adding category in the template property file (#1094)

Update OpenShift workflow to use GHCR by default (#6)

.github/labeler.yml

@@ -0,0 +1,3 @@
+# Add 'code-scanning' label to any changes within 'code-scanning' folder or any subfolders
+code-scanning:
+- code-scanning/**/*

.github/pull_request_template.md

@@ -1,32 +1,55 @@
+<!--
+IMPORTANT:
+
 This repository contains configuration for what users see when they click on the `Actions` tab and the setup page for Code Scanning.
 
 It is not:
 * A playground to try out scripts
 * A place for you to create a workflow for your repository
+-->
+
+## Pre-requisites
+
+- [ ] Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: [partner.github.com/apply](https://partner.github.com/apply?partnershipType=Technology+Partner).
 
 ---
 
-**Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.**
+### **Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.**
 
 ---
 
-In the workflow and properties files:
+## Tasks
 
-- [ ] The workflow filename of CI workflows should be the name of the language or platform, in lower case.  Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
+**For _all_ workflows, the workflow:**
 
-  The workflow filename of publishing workflows should be the name of the language or platform, in lower case, followed by "-publish".
-- [ ] Includes a matching `ci/properties/*.properties.json` file.
-- [ ] Use sentence case for the names of workflows and steps, for example "Run tests".
-- [ ] The name of CI workflows should only be the name of the language or platform: for example "Go" (not "Go CI" or "Go Build")
-- [ ] Include comments in the workflow for any parts that are not obvious or could use clarification.
-- [ ] CI workflows should run on `push` to `branches: [ $default-branch ]` and `pull_request` to `branches: [ $default-branch ]`.
+- [ ] Should be contained in a `.yml` file with the language or platform as its filename, in lower, [_kebab-cased_](https://en.wikipedia.org/wiki/Kebab_case) format (for example, [`docker-image.yml`](https://github.com/actions/starter-workflows/blob/main/ci/docker-image.yml)).  Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
+- [ ] Should use sentence case for the names of workflows and steps (for example, "Run tests").
+- [ ] Should be named _only_ by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
+- [ ] Should include comments in the workflow for any parts that are not obvious or could use clarification.
+
+**For _CI_ workflows, the workflow:**
+
+- [ ] Should be preserved under [the `ci` directory](https://github.com/actions/starter-workflows/tree/main/ci).
+- [ ] Should include a matching `ci/properties/*.properties.json` file (for example, [`ci/properties/docker-publish.properties.json`](https://github.com/actions/starter-workflows/blob/main/ci/properties/docker-publish.properties.json)).
+- [ ] Should run on `push` to `branches: [ $default-branch ]` and `pull_request` to `branches: [ $default-branch ]`.
 - [ ] Packaging workflows should run on `release` with `types: [ created ]`.
-- [ ] Code Scanning workflows should run on `push` to `branches: [ $default-branch, $protected-branches ]` and `pull_request` to `branches: [ $default-branch ]`. We also recommend a `schedule` trigger of `cron: $cron-weekly`.
+- [ ] Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, [`docker-publish.yml`](https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml)).
 
-Some general notes:
+**For _Code Scanning_ workflows, the workflow:**
 
-- [ ] This workflow must only use actions that are produced by GitHub, [in the `actions` organization](https://github.com/actions), **or**
-- [ ] This workflow must only use actions that are produced by the language or ecosystem that the workflow supports.  These actions must be [published to the GitHub Marketplace](https://github.com/marketplace?type=actions).  We recommend that these actions be referenced using the full 40 character hash of the action's commit instead of a tag.  Additionally, workflows must include the following comment at the top of the workflow file:
+- [ ] Should be preserved under [the `code-scanning` directory](https://github.com/actions/starter-workflows/tree/main/ci).
+- [ ] Should include a matching `code-scanning/properties/*.properties.json` file (for example, [`code-scanning/properties/codeql.properties.json`](https://github.com/actions/starter-workflows/blob/main/code-scanning/properties/codeql.properties.json)), with properties set as follows:
+  - [ ] `name`: Name of the Code Scanning integration.
+  - [ ] `organization`: Name of the organization producing the Code Scanning integration.
+  - [ ] `description`: Short description of the Code Scanning integration.
+  - [ ] `categories`: Array of languages supported by the Code Scanning integration.
+  - [ ] `iconName`: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in [the `icons` directory](https://github.com/actions/starter-workflows/tree/main/icons).
+- [ ] Should run on `push` to `branches: [ $default-branch, $protected-branches ]` and `pull_request` to `branches: [ $default-branch ]`. We also recommend a `schedule` trigger of `cron: $cron-weekly` (for example, [`codeql.yml`](https://github.com/actions/starter-workflows/blob/c59b62dee0eae1f9f368b7011cf05c2fc42cf084/code-scanning/codeql.yml#L14-L21)).
+
+**Some general notes:**
+
+- [ ] This workflow must _only_ use actions that are produced by GitHub, [in the `actions` organization](https://github.com/actions), **or**
+- [ ] This workflow must _only_ use actions that are produced by the language or ecosystem that the workflow supports.  These actions must be [published to the GitHub Marketplace](https://github.com/marketplace?type=actions).  We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag.  Additionally, workflows must include the following comment at the top of the workflow file:
     ```
     # This workflow uses actions that are not certified by GitHub.
     # They are provided by a third-party and are governed by

.github/workflows/label-feature.yml

@@ -5,6 +5,8 @@ on:
 
 jobs:
   build:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
     - name: Close Issue

.github/workflows/label-support.yml

@@ -5,6 +5,8 @@ on:
 
 jobs:
   build:
+    permissions:
+      issues: write
     runs-on: ubuntu-latest
     steps:
     - name: Close Issue

.github/workflows/labeler-triage.yml

@@ -0,0 +1,16 @@
+name: "Pull Request Labeler"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+on:
+- pull_request_target
+
+jobs:
+  triage:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/labeler@v3
+      with:
+        repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/stale.yml

@@ -7,12 +7,14 @@ on:
 jobs:
   stale:
 
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
 
     steps:
     - uses: actions/stale@v3
       with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'This issue has become stale and will be closed automatically within a period of time. Sorry about that.'
         stale-pr-message: 'This pull request has become stale and will be closed automatically within a period of time. Sorry about that.'
         stale-issue-label: 'no-issue-activity'

.github/workflows/sync_ghes.yaml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   sync:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
@@ -14,7 +16,7 @@ jobs:
         git fetch --no-tags --prune --depth=1 origin +refs/heads/*:refs/remotes/origin/*
         git config user.email "cschleiden@github.com"
         git config user.name "GitHub Actions"
-    - uses: actions/setup-node@v1
+    - uses: actions/setup-node@v2
       with:
         node-version: '12'
     - name: Check starter workflows for GHES compat

.github/workflows/validate-data.yaml

@@ -6,11 +6,13 @@ on:
 
 jobs:
   validate-data:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
 
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v2
         with:
           node-version: "12"
 

CODEOWNERS

@@ -1,3 +1,3 @@
-* @actions/actions-experience
+* @actions/starter-workflows
 
 /code-scanning/ @actions/advanced-security-code-scanning

CONTRIBUTING.md

@@ -19,6 +19,6 @@ Before merging a new workflow, the following requirements need to be met:
 - There are many programming languages and tools out there. Right now we don't have a page that allows for a really large number of workflows, so we do have to be a little choosy about what we accept. Less popular tools or languages might not be accepted.
 - Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
 - Automation and CI workflows cannot be dependent on a paid service or product.
-- We recommend that Actions outside of the `actions` organization be pinned to a specific SHA.
+- We require that Actions outside of the `actions` organization be pinned to a specific SHA.
 
 Thank you

README.md

@@ -10,8 +10,9 @@ These are the workflow files for helping people get started with GitHub Actions.
 
 <img src="https://d3vv6lp55qjaqc.cloudfront.net/items/353A3p3Y2x3c2t2N0c01/Image%202019-08-27%20at%203.25.07%20PM.png" max-width="75%"/>
 
-**Directory structure:**
-* [ci](ci): solutions for Continuous Integration
+### Directory structure
+
+* [ci](ci): solutions for Continuous Integration and Deployments
 * [automation](automation): solutions for automating workflows.
 * [code-scanning](code-scanning): starter workflows for [Code Scanning](https://github.com/features/security)
 * [icons](icons): svg icons for the relevant template
@@ -20,8 +21,28 @@ Each workflow must be written in YAML and have a `.yml` extension. They also nee
 
 For example: `ci/django.yml` and `ci/properties/django.properties.json`.
 
-**Valid properties:**
-* `name`: the name shown in onboarding
+### Valid properties
+
+* `name`: the name shown in onboarding. This property is unique within the repository.
 * `description`: the description shown in onboarding
-* `iconName`: the icon name in the relevant folder, for example `django` should have an icon `icons/django.svg`. Only SVG is supported at this time
-* `categories`: the categories that it will be shown under
+* `iconName`: the icon name in the relevant folder, for example, `django` should have an icon `icons/django.svg`. Only SVG is supported at this time. Another option is to use [octicon](https://primer.style/octicons/). The format to use an octicon is `octicon <<icon name>>`. Example: `octicon person`
+* `creator`: creator of the template shown in onboarding. All the workflow templates from an author will have the same `creator` field.
+* `categories`: the categories that it will be shown under. Choose at least one category from the list [here](#categories). Further, choose the categories from the list of languages available [here](https://github.com/github/linguist/blob/master/lib/linguist/languages.yml). When a user views the available templates, those templates that match the same language will feature more prominently.
+
+### Categories
+* continuous-integration
+* deployment
+* testing
+* code-quality
+* code-review
+* dependency-management
+* monitoring
+* Automation
+* utilities
+
+### Variables
+These variables can be placed in the starter workflow and will be substituted as detailed below:
+
+* `$default-branch`: will substitute the branch from the repository, for example `main` and `master`
+* `$protected-branches`: will substitue any protected branches from the repository.
+* `$cron-daily`: will substitute a valid but random time within the day

automation/greetings.yml

@@ -5,6 +5,9 @@ on: [pull_request, issues]
 jobs:
   greeting:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
     - uses: actions/first-interaction@v1
       with:

automation/label.yml

@@ -12,6 +12,9 @@ jobs:
   label:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
     - uses: actions/labeler@v2

automation/stale.yml

@@ -1,13 +1,21 @@
+# This workflow warns and then closes issues and PRs that have had no activity for a specified amount of time.
+#
+# You can adjust the behavior by modifying this file.
+# For more information, see:
+# https://github.com/actions/stale
 name: Mark stale issues and pull requests
 
 on:
   schedule:
-  - cron: "30 1 * * *"
+  - cron: $cron-daily
 
 jobs:
   stale:
 
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
 
     steps:
     - uses: actions/stale@v3

ci/android.yml

@@ -13,10 +13,13 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: set up JDK 11
+      uses: actions/setup-java@v2
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'adopt'
+        cache: gradle
+
     - name: Grant execute permission for gradlew
       run: chmod +x gradlew
     - name: Build with Gradle

ci/ant.yml

@@ -16,9 +16,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: Set up JDK 11
+      uses: actions/setup-java@v2
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'adopt'
     - name: Build with Ant
       run: ant -noinput -buildfile build.xml

ci/blank.yml

@@ -2,7 +2,7 @@
 
 name: CI
 
-# Controls when the action will run. 
+# Controls when the workflow will run
 on:
   # Triggers the workflow on push or pull request events but only for the $default-branch branch
   push:

ci/cmake.yml

@@ -1,6 +1,10 @@
 name: CMake
 
-on: [push]
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
 
 env:
   # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
@@ -17,30 +21,18 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
-    - name: Create Build Environment
-      # Some projects don't allow in-source building, so create a separate build directory
-      # We'll use this as our working directory for all subsequent commands
-      run: cmake -E make_directory ${{github.workspace}}/build
-
     - name: Configure CMake
-      # Use a bash shell so we can use the same syntax for environment variable
-      # access regardless of the host operating system
-      shell: bash
-      working-directory: ${{github.workspace}}/build
-      # Note the current convention is to use the -S and -B options here to specify source 
-      # and build directories, but this is only available with CMake 3.13 and higher.  
-      # The CMake binaries on the Github Actions machines are (as of this writing) 3.12
-      run: cmake $GITHUB_WORKSPACE -DCMAKE_BUILD_TYPE=$BUILD_TYPE
+      # Configure CMake in a 'build' subdirectory. `CMAKE_BUILD_TYPE` is only required if you are using a single-configuration generator such as make.
+      # See https://cmake.org/cmake/help/latest/variable/CMAKE_BUILD_TYPE.html?highlight=cmake_build_type
+      run: cmake -B ${{github.workspace}}/build -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}}
 
     - name: Build
-      working-directory: ${{github.workspace}}/build
-      shell: bash
-      # Execute the build.  You can specify a specific target with "--target <NAME>"
-      run: cmake --build . --config $BUILD_TYPE
+      # Build your program with the given configuration
+      run: cmake --build ${{github.workspace}}/build --config ${{env.BUILD_TYPE}}
 
     - name: Test
       working-directory: ${{github.workspace}}/build
-      shell: bash
       # Execute tests defined by the CMake configuration.  
       # See https://cmake.org/cmake/help/latest/manual/ctest.1.html for more detail
-      run: ctest -C $BUILD_TYPE
+      run: ctest -C ${{env.BUILD_TYPE}}
+      

ci/dart.yml

@@ -1,3 +1,8 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
 name: Dart
 
 on:
@@ -10,18 +15,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
-    # Note that this workflow uses the latest stable version of the Dart SDK.
-    # Docker images for other release channels - like dev and beta - are also
-    # available. See https://hub.docker.com/r/google/dart/ for the available
-    # images.
-    container:
-      image:  google/dart:latest
-
     steps:
       - uses: actions/checkout@v2
 
-      - name: Print Dart SDK version
-        run: dart --version
+      # Note: This workflow uses the latest stable version of the Dart SDK.
+      # You can specify other versions if desired, see documentation here:
+      # https://github.com/dart-lang/setup-dart/blob/main/README.md
+      # - uses: dart-lang/setup-dart@v1
+      - uses: dart-lang/setup-dart@9a04e6d73cca37bd455e0608d7e5092f881fd603
 
       - name: Install dependencies
         run: dart pub get

ci/deno.yml

@@ -3,8 +3,8 @@
 # separate terms of service, privacy policy, and support
 # documentation.
 
-# This workflow will install Deno and run tests across stable and nightly builds on Windows, Ubuntu and macOS.
-# For more information see: https://github.com/denolib/setup-deno
+# This workflow will install Deno then run Deno lint and test.
+# For more information see: https://github.com/denoland/setup-deno
 
 name: Deno
 
@@ -16,24 +16,24 @@ on:
 
 jobs:
   test:
-    runs-on: ${{ matrix.os }} # runs a test on Ubuntu, Windows and macOS
-
-    strategy:
-      matrix:
-        deno: ["v1.x", "nightly"]
-        os: [macOS-latest, windows-latest, ubuntu-latest]
+    runs-on: ubuntu-latest
 
     steps:
       - name: Setup repo
         uses: actions/checkout@v2
 
       - name: Setup Deno
-        uses: denolib/setup-deno@c7d7968ad4a59c159a777f79adddad6872ee8d96
+        # uses: denoland/setup-deno@v1
+        uses: denoland/setup-deno@004814556e37c54a2f6e31384c9e18e9833173669
         with:
-          deno-version: ${{ matrix.deno }} # tests across multiple Deno versions
+          deno-version: v1.x
 
-      - name: Cache Dependencies
-        run: deno cache deps.ts
+      # Uncomment this step to verify the use of 'deno fmt' on each commit.
+      # - name: Verify formatting
+      #   run: deno fmt --check
 
-      - name: Run Tests
+      - name: Run linter
+        run: deno lint
+
+      - name: Run tests
         run: deno test -A --unstable

ci/docker-publish.yml

@@ -1,76 +1,63 @@
 name: Docker
 
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
 on:
+  schedule:
+    - cron: $cron-daily
   push:
-    # Publish `$default-branch` as Docker `latest` image.
-    branches:
-      - $default-branch
-
-    # Publish `v1.2.3` tags as releases.
-    tags:
-      - v*
-
-  # Run tests for any PRs.
+    branches: [ $default-branch ]
+    # Publish semver tags as releases.
+    tags: [ 'v*.*.*' ]
   pull_request:
+    branches: [ $default-branch ]
 
 env:
-  # TODO: Change variable to your image's name.
-  IMAGE_NAME: image
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
 
 jobs:
-  # Run tests.
-  # See also https://docs.docker.com/docker-hub/builds/automated-testing/
-  test:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Run tests
-        run: |
-          if [ -f docker-compose.test.yml ]; then
-            docker-compose --file docker-compose.test.yml build
-            docker-compose --file docker-compose.test.yml run sut
-          else
-            docker build . --file Dockerfile
-          fi
-
-  # Push image to GitHub Packages.
-  # See also https://docs.docker.com/docker-hub/builds/
-  push:
-    # Ensure test job passes before pushing image.
-    needs: test
+  build:
 
     runs-on: ubuntu-latest
-    if: github.event_name == 'push'
+    permissions:
+      contents: read
+      packages: write
 
     steps:
-      - uses: actions/checkout@v2
+      - name: Checkout repository
+        uses: actions/checkout@v2
 
-      - name: Build image
-        run: docker build . --file Dockerfile --tag $IMAGE_NAME
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Log into registry
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login docker.pkg.github.com -u ${{ github.actor }} --password-stdin
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
-      - name: Push image
-        run: |
-          IMAGE_ID=docker.pkg.github.com/${{ github.repository }}/$IMAGE_NAME
-
-          # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
-
-          # Strip git ref prefix from version
-          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
-
-          # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
-
-          # Use Docker `latest` tag convention
-          [ "$VERSION" == "$default-branch" ] && VERSION=latest
-
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

ci/dotnet-desktop.yml

@@ -75,7 +75,7 @@ jobs:
 
     # Add  MSBuild to the PATH: https://github.com/microsoft/setup-msbuild
     - name: Setup MSBuild.exe
-      uses: microsoft/setup-msbuild@2008f912f56e61277eefaac6d1888b750582aa16
+      uses: microsoft/setup-msbuild@v1.0.2
 
     # Execute all unit tests in the solution
     - name: Execute unit tests
@@ -107,7 +107,7 @@ jobs:
     - name: Remove the pfx
       run: Remove-Item -path $env:Wap_Project_Directory\$env:Signing_Certificate
 
-    # Upload the MSIX package: https://github.com/marketplace/actions/upload-artifact
+    # Upload the MSIX package: https://github.com/marketplace/actions/upload-a-build-artifact
     - name: Upload build artifacts
       uses: actions/upload-artifact@v2
       with:

ci/elixir.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
     - uses: actions/checkout@v2
     - name: Set up Elixir
-      uses: actions/setup-elixir@v1
+      uses: erlef/setup-elixir@885971a72ed1f9240973bd92ab57af8c1aa68f24
       with:
         elixir-version: '1.10.3' # Define the elixir version [required]
         otp-version: '22.3' # Define the OTP version [required]

ci/gem-push.yml

@@ -10,6 +10,9 @@ jobs:
   build:
     name: Build + Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
     - uses: actions/checkout@v2

ci/go.yml

@@ -16,7 +16,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v2
       with:
-        go-version: 1.15
+        go-version: 1.17
 
     - name: Build
       run: go build -v ./...

ci/gradle-publish.yml

@@ -1,5 +1,5 @@
 # This workflow will build a package using Gradle and then publish it to GitHub packages when a release is created
-# For more information see: https://github.com/actions/setup-java#publishing-using-gradle
+# For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#Publishing-using-gradle
 
 name: Gradle Package
 
@@ -11,13 +11,17 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: Set up JDK 11
+      uses: actions/setup-java@v2
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'adopt'
         server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
         settings-path: ${{ github.workspace }} # location for the settings.xml file
 

ci/gradle.yml

@@ -1,4 +1,4 @@
-# This workflow will build a Java project with Gradle
+# This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time
 # For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle
 
 name: Java CI with Gradle
@@ -16,10 +16,12 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: Set up JDK 11
+      uses: actions/setup-java@v2
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'adopt'
+        cache: gradle
     - name: Grant execute permission for gradlew
       run: chmod +x gradlew
     - name: Build with Gradle

ci/grunt.yml

@@ -0,0 +1,28 @@
+name: NodeJS with Grunt
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x, 14.x, 16.x]
+    
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Build
+      run: |
+        npm install
+        grunt

ci/gulp.yml

@@ -0,0 +1,28 @@
+name: NodeJS with Gulp
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x, 14.x, 16.x]
+    
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Build
+      run: |
+        npm install
+        gulp

ci/ios.yml

@@ -25,7 +25,8 @@ jobs:
           scheme: ${{ 'default' }}
           platform: ${{ 'iOS Simulator' }}
         run: |
-          device=`instruments -s -devices | grep -oE 'iPhone.*?[^\(]+' | head -1 | awk '{$1=$1;print}'`
+          # xcrun xctrace returns via stderr, not the expected stdout (see https://developer.apple.com/forums/thread/663959)
+          device=`xcrun xctrace list devices 2>&1 | grep -oE 'iPhone.*?[^\(]+' | head -1 | awk '{$1=$1;print}'`
           if [ $scheme = default ]; then scheme=$(cat default); fi
           if [ "`ls -A | grep -i \\.xcworkspace\$`" ]; then filetype_parameter="workspace" && file_to_build="`ls -A | grep -i \\.xcworkspace\$`"; else filetype_parameter="project" && file_to_build="`ls -A | grep -i \\.xcodeproj\$`"; fi
           file_to_build=`echo $file_to_build | awk '{$1=$1;print}'`
@@ -35,7 +36,8 @@ jobs:
           scheme: ${{ 'default' }}
           platform: ${{ 'iOS Simulator' }}
         run: |
-          device=`instruments -s -devices | grep -oE 'iPhone.*?[^\(]+' | head -1 | awk '{$1=$1;print}'`
+          # xcrun xctrace returns via stderr, not the expected stdout (see https://developer.apple.com/forums/thread/663959)
+          device=`xcrun xctrace list devices 2>&1 | grep -oE 'iPhone.*?[^\(]+' | head -1 | awk '{$1=$1;print}'`
           if [ $scheme = default ]; then scheme=$(cat default); fi
           if [ "`ls -A | grep -i \\.xcworkspace\$`" ]; then filetype_parameter="workspace" && file_to_build="`ls -A | grep -i \\.xcworkspace\$`"; else filetype_parameter="project" && file_to_build="`ls -A | grep -i \\.xcodeproj\$`"; fi
           file_to_build=`echo $file_to_build | awk '{$1=$1;print}'`

ci/jekyll.yml

@@ -17,4 +17,4 @@ jobs:
       run: |
         docker run \
         -v ${{ github.workspace }}:/srv/jekyll -v ${{ github.workspace }}/_site:/srv/jekyll/_site \
-        jekyll/builder:latest /bin/bash -c "chmod 777 /srv/jekyll && jekyll build --future"
+        jekyll/builder:latest /bin/bash -c "chmod -R 777 /srv/jekyll && jekyll build --future"

ci/laravel.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: shivammathur/setup-php@b7d1d9c9a92d8d8463ce36d7f60da34d461724f8
+    - uses: shivammathur/setup-php@15c43e89cdef867065b0213be354c2841860869e
       with:
         php-version: '8.0'
     - uses: actions/checkout@v2

ci/maven-publish.yml

@@ -1,5 +1,5 @@
 # This workflow will build a package using Maven and then publish it to GitHub packages when a release is created
-# For more information see: https://github.com/actions/setup-java#apache-maven-with-a-settings-path
+# For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#apache-maven-with-a-settings-path
 
 name: Maven Package
 
@@ -11,13 +11,17 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: Set up JDK 11
+      uses: actions/setup-java@v2
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'adopt'
         server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
         settings-path: ${{ github.workspace }} # location for the settings.xml file
 
@@ -27,4 +31,4 @@ jobs:
     - name: Publish to GitHub Packages Apache Maven
       run: mvn deploy -s $GITHUB_WORKSPACE/settings.xml
       env:
-        GITHUB_TOKEN: ${{ github.token }}
+        GITHUB_TOKEN: ${{ github.token }}

ci/maven.yml

@@ -1,4 +1,4 @@
-# This workflow will build a Java project with Maven
+# This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time
 # For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
 
 name: Java CI with Maven
@@ -16,9 +16,11 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: Set up JDK 11
+      uses: actions/setup-java@v2
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'adopt'
+        cache: maven
     - name: Build with Maven
       run: mvn -B package --file pom.xml

ci/msbuild.yml

@@ -19,7 +19,7 @@ jobs:
     - uses: actions/checkout@v2
 
     - name: Add MSBuild to PATH
-      uses: microsoft/setup-msbuild@v1
+      uses: microsoft/setup-msbuild@v1.0.2
 
     - name: Restore NuGet packages
       working-directory: ${{env.GITHUB_WORKSPACE}}

ci/node.js.yml

@@ -1,4 +1,4 @@
-# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
+# This workflow will do a clean install of node dependencies, cache/restore them, build the source code and run tests across different versions of node
 # For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
 
 name: Node.js CI
@@ -16,15 +16,16 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [10.x, 12.x, 14.x, 15.x]
+        node-version: [12.x, 14.x, 16.x]
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:
     - uses: actions/checkout@v2
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@v2
       with:
         node-version: ${{ matrix.node-version }}
+        cache: 'npm'
     - run: npm ci
     - run: npm run build --if-present
     - run: npm test

ci/npm-publish.yml

@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v2
         with:
-          node-version: 12
+          node-version: 14
       - run: npm ci
       - run: npm test
 
@@ -23,9 +23,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v2
         with:
-          node-version: 12
+          node-version: 14
           registry-url: https://registry.npmjs.org/
       - run: npm ci
       - run: npm publish
@@ -35,11 +35,14 @@ jobs:
   publish-gpr:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
+      - uses: actions/setup-node@v2
         with:
-          node-version: 12
+          node-version: 14
           registry-url: $registry-url(npm)
       - run: npm ci
       - run: npm publish

ci/openshift.yml

@@ -1,152 +0,0 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-### The OpenShift Starter workflow will:
-# - Checkout your repository
-# - Perform a Docker build
-# - Push the built image to an image registry
-# - Log in to your OpenShift cluster
-# - Create an OpenShift app from the image and expose it to the internet.
-
-### Before you begin:
-# - Have write access to a container image registry such as quay.io or Dockerhub.
-# - Have access to an OpenShift cluster.
-#   - For instructions to get started with OpenShift see https://www.openshift.com/try
-# - The project you wish to add this workflow to should have a Dockerfile.
-#   - If you don't have a Dockerfile at the repository root, see the buildah-build step.
-#   - Builds from scratch are also available, but require more configuration.
-
-### To get the workflow running:
-# 1. Add this workflow to your repository.
-# 2. Edit the top-level 'env' section, which contains a list of environment variables that must be configured.
-# 3. Create the secrets referenced in the 'env' section under your repository Settings.
-# 4. Edit the 'branches' in the 'on' section to trigger the workflow on a push to your branch.
-# 5. Commit and push your changes.
-
-# For a more sophisticated example, see https://github.com/redhat-actions/spring-petclinic/blob/main/.github/workflows/petclinic-sample.yaml
-# Also see our GitHub organization, https://github.com/redhat-actions/
-
-name: OpenShift
-
-# ⬇️  Modify the fields marked with ⬇️ to fit your project, and create any secrets that are referenced.
-# https://docs.github.com/en/free-pro-team@latest/actions/reference/encrypted-secrets
-env:
-  # ⬇️ EDIT with your registry and registry path.
-  REGISTRY: quay.io/<username>
-  # ⬇️ EDIT with your registry username.
-  REGISTRY_USER: <username>
-  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-
-  # ⬇️ EDIT to log into your OpenShift cluster and set up the context.
-  # See https://github.com/redhat-actions/oc-login#readme for how to retrieve these values.
-  OPENSHIFT_SERVER: ${{ secrets.OPENSHIFT_SERVER }}
-  OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
-
-  # ⬇️ EDIT with the port your application should be accessible on.
-  APP_PORT: 8080
-
-  # ⬇️ EDIT if you wish to set the kube context's namespace after login. Leave blank to use the default namespace.
-  OPENSHIFT_NAMESPACE: ""
-
-  # If you wish to manually provide the APP_NAME and TAG, set them here, otherwise they will be auto-detected.
-  APP_NAME: ""
-  TAG: ""
-
-on:
-  # https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
-  push:
-    # Edit to the branch(es) you want to build and deploy on each push.
-    branches: [ $default-branch ]
-
-jobs:
-  openshift-ci-cd:
-    name: Build and deploy to OpenShift
-    runs-on: ubuntu-20.04
-
-    steps:
-    - uses: actions/checkout@v2
-
-    - name: Determine app name
-      if: env.APP_NAME == ''
-      run: |
-        echo "APP_NAME=$(basename $PWD)" | tee -a $GITHUB_ENV
-
-    - name: Determine tag
-      if: env.TAG == ''
-      run: |
-        echo "TAG=${GITHUB_SHA::7}" | tee -a $GITHUB_ENV
-
-    # https://github.com/redhat-actions/buildah-build#readme
-    - name: Build from Dockerfile
-      uses: redhat-actions/buildah-build@v1
-      with:
-        image: ${{ env.APP_NAME }}
-        tag: ${{ env.TAG }}
-        # If you don't have a dockerfile, see:
-        # https://github.com/redhat-actions/buildah-build#building-from-scratch
-        # Otherwise, point this to your Dockerfile relative to the repository root.
-        dockerfiles: |
-          ./Dockerfile
-
-    # https://github.com/redhat-actions/push-to-registry#readme
-    - name: Push to registry
-      id: push-to-registry
-      uses: redhat-actions/push-to-registry@v1
-      with:
-        image: ${{ env.APP_NAME }}
-        tag: ${{ env.TAG }}
-        registry: ${{ env.REGISTRY }}
-        username: ${{ env.REGISTRY_USER }}
-        password: ${{ env.REGISTRY_PASSWORD }}
-
-    # The path the image was pushed to is now stored in ${{ steps.push-to-registry.outputs.registry-path }}
-
-    # oc-login works on all platforms, but oc must be installed first.
-    # The GitHub Ubuntu runner already includes oc.
-    # Otherwise, https://github.com/redhat-actions/oc-installer#readme is available.
-
-    # https://github.com/redhat-actions/oc-login#readme
-    - name: Log in to OpenShift
-      uses: redhat-actions/oc-login@v1
-      with:
-        openshift_server_url: ${{ env.OPENSHIFT_SERVER }}
-        openshift_token: ${{ env.OPENSHIFT_TOKEN }}
-        insecure_skip_tls_verify: true
-        namespace: ${{ env.OPENSHIFT_NAMESPACE }}
-
-    # This step should create a deployment, service, and route to run your app and expose it to the internet.
-    # Feel free to replace this with 'oc apply', 'helm install', or however you like to deploy your app.
-    - name: Create and expose app
-      run: |
-        export IMAGE="${{ steps.push-to-registry.outputs.registry-path }}"
-        export PORT=${{ env.APP_PORT }}
-
-        export SELECTOR="app=${{ env.APP_NAME }}"
-        echo "SELECTOR=$SELECTOR" >> $GITHUB_ENV
-
-        set -x
-        # Take down any old deployment
-        oc delete all --selector="$SELECTOR"
-        oc new-app --name $APP_NAME --docker-image="$IMAGE"
-
-        # Make sure the app port is exposed
-        oc patch svc $APP_NAME -p "{ \"spec\": { \"ports\": [{ \"name\": \"$PORT-tcp\", \"port\": $PORT }] } }"
-        oc expose service $APP_NAME --port=$PORT
-
-        oc get all --selector="$SELECTOR"
-        set +x
-
-        export ROUTE="$(oc get route $APP_NAME -o jsonpath='{.spec.host}')"
-        echo "$APP_NAME is exposed at $ROUTE"
-        echo "ROUTE=$ROUTE" >> $GITHUB_ENV
-
-    - name: View application route
-      run: |
-        [[ -n ${{ env.ROUTE }} ]] || (echo "Determining application route failed in previous step"; exit 1)
-        echo "======================== Your application is available at: ========================"
-        echo ${{ env.ROUTE }}
-        echo "==================================================================================="
-        echo
-        echo "Your app can be taken down with: \"oc delete all --selector='${{ env.SELECTOR }}'\""

ci/php.yml

@@ -15,7 +15,7 @@ jobs:
     - uses: actions/checkout@v2
 
     - name: Validate composer.json and composer.lock
-      run: composer validate
+      run: composer validate --strict
 
     - name: Cache Composer packages
       id: composer-cache
@@ -27,8 +27,7 @@ jobs:
           ${{ runner.os }}-php-
 
     - name: Install dependencies
-      if: steps.composer-cache.outputs.cache-hit != 'true'
-      run: composer install --prefer-dist --no-progress --no-suggest
+      run: composer install --prefer-dist --no-progress
 
     # Add a test script to composer.json, for instance: "test": "vendor/bin/phpunit"
     # Docs: https://getcomposer.org/doc/articles/scripts.md

ci/properties/ada.properties.json

@@ -2,5 +2,5 @@
     "name": "Ada",
     "description": "Build Ada project with GPRbuild.",
     "iconName": "ada",
-    "categories": ["Ada"]
+    "categories": ["Continuous integration", "Ada"]
 }

ci/properties/android.properties.json

@@ -2,5 +2,5 @@
     "name": "Android CI",
     "description": "Build an Android project with Gradle.",
     "iconName": "android",
-    "categories": ["Java", "Mobile"]
+    "categories": ["Continuous integration", "Java", "Mobile"]
 }

ci/properties/ant.properties.json

@@ -2,5 +2,5 @@
     "name": "Java with Ant",
     "description": "Build and test a Java project with Apache Ant.",
     "iconName": "ant",
-    "categories": ["Ant", "Java"]
+    "categories": ["Continuous integration", "Ant", "Java"]
 }

ci/properties/blank.properties.json

@@ -1,6 +1,7 @@
 {
     "name": "Simple workflow",
     "description": "Start with a file with the minimum necessary structure.",
+    "creator": "GitHub",
     "iconName": "blank",
     "categories": null
 }

ci/properties/c-cpp.properties.json

@@ -2,5 +2,5 @@
     "name": "C/C++ with Make",
     "description": "Build and test a C/C++ project using Make.",
     "iconName": "c-cpp",
-    "categories": ["C", "C++"]
+    "categories": ["Continuous integration", "C", "C++"]
 }

ci/properties/clojure.properties.json

@@ -2,5 +2,5 @@
     "name": "Clojure",
     "description": "Build and test a Clojure project with Leiningen.",
     "iconName": "clojure",
-    "categories": ["Clojure", "Java"]
+    "categories": ["Continuous integration", "Clojure", "Java"]
 }

ci/properties/cmake.properties.json

@@ -2,5 +2,5 @@
     "name": "CMake based projects",
     "description": "Build and test a CMake based project.",
     "iconName": "cmake",
-    "categories": ["C", "C++"]
+    "categories": ["Continuous integration", "C", "C++"]
 }

ci/properties/crystal.properties.json

@@ -2,5 +2,5 @@
     "name": "Crystal",
     "description": "Build and test a Crystal project.",
     "iconName": "crystal",
-    "categories": ["Crystal"]
+    "categories": ["Continuous integration", "Crystal"]
 }

ci/properties/d.properties.json

@@ -2,5 +2,5 @@
     "name": "D",
     "description": "Build and test a D project with dub.",
     "iconName": "d",
-    "categories": [ "D" ]
+    "categories": ["Continuous integration", "D"]
 }

ci/properties/dart.properties.json

@@ -2,5 +2,5 @@
     "name": "Dart",
     "description": "Build and test a Dart project with Pub.",
     "iconName": "dart",
-    "categories": ["Dart"]
+    "categories": ["Continuous integration", "Dart"]
 }

ci/properties/deno.properties.json

@@ -2,5 +2,5 @@
     "name": "Deno",
     "description": "Test your Deno project",
     "iconName": "deno",
-    "categories": ["JavaScript", "TypeScript", "Deno"]
+    "categories": ["Continuous integration", "JavaScript", "TypeScript", "Deno"]
 }

ci/properties/django.properties.json

@@ -2,5 +2,5 @@
     "name": "Django",
     "description": "Build and Test a Django Project",
     "iconName": "django",
-    "categories": ["Python", "Django"]
+    "categories": ["Continuous integration", "Python", "Django"]
 }

ci/properties/docker-image.properties.json

@@ -2,5 +2,5 @@
     "name": "Docker image",
     "description": "Build a Docker image to deploy, run, or push to a registry.",
     "iconName": "docker",
-    "categories": ["Dockerfile"]
+    "categories": ["Continuous integration", "Dockerfile"]
 }

ci/properties/docker-publish.properties.json

@@ -2,5 +2,5 @@
   "name": "Publish Docker Container",
   "description": "Build, test and push Docker image to GitHub Packages.",
   "iconName": "docker",
-  "categories": ["Dockerfile"]
+  "categories": ["Continuous integration", "Dockerfile"]
 }

ci/properties/dotnet-desktop.properties.json

@@ -2,5 +2,5 @@
     "name": ".NET Desktop",
     "description": "Build, test, sign and publish a desktop application built on .NET.",
     "iconName": "dotnet",
-    "categories": ["C#", "Visual Basic", "WPF", ".NET"]
+    "categories": ["Continuous integration", "C#", "Visual Basic", "WPF", ".NET"]
 }

ci/properties/dotnet.properties.json

@@ -2,5 +2,5 @@
     "name": ".NET",
     "description": "Build and test a .NET or ASP.NET Core project.",
     "iconName": "dotnet",
-    "categories": ["C#", "F#", "Visual Basic", "ASP", "ASP.NET", ".NET"]
+    "categories": ["Continuous integration", "C#", "F#", "Visual Basic", "ASP", "ASP.NET", ".NET"]
 }

ci/properties/elixir.properties.json

@@ -2,5 +2,5 @@
     "name": "Elixir",
     "description": "Build and test an Elixir project with Mix.",
     "iconName": "elixir",
-    "categories": ["Elixir", "Erlang"]
+    "categories": ["Continuous integration", "Elixir", "Erlang"]
 }

ci/properties/erlang.properties.json

@@ -2,5 +2,5 @@
     "name": "Erlang",
     "description": "Build and test an Erlang project with rebar.",
     "iconName": "erlang",
-    "categories": ["Erlang"]
+    "categories": ["Continuous integration", "Erlang"]
 }

ci/properties/gem-push.properties.json

@@ -2,5 +2,5 @@
     "name": "Ruby Gem",
     "description": "Pushes a Ruby Gem to RubyGems and GitHub Package Registry.",
     "iconName": "ruby-gems",
-    "categories": ["Ruby", "SDLC"]
+    "categories": ["Continuous integration", "Ruby"]
 }

ci/properties/go.properties.json

@@ -2,5 +2,5 @@
     "name": "Go",
     "description": "Build a Go project.",
     "iconName": "go",
-    "categories": ["Go"]
+    "categories": ["Continuous integration", "Go"]
 }

ci/properties/gradle-publish.properties.json

@@ -2,5 +2,5 @@
     "name": "Publish Java Package with Gradle",
     "description": "Build a Java Package using Gradle and publish to GitHub Packages.",
     "iconName": "gradle",
-    "categories": ["Java", "Gradle"]
+    "categories": ["Continuous integration", "Java", "Gradle", "Spring", "JSF"]
 }

ci/properties/gradle.properties.json

@@ -2,5 +2,5 @@
     "name": "Java with Gradle",
     "description": "Build and test a Java project using a Gradle wrapper script.",
     "iconName": "gradle",
-    "categories": ["Java", "Gradle"]
+    "categories": ["Continuous integration", "Java", "Gradle", "Spring", "JSF"]
 }

ci/properties/grunt.properties.json

@@ -0,0 +1,6 @@
+{
+    "name": "Grunt",
+    "description": "Build a NodeJS project with npm and grunt.",
+    "iconName": "grunt",
+    "categories": ["Continuous integration", "JavaScript", "TypeScript", "npm", "Grunt"]
+}

ci/properties/gulp.properties.json

@@ -0,0 +1,6 @@
+{
+    "name": "Gulp",
+    "description": "Build a NodeJS project with npm and gulp.",
+    "iconName": "gulp",
+    "categories": ["Continuous integration", "JavaScript", "TypeScript", "npm", "Gulp"]
+}

ci/properties/haskell.properties.json

@@ -2,5 +2,5 @@
     "name": "Haskell",
     "description": "Build and test a Haskell project with Cabal.",
     "iconName": "haskell",
-    "categories": ["Haskell"]
+    "categories": ["Continuous integration", "Haskell"]
 }

ci/properties/ios.properties.json

@@ -3,6 +3,7 @@
     "description": "Build and test an iOS application using xcodebuild and any available iPhone simulator.",
     "iconName": "xcode",
     "categories": [
+        "Continuous integration",
         "iOS",
         "Xcode"
     ]

ci/properties/jekyll.properties.json

@@ -2,5 +2,5 @@
     "name": "Jekyll",
     "description": "Package a Jekyll site using the jekyll/builder Docker image.",
     "iconName": "jekyll",
-    "categories": ["HTML"]
+    "categories": ["Continuous integration", "HTML"]
 }

ci/properties/laravel.properties.json

@@ -3,6 +3,7 @@
     "description": "Test a Laravel project.",
     "iconName": "php",
     "categories": [
+        "Continuous integration",
         "PHP",
         "Laravel"
     ]

ci/properties/maven-publish.properties.json

@@ -2,5 +2,5 @@
     "name": "Publish Java Package with Maven",
     "description": "Build a Java Package using Maven and publish to GitHub Packages.",
     "iconName": "maven",
-    "categories": ["Java", "Maven"]
+    "categories": ["Continuous integration", "Java", "Maven", "Spring", "JSF"]
 }

ci/properties/maven.properties.json

@@ -2,5 +2,5 @@
     "name": "Java with Maven",
     "description": "Build and test a Java project with Apache Maven.",
     "iconName": "maven",
-    "categories": ["Java", "Maven"]
+    "categories": ["Continuous integration", "Java", "Maven", "Spring", "JSF"]
 }

ci/properties/msbuild.properties.json

@@ -2,5 +2,5 @@
     "name": "MSBuild based projects",
     "description": "Build a MSBuild based project.",
     "iconName": "c-cpp",
-    "categories": ["C", "C++"]
+    "categories": ["Continuous integration", "C", "C++"]
 }

ci/properties/node.js.properties.json

@@ -2,5 +2,5 @@
     "name": "Node.js",
     "description": "Build and test a Node.js project with npm.",
     "iconName": "nodejs",
-    "categories": ["JavaScript", "Node", "Npm"]
+    "categories": ["Continuous integration", "JavaScript", "npm", "React", "Angular"]
 }

ci/properties/npm-publish.properties.json

@@ -2,5 +2,5 @@
     "name": "Publish Node.js Package",
     "description": "Publishes a Node.js package to npm and GitHub Packages.",
     "iconName": "node-package-transparent",
-    "categories": ["JavaScript", "SDLC"]
+    "categories": ["Continuous integration", "JavaScript", "npm"]
 }

ci/properties/php.properties.json

@@ -2,5 +2,5 @@
     "name": "PHP",
     "description": "Build and test a PHP application using Composer",
     "iconName": "php",
-    "categories": ["PHP", "Composer"]
+    "categories": ["Continuous integration", "PHP", "Composer"]
 }

ci/properties/pylint.properties.json

@@ -2,5 +2,5 @@
     "name": "Pylint",
     "description": "Lint a Python application with pylint.",
     "iconName": "python",
-    "categories": ["Python"]
+    "categories": ["Continuous integration", "Python"]
 }

ci/properties/python-app.properties.json

@@ -2,5 +2,5 @@
     "name": "Python application",
     "description": "Create and test a Python application.",
     "iconName": "python",
-    "categories": ["Python"]
+    "categories": ["Continuous integration", "Python"]
 }

ci/properties/python-package-conda.properties.json

@@ -2,5 +2,5 @@
     "name": "Python Package using Anaconda",
     "description": "Create and test a Python package on multiple Python versions using Anaconda for package management.",
     "iconName": "python",
-    "categories": ["Python"]
+    "categories": ["Continuous integration", "Python"]
 }

ci/properties/python-package.properties.json

@@ -2,5 +2,5 @@
     "name": "Python package",
     "description": "Create and test a Python package on multiple Python versions.",
     "iconName": "python",
-    "categories": ["Python"]
+    "categories": ["Continuous integration", "Python"]
 }

ci/properties/python-publish.properties.json

@@ -2,5 +2,5 @@
     "name": "Publish Python Package",
     "description": "Publish a Python Package to PyPI on release.",
     "iconName": "python",
-    "categories": ["Python"]
+    "categories": ["Continuous integration", "Python"]
 }

ci/properties/r.properties.json

@@ -2,5 +2,5 @@
     "name": "R package",
     "description": "Create and test an R package on multiple R versions.",
     "iconName": "r",
-    "categories": ["R"]
+    "categories": ["Continuous integration", "R"]
 }

ci/properties/rails-lint.properties.json

@@ -0,0 +1,6 @@
+{
+    "name": "Rails - Build and Run Linters",
+    "description": "Build Rails application and run linters",
+    "iconName": "ruby",
+    "categories": ["Continuous integration", "Ruby", "Rails"]
+}

ci/properties/ruby.properties.json

@@ -2,5 +2,5 @@
     "name": "Ruby",
     "description": "Build and test a Ruby project with Rake.",
     "iconName": "ruby",
-    "categories": ["Ruby"]
+    "categories": ["Continuous integration", "Ruby"]
 }

ci/properties/rust.properties.json

@@ -2,5 +2,5 @@
     "name": "Rust",
     "description": "Build and test a Rust project with Cargo.",
     "iconName": "rust",
-    "categories": ["Rust"]
+    "categories": ["Continuous integration", "Rust"]
 }

ci/properties/scala.properties.json

@@ -2,5 +2,5 @@
     "name": "Scala",
     "description": "Build and test a Scala project with SBT.",
     "iconName": "scala",
-    "categories": ["Scala", "Java"]
+    "categories": ["Continuous integration", "Scala", "Java"]
 }

ci/properties/swift.properties.json

@@ -2,5 +2,5 @@
     "name": "Swift",
     "description": "Build and test a Swift Package.",
     "iconName": "swift",
-    "categories": ["Swift"]
+    "categories": ["Continuous integration", "Swift"]
 }

ci/properties/webpack.properties.json

@@ -0,0 +1,6 @@
+{
+    "name": "Webpack",
+    "description": "Build a NodeJS project with npm and webpack.",
+    "iconName": "webpack",
+    "categories": ["Continuous integration", "JavaScript", "TypeScript", "npm", "Webpack"]
+}

ci/pylint.yml

@@ -9,10 +9,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v1
+    - name: Set up Python 3.9
+      uses: actions/setup-python@v2
       with:
-        python-version: 3.8
+        python-version: 3.9
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip

ci/python-package.yml

@@ -14,6 +14,7 @@ jobs:
 
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         python-version: [3.7, 3.8, 3.9]
 

ci/python-publish.yml

@@ -1,11 +1,16 @@
 # This workflow will upload a Python Package using Twine when a release is created
 # For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
 
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
 name: Upload Python Package
 
 on:
   release:
-    types: [created]
+    types: [published]
 
 jobs:
   deploy:
@@ -21,11 +26,11 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install setuptools wheel twine
-    - name: Build and publish
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        python setup.py sdist bdist_wheel
-        twine upload dist/*
+        pip install build
+    - name: Build package
+      run: python -m build
+    - name: Publish package
+      uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
+      with:
+        user: __token__
+        password: ${{ secrets.PYPI_API_TOKEN }}

ci/r.yml

@@ -16,7 +16,7 @@ on:
 
 jobs:
   build:
-    runs-on: macOS-latest
+    runs-on: macos-latest
     strategy:
       matrix:
         r-version: [3.5, 3.6]

ci/rails-lint.yml

@@ -0,0 +1,32 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+# This workflow will download a prebuilt Ruby version, install dependencies, and  run linters
+name: Build Rails and run linters
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+jobs:
+  run-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Setup Ruby and install gems
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+      # Add or Replace any other security checks here
+      - name: Run security checks
+        run: |
+          bin/bundler-audit --update
+          bin/brakeman -q -w2
+      # Add or Replace any other Linters here
+      - name: Run linters
+        run: |
+          bin/rubocop --parallel

ci/scala.yml

@@ -13,9 +13,10 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up JDK 1.8
-      uses: actions/setup-java@v1
+    - name: Set up JDK 11
+      uses: actions/setup-java@v2
       with:
-        java-version: 1.8
+        java-version: '11'
+        distribution: 'adopt'
     - name: Run tests
       run: sbt test

ci/webpack.yml

@@ -0,0 +1,28 @@
+name: NodeJS with Webpack
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x, 14.x, 16.x]
+    
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Build
+      run: |
+        npm install
+        npx webpack

code-scanning/README.md

@@ -1,4 +1,3 @@
 # Code Scanning Workflows
 
-GitHub code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production. Before you can configure code scanning for a repository, you must enable code scanning by adding a GitHub Actions workflow to the repository. For more information, see [Enabling Code Scanning for a repository](/github/finding-security-vulnerabilities-and-errors-in-your-code/enabling-code-scanning-for-a-repository).
-
+GitHub code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production. Before you can configure code scanning for a repository, you must enable code scanning by adding a GitHub Actions workflow to the repository. For more information, see [Setting up code scanning for a repository](https://docs.github.com/en/code-security/secure-coding/setting-up-code-scanning-for-a-repository).

code-scanning/codeql.yml

@@ -24,6 +24,10 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     strategy:
       fail-fast: false

code-scanning/devskim.yml

@@ -0,0 +1,34 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: DevSkim
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    branches: [ $default-branch ]
+  schedule:
+    - cron: $cron-weekly
+
+jobs:
+  lint:
+    name: DevSkim
+    runs-on: ubuntu-20.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Run DevSkim scanner
+        uses: microsoft/DevSkim-Action@v1
+        
+      - name: Upload DevSkim scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: devskim-results.sarif

code-scanning/flawfinder.yml

@@ -0,0 +1,38 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: flawfinder
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ $default-branch ]
+  schedule:
+    - cron: $cron-weekly
+
+jobs:
+  flawfinder:
+    name: Flawfinder
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: flawfinder_scan
+        uses: david-a-wheeler/flawfinder@8e4a779ad59dbfaee5da586aa9210853b701959c
+        with:
+          arguments: '--sarif ./'
+          output: 'flawfinder_results.sarif'
+
+      - name: Upload analysis results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: ${{github.workspace}}/flawfinder_results.sarif

code-scanning/kubesec.yml

@@ -0,0 +1,41 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Kubesec
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ $default-branch ]
+  schedule:
+    - cron: $cron-weekly
+
+jobs:
+  lint:
+    name: Kubesec
+    runs-on: ubuntu-20.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Run kubesec scanner
+        uses: controlplaneio/kubesec-action@43d0ddff5ffee89a6bb9f29b64cd865411137b14
+        with:
+          input: file.yaml # specify configuration file to scan here
+          format: template
+          template: template/sarif.tpl
+          output: kubesec-results.sarif
+          exit-code: "0"
+
+      - name: Upload Kubesec scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: kubesec-results.sarif

code-scanning/mayhem-for-api.yml

@@ -0,0 +1,66 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+#
+# This workflow starts your API and fuzzes it with ForAllSecure Mayhem for API
+# to find reliability, performance and security issues before they reach
+# production.
+#
+# To use this workflow, you will need to:
+#
+# 1. Create a Mayhem for API account at
+#    https://mayhem4api.forallsecure.com/signup (30-day free trial)
+#
+# 2. Create a service account token `mapi organization service-account create
+#    <org-name> <service-account-name>`
+#
+# 3. Add the service account token as a secret in GitHub called "MAPI_TOKEN"
+#
+# 4. Update the "Start your API" step to run your API in the background before
+#    starting the Mayhem for API scan, and update the `api-url` & `api-spec`
+#    field.
+#
+# If you have any questions, please contact us at mayhem4api@forallsecure.com
+
+name: "Mayhem for API"
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ $default-branch ]
+
+jobs:
+  mayhem-for-api:
+    name: Mayhem for API
+    # Mayhem for API runs on linux, mac and windows
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v2
+
+      # Run your API in the background. Ideally, the API would run in debug
+      # mode & send stacktraces back on "500 Internal Server Error" responses
+      # (don't do this in production though!)
+      - name: Start your API
+        run: ./run_your_api.sh & # <- ✏️ update this
+
+      - name: Mayhem for API
+        uses: ForAllSecure/mapi-action@193b709971cc377675e33284aecbf9229853e010
+        continue-on-error: true
+        with:
+          mapi-token: ${{ secrets.MAPI_TOKEN }}
+          api-url: http://localhost:8080 # <- ✏️ update this
+          api-spec: http://localhost:8080/openapi.json # <- ✏️ update this
+          duration: 60
+          sarif-report: mapi.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: mapi.sarif

code-scanning/powershell.yml

@@ -0,0 +1,42 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+#
+# https://github.com/microsoft/action-psscriptanalyzer
+# For more information on PSScriptAnalyzer in general, see
+# https://github.com/PowerShell/PSScriptAnalyzer
+
+name: PSScriptAnalyzer
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    branches: [ $default-branch ]
+  schedule:
+    - cron: $cron-weekly
+    
+jobs:
+  build:
+    name: PSScriptAnalyzer
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Run PSScriptAnalyzer
+        uses: microsoft/psscriptanalyzer-action@2044ae068e37d0161fa2127de04c19633882f061
+        with:
+          # Check https://github.com/microsoft/action-psscriptanalyzer for more info about the options.
+          # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules.
+          path: .\
+          recurse: true 
+          # Include your own basic security rules. Removing this option will run all the rules 
+          includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"'
+          output: results.sarif
+      
+      # Upload the SARIF file generated in the previous step
+      - name: Upload SARIF results file
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: results.sarif

code-scanning/properties/devskim.properties.json

@@ -0,0 +1,7 @@
+{
+    "name": "DevSkim",
+    "creator": "Microsoft CST-E",
+    "description": "DevSkim is a security linter that highlights common security issues in source code.",
+    "iconName": "cst-logo",
+    "categories": ["Code Scanning", "C", "C#", "C++", "Go", "Java", "JavaScript", "TypeScript", "Python", "Powershell", "Cobol", "Objective C", "PHP", "Ruby", "Rust", "SQL", "Swift", "Visual Basic"]
+}