diff --git a/.github/workflows/block_reserved_branches.yml b/.github/workflows/block_reserved_branches.yml index 308ba4805..ba3fc471b 100644 --- a/.github/workflows/block_reserved_branches.yml +++ b/.github/workflows/block_reserved_branches.yml @@ -1,4 +1,3 @@ -# Author: Ahmad Samir name: Block Reserved Branches on: @@ -9,20 +8,63 @@ on: jobs: block-reserved-branches: runs-on: app-sever-project-runner + steps: - - name: Check for reserved or pattern-matching branch names + - name: Validate branch creator + reserved names env: GH_TOKEN: ${{ secrets.GH_TOKEN }} REPO: ${{ github.repository }} BRANCH_NAME: ${{ github.ref_name }} + CREATOR: ${{ github.actor }} run: | + echo "Branch: $BRANCH_NAME" + echo "Creator: $CREATOR" + + ####################################################### + # 🟦 1) Allowed Users List + ####################################################### + ALLOWED_USERS=( + "expsa" + "moutazmuhammad" + "ronozoro" + "Abubaker-Altaib" + "altexp" + "the5abir" + "ahmadaking" + "kchyounes19" + "abdurrahman-saber" + "maltayyar2" + "esam-sermah" + "mohammed-alkhazrji" + ) + + IS_ALLOWED="false" + for user in "${ALLOWED_USERS[@]}"; do + if [[ "$CREATOR" == "$user" ]]; then + IS_ALLOWED="true" + break + fi + done + + if [[ "$IS_ALLOWED" == "false" ]]; then + echo "❌ User '$CREATOR' is NOT allowed to create branches. Deleting..." + curl -s -X DELETE \ + -H "Authorization: token $GH_TOKEN" \ + https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME + exit 1 + fi + + echo "✔ User '$CREATOR' is allowed." + + ####################################################### + # 🟦 2) Reserved Branch Names (Your Existing List) + ####################################################### RESERVED_NAMES=( master dev_odex25_accounting dev_odex25_base dev_odex25_dms dev_odex25_donation - dev_odex25_ensan dev_odex25_fleet dev_odex25_helpdesk dev_odex25_hr @@ -39,11 +81,13 @@ jobs: dev_odex25_website dev_odex-event dev_openeducat_erp-14.0.1.0 + dev_odex25_benefit + dev_odex25_takaful + dev_odex25_ensan master_odex25_accounting master_odex25_base master_odex25_dms master_odex25_donation - master_odex25_ensan master_odex25_fleet master_odex25_helpdesk master_odex25_hr @@ -60,11 +104,13 @@ jobs: master_odex25_website master_odex-event master_openeducat_erp-14.0.1.0 + master_odex25_benefit + master_odex25_takaful + master_odex25_ensan preprod_odex25_accounting preprod_odex25_base preprod_odex25_dms preprod_odex25_donation - preprod_odex25_ensan preprod_odex25_fleet preprod_odex25_helpdesk preprod_odex25_hr @@ -81,19 +127,31 @@ jobs: preprod_odex25_website preprod_odex-event preprod_openeducat_erp-14.0.1.0 + preprod_odex25_benefit + preprod_odex25_takaful + preprod_odex25_ensan ) - # Check if branch is an exact reserved name + + # Exact match for reserved in "${RESERVED_NAMES[@]}"; do if [[ "$BRANCH_NAME" == "$reserved" ]]; then echo "❌ Branch name '$BRANCH_NAME' is reserved. Deleting..." - curl -s -X DELETE -H "Authorization: token $GH_TOKEN" https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME + curl -s -X DELETE \ + -H "Authorization: token $GH_TOKEN" \ + https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME exit 1 fi done - # Check if branch name matches restricted patterns + + ####################################################### + # 🟦 3) Pattern-based Restriction + ####################################################### if [[ "$BRANCH_NAME" == master_* || "$BRANCH_NAME" == preprod_* || "$BRANCH_NAME" == dev_* ]]; then echo "❌ Branch name '$BRANCH_NAME' matches restricted pattern. Deleting..." - curl -s -X DELETE -H "Authorization: token $GH_TOKEN" https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME + curl -s -X DELETE \ + -H "Authorization: token $GH_TOKEN" \ + https://api.github.com/repos/$REPO/git/refs/heads/$BRANCH_NAME exit 1 fi - echo "✅ Branch '$BRANCH_NAME' is allowed." \ No newline at end of file + + echo "✅ Branch '$BRANCH_NAME' is allowed." diff --git a/.github/workflows/dev-preprod-servers.yml b/.github/workflows/dev-preprod-servers.yml index d21f6f5a5..1576903ee 100644 --- a/.github/workflows/dev-preprod-servers.yml +++ b/.github/workflows/dev-preprod-servers.yml @@ -22,8 +22,10 @@ on: - dev_odex25_transactions - dev_odex25_website - dev_openeducat_erp-14.0.1.0 - - dev_odex25_ensan - dev_odex25_donation + - dev_odex25_benefit + - dev_odex25_takaful + - dev_odex25_ensan - preprod_odex-event - preprod_odex25_accounting - preprod_odex25_base @@ -43,9 +45,11 @@ on: - preprod_odex25_transactions - preprod_odex25_website - preprod_openeducat_erp-14.0.1.0 - - preprod_odex25_ensan - preprod_odex25_donation - + - preprod_odex25_benefit + - preprod_odex25_takaful + - preprod_odex25_ensan + workflow_dispatch: inputs: environment: @@ -82,7 +86,8 @@ jobs: github.ref == 'refs/heads/preprod_odex25_transactions' || github.ref == 'refs/heads/preprod_odex25_website' || github.ref == 'refs/heads/preprod_openeducat_erp-14.0.1.0' || - github.ref == 'refs/heads/preprod_odex25_ensan' || + github.ref == 'refs/heads/preprod_odex25_benefit' || + github.ref == 'refs/heads/preprod_odex25_takaful' || github.ref == 'refs/heads/preprod_odex25_donation') || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'preprod') steps: @@ -120,7 +125,8 @@ jobs: github.ref == 'refs/heads/dev_odex25_transactions' || github.ref == 'refs/heads/dev_odex25_website' || github.ref == 'refs/heads/dev_openeducat_erp-14.0.1.0' || - github.ref == 'refs/heads/dev_odex25_ensan' || + github.ref == 'refs/heads/dev_odex25_benefit' || + github.ref == 'refs/heads/dev_odex25_takaful' || github.ref == 'refs/heads/dev_odex25_donation') || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'dev') steps: @@ -158,7 +164,8 @@ jobs: github.ref == 'refs/heads/preprod_odex25_transactions' || github.ref == 'refs/heads/preprod_odex25_website' || github.ref == 'refs/heads/preprod_openeducat_erp-14.0.1.0' || - github.ref == 'refs/heads/preprod_odex25_ensan' || + github.ref == 'refs/heads/preprod_odex25_benefit' || + github.ref == 'refs/heads/preprod_odex25_takaful' || github.ref == 'refs/heads/preprod_odex25_donation') || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'preprod') steps: diff --git a/.github/workflows/prevent-invalid-branch-merges.yml b/.github/workflows/prevent-invalid-branch-merges.yml index c0b8c6b63..e10c2e26b 100644 --- a/.github/workflows/prevent-invalid-branch-merges.yml +++ b/.github/workflows/prevent-invalid-branch-merges.yml @@ -25,6 +25,8 @@ on: - dev_odex25_ensan - dev_odex25_helpdesk - dev_odex25_donation + - dev_odex25_benefit + - dev_odex25_takaful - preprod_odex-event - preprod_odex25_accounting @@ -47,6 +49,8 @@ on: - preprod_odex25_ensan - preprod_odex25_helpdesk - preprod_odex25_donation + - preprod_odex25_benefit + - preprod_odex25_takaful - master_odex-event - master_odex25_accounting @@ -69,7 +73,8 @@ on: - master_odex25_ensan - master_odex25_helpdesk - master_odex25_donation - + - master_odex25_benefit + - master_odex25_takaful jobs: @@ -188,6 +193,17 @@ jobs: exit 1 fi + if [[ "${{ github.base_ref }}" == "preprod_odex25_benefit" && "${{ github.head_ref }}" != "dev_odex25_benefit" ]]; then + echo "::error ::You can only merge to 'preprod_odex25_donation' from 'dev_odex25_donation' branch!" + exit 1 + fi + + if [[ "${{ github.base_ref }}" == "preprod_odex25_takaful" && "${{ github.head_ref }}" != "dev_odex25_takaful" ]]; then + echo "::error ::You can only merge to 'preprod_odex25_donation' from 'dev_odex25_donation' branch!" + exit 1 + fi + + # ✅ Master Branches if [[ "${{ github.base_ref }}" == "master_odex-event" && "${{ github.head_ref }}" != "preprod_odex-event" ]]; then echo "::error ::You can only merge to 'master_odex-event' from 'preprod_odex-event' branch!" @@ -294,6 +310,19 @@ jobs: exit 1 fi + if [[ "${{ github.base_ref }}" == "master_odex25_benefit" && "${{ github.head_ref }}" != "preprod_odex25_benefit" ]]; then + echo "::error ::You can only merge to 'master_odex25_donation' from 'preprod_odex25_donation' branch!" + exit 1 + fi + + if [[ "${{ github.base_ref }}" == "master_odex25_takaful" && "${{ github.head_ref }}" != "preprod_odex25_takaful" ]]; then + echo "::error ::You can only merge to 'master_odex25_donation' from 'preprod_odex25_donation' branch!" + exit 1 + fi + + + + # ❌ Block ALL merges to 'master' if [[ "${{ github.base_ref }}" == "master" ]]; then @@ -301,4 +330,4 @@ jobs: exit 1 fi - echo "Merge validation passed." \ No newline at end of file + echo "Merge validation passed." diff --git a/.github/workflows/production_pull_code.yml b/.github/workflows/production_pull_code.yml index 00525eb63..d5a272105 100644 --- a/.github/workflows/production_pull_code.yml +++ b/.github/workflows/production_pull_code.yml @@ -22,7 +22,7 @@ jobs: ensan_master_server: name: Deploy to Ensan Master runs-on: new-ensan-vpn-client-server-runner - if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Ensan Project - Production' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_ensan' || github.ref == 'refs/heads/master_odex25_donation') && + if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Ensan Project - Production' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_takaful' || github.ref == 'refs/heads/master_odex25_benefit' || github.ref == 'refs/heads/master_odex25_donation' || github.ref == 'refs/heads/master_odex25_ensan') && (github.actor == 'moutazmuhammad' || github.actor == 'expsa' || github.actor == 'ahmadaking' || @@ -50,7 +50,7 @@ jobs: helpdesk_maser_server: name: Deploy to Helpdesk Master runs-on: helpdesk_server - if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Helpdesk Khabir Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_ensan' || github.ref == 'refs/heads/master_odex25_helpdesk') && + if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Helpdesk Khabir Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_takaful' || github.ref == 'refs/heads/master_odex25_benefit' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_ensan') && (github.actor == 'moutazmuhammad' || github.actor == 'expsa' || github.actor == 'ahmadaking' || @@ -78,7 +78,7 @@ jobs: kaz_master_server: name: Deploy to KAZ Master runs-on: kaz-library-project-runner - if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'King AbdelAziz Library Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_ensan') && + if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'King AbdelAziz Library Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_takaful' || github.ref == 'refs/heads/master_odex25_benefit' || github.ref == 'refs/heads/master_odex25_ensan') && (github.actor == 'moutazmuhammad' || github.actor == 'expsa' || github.actor == 'ahmadaking' || @@ -107,7 +107,7 @@ jobs: twahod_master_server: name: Deploy to Twahod Master runs-on: twahod-client-project-runner - if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Twahod Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_ensan') && + if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Twahod Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_takaful' || github.ref == 'refs/heads/master_odex25_benefit' || github.ref == 'refs/heads/master_odex25_ensan') && (github.actor == 'moutazmuhammad' || github.actor == 'expsa' || github.actor == 'ahmadaking' || @@ -135,7 +135,7 @@ jobs: ekram_master_server: name: Deploy to Ekram Master runs-on: ekram-client-project-runner - if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Ekram Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_ensan') && + if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Ekram Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_takaful' || github.ref == 'refs/heads/master_odex25_benefit' || github.ref == 'refs/heads/master_odex25_ensan') && (github.actor == 'moutazmuhammad' || github.actor == 'expsa' || github.actor == 'ahmadaking' || @@ -218,7 +218,7 @@ jobs: jazala_master_server: name: Deploy to Jazala Master runs-on: jazala-client-project-runner - if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Jazala Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_ensan') && + if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'Jazala Project' && (github.ref == 'refs/heads/master_odex-event' || github.ref == 'refs/heads/master_odex25_accounting' || github.ref == 'refs/heads/master_odex25_base' || github.ref == 'refs/heads/master_odex25_dms' || github.ref == 'refs/heads/master_odex25_fleet' || github.ref == 'refs/heads/master_odex25_helpdesk' || github.ref == 'refs/heads/master_odex25_ENSAN' || github.ref == 'refs/heads/master_odex25_hr' || github.ref == 'refs/heads/master_odex25_inventory' || github.ref == 'refs/heads/master_odex25_maintenance' || github.ref == 'refs/heads/master_odex25_mobile' || github.ref == 'refs/heads/master_odex25_pos' || github.ref == 'refs/heads/master_odex25_project' || github.ref == 'refs/heads/master_odex25_purchase' || github.ref == 'refs/heads/master_odex25_realstate' || github.ref == 'refs/heads/master_odex25_sales' || github.ref == 'refs/heads/master_odex25_survey' || github.ref == 'refs/heads/master_odex25_transactions' || github.ref == 'refs/heads/master_odex25_website' || github.ref == 'refs/heads/master_openeducat_erp-14.0.1.0' || github.ref == 'refs/heads/master_odex25_takaful' || github.ref == 'refs/heads/master_odex25_benefit' || github.ref == 'refs/heads/master_odex25_ensan') && (github.actor == 'moutazmuhammad' || github.actor == 'expsa' || github.actor == 'ahmadaking' || diff --git a/.github/workflows/restrict-pr-authors.yaml b/.github/workflows/restrict-pr-authors.yaml new file mode 100644 index 000000000..5a8e9bab5 --- /dev/null +++ b/.github/workflows/restrict-pr-authors.yaml @@ -0,0 +1,102 @@ +name: Restrict PR Authors & Committers + +permissions: + contents: read + pull-requests: write + +on: + pull_request: + types: [opened, reopened, synchronize] + branches: + - dev_odex-event + - dev_odex25_accounting + - dev_odex25_base + - dev_odex25_dms + - dev_odex25_fleet + - dev_odex25_hr + - dev_odex25_inventory + - dev_odex25_maintenance + - dev_odex25_mobile + - dev_odex25_pos + - dev_odex25_project + - dev_odex25_purchase + - dev_odex25_realstate + - dev_odex25_sales + - dev_odex25_survey + - dev_odex25_transactions + - dev_odex25_website + - dev_openeducat_erp-14.0.1.0 + - dev_odex25_benefit + - dev_odex25_takaful + - dev_odex25_helpdesk + - dev_odex25_donation + - dev_odex25_ensan +jobs: + check_pr_author: + runs-on: linting_odex25-standard-modules_runner + + steps: + - name: Validate PR Author & Commit Authors + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GH_TOKEN }} + script: | + const allowed = [ + "expsa", + "moutazmuhammad", + "ronozoro", + "Abubaker-Altaib", + "altexp", + "the5abir", + "ahmadaking", + "kchyounes19", + "abdurrahman-saber", + "maltayyar2", + "esam-sermah", + "mohammed-alkhazrji" + ]; + + const pr = context.payload.pull_request; + const prAuthor = pr.user.login; + const owner = context.repo.owner; + const repo = context.repo.repo; + + core.info(`PR author: ${prAuthor}`); + + // Check PR author + if (!allowed.includes(prAuthor)) { + core.error(`Unauthorized PR author: ${prAuthor}. Closing PR...`); + await github.rest.pulls.update({ + owner, + repo, + pull_number: pr.number, + state: "closed" + }); + return; + } + + // Check commit authors + const commitList = await github.rest.pulls.listCommits({ + owner, + repo, + pull_number: pr.number + }); + + for (const commit of commitList.data) { + const commitAuthor = commit.author ? commit.author.login : null; + + if (commitAuthor && !allowed.includes(commitAuthor)) { + core.error(`Unauthorized commit author: ${commitAuthor}. Closing PR...`); + + await github.rest.pulls.update({ + owner, + repo, + pull_number: pr.number, + state: "closed" + }); + + return; + } + } + + core.info("All PR authors and committers are allowed."); diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml deleted file mode 100644 index 9a5223bbe..000000000 --- a/.github/workflows/sonarqube.yml +++ /dev/null @@ -1,61 +0,0 @@ -name: SonarQube Analysis - -on: - push: - branches: - - master_odex-event - - master_odex25_accounting - - master_odex25_base - - master_odex25_dms - - master_odex25_fleet - - master_odex25_helpdesk - - master_odex25_hr - - master_odex25_inventory - - master_odex25_maintenance - - master_odex25_mobile - - master_odex25_pos - - master_odex25_project - - master_odex25_purchase - - master_odex25_realstate - - master_odex25_sales - - master_odex25_survey - - master_odex25_transactions - - master_odex25_website - - master_openeducat_erp-14.0.1.0 - - master_odex25_ensan - - master_odex25_donation - - -jobs: - sonar: - runs-on: sonarqube - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Run SonarScanner - run: | - export BRANCH_NAME="${GITHUB_REF#refs/heads/}" - export SAFE_BRANCH_NAME="${BRANCH_NAME//\//_}" - export PROJECT_KEY="odex25_standard_modules_${SAFE_BRANCH_NAME}" - export PROJECT_NAME="Standard Modules ${SAFE_BRANCH_NAME^}" - export SOURCE_FOLDER_NAME="${BRANCH_NAME#master_}" - export PROJECT_VERSION="1.0" - export SONAR_HOST_URL=${{ secrets.SONAR_HOST_URL }} - export SONAR_TOKEN=${{ secrets.SONAR_TOKEN }} - - sonar-scanner \ - -Dsonar.projectKey="$PROJECT_KEY" \ - -Dsonar.projectName="$PROJECT_NAME" \ - -Dsonar.projectVersion="$PROJECT_VERSION" \ - -Dsonar.sources="$SOURCE_FOLDER_NAME" \ - -Dsonar.inclusions="**/*.py, **/*.xml, **/*.js, **/*.html, **/*.css" \ - -Dsonar.exclusions="**/__manifest__.py, **/migrations/**, **/__pycache__/**" \ - -Dsonar.sourceEncoding="UTF-8" \ - -Dsonar.host.url="$SONAR_HOST_URL" \ - -Dsonar.login="$SONAR_TOKEN" - - - name: Cleanup workspace - if: always() - run: | - rm -rf $GITHUB_WORKSPACE/* diff --git a/odex25_purchase/odex25_annual_purchase/views/addendum_views.xml b/odex25_purchase/odex25_annual_purchase/views/addendum_views.xml index 93f4c7732..5b2d1b301 100644 --- a/odex25_purchase/odex25_annual_purchase/views/addendum_views.xml +++ b/odex25_purchase/odex25_annual_purchase/views/addendum_views.xml @@ -19,12 +19,12 @@
-
diff --git a/odex25_purchase/odex25_annual_purchase/views/annual_request_views.xml b/odex25_purchase/odex25_annual_purchase/views/annual_request_views.xml index 0af18ede0..54dae2245 100644 --- a/odex25_purchase/odex25_annual_purchase/views/annual_request_views.xml +++ b/odex25_purchase/odex25_annual_purchase/views/annual_request_views.xml @@ -23,18 +23,20 @@
-
diff --git a/odex25_purchase/odex25_evaluation_eriteria/wizard/final_evaluation_wizard.xml b/odex25_purchase/odex25_evaluation_eriteria/wizard/final_evaluation_wizard.xml index 159ced86d..389e97d49 100644 --- a/odex25_purchase/odex25_evaluation_eriteria/wizard/final_evaluation_wizard.xml +++ b/odex25_purchase/odex25_evaluation_eriteria/wizard/final_evaluation_wizard.xml @@ -23,10 +23,10 @@
diff --git a/odex25_purchase/odex25_evaluation_eriteria/wizard/intial_evaluation_wizard.xml b/odex25_purchase/odex25_evaluation_eriteria/wizard/intial_evaluation_wizard.xml index 499b20512..cec2d59d7 100644 --- a/odex25_purchase/odex25_evaluation_eriteria/wizard/intial_evaluation_wizard.xml +++ b/odex25_purchase/odex25_evaluation_eriteria/wizard/intial_evaluation_wizard.xml @@ -21,10 +21,10 @@ diff --git a/odex25_purchase/odex25_purchase_coc/views/views.xml b/odex25_purchase/odex25_purchase_coc/views/views.xml index 65f8a37d9..e1340e7b5 100644 --- a/odex25_purchase/odex25_purchase_coc/views/views.xml +++ b/odex25_purchase/odex25_purchase_coc/views/views.xml @@ -41,28 +41,28 @@
-
diff --git a/odex25_purchase/odex25_purchase_coc/wizard/purchase_coc_partial_wizard.xml b/odex25_purchase/odex25_purchase_coc/wizard/purchase_coc_partial_wizard.xml index 9f55467bc..6df4b66df 100644 --- a/odex25_purchase/odex25_purchase_coc/wizard/purchase_coc_partial_wizard.xml +++ b/odex25_purchase/odex25_purchase_coc/wizard/purchase_coc_partial_wizard.xml @@ -10,8 +10,8 @@ You have processed less product than the initial order.

-
diff --git a/odex25_purchase/odex25_taqeem_purchase/views/competitve_purchase.xml b/odex25_purchase/odex25_taqeem_purchase/views/competitve_purchase.xml index 02a88311f..3968b4a7b 100644 --- a/odex25_purchase/odex25_taqeem_purchase/views/competitve_purchase.xml +++ b/odex25_purchase/odex25_taqeem_purchase/views/competitve_purchase.xml @@ -21,8 +21,8 @@ - -