Upgrade Spring Boot to 3.5.13 to resolve CVE-2026-22732 (CRITICAL) in… #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: 'Deployment environment' | |
| required: false | |
| default: 'production' | |
| type: choice | |
| options: | |
| - production | |
| - skip-deploy | |
| permissions: | |
| contents: read | |
| checks: write | |
| jobs: | |
| test: | |
| name: Run Tests | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 21 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '21' | |
| distribution: 'temurin' | |
| cache: 'maven' | |
| cache-dependency-path: backend/pom.xml | |
| - name: Run tests | |
| run: | | |
| chmod +x ./mvnw | |
| ./mvnw -B test | |
| - name: Publish test results | |
| uses: dorny/test-reporter@v1 | |
| if: always() | |
| with: | |
| name: Test Results | |
| path: backend/target/surefire-reports/*.xml | |
| reporter: java-junit | |
| - name: Upload test results | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: test-results | |
| path: backend/target/surefire-reports/ | |
| retention-days: 7 | |
| security-scan: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Build backend image | |
| run: docker build -f ./backend/DockerFile -t shelfsense-backend:scan ./backend | |
| - name: Run Trivy vulnerability scan | |
| uses: aquasecurity/trivy-action@v0.35.0 | |
| with: | |
| image-ref: 'shelfsense-backend:scan' | |
| format: 'table' | |
| severity: 'CRITICAL,HIGH' | |
| exit-code: '1' | |
| limit-severities-for-exit-code: true | |
| - name: Generate Trivy SARIF report | |
| uses: aquasecurity/trivy-action@v0.35.0 | |
| if: always() | |
| with: | |
| image-ref: 'shelfsense-backend:scan' | |
| format: 'sarif' | |
| severity: 'CRITICAL,HIGH' | |
| output: 'trivy-results.sarif' | |
| - name: Upload Trivy scan report | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: trivy-security-report | |
| path: trivy-results.sarif | |
| retention-days: 30 | |
| deploy: | |
| name: Deploy to Hetzner | |
| needs: [test, security-scan] | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event.inputs.environment == 'production') | |
| steps: | |
| - name: Deploy via SSH | |
| uses: appleboy/ssh-action@v1 | |
| with: | |
| host: ${{ secrets.SSH_HOST }} | |
| username: ${{ secrets.SSH_USER }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| cd ~/shelfsense | |
| git pull origin master | |
| docker compose -f docker-compose.prod.yml up -d --build --force-recreate | |
| docker image prune -f |