Add Sonar cpd input and replace some external actions

.editorconfig

@@ -5,7 +5,9 @@ end_of_line = lf
 indent_size = 2
 indent_style = space
 insert_final_newline = true
+
+[*.{js,json,tf*,yml,yaml}]
 trim_trailing_whitespace = true
 
-[md]
+[*.md]
 trim_trailing_whitespace = false

.github/workflows/ci.yml

@@ -14,3 +14,79 @@ jobs:
   markup-lint:
     name: Markup
     uses: ./.github/workflows/reusable-markup-lint.yml
+
+  test-terraform-setup:
+    name: "Test / Terraform setup action"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - name: Install terraform
+        uses: ./actions/terraform/setup
+      - name: Verify terraform is installed
+        run: |
+          terraform version
+          command -v terraform
+
+  test-tflint-setup:
+    name: "Test / TFLint setup action"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - name: Setup TFLint
+        uses: ./actions/tflint/setup
+      - name: Verify tflint is installed
+        run: |
+          tflint --version
+          command -v tflint
+
+  test-syft-generate-sbom:
+    name: "Test / Syft generate-sbom action"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - name: Generate SBOM for this repository
+        uses: ./actions/syft/generate-sbom
+        with:
+          target-path: actions
+          output-file: sbom-test.spdx.json
+          upload-artifact: "false"
+      - name: Verify SBOM was generated
+        run: |
+          test -s sbom-test.spdx.json
+          grep -q '"spdxVersion"' sbom-test.spdx.json
+
+  test-trivy-scan:
+    name: "Test / Trivy scan action"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v7
+      - name: Scan a real image with Trivy
+        uses: ./actions/trivy/scan
+        with:
+          scan-type: image
+          target: devprofr/terraform-backend-mongodb:latest
+          severity: CRITICAL,HIGH
+          exit-code: "0"
+      - name: Scan a directory with Trivy
+        uses: ./actions/trivy/scan
+        with:
+          scan-type: config
+          target: test/fixtures/terraform
+          format: sarif
+          output-file: trivy-test.sarif
+          severity: HIGH,CRITICAL
+      - name: Verify SARIF report was generated
+        run: test -s trivy-test.sarif
+
+  test-terraform-quality:
+    name: "Test / Terraform quality reusable workflow"
+    uses: ./.github/workflows/reusable-terraform-quality.yml
+    with:
+      working-directory: test/fixtures/terraform
+      # explicit override: for this same-repo local "./" call, github.workflow_sha's behavior is unverified,
+      # so pin to a ref we know is fetchable (branch on push, PR merge ref on PRs)
+      workflow-parts-version: ${{ github.ref }}

.github/workflows/reusable-container-publication.yml

@@ -58,7 +58,7 @@ on:
         required: false
         default: ubuntu-latest
       workflow-parts-version:
-        description: GitHub workflow parts version (branch/tag/SHA)
+        description: GitHub workflow parts version (branch/tag/SHA). Should match the ref/tag/SHA the caller pinned for this reusable workflow itself.
         type: string
         required: false
         default: main
@@ -100,9 +100,9 @@ jobs:
             echo "$SECRET_VARS" >> "$GITHUB_ENV"
           fi
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Checkout workflow parts
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: devpro/github-workflow-parts
           ref: ${{ inputs.workflow-parts-version }}
@@ -129,12 +129,11 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           build-args: ${{ inputs.extra-build-arguments }}
-      # TODO: replace with a more secure action
-      # - name: Generate SBOM with Syft
-      #   uses: anchore/sbom-action@v0
-      #   continue-on-error: true
-      #   with:
-      #     image: ${{ env.IMAGE_REF }}
+      - name: Generate SBOM with Syft
+        uses: ./workflow-parts/actions/syft/generate-sbom
+        continue-on-error: true
+        with:
+          target-image: ${{ env.IMAGE_REF }}
       - name: Push latest tag
         if: ${{ inputs.create-latest }}
         run: |

.github/workflows/reusable-container-scan.yml

@@ -49,6 +49,11 @@ on:
         type: boolean
         required: false
         default: true
+      workflow-parts-version:
+        description: "GitHub workflow parts version (branch/tag/SHA). Should match the ref/tag/SHA the caller pinned for this reusable workflow itself."
+        type: string
+        required: false
+        default: "main"
       working-directory:
         description: Working directory
         type: string
@@ -64,7 +69,13 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+      - name: Checkout workflow parts
+        uses: actions/checkout@v7
+        with:
+          repository: devpro/github-workflow-parts
+          ref: ${{ inputs.workflow-parts-version }}
+          path: workflow-parts
       - name: Build container image
         run: docker build . --file ${{ inputs.image-definition }} --tag ${{ env.IMAGE_REF }}
         shell: bash
@@ -80,14 +91,15 @@ jobs:
       #     nv-scanner-image: neuvector/scanner:5
       - name: Scan container image with Trivy
         if: ${{ inputs.trivy-enabled }}
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1    # v0.35.0
+        uses: ./workflow-parts/actions/trivy/scan
         with:
-          image-ref: ${{ env.IMAGE_REF }}
-          format: 'table'
-          exit-code: '1'
-          ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'
+          scan-type: image
+          target: ${{ env.IMAGE_REF }}
+          format: table
+          exit-code: "1"
+          ignore-unfixed: "true"
+          pkg-types: os,library
+          severity: CRITICAL,HIGH
     env:
       GITHUB_TOKEN: ${{ github.token }}
       IMAGE_REF: ${{ inputs.image-path }}/${{ inputs.image-name }}:${{ inputs.image-tag }}

.github/workflows/reusable-dotnet-quality.yml

@@ -48,6 +48,11 @@ on:
         type: boolean
         required: false
         default: false
+      sonar-cpd-exclusions:
+        description: Files or directories that should be excluded from Sonar code duplication analysis
+        type: string
+        required: false
+        default: "**/*Generated*.cs"
       sonar-exclusions:
         description: Files or directories that should be excluded from Sonar analysis
         type: string
@@ -74,7 +79,7 @@ on:
         required: false
         default: ""
       workflow-parts-version:
-        description: GitHub workflow parts version (branch/tag/SHA)
+        description: GitHub workflow parts version (branch/tag/SHA). Should match the ref/tag/SHA the caller pinned for this reusable workflow itself.
         type: string
         required: false
         default: main
@@ -128,11 +133,11 @@ jobs:
         run: git config --global core.autocrlf false
         shell: bash
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Checkout workflow parts
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: devpro/github-workflow-parts
           ref: ${{ inputs.workflow-parts-version }}
@@ -155,6 +160,7 @@ jobs:
         uses: ./workflow-parts/actions/dotnet/build-test-sonar
         with:
           dotnet-test-args: ${{ inputs.dotnet-test-args }}
+          sonar-cpd-exclusions: ${{ inputs.sonar-cpd-exclusions }}
           sonar-exclusions: ${{ inputs.sonar-exclusions }}
           sonar-host-url: ${{ inputs.sonar-host-url }}
           sonar-organization: ${{ inputs.sonar-organization }}
@@ -177,17 +183,12 @@ jobs:
         if: ${{ inputs.fossa-enabled && steps.fossa.outcome == 'success' }}
         run: echo '${{ steps.fossa.outputs.report }}' > report/fossa.html
         continue-on-error: true
-      # TODO: replace with more secure action
-      # - name: Generate SBOM with Syft
-      #   uses: anchore/sbom-action@v0
-      #   # with:
-      #   #   path: . # Or Dockerfile path
-      #   #   format: spdx-json # Or cyclonedx-json
-      #   #   output-file: sbom.json
-      #   #   upload-artifact: true # Auto-upload to workflow artifacts
+      - name: Generate SBOM with Syft
+        uses: ./workflow-parts/actions/syft/generate-sbom
+        continue-on-error: true
       - name: Archive test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dotnet-test-results
           path: |

.github/workflows/reusable-markup-lint.yml

@@ -28,7 +28,7 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Lint Markdown files
         run: npx markdownlint-cli2 "**/*.md"
       - name: Lint YAML files

.github/workflows/reusable-terraform-deployment.yml

@@ -37,7 +37,7 @@ on:
         required: false
         default: ""
       workflow-parts-version:
-        description: "GitHub workflow parts version (branch/tag/SHA)"
+        description: "GitHub workflow parts version (branch/tag/SHA). Should match the ref/tag/SHA the caller pinned for this reusable workflow itself."
         type: string
         required: false
         default: "main"
@@ -90,9 +90,9 @@ jobs:
           - 8080:8080
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Checkout workflow parts
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           repository: devpro/github-workflow-parts
           ref: ${{ inputs.workflow-parts-version }}
@@ -120,13 +120,13 @@ jobs:
         run: |
           ${{ inputs.custom-commands }}
       - name: Cache Terraform plugins
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.terraform.d/plugin-cache
           key: terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
       - name: Install terraform
-        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e
+        uses: ./workflow-parts/actions/terraform/setup
       - name: Terraform init
         run: terraform init
       - name: Terraform validate

.github/workflows/reusable-terraform-quality.yml

@@ -18,6 +18,11 @@ on:
         type: string
         required: false
         default: "ubuntu-latest"
+      workflow-parts-version:
+        description: "GitHub workflow parts version (branch/tag/SHA). Should match the ref/tag/SHA the caller pinned for this reusable workflow itself."
+        type: string
+        required: false
+        default: "main"
 
 jobs:
   terraform-validate:
@@ -28,15 +33,21 @@ jobs:
         working-directory: ${{ inputs.working-directory }}
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
+      - name: Checkout workflow parts
+        uses: actions/checkout@v7
+        with:
+          repository: devpro/github-workflow-parts
+          ref: ${{ inputs.workflow-parts-version }}
+          path: workflow-parts
       - name: Cache Terraform plugins
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: |
             ~/.terraform.d/plugin-cache
           key: terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
       - name: Install terraform
-        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e
+        uses: ./workflow-parts/actions/terraform/setup
       - name: Check Terraform format
         run: terraform fmt -recursive -check
       - name: Terraform Init
@@ -59,15 +70,15 @@ jobs:
       #     sarif_file: results.sarif
       # TFLint is a pluggable terraform linter (ref. https://github.com/terraform-linters/tflint)
       - name: Cache TFLint plugins
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ~/.tflint.d/plugins
           key: tflint-${{ hashFiles('**/.tflint.hcl') }}
       - name: Setup TFLint
-        uses: terraform-linters/setup-tflint@b480b8fcdaa6f2c577f8e4fa799e89e756bb7c93
+        uses: ./workflow-parts/actions/tflint/setup
         with:
-          # ref. https://github.com/terraform-linters/tflint/pkgs/container/tflint
-          tflint_version: v0.60.0
+          # ref. https://github.com/terraform-linters/tflint/releases
+          tflint-version: v0.60.0
       - name: Initialize TFLint
         run: tflint --init --recursive
         env:
@@ -76,16 +87,15 @@ jobs:
       - name: Run TFLint
         run: tflint --recursive --format compact
       - name: Run Trivy IaC scan
-        # v0.35.0
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1
+        uses: ./workflow-parts/actions/trivy/scan
         with:
-          scan-type: "config"
-          format: "sarif"
-          output: "trivy-results.sarif"
-          ignore-unfixed: true
-          severity: "HIGH,CRITICAL"
+          scan-type: config
+          target: .
+          format: sarif
+          output-file: trivy-results.sarif
+          severity: HIGH,CRITICAL
       - name: Upload SARIF as artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: security-results

.gitignore

@@ -0,0 +1,2 @@
+.terraform/
+*.tfplan

.markdownlint-cli2.yaml

@@ -4,5 +4,6 @@ ignores:
 config:
   # ref. https://github.com/DavidAnson/markdownlint
   default: true
+  MD009: false
   MD013:
     line_length: 240