Rebase master

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+
+  - package-ecosystem: "npm"
+    directory: "/pdf-service"
+    schedule:
+      interval: "weekly"
+
+  # Covers all modules listed in root pom.xml
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Not in root pom.xml - need individual entries
+  - package-ecosystem: "maven"
+    directory: "/MDMS-v2"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "maven"
+    directory: "/egov-malware-detection"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "maven"
+    directory: "/egov-user"
+    schedule:
+      interval: "weekly"

.github/workflows/build.yaml

@@ -31,6 +31,7 @@ on:
           - "egov-indexer"
           - "egov-localization"
           - "egov-location"
+          - "egov-malware-detection"
           - "egov-mdms-service"
           - "egov-notification-mail"
           - "egov-notification-sms"
@@ -59,9 +60,8 @@ on:
           - "zuul"
         default: "audit-service"
 
-env:
-  DOCKER_USERNAME: ${{ vars.DOCKER_USERNAME }}
-  DOCKER_PASSWORD: ${{ secrets.DOCKER_ACCESS_TOKEN }}
+permissions:
+  contents: read
 
 jobs:
   resolve-config:
@@ -82,8 +82,9 @@ jobs:
 
       - name: Determine Dockerfile path from build-config.yml
         id: pick_dockerfile
+        env:
+          SERVICE: ${{ github.event.inputs.service }}
         run: |
-          SERVICE="${{ github.event.inputs.service }}"
           DEFAULT_DOCKERFILE="build/maven/Dockerfile"
 
           echo "Looking for service '$SERVICE' in build-config.yml..."
@@ -130,8 +131,11 @@ jobs:
 
       - name: Check for DB folder
         id: check-db-folder
+        env:
+          SERVICE: ${{ github.event.inputs.service }}
+          SERVICE_FOLDER: ${{ github.event.inputs.service_folder }}
         run: |
-          BASE_PATH="${{ github.event.inputs.service_folder }}/${{ github.event.inputs.service }}"
+          BASE_PATH="${SERVICE_FOLDER}/${SERVICE}"
 
           if [ -d "$BASE_PATH/src/main/resources/db" ]; then
             echo "folder_exists=true" >> "$GITHUB_OUTPUT"
@@ -151,8 +155,8 @@ jobs:
       - name: Log in to Docker Hub
         uses: docker/login-action@v2
         with:
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_PASSWORD }}
+          username: ${{ vars.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
       - name: Build & push ${{ matrix.arch }} image
         id: build_push_app
@@ -187,37 +191,45 @@ jobs:
       - name: Log in to Docker Hub
         uses: docker/login-action@v2
         with:
-          username: ${{ env.DOCKER_USERNAME }}
-          password: ${{ env.DOCKER_PASSWORD }}
+          username: ${{ vars.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
 
       - name: Create & push multi-arch manifest (application)
+        env:
+          SERVICE: ${{ github.event.inputs.service }}
+          TAG: ${{ needs.resolve-config.outputs.tag }}
         run: |
           docker buildx imagetools create \
-            --tag egovio/${{ github.event.inputs.service }}:${{ needs.resolve-config.outputs.tag }} \
-            egovio/${{ github.event.inputs.service }}:${{ needs.resolve-config.outputs.tag }}-amd64 \
-            egovio/${{ github.event.inputs.service }}:${{ needs.resolve-config.outputs.tag }}-arm64
+            --tag "egovio/${SERVICE}:${TAG}" \
+            "egovio/${SERVICE}:${TAG}-amd64" \
+            "egovio/${SERVICE}:${TAG}-arm64"
 
       - name: Create & push multi-arch manifest (database)
         if: ${{ needs.build-matrix.outputs.db_folder_exists == 'true' }}
+        env:
+          SERVICE: ${{ github.event.inputs.service }}
+          TAG: ${{ needs.resolve-config.outputs.tag }}
         run: |
           docker buildx imagetools create \
-            --tag egovio/${{ github.event.inputs.service }}-db:${{ needs.resolve-config.outputs.tag }} \
-            egovio/${{ github.event.inputs.service }}-db:${{ needs.resolve-config.outputs.tag }}-amd64 \
-            egovio/${{ github.event.inputs.service }}-db:${{ needs.resolve-config.outputs.tag }}-arm64
+            --tag "egovio/${SERVICE}-db:${TAG}" \
+            "egovio/${SERVICE}-db:${TAG}-amd64" \
+            "egovio/${SERVICE}-db:${TAG}-arm64"
 
       - name: Add all image tags to GitHub summary
         env:
           DB_EXISTS: ${{ needs.build-matrix.outputs.db_folder_exists }}
+          SERVICE: ${{ github.event.inputs.service }}
+          TAG: ${{ needs.resolve-config.outputs.tag }}
         run: |
           echo "## App Docker images" >> $GITHUB_STEP_SUMMARY
-          echo "- \`egovio/${{ github.event.inputs.service }}:${{ needs.resolve-config.outputs.tag }}-amd64\`" >> $GITHUB_STEP_SUMMARY
-          echo "- \`egovio/${{ github.event.inputs.service }}:${{ needs.resolve-config.outputs.tag }}-arm64\`" >> $GITHUB_STEP_SUMMARY
-          echo "- **multi‑arch** \`egovio/${{ github.event.inputs.service }}:${{ needs.resolve-config.outputs.tag }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "- \`egovio/${SERVICE}:${TAG}-amd64\`" >> $GITHUB_STEP_SUMMARY
+          echo "- \`egovio/${SERVICE}:${TAG}-arm64\`" >> $GITHUB_STEP_SUMMARY
+          echo "- **multi‑arch** \`egovio/${SERVICE}:${TAG}\`" >> $GITHUB_STEP_SUMMARY
 
           if [ "$DB_EXISTS" = "true" ]; then
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "## DB Docker images" >> $GITHUB_STEP_SUMMARY
-            echo "- \`egovio/${{ github.event.inputs.service }}-db:${{ needs.resolve-config.outputs.tag }}-amd64\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`egovio/${{ github.event.inputs.service }}-db:${{ needs.resolve-config.outputs.tag }}-arm64\`" >> $GITHUB_STEP_SUMMARY
-            echo "- **multi‑arch** \`egovio/${{ github.event.inputs.service }}-db:${{ needs.resolve-config.outputs.tag }}\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`egovio/${SERVICE}-db:${TAG}-amd64\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`egovio/${SERVICE}-db:${TAG}-arm64\`" >> $GITHUB_STEP_SUMMARY
+            echo "- **multi‑arch** \`egovio/${SERVICE}-db:${TAG}\`" >> $GITHUB_STEP_SUMMARY
           fi

.github/workflows/scorecard.yml

@@ -0,0 +1,77 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '45 1 * * 4'
+  push:
+    branches: [ "master" ]
+
+  workflow_dispatch:
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+          # file_mode: git
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif

accelerators/gateway-kubernetes-discovery/go.mod

@@ -4,6 +4,6 @@ go 1.13
 
 require (
 	k8s.io/api v0.17.0
-	k8s.io/apimachinery v0.17.0
-	k8s.io/client-go v0.17.0
+	k8s.io/apimachinery v0.17.9
+	k8s.io/client-go v0.17.16
 )

build/maven-java8/Dockerfile

@@ -1,5 +1,5 @@
 # ──────────────── BUILD STAGE ────────────────
-FROM maven:3.9.6-amazoncorretto-8-debian AS build
+FROM maven:3.9-eclipse-temurin-8 AS build
 ARG WORK_DIR
 WORKDIR /app
 
@@ -13,7 +13,7 @@ RUN mvn -B -f pom.xml package -DskipTests
 
 
 # ─────────────── RUNTIME STAGE ───────────────
-FROM eclipse-temurin:8-jdk AS runtime
+FROM eclipse-temurin:8-jre AS runtime
 WORKDIR /opt/egov
 
 # Pull in the fat JAR and our startup script
@@ -22,6 +22,5 @@ COPY --from=build /app/start.sh    ./start.sh
 
 RUN chmod +x ./start.sh
 
-# Override any Alpine tini entrypoint and launch via shell
 ENTRYPOINT ["sh", "./start.sh"]
 

build/maven/Dockerfile

@@ -1,27 +1,21 @@
-FROM maven:3.9.6-amazoncorretto-17 AS build
+# ──────────────── BUILD STAGE ────────────────
+FROM maven:3.9-eclipse-temurin-17 AS build
 ARG WORK_DIR
 WORKDIR /app
 
 # Copy project files
 COPY ${WORK_DIR}/pom.xml ./pom.xml
-COPY build/maven/start.sh ./start.sh
 COPY ${WORK_DIR}/src ./src
 
 # Build the project
-RUN mvn -B -f /app/pom.xml package
+RUN mvn -B -f /app/pom.xml package -DskipTests
 
-# Runtime image – using a multi-arch base image
-FROM amazoncorretto:17-alpine
+# ─────────────── RUNTIME STAGE ───────────────
+FROM gcr.io/distroless/java17-debian12:nonroot
 
 WORKDIR /opt/egov
 
-# Copy artifacts from the build stage
-COPY --from=build /app/target/*.jar /app/start.sh /opt/egov/
+# Copy artifact from the build stage
+COPY --from=build /app/target/*.jar ./application.jar
 
-# Ensure the start script has correct line endings and is executable
-RUN dos2unix /opt/egov/start.sh && chmod +x /opt/egov/start.sh
-
-# Verify architecture inside the container
-RUN uname -m
-
-CMD ["/opt/egov/start.sh"]
+ENTRYPOINT ["java", "-jar", "application.jar"]

core-services/audit-service/CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 All notable changes to this module will be documented in this file.
 
+## 2.9.3 - 2026-03-16
+- Upgraded Spring Boot version from 3.2.2 to 3.4.5 to fix HIGH/CRITICAL CVEs
+- Upgraded tracer, services-common, mdms-client, enc-client library versions
+- Upgraded PostgreSQL driver from 42.7.1 to 42.7.4
+- Removed hardcoded log4j2.version override (now managed by Spring Boot)
+
 ## 2.9.1 - 2025-05-21
 - Upgraded tracer version from 2.9.0 to 2.9.1
 - added variables in application.properties required for opentelemetry