Bump step-security/harden-runner from 2.14.1 to 2.19.4#7
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump step-security/harden-runner from 2.14.1 to 2.19.4#7dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.1 to 2.19.4. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@e3f713f...9af89fc) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.19.4 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
PR: #7 Note: This metadata is also included in the Gerrit commit message for reconciliation. |
|
Change raised in Gerrit by GitHub2Gerrit: https://gerrit.onap.org/r/c/sdc/+/144696 |
onap-github
pushed a commit
that referenced
this pull request
Jun 29, 2026
Replace the AngularJS GeneralViewModel (1079-line controller) and general-view.html (679-line template) with a pure-Angular GeneralTabComponent (reactive form), downgraded via @angular/upgrade/static and rendered in the ui-router workspace.general state. This is Phase 3 of the AngularJS removal migration (SDC-4829); child-tab rendering and the workspace shell (WorkspaceContainerComponent, Phase 2) are unchanged. Architecture: - Reactive form (ReactiveFormsModule) built by GeneralFormService; category / model / base-type logic in ComponentMetadataService and the component. - No @input: the component reads/writes the shared Angular WorkspaceService (downgradeComponent propagateDigest:false). ChangeDetectionStrategy.OnPush with guarded detectChanges(); all RxJS subscriptions use takeUntil(destroy$); AngularJS services resolved lazily via $injector.get() in ngOnInit. - All Selenium data-tests-id attributes preserved (incl. the i-sdc-tag-input tags widget + chips). This also structurally fixes the Phase-2 save() data-loss regression: the shim $scope.save no-op is removed; GeneralTabComponent owns save() (a real updateComponent() PUT) and the ON_LIFECYCLE_CHANGE_WITH_SAVE -> save -> handleChangeLifecycleState chain. The shell's commitPendingFormValues() debounce hack is removed (the reactive form keeps WorkspaceService.component current). The migrated tab ports every behavior the old controller had beyond visible bindings: category-dropdown population (initCategories) and the structured component.categories array built on selection; instantiation types, models, base types, environment context; create-mode contactId auto-set and default icon; tags add/delete; full patch-from / sync-to of all form controls (including the Service-only fields) so EDIT/VIEW shows persisted values and edits round-trip on save. Six reactive-form/ng-model parity fixes were required so values the old two-way ng-model bindings carried for free are not lost: 1. The model <select>'s empty "no model" option must coerce '' to null before it reaches the component. The old ng-model mapped the blank <option value=""> to null; the backend keys its datatype cache by model name (ApplicationDataTypeCache.getDataTypeDefinitionMapByModel), so a component persisted with model="" resolves an empty datatype scope and the backend then rejects even basic string/boolean properties with "Unsupported datatype found for property" on a later page. Coercing ''->null in syncFormToComponent and onModelChange fixes the property/composition failures on VFs created through the migrated General tab. 2. The init* methods that apply a default to the component (initEnvironmentContext, initInstantiationTypes, single-option VSP model) must also reflect that default into the reactive control. The old ng-model bound component.environmentContext / component.instantiationType, so setting the component updated the <select>; with formControlName the control kept its '' build default, and the next syncFormToComponent overwrote the component default back to ''. For a Service create this sent an empty Environment Context and the backend rejected it with "Invalid Environment context". The new patchControl() helper reflects each applied default into the form. 3. vendorName/vendorRelease must be required only for Resources. The old template wrapped them in ng-if="component.isResource()", and an unrendered AngularJS ng-model field never registered in editForm.$valid, so a Service was unaffected by them. The reactive form required them unconditionally while the new template hides them for Services (*ngIf), leaving a Service's form permanently invalid; the lifecycle-save gate then aborted on !form.valid and the certify modal never opened (Selenium timed out on the checkindialog textarea in EtsiModelUiTests.createServiceWithModel). buildForm() now takes isResource and gates the required validator accordingly. 4. Category-specific metadata (the per-category metadataKeys subsystem) must be ported. The old onCategoryChange seeded component.categorySpecificMetadata from the selected category's (and subcategory's) metadataKeys, and the old template rendered each key as a <select> (when it defines validValues) or an <input>, with data-tests-id="{{key}}". This surfaces fields like "ETSI Version" for the ETSI NFV Network Service category. The migrated tab had neither the population nor the <select> rendering, so the ETSI Version select never appeared and EtsiNetworkServiceUiTests.createService timed out waiting for it. Ported initCategorySpecificMetadata() plus the metadata-key helpers (getMetadataKey/getMetadataKeyValidValues/isMetadataKeyMandatory/ isMetadataKeyForComponentCategory/isCategoryServiceMetadataKey/ getMetadataDisplayName) and the <select>/<input> template variants; the dedicated Service keys (Naming Policy/Service Type/Service Function/Service Role) are excluded since they have their own controls. 5. The component name must render as a non-deletable "special" tag chip. The old sdc-tags directive showed component.name as a separate chip (no delete) that still carried data-tests-id="i-sdc-tag-text", and stripped the name from the editable tag list on load. The migrated tags widget rendered only the editable tags (name filtered out) and no special chip, so (a) an onboarded VF with only the name tag exposed zero i-sdc-tag-text elements and the onboarding flows (OnboardingFlowsUi.onapOnboardVNFflow/onboardCNFTest, which wait for the tags table via VfVerificator.verifyOnboardedVnfMetadata) timed out, and (b) after a rename the persisted old name leaked as a deletable chip (Service.updateService tags assertion). The name is now stripped from component.tags on load (mirroring the old controller) and rendered as a live-bound special chip; save()/ updateComponent re-adds the current name via Component.handleTags, so the backend round-trip is unchanged. 6. Category options must be sorted by name. The old template rendered the category optgroups with |orderBy:'name'; the migrated template rendered them in raw array order. The Selenium category pickers use Select.selectByVisibleText(sub), which selects the FIRST option with that text, and several main categories share a subcategory name (e.g. "Database" under Application L4+, DCAE Component and Generic). Without the sort the first match was environment-dependent, so a VFC imported under the ETSI model exported main category "Generic" instead of "Application L4+" (ImportVfcUiTest.checkEtsiMetadata). initCategories() now sorts a copy of the cached categories by name (Application L4+ sorts first), matching the old ordering; the shared CacheService array is not mutated. Verified: 71 GeneralTabComponent unit tests + full Jest suite (634) green (coverage thresholds unchanged); production webpack (AOT) build clean. The full set of previously-failing flows was reproduced against the production Docker build via the webseal-simulator and confirmed fixed: ETSI Network Service create renders the ETSI Version select (options 3.3.1/2.7.1/2.5.1) and creates with POST 201; an onboarded/created component exposes exactly one i-sdc-tag-text chip (its name) with no delete control; a rename does not leak the old name as a chip; and the resource category dropdown is sorted so the first "Database" option resolves to Application L4+. Review follow-up (PS6): nine code-review findings fixed, all ported from the old GeneralViewModel (the behavioral spec) and verified on the production Docker build via the webseal-simulator: - #1 (was a clear bug) The Service Role / Service Function dropdowns bound to component.serviceRoleValues / serviceFunctionValues, which exist nowhere, so both rendered zero options. They now bind to getMetadataKeyValidValues('Service Role'|'Service Function') (which appends the "Others" sentinel), with the dropdown-or-free-text fallback and the setServiceRole/setServiceFunction/setFunctionRole "Others" handling restored. The on-change handlers patch the reactive control too, so the selection is not clobbered by the next syncFormToComponent. - #2 Per-field disable predicates restored (the template had collapsed every field to isViewMode()): model is create-only; category/vendorName are locked for certified and CSAR-imported assets; instantiation type and base type follow the old isCsarComponent()/mode rules. This stops a user mutating the model scope key on a checked-out asset. - #3 onCategoryChange now loads the category's base types and auto-selects the required/default base type in create mode (loadBaseTypes/clearBaseTypes ported); previously a Service create on a base-type-required category got none. - #4 Restored updateIcon/possibleToUpdateIcon (the change-icon button), async name-uniqueness validation (nameExist error + breadcrumb title update), and the componentCsar checkout auto-save. - #5 isModelRequired now toggles a Validators.required on the model control and the blank model option is gated by showDefaultModelOption (VSP-import path). - #6 calculateUnique now uses ComponentMetadataService (was dead-injected). - #7 addTag enforces the tag validation pattern. - #8 name maxlength restored to 50. - #9 onEcompGeneratedNamingChange clears namingPolicy when generated naming is off. Verified: 108 GeneralTabComponent unit tests green (71 prior + 37 new in general-tab-fixes.spec.ts), production webpack (AOT) build clean, and the live sim confirmed the Service Role/Function dropdowns populate (incl. Others), the "Others" free-text round-trips and persists via the metadata PUT (model saved as null, not ""), base types load on category change, the icon modal opens, and the per-field disable locks hold for both a Service and a VF. A Playwright guard for the Service-field dropdowns was added to general-tab-save.spec.ts. Issue-ID: SDC-4829 Change-Id: Ib4ae02c4eb2d098e9e9c64a5146f01e1903e3a7d Signed-off-by: Fiete Ostkamp <fiete.ostkamp@telekom.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps step-security/harden-runner from 2.14.1 to 2.19.4.
Release notes
Sourced from step-security/harden-runner's releases.
... (truncated)
Commits
9af89fcMerge pull request #667 from step-security/update-agent-v1.8.6485dce8Update agent to v1.8.6ab7a940Merge pull request #665 from step-security/fix/use-policy-store-default-auditec41b78Default to audit mode when api-key missing with use-policy-store9ca718dMerge pull request #664 from step-security/update-agent-v1.8.51dee3dfUpdate agent to v1.8.5a5ad31dMerge pull request #657 from devantler/fix/ubuntu-slim-user-env6e92856build dist and trim ubuntu-slim message4e0504eMerge branch 'main' into fix/ubuntu-slim-user-env8d3c67dRelease v2.19.0 (#661)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)