Skip to content

Commit 12a928d

Browse files
arpit-jnarpit-jn
authored
Merge branch 'main' into dependabot/npm_and_yarn/examples/users-api/multi-ceff1a497b
2 parents b937ff6 + 1644bb5 commit 12a928d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+4288
-5416
lines changed

‎.github/actions/rl-scanner/action.yml

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: 'Reversing Labs Scanner'
2+
description: 'Runs the Reversing Labs scanner on a specified artifact.'
3+
inputs:
4+
artifact-path:
5+
description: 'Path to the artifact to be scanned.'
6+
required: true
7+
version:
8+
description: 'Version of the artifact.'
9+
required: true
10+
11+
runs:
12+
using: 'composite'
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: '3.10'
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: 'The outcome of the scan process.'
71+
value: ${{ env.scan-status }}

‎.github/workflows/browserstack.yml

+1-8
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Browserstack
33
on:
44
merge_group:
55
workflow_dispatch:
6-
pull_request_target:
6+
pull_request:
77
types:
88
- opened
99
- synchronize
@@ -22,15 +22,8 @@ env:
2222
NODE_VERSION: 18
2323

2424
jobs:
25-
authorize:
26-
name: Authorize
27-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
28-
runs-on: ubuntu-latest
29-
steps:
30-
- run: true
3125

3226
browserstack:
33-
needs: authorize # Require approval before running on forked pull requests
3427

3528
name: BrowserStack Tests
3629
runs-on: ubuntu-latest

‎.github/workflows/integration.yml

+1-10
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Integration Tests
33
on:
44
merge_group:
55
workflow_dispatch:
6-
pull_request_target:
6+
pull_request:
77
types:
88
- opened
99
- synchronize
@@ -22,16 +22,7 @@ env:
2222
NODE_VERSION: 18
2323

2424
jobs:
25-
26-
authorize:
27-
name: Authorize
28-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
29-
runs-on: ubuntu-latest
30-
steps:
31-
- run: true
32-
3325
test-examples:
34-
needs: authorize # Require approval before running on forked pull requests
3526
name: Run example tests
3627
runs-on: ubuntu-latest
3728

‎.github/workflows/npm-release.yml

+7-7
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
required: true
88
type: string
99
require-build:
10-
default: true
10+
default: "true"
1111
type: string
1212
release-directory:
1313
default: './'
@@ -32,17 +32,17 @@ jobs:
3232

3333
# Get the version from the branch name
3434
- id: get_version
35-
uses: ./get-version
35+
uses: ./.github/actions/get-version
3636

3737
# Get the prerelease flag from the branch name
3838
- id: get_prerelease
39-
uses: ./get-prerelease
39+
uses: ./.github/actions/get-prerelease
4040
with:
4141
version: ${{ steps.get_version.outputs.version }}
4242

4343
# Get the release notes
4444
- id: get_release_notes
45-
uses: ./get-release-notes
45+
uses: ./.github/actions/get-release-notes
4646
with:
4747
token: ${{ secrets.github-token }}
4848
version: ${{ steps.get_version.outputs.version }}
@@ -51,7 +51,7 @@ jobs:
5151

5252
# Check if the tag already exists
5353
- id: tag_exists
54-
uses: ./tag-exists
54+
uses: ./.github/actions/tag-exists
5555
with:
5656
tag: ${{ steps.get_version.outputs.version }}
5757
token: ${{ secrets.github-token }}
@@ -61,7 +61,7 @@ jobs:
6161
run: exit 1
6262

6363
# Publish the release to our package manager
64-
- uses: ./npm-publish
64+
- uses: ./.github/actions/npm-publish
6565
with:
6666
node-version: ${{ inputs.node-version }}
6767
require-build: ${{ inputs.require-build }}
@@ -70,7 +70,7 @@ jobs:
7070
release-directory: ${{ inputs.release-directory }}
7171

7272
# Create a release for the tag
73-
- uses: ./release-create
73+
- uses: ./.github/actions/release-create
7474
with:
7575
token: ${{ secrets.github-token }}
7676
name: ${{ steps.get_version.outputs.version }}

‎.github/workflows/release.yml

+14-2
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ on:
55
types:
66
- closed
77
workflow_dispatch:
8-
98
permissions:
109
contents: write
1110
id-token: write # For publishing to npm using --provenance
@@ -15,11 +14,24 @@ permissions:
1514
### TODO: Also remove `npm-release` workflow from this repo's .github/workflows folder once the repo is public.
1615

1716
jobs:
17+
rl-scanner:
18+
uses: ./.github/workflows/rl-secure.yml
19+
with:
20+
node-version: 18
21+
artifact-name: 'auth0-react.tgz'
22+
secrets:
23+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
24+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
25+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
26+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
27+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
28+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
1829
release:
1930
uses: ./.github/workflows/npm-release.yml
31+
needs: rl-scanner
2032
with:
2133
node-version: 18
2234
require-build: true
2335
secrets:
2436
npm-token: ${{ secrets.NPM_TOKEN }}
25-
github-token: ${{ secrets.GITHUB_TOKEN }}
37+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/rl-secure.yml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: RL-Secure Workflow
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
node-version:
7+
required: true
8+
type: string
9+
artifact-name:
10+
required: true
11+
type: string
12+
secrets:
13+
RLSECURE_LICENSE:
14+
required: true
15+
RLSECURE_SITE_KEY:
16+
required: true
17+
SIGNAL_HANDLER_TOKEN:
18+
required: true
19+
PRODSEC_TOOLS_USER:
20+
required: true
21+
PRODSEC_TOOLS_TOKEN:
22+
required: true
23+
PRODSEC_TOOLS_ARN:
24+
required: true
25+
26+
jobs:
27+
rl-scanner:
28+
name: Run Reversing Labs Scanner
29+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
30+
runs-on: ubuntu-latest
31+
outputs:
32+
scan-status: ${{ steps.rl-scan-conclusion.outcome }}
33+
34+
steps:
35+
- name: Checkout code
36+
uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 0
39+
40+
- name: Build package
41+
uses: ./.github/actions/build
42+
with:
43+
node: ${{ inputs.node-version }}
44+
45+
- name: Create tgz build artifact
46+
run: |
47+
tar -czvf ${{ inputs.artifact-name }} *
48+
49+
- id: get_version
50+
uses: ./.github/actions/get-version
51+
52+
- name: Run RL Scanner
53+
id: rl-scan-conclusion
54+
uses: ./.github/actions/rl-scanner
55+
with:
56+
artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
57+
version: "${{ steps.get_version.outputs.version }}"
58+
env:
59+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
60+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
61+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
62+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
63+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
64+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
65+
66+
- name: Output scan result
67+
run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

‎.github/workflows/semgrep.yml

+1-10
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Semgrep
22

33
on:
44
merge_group:
5-
pull_request_target:
5+
pull_request:
66
types:
77
- opened
88
- synchronize
@@ -21,16 +21,7 @@ concurrency:
2121
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
2222

2323
jobs:
24-
authorize:
25-
name: Authorize
26-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
27-
runs-on: ubuntu-latest
28-
steps:
29-
- run: true
30-
3124
run:
32-
needs: authorize # Require approval before running on forked pull requests
33-
3425
name: Check for Vulnerabilities
3526
runs-on: ubuntu-latest
3627

‎.github/workflows/snyk.yml

+1-9
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Snyk
33
on:
44
merge_group:
55
workflow_dispatch:
6-
pull_request_target:
6+
pull_request:
77
types:
88
- opened
99
- synchronize
@@ -22,15 +22,7 @@ concurrency:
2222
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
2323

2424
jobs:
25-
authorize:
26-
name: Authorize
27-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
28-
runs-on: ubuntu-latest
29-
steps:
30-
- run: true
31-
3225
check:
33-
needs: authorize
3426

3527
name: Check for Vulnerabilities
3628
runs-on: ubuntu-latest

‎.version

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v2.2.4
1+
v2.3.0

‎CHANGELOG.md

+35
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,40 @@
11
# Change Log
22

3+
## [v2.3.0](https://github.com/auth0/auth0-react/tree/v2.3.0) (2025-01-21)
4+
[Full Changelog](https://github.com/auth0/auth0-react/compare/v2.2.4...v2.3.0)
5+
6+
**Added**
7+
- Release v2.3.0 [\#825](https://github.com/auth0/auth0-react/pull/825) ([tusharpandey13](https://github.com/tusharpandey13))
8+
- Feature/react19 [\#824](https://github.com/auth0/auth0-react/pull/824) ([tusharpandey13](https://github.com/tusharpandey13))
9+
- Add ReversingLabs Workflow (Don't Merge) [\#782](https://github.com/auth0/auth0-react/pull/782) ([developerkunal](https://github.com/developerkunal))
10+
11+
**Changed**
12+
- ci: changed pull_request_target to pull_request and removed the authorize step [\#796](https://github.com/auth0/auth0-react/pull/796) ([desusai7](https://github.com/desusai7))
13+
- Bump @testing-library/react from 14.1.2 to 14.3.1 [\#757](https://github.com/auth0/auth0-react/pull/757) ([dependabot[bot]](https://github.com/apps/dependabot))
14+
- Bump ts-jest from 29.1.1 to 29.1.5 [\#766](https://github.com/auth0/auth0-react/pull/766) ([dependabot[bot]](https://github.com/apps/dependabot))
15+
- Bump cypress from 13.6.1 to 13.12.0 [\#770](https://github.com/auth0/auth0-react/pull/770) ([dependabot[bot]](https://github.com/apps/dependabot))
16+
- Bump @types/jest from 29.5.11 to 29.5.12 [\#750](https://github.com/auth0/auth0-react/pull/750) ([dependabot[bot]](https://github.com/apps/dependabot))
17+
- Bump @types/react from 18.2.45 to 18.2.64 [\#747](https://github.com/auth0/auth0-react/pull/747) ([dependabot[bot]](https://github.com/apps/dependabot))
18+
- Bump browserstack-cypress-cli from 1.28.0 to 1.28.1 [\#715](https://github.com/auth0/auth0-react/pull/715) ([dependabot[bot]](https://github.com/apps/dependabot))
19+
20+
**Fixed**
21+
- fix npm release workflow [\#826](https://github.com/auth0/auth0-react/pull/826) ([tusharpandey13](https://github.com/tusharpandey13))
22+
- Update codeowner file with new GitHub team name [\#790](https://github.com/auth0/auth0-react/pull/790) ([stevenwong-okta](https://github.com/stevenwong-okta))
23+
- Workaround for failing "integration test (CRA)" [\#769](https://github.com/auth0/auth0-react/pull/769) ([nandan-bhat](https://github.com/nandan-bhat))
24+
25+
**Removed**
26+
- Revert "Release v2.3.0" [\#827](https://github.com/auth0/auth0-react/pull/827) ([tusharpandey13](https://github.com/tusharpandey13))
27+
28+
**Security**
29+
- Bump pretty-quick from 3.1.3 to 3.3.1 [\#736](https://github.com/auth0/auth0-react/pull/736) ([dependabot[bot]](https://github.com/apps/dependabot))
30+
- Bump next from 13.5.6 to 14.1.1 in /examples/nextjs-app [\#761](https://github.com/auth0/auth0-react/pull/761) ([dependabot[bot]](https://github.com/apps/dependabot))
31+
- Bump jose from 4.11.0 to 4.15.5 in /examples/users-api [\#749](https://github.com/auth0/auth0-react/pull/749) ([dependabot[bot]](https://github.com/apps/dependabot))
32+
- Bump express from 4.18.2 to 4.19.2 in /examples/users-api [\#754](https://github.com/auth0/auth0-react/pull/754) ([dependabot[bot]](https://github.com/apps/dependabot))
33+
- Bump follow-redirects from 1.15.3 to 1.15.6 [\#752](https://github.com/auth0/auth0-react/pull/752) ([dependabot[bot]](https://github.com/apps/dependabot))
34+
- Bump ws from 7.5.9 to 7.5.10 [\#768](https://github.com/auth0/auth0-react/pull/768) ([dependabot[bot]](https://github.com/apps/dependabot))
35+
- Bump braces from 3.0.2 to 3.0.3 [\#773](https://github.com/auth0/auth0-react/pull/773) ([dependabot[bot]](https://github.com/apps/dependabot))
36+
- Bump oidc-provider from 8.4.3 to 8.4.5 [\#720](https://github.com/auth0/auth0-react/pull/720) ([dependabot[bot]](https://github.com/apps/dependabot))
37+
338
## [v2.2.4](https://github.com/auth0/auth0-react/tree/v2.2.4) (2023-12-11)
439
[Full Changelog](https://github.com/auth0/auth0-react/compare/v2.2.3...v2.2.4)
540

0 commit comments

Comments
 (0)