.eslintignore

@@ -1,4 +1,9 @@
 /cli/assets
 **/locales/index.js
-cli/config/init.entrypoint.js
-cli/config/init.App.test.js
+# These are to avoid lint errors like 'cannot find module App.jsx'
+cli/config/templates/init/entrypoint.jsx
+cli/config/templates/init/App.test.jsx
+cli/config/templates/init-typescript/entrypoint.tsx
+cli/config/templates/init-typescript/App.test.tsx
+cli/config/templates/init-typescript/global.d.ts
+cli/config/templates/init-typescript/modules.d.ts

.github/workflows/dhis2-deploy-netlify.yml

@@ -26,7 +26,7 @@ jobs:
             - uses: actions/checkout@v2
             - uses: actions/setup-node@v1
               with:
-                  node-version: 14.x
+                  node-version: 18.x
 
             - uses: c-hive/gha-yarn-cache@v1
             - run: yarn install --frozen-lockfile

.github/workflows/dhis2-verify-lib.yml

@@ -21,15 +21,15 @@ jobs:
             - uses: actions/checkout@v2
             - uses: actions/setup-node@v1
               with:
-                  node-version: 14.x
+                  node-version: 18.x
 
             - uses: c-hive/gha-yarn-cache@v1
             - run: yarn install --frozen-lockfile
 
             - name: Build
               run: yarn build
 
-            - uses: actions/upload-artifact@v2
+            - uses: actions/upload-artifact@v4
               with:
                   name: lib-build
                   path: |
@@ -43,7 +43,7 @@ jobs:
             - uses: actions/checkout@v2
             - uses: actions/setup-node@v1
               with:
-                  node-version: 14.x
+                  node-version: 18.x
 
             - uses: c-hive/gha-yarn-cache@v1
             - run: yarn install --frozen-lockfile
@@ -59,9 +59,9 @@ jobs:
             - uses: actions/checkout@v2
             - uses: actions/setup-node@v1
               with:
-                  node-version: 14.x
+                  node-version: 18.x
 
-            - uses: actions/download-artifact@v2
+            - uses: actions/download-artifact@v4
               with:
                   name: lib-build
 
@@ -81,15 +81,19 @@ jobs:
                   token: ${{env.GH_TOKEN}}
             - uses: actions/setup-node@v1
               with:
-                  node-version: 14.x
+                  node-version: 18.x
 
-            - uses: actions/download-artifact@v2
+            - uses: actions/download-artifact@v4
               with:
                   name: lib-build
 
             - uses: c-hive/gha-yarn-cache@v1
             - run: yarn install --frozen-lockfile
 
+            # If npm > v7, the semantic release action below modifies yarn.lock
+            # upon release (since it runs `npm version ___`)
+            - run: npm install -g npm@^6
+
             - uses: dhis2/action-semantic-release@master
               with:
                   publish-npm: true

.github/workflows/generate-and-upload-bom.yml

@@ -0,0 +1,41 @@
+name: 'This workflow creates bill of material and uploads it to Dependency-Track each night'
+
+on:
+    schedule:
+        - cron: '0 0 * * *'
+
+concurrency:
+    group: ${{ github.workflow}}-${{ github.ref }}
+    cancel-in-progress: true
+
+defaults:
+    run:
+        shell: bash
+
+jobs:
+    create-bom:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@v4
+            - uses: actions/setup-node@v4
+              with:
+                  node-version: 18.x
+
+            - name: Install Dependencies
+              run: yarn install --frozen-lockfile
+
+            - name: Generate BOMs
+              run: |
+                  npm install -g @cyclonedx/cdxgen
+                  cdxgen -o sbom.json
+            - name: Upload SBOM to DependencyTrack
+              env:
+                  DEPENDENCY_TRACK_API: 'https://dt.security.dhis2.org/api/v1/bom'
+              run: |
+                  curl -X POST "$DEPENDENCY_TRACK_API" \
+                      --fail-with-body \
+                      -H "Content-Type: multipart/form-data" \
+                      -H "X-Api-Key: ${{ secrets.DEPENDENCYTRACK_APIKEY }}" \
+                      -F "project=127b6ae4-8387-4e81-822d-f6a788150de4" \
+                      -F "bom=@sbom.json"

.gitignore

@@ -22,6 +22,7 @@ cli/assets
 
 # misc
 .DS_Store
+.env
 .env.local
 .env.development.local
 .env.test.local