby@v1
-      uses: ruby/setup-ruby@ec106b438a1ff6ff109590de34ddc62c540232e0
+      uses: ruby/setup-ruby@21351ecc0a7c196081abca5dc55b08f085efe09a
       with:
         ruby-version: 2.6
     - name: Install dependencies

code-scanning/codeql.yml

@@ -0,0 +1,67 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ $default-branch ]
+  schedule:
+    - cron: $cron-weekly
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ $detected-codeql-languages ]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more:
+        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

code-scanning/properties/codeql.properties.json

@@ -0,0 +1,7 @@
+{
+    "name": "CodeQL Analysis",
+    "creator": "GitHub",
+    "description": "Security analysis from GitHub for C, C++, C#, Java, JavaScript, TypeScript, Python, and Go developers.",
+    "iconName": "octicon mark-github",
+    "categories": ["Code Scanning", "C", "C#", "C++", "Go", "Java", "JavaScript", "TypeScript", "Python"]
+}

icons/dotnetcore.svg

@@ -1 +0,0 @@
-<svg fill="none" height="48" width="48" xmlns="http://www.w3.org/2000/svg"><path d="M24 48c13.255 0 24-10.745 24-24S37.255 0 24 0 0 10.745 0 24s10.745 24 24 24z" fill="#5c2d91"/><g fill="#fff"><path d="M7.923 6.657a23.67 23.67 0 1033.42 33.42z" opacity=".1"/><path d="M6.133 27.554a.999.999 0 01-.74-.31 1.02 1.02 0 01-.303-.74 1.036 1.036 0 01.303-.74.991.991 0 01.74-.318 1.013 1.013 0 01.74.318 1.028 1.028 0 01.31.74 1.013 1.013 0 01-.31.74 1.02 1.02 0 01-.74.31zM20.83 27.369h-1.937l-6.931-10.755a4.438 4.438 0 01-.43-.844h-.059c.066.615.09 1.232.074 1.85v9.749H9.972V13.884h2.049l6.746 10.563c.28.44.463.74.547.903h.037a14.26 14.26 0 01-.096-1.983v-9.483h1.576zM31.497 27.369H24.33V13.884h6.835v1.428h-5.222v4.482h4.867v1.42h-4.867v4.676h5.563zM42.082 15.312h-3.92v12.057h-1.576V15.312H32.71v-1.428h9.372z"/></g><path d="M19.98 36.541a3.647 3.647 0 01-1.716.363 2.766 2.766 0 01-2.123-.85 3.151 3.151 0 01-.799-2.22 3.3 3.3 0 01.895-2.411 3.048 3.048 0 012.278-.918c.506-.017 1.01.071 1.48.26v.739a2.959 2.959 0 00-1.48-.37 2.263 2.263 0 00-1.738.74c-.461.525-.7 1.21-.666 1.908a2.567 2.567 0 00.622 1.813 2.116 2.116 0 001.634.673 3.062 3.062 0 001.62-.415zM23.005 36.904a2.056 2.056 0 01-1.575-.658 2.3 2.3 0 01-.585-1.65 2.397 2.397 0 01.614-1.746 2.22 2.22 0 011.65-.628 1.99 1.99 0 011.546.613c.393.474.591 1.08.555 1.694a2.382 2.382 0 01-.6 1.702 2.1 2.1 0 01-1.605.673zm.052-4.046a1.354 1.354 0 00-1.08.466 1.916 1.916 0 00-.4 1.287c-.025.45.117.892.4 1.242a1.369 1.369 0 001.08.46 1.302 1.302 0 001.058-.445c.269-.367.4-.818.37-1.272.029-.457-.102-.91-.37-1.28a1.294 1.294 0 00-1.058-.458zM28.664 33.08a.873.873 0 00-.54-.141.91.91 0 00-.74.429c-.22.349-.326.757-.303 1.169V36.8h-.74v-4.438h.74v.925c.081-.286.243-.543.466-.74.193-.167.44-.26.695-.259.143-.006.286.014.422.06zM32.999 34.766h-3.13c-.02.414.114.82.378 1.14a1.376 1.376 0 001.05.399 2.22 2.22 0 001.376-.496v.666c-.457.301-.999.449-1.546.421a1.879 1.879 0 01-1.48-.606 2.478 2.478 0 01-.54-1.701 2.426 2.426 0 01.585-1.687 1.886 1.886 0 011.48-.65 1.672 1.672 0 011.346.561c.34.45.509 1.006.473 1.568zm-.74-.599a1.48 1.48 0 00-.296-.954 1.013 1.013 0 00-.813-.34 1.147 1.147 0 00-.851.362 1.635 1.635 0 00-.437.94z" fill="#f2f2f2"/></svg>

script/validate-data/package-lock.json

@@ -5,9 +5,9 @@
   "requires": true,
   "dependencies": {
     "@actions/core": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.4.tgz",
-      "integrity": "sha512-YJCEq8BE3CdN8+7HPZ/4DxJjk/OkZV2FFIf+DlZTC/4iBlzYCD5yjRR6eiOS5llO11zbRltIRuKAjMKaWTE6cg=="
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
+      "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
     },
     "@types/js-yaml": {
       "version": "3.12.4",

script/validate-data/package.json

@@ -14,7 +14,7 @@
     "typescript": "^3.9.2"
   },
   "dependencies": {
-    "@actions/core": "^1.2.4",
+    "@actions/core": "^1.2.6",
     "js-yaml": "^3.13.1",
     "jsonschema": "^1.2.6"
   }