Merge branch 'main' into 30062-image-field-generate-with-dotai-functi…

…onality

.github/actions/legacy-release/sbom-generator/action.yml

@@ -0,0 +1,64 @@
+name: 'DotCMS SBOM Generator'
+description: 'Generates SBOM for a specified version of dotCMS'
+inputs:
+  dotcms_version:
+    description: 'The dotCMS version (vYY.MM.DD)'
+    required: true
+  github_token:
+    description: 'GitHub token for pushing changes'
+    required: true
+outputs:
+  sbom-artifact:
+    description: 'SBOM artifact'
+    value: ${{ steps.sbom-artifact.outputs.artifact }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout core repository
+      uses: actions/checkout@v4
+      with:
+        repository: dotCMS/core
+        token: ${{ inputs.github_token }}
+        path: core
+
+    - name: Set dotCMS version
+      shell: bash
+      run: |
+        formatted_tag=$(echo "${{ inputs.dotcms_version }}" | sed -e 's/^dotcms-cli-//' -e 's/^v//')
+        echo "DOTCMS_VERSION=$formatted_tag" >> $GITHUB_ENV
+
+    - name: Pull and run dotCMS Docker image
+      shell: bash
+      run: |
+        docker pull dotcms/dotcms:${{ env.DOTCMS_VERSION }}
+        docker run -d -p 8082:8082 dotcms/dotcms:${{ env.DOTCMS_VERSION }}
+
+    - name: Install pipx
+      shell: bash
+      run: pip install pipx
+
+    - name: Scan Docker Image with Syft
+      shell: bash
+      run: |
+        pipx run anchore_syft dotcms/dotcms:${{ env.DOTCMS_VERSION }} -o cyclonedx-json > core/sbom-cyclonedx.json
+
+    - name: Rename SBOM file with dotCMS version
+      shell: bash
+      run: |
+        mv core/sbom-cyclonedx.json core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
+
+    - name: Upload SBOM to GitHub
+      uses: actions/upload-artifact@v4
+      with:
+        name: sbom-dotcms-${{ env.DOTCMS_VERSION }}
+        path: core/sbom-dotcms-${{ env.DOTCMS_VERSION }}.json
+
+    - name: Set SBOM artifact
+      shell: bash
+      id: sbom-artifact
+      env:
+        PACKAGE: ${{ inputs.dotcms_package }}
+        VERSION: ${{ env.DOTCMS_VERSION }}
+      run: |
+        echo "artifact=sbom-dotcms-${VERSION}" >> $GITHUB_OUTPUT

.github/workflows/issue_comp_link-issue-to-pr.yml

@@ -7,6 +7,15 @@ on:
         description: 'Pull Request branch'
         type: string
         required: true
+      pr_url:
+        description: 'Pull Request URL'
+        type: string
+        required: true
+    secrets:
+      CI_MACHINE_TOKEN:
+        description: 'CI machine token'
+        required: true
+
   workflow_dispatch:
     inputs:
       pr_branch:
@@ -80,6 +89,8 @@ jobs:
             
             core.setOutput('pr_list', prList);
             core.setOutput('existing_comment_id', existingCommentId);
+            console.log(`pr_list: [${prList}]`);
+            console.log(`existing_comment_id: [${existingCommentId}]`);
 
       - name: Update or create comment
         if: steps.check_comment.outputs.existing_comment_id == ''
@@ -98,5 +109,5 @@ jobs:
               owner: '${{ github.repository_owner }}',
               repo: '${{ github.event.repository.name }}',
               comment_id: ${{ steps.check_comment.outputs.existing_comment_id }},
-              body: prs.join('\n'),
+              body: `${prs.join('\n')}`,
             });

.github/workflows/issue_open-pr.yml

@@ -7,6 +7,9 @@ on:
 jobs:
   add-issue-to-pr:
     name: Add Issue to PR
-    uses: ./.github/workflows/issue_comp-link-issue-to-pr.yml
+    uses: ./.github/workflows/issue_comp_link-issue-to-pr.yml
     with:
       pr_branch: ${{ github.head_ref }}
+      pr_url: ${{ github.event.pull_request.html_url }}
+    secrets:
+      CI_MACHINE_TOKEN: ${{ secrets.CI_MACHINE_TOKEN }}

.github/workflows/legacy-release_maven-release-process.yml

@@ -126,7 +126,7 @@ jobs:
           echo "release_commit=${release_commit}" >> $GITHUB_OUTPUT
 
       - name: Setup Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: ${{ env.JAVA_DISTRO }}
@@ -158,7 +158,7 @@ jobs:
 
       - name: Cache Maven Repository
         id: cache-maven
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: maven-core-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -168,7 +168,7 @@ jobs:
 
       - name: Cache Core Output
         id: cache-core-output
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ./dotCMS/target/classes
@@ -181,7 +181,7 @@ jobs:
 
       - name: Cache Node Binary
         id: cache-node-binary
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             core-web/installs
@@ -190,7 +190,7 @@ jobs:
 
       - name: Cache NPM
         id: cache-npm
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.npm
@@ -200,7 +200,7 @@ jobs:
 
       - name: Cache Docker Context
         id: cache-docker-context
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ${{ env.DOCKER_BUILD_CONTEXT }}/context
           key: docker-context-${{ steps.set-common-vars.outputs.date }}-${{ github.run_id }}
@@ -235,14 +235,14 @@ jobs:
 
       - name: Restore Maven Repository
         id: restore-maven
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v4
         with:
           path: ~/.m2/repository
           key: maven-core-${{ needs.prepare-release.outputs.date }}-${{ github.run_id }}
 
       - name: Restore Core Output
         id: restore-core-output
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v4
         with:
           path: |
             ./dotCMS/target/classes
@@ -252,20 +252,20 @@ jobs:
 
       - name: Restore Node Binary
         id: restore-node-binary
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v4
         with:
           path: core-web/installs
           key: node-binary-${{ hashFiles('core-web/.nvmrc') }}
 
       - name: Restore NPM
         id: restore-npm
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@v4
         with:
           path: ~/.npm
           key: npm-${{ hashFiles('core-web/package-lock.json') }}
 
       - name: Setup Java
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: ${{ env.JAVA_DISTRO }}
@@ -340,6 +340,45 @@ jobs:
       docker_io_username: ${{ secrets.DOCKER_USERNAME }}
       docker_io_token: ${{ secrets.DOCKER_TOKEN }}
 
+  generate-sbom:
+    name: Generate SBOM
+    runs-on: ubuntu-latest
+    needs: [  prepare-release, build-push-image ]
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/legacy-release/sbom-generator
+        id: sbom-generator
+        with:
+          dotcms_version: ${{ needs.prepare-release.outputs.release_version }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: 'Download all build artifacts'
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ github.workspace }}/artifacts
+          pattern: ${{ steps.sbom-generator.outputs.sbom-artifact }}
+
+      - name: Upload SBOM Asset
+        env:
+          GITHUB_TOKEN: ${{ github.token }}  
+        run: |
+          echo "::group::Upload SBOM Asset"
+          ARTIFACT_NAME=${{ steps.sbom-generator.outputs.sbom-artifact }}
+          SBOM="./artifacts/${ARTIFACT_NAME}/${ARTIFACT_NAME}.json"
+          
+          if [ -f "${SBOM}" ]; then
+            echo "SBOM: ${SBOM}"
+            cat "${SBOM}"
+            
+            zip "${ARTIFACT_NAME}.zip" "${SBOM}"
+            gh release upload "${{ needs.prepare-release.outputs.release_tag }}" "${ARTIFACT_NAME}.zip"
+          else
+            echo "SBOM artifact not found."
+          fi
+          echo "::endgroup::"   
+
   finish-release:
     name: Finish Release
     runs-on: ubuntu-latest

bom/application/pom.xml

@@ -22,7 +22,6 @@
         <bouncy-castle.version>1.70</bouncy-castle.version>
         <awaitility.version>4.0.0</awaitility.version>
         <shedlock.version>4.33.0</shedlock.version>
-        <glowroot.version>0.14.1</glowroot.version>
         <jackson.version>2.17.2</jackson.version>
         <jersey.version>2.28</jersey.version>
         <graalvm.version>22.3.3</graalvm.version>
@@ -1506,10 +1505,8 @@
                 <groupId>org.glowroot</groupId>
                 <artifactId>glowroot-agent</artifactId>
                 <version>${glowroot.version}</version>
-                <!-- TODO: May need zip
-                <type>zip</type>
                 <classifier>dist</classifier>
-                -->
+                <type>zip</type>
             </dependency>
 
 

dotCMS/pom.xml

@@ -15,7 +15,6 @@
         <palantirJavaFormat.version>2.29.0</palantirJavaFormat.version>
         <src.dir>${project.basedir}/src/main/java</src.dir>
         <test.src.dir>${project.basedir}/src/test/java</test.src.dir>
-        <glowroot.version>0.14.1</glowroot.version>
         <version.cargo.plugin>1.10.6</version.cargo.plugin>
         <assembly-directory>${basedir}/target/dist</assembly-directory>
         <docker.skip.build>${docker.skip}</docker.skip.build>
@@ -26,6 +25,7 @@
         <tomcat-dist-folder>dotserver/tomcat-${tomcat.version}</tomcat-dist-folder>
         <tomcat-lib-folder>${assembly-directory}/${tomcat-dist-folder}/lib</tomcat-lib-folder>
         <tomcat-log4j-lib-folder>${assembly-directory}/${tomcat-dist-folder}/log4j2/lib</tomcat-log4j-lib-folder>
+        <tomcat-glowroot-parent-folder>${assembly-directory}/${tomcat-dist-folder}</tomcat-glowroot-parent-folder>
         <session-manager-lib-folder>${tomcat-lib-folder}</session-manager-lib-folder>
         <tomcat9-overrides>${project.basedir}/src/main/resources/container/tomcat9</tomcat9-overrides>
         <exploded-webapp-dir>${assembly-directory}/${tomcat-dist-folder}/webapps/ROOT</exploded-webapp-dir>
@@ -1269,15 +1269,6 @@
             <scope>test</scope>
         </dependency>
 
-
-        <!--
-                <dependency>
-                    <groupId>org.glowroot</groupId>
-                    <artifactId>glowroot-agent</artifactId>
-                </dependency>
-        -->
-
-
         <!-- Test Dependencies -->
         <dependency>
             <groupId>org.junit.jupiter</groupId>
@@ -1511,6 +1502,17 @@
                         </goals>
                         <configuration>
                             <artifactItems>
+                              <artifactItem>
+                                    <groupId>org.glowroot</groupId>
+                                    <artifactId>glowroot-agent</artifactId>
+                                    <classifier>dist</classifier>
+                                    <type>zip</type>
+                                    <version>${glowroot.version}</version>
+                                    <overWrite>true</overWrite>
+                                    <!-- the inner "glowroot" folder gets created under this -->
+                                    <outputDirectory>${tomcat-glowroot-parent-folder}</outputDirectory>
+                                </artifactItem>
+
                                 <artifactItem>
                                     <groupId>com.dotcms</groupId>
                                     <artifactId>dotcms-core-web</artifactId>
@@ -1976,6 +1978,10 @@
                                 <configuration>
                                     <type>standalone</type>
                                     <configfiles>
+                                        <configfile>
+                                            <file>${tomcat9-overrides}/glowroot/local-web/admin.json</file>
+                                            <todir>glowroot/local-web</todir>
+                                        </configfile>
                                         <configfile>
                                             <file>${tomcat9-overrides}/bin/build.conf</file>
                                             <todir>bin</todir>

dotCMS/src/main/java/com/dotcms/variant/business/web/CurrentVariantWebInterceptor.java

@@ -56,7 +56,7 @@ public Result intercept(final HttpServletRequest request, final HttpServletRespo
         }
 
         if (!UtilMethods.isSet(currentVariantName)) {
-            final HttpSession session = request.getSession();
+            final HttpSession session = request.getSession(false);
 
             if (session != null) {
                 final Object attribute = session.getAttribute(VariantAPI.VARIANT_KEY);
@@ -98,4 +98,4 @@ private static Optional<String> getVariantValueFromReferer(final String refererV
 
         return Optional.empty();
     }
-}
+}

dotCMS/src/main/java/com/dotcms/variant/business/web/VariantWebAPIImpl.java

@@ -66,19 +66,21 @@ public String currentVariantId() {
             }
         }
 
-        setSessionAttribute(request, currentVariantName);
+        setSessionAttributeIfNeeded(request, currentVariantName);
         return currentVariantName;
     }
 
-    private static void setSessionAttribute(final HttpServletRequest request,
+    private static void setSessionAttributeIfNeeded(final HttpServletRequest request,
             final String currentVariantName) {
 
-        final HttpSession session = request.getSession(true);
+        boolean buildSessionIfNeeded = !"DEFAULT".equals(currentVariantName);
+
+        final HttpSession session = request.getSession(buildSessionIfNeeded);
 
         if (!UtilMethods.isSet(session)) {
             return;
         }
-        
+
         final Object attribute = session.getAttribute(VariantAPI.VARIANT_KEY);
 
         if (mustOverwrite(attribute, currentVariantName)) {

dotCMS/src/main/java/com/dotmarketing/business/ajax/DwrUtil.java

@@ -27,7 +27,7 @@
  * Provides utility methods for DWR-related classes that allow developers to retrieve common-use
  * information such as:
  * <ul>
- *     <li>The current Session, Servlet Context, and DWR objects.</li>
+ *     <li>The current Session, Request, Servlet Context, and DWR objects.</li>
  *     <li>The currently logged-in User and their Roles.</li>
  *     <li>Portlet validation data.</li>>
  * </ul>
@@ -176,4 +176,14 @@ public static ServletContext getServletContext() {
         return ctx.getServletContext();
     }
 
+    /**
+     * Returns the current HTTP Request object from the DWR Web Context Factory.
+     *
+     * @return The current instance of the {@link HttpServletRequest} object.
+     */
+    public static HttpServletRequest getHttpServletRequest() {
+        final WebContext ctx = WebContextFactory.get();
+        return ctx.getHttpServletRequest();
+    }
+
 }