From 128595cdb052e79c725aad0042cb674497edfae8 Mon Sep 17 00:00:00 2001
From: karmaking <daniel@danieltippmann.de>
Date: Tue, 13 Jan 2026 14:45:22 +0100
Subject: [PATCH 1/2] fix github action

---
 .github/workflows/auto_update_base_image.yml  |  35 ----
 .../build_container_develop_branch.yml        |  30 ----
 .../build_container_non_develop_branch.yml    | 151 ------------------
 .github/workflows/build_pull_request.yml      | 124 --------------
 .github/workflows/run_trivy.yml               |  54 -------
 .gitignore                                    |   1 -
 6 files changed, 395 deletions(-)
 delete mode 100644 .github/workflows/auto_update_base_image.yml
 delete mode 100644 .github/workflows/build_container_non_develop_branch.yml
 delete mode 100644 .github/workflows/build_pull_request.yml
 delete mode 100644 .github/workflows/run_trivy.yml

diff --git a/.github/workflows/auto_update_base_image.yml b/.github/workflows/auto_update_base_image.yml
deleted file mode 100644
index 3048faf15..000000000
--- a/.github/workflows/auto_update_base_image.yml
+++ /dev/null
@@ -1,35 +0,0 @@
-name: Regular base image update check
-on:
-  schedule:
-    - cron: "0 5 * * *"
-  workflow_dispatch:
-
-env:
-  ## Sets environment variable
-  DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Docker Image Update Checker
-        id: baseupdatecheck
-        uses: lucacome/docker-image-update-checker@v2.0.0
-        with:
-          base-image: jetty:9.4-jdk11-alpine
-          image: ${{ env.DOCKER_HUB_ORGANIZATION }}/obp-api:latest
-
-      - name: Trigger build_container_develop_branch workflow
-        uses: actions/github-script@v6
-        with:
-          script: |
-            await github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'build_container_develop_branch.yml',
-              ref: 'refs/heads/develop'
-            });
-        if: steps.baseupdatecheck.outputs.needs-updating == 'true'
diff --git a/.github/workflows/build_container_develop_branch.yml b/.github/workflows/build_container_develop_branch.yml
index 3afc3d6ec..db6bd5160 100644
--- a/.github/workflows/build_container_develop_branch.yml
+++ b/.github/workflows/build_container_develop_branch.yml
@@ -124,33 +124,3 @@ jobs:
         with:
           name: ${{ github.sha }}
           path: push/
-
-      - name: Build the Docker image
-        run: |
-          echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u "${{ secrets.DOCKER_HUB_USERNAME }}" --password-stdin docker.io
-          docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop
-          docker build . --file .github/Dockerfile_PreBuild_OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop-OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
-          docker push docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }} --all-tags
-          echo docker done
-
-      - uses: sigstore/cosign-installer@4d14d7f17e7112af04ea6108fbb4bfc714c00390
-
-      - name: Write signing key to disk (only needed for `cosign sign --key`)
-        run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
-
-      - name: Sign container image
-        run: |
-          cosign sign -y --key cosign.key \
-            docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop
-          cosign sign -y --key cosign.key \
-                      docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest
-          cosign sign -y --key cosign.key \
-                      docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA
-          cosign sign -y --key cosign.key \
-                      docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:develop-OC
-          cosign sign -y --key cosign.key \
-                      docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:latest-OC
-        env:
-          COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"
-
-
diff --git a/.github/workflows/build_container_non_develop_branch.yml b/.github/workflows/build_container_non_develop_branch.yml
deleted file mode 100644
index fda13bb72..000000000
--- a/.github/workflows/build_container_non_develop_branch.yml
+++ /dev/null
@@ -1,151 +0,0 @@
-name: Build and publish container non develop
-
-on:
-  push:
-    branches:
-      - '**'
-      - '!develop'
-
-env:
-  DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
-  DOCKER_HUB_REPOSITORY: obp-api
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    services:
-      # Label used to access the service container
-      redis:
-        # Docker Hub image
-        image: redis
-        ports:
-          # Opens tcp port 6379 on the host and service container
-          - 6379:6379
-        # Set health checks to wait until redis has started
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    steps:
-      - uses: actions/checkout@v4
-      - name: Extract branch name
-        shell: bash
-        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
-      - name: Set up JDK 11
-        uses: actions/setup-java@v4
-        with:
-          java-version: '11'
-          distribution: 'adopt'
-          cache: maven
-      - name: Build with Maven
-        run: |
-          set -o pipefail
-          cp obp-api/src/main/resources/props/sample.props.template obp-api/src/main/resources/props/production.default.props
-          echo connector=star > obp-api/src/main/resources/props/test.default.props
-          echo starConnector_supported_types=mapped,internal >> obp-api/src/main/resources/props/test.default.props
-          echo hostname=http://localhost:8016 >> obp-api/src/main/resources/props/test.default.props
-          echo tests.port=8016 >> obp-api/src/main/resources/props/test.default.props
-          echo End of minimum settings >> obp-api/src/main/resources/props/test.default.props
-          echo payments_enabled=false >> obp-api/src/main/resources/props/test.default.props
-          echo importer_secret=change_me >> obp-api/src/main/resources/props/test.default.props
-          echo messageQueue.updateBankAccountsTransaction=false >> obp-api/src/main/resources/props/test.default.props
-          echo messageQueue.createBankAccounts=false >> obp-api/src/main/resources/props/test.default.props
-          echo allow_sandbox_account_creation=true >> obp-api/src/main/resources/props/test.default.props
-          echo allow_sandbox_data_import=true >> obp-api/src/main/resources/props/test.default.props
-          echo sandbox_data_import_secret=change_me >> obp-api/src/main/resources/props/test.default.props
-          echo allow_account_deletion=true >> obp-api/src/main/resources/props/test.default.props
-          echo allowed_internal_redirect_urls = /,/oauth/authorize >> obp-api/src/main/resources/props/test.default.props
-          echo transactionRequests_enabled=true >> obp-api/src/main/resources/props/test.default.props
-          echo transactionRequests_supported_types=SEPA,SANDBOX_TAN,FREE_FORM,COUNTERPARTY,ACCOUNT,SIMPLE >> obp-api/src/main/resources/props/test.default.props
-          echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo openredirects.hostname.whitlelist=http://127.0.0.1,http://localhost >> obp-api/src/main/resources/props/test.default.props
-          echo remotedata.secret = foobarbaz >> obp-api/src/main/resources/props/test.default.props
-          echo allow_public_views=true >> obp-api/src/main/resources/props/test.default.props
-
-          echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo ACCOUNT_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo SEPA_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo FREE_FORM_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo COUNTERPARTY_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo SEPA_CREDIT_TRANSFERS_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-
-          echo allow_oauth2_login=true >> obp-api/src/main/resources/props/test.default.props
-          echo oauth2.jwk_set.url=https://www.googleapis.com/oauth2/v3/certs >> obp-api/src/main/resources/props/test.default.props
-
-          echo ResetPasswordUrlEnabled=true >> obp-api/src/main/resources/props/test.default.props
-
-          echo consents.allowed=true >> obp-api/src/main/resources/props/test.default.props
-          MAVEN_OPTS="-Xmx3G -Xss2m" mvn clean package -Pprod 2>&1 | tee maven-build.log
-
-      - name: Report failing tests (if any)
-        if: always()
-        run: |
-          echo "Checking build log for failing tests via grep..."
-          if [ ! -f maven-build.log ]; then
-            echo "No maven-build.log found; skipping failure scan."
-            exit 0
-          fi
-          if grep -n "\*\*\* FAILED \*\*\*" maven-build.log; then
-            echo "Failing tests detected above."
-            exit 1
-          else
-            echo "No failing tests detected in maven-build.log."
-          fi
-
-      - name: Upload Maven build log
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: maven-build-log
-          if-no-files-found: ignore
-          path: |
-            maven-build.log
-
-      - name: Upload test reports
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-reports
-          if-no-files-found: ignore
-          path: |
-            obp-api/target/surefire-reports/**
-            obp-commons/target/surefire-reports/**
-            **/target/scalatest-reports/**
-            **/target/site/surefire-report.html
-            **/target/site/surefire-report/*
-
-      - name: Save .war artifact
-        run: |
-          mkdir -p ./push
-          cp obp-api/target/obp-api-1.*.war ./push/
-      - uses: actions/upload-artifact@v4
-        with:
-          name: ${{ github.sha }}
-          path: push/
-
-      - name: Build the Docker image
-        run: |
-          echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u "${{ secrets.DOCKER_HUB_USERNAME }}" --password-stdin docker.io
-          docker build . --file .github/Dockerfile_PreBuild --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA  --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
-          docker build . --file .github/Dockerfile_PreBuild_OC --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA-OC  --tag docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
-          docker push docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }} --all-tags
-          echo docker done
-
-      - uses: sigstore/cosign-installer@4d14d7f17e7112af04ea6108fbb4bfc714c00390
-
-      - name: Write signing key to disk (only needed for `cosign sign --key`)
-        run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
-
-      - name: Sign container image
-        run: |
-          cosign sign -y --key cosign.key \
-            docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}
-          cosign sign -y --key cosign.key \
-                      docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${GITHUB_REF##*/}-OC
-          cosign sign -y --key cosign.key \
-                      docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:$GITHUB_SHA
-        env:
-          COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"
-
-
diff --git a/.github/workflows/build_pull_request.yml b/.github/workflows/build_pull_request.yml
deleted file mode 100644
index 61d1e05a5..000000000
--- a/.github/workflows/build_pull_request.yml
+++ /dev/null
@@ -1,124 +0,0 @@
-name: Build on Pull Request
-
-on:
-  pull_request:
-    branches:
-      - '**'
-env:
-  ## Sets environment variable
-  DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
-
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    services:
-      # Label used to access the service container
-      redis:
-        # Docker Hub image
-        image: redis
-        ports:
-          # Opens tcp port 6379 on the host and service container
-          - 6379:6379
-        # Set health checks to wait until redis has started
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK 11
-        uses: actions/setup-java@v4
-        with:
-          java-version: '11'
-          distribution: 'adopt'
-          cache: maven
-      - name: Build with Maven
-        run: |
-          set -o pipefail
-          cp obp-api/src/main/resources/props/sample.props.template obp-api/src/main/resources/props/production.default.props
-          echo connector=star > obp-api/src/main/resources/props/test.default.props
-          echo starConnector_supported_types=mapped,internal >> obp-api/src/main/resources/props/test.default.props
-          echo hostname=http://localhost:8016 >> obp-api/src/main/resources/props/test.default.props
-          echo tests.port=8016 >> obp-api/src/main/resources/props/test.default.props
-          echo End of minimum settings >> obp-api/src/main/resources/props/test.default.props
-          echo payments_enabled=false >> obp-api/src/main/resources/props/test.default.props
-          echo importer_secret=change_me >> obp-api/src/main/resources/props/test.default.props
-          echo messageQueue.updateBankAccountsTransaction=false >> obp-api/src/main/resources/props/test.default.props
-          echo messageQueue.createBankAccounts=false >> obp-api/src/main/resources/props/test.default.props
-          echo allow_sandbox_account_creation=true >> obp-api/src/main/resources/props/test.default.props
-          echo allow_sandbox_data_import=true >> obp-api/src/main/resources/props/test.default.props
-          echo sandbox_data_import_secret=change_me >> obp-api/src/main/resources/props/test.default.props
-          echo allow_account_deletion=true >> obp-api/src/main/resources/props/test.default.props
-          echo allowed_internal_redirect_urls = /,/oauth/authorize >> obp-api/src/main/resources/props/test.default.props
-          echo transactionRequests_enabled=true >> obp-api/src/main/resources/props/test.default.props
-          echo transactionRequests_supported_types=SEPA,SANDBOX_TAN,FREE_FORM,COUNTERPARTY,ACCOUNT,SIMPLE >> obp-api/src/main/resources/props/test.default.props
-          echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo openredirects.hostname.whitlelist=http://127.0.0.1,http://localhost >> obp-api/src/main/resources/props/test.default.props
-          echo remotedata.secret = foobarbaz >> obp-api/src/main/resources/props/test.default.props
-          echo allow_public_views=true >> obp-api/src/main/resources/props/test.default.props
-
-          echo SIMPLE_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo ACCOUNT_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo SEPA_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo FREE_FORM_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo COUNTERPARTY_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-          echo SEPA_CREDIT_TRANSFERS_OTP_INSTRUCTION_TRANSPORT=dummy >> obp-api/src/main/resources/props/test.default.props
-
-          echo allow_oauth2_login=true >> obp-api/src/main/resources/props/test.default.props
-          echo oauth2.jwk_set.url=https://www.googleapis.com/oauth2/v3/certs >> obp-api/src/main/resources/props/test.default.props
-
-          echo ResetPasswordUrlEnabled=true >> obp-api/src/main/resources/props/test.default.props
-
-          echo consents.allowed=true >> obp-api/src/main/resources/props/test.default.props
-          MAVEN_OPTS="-Xmx3G -Xss2m" mvn clean package -Pprod 2>&1 | tee maven-build.log
-
-      - name: Report failing tests (if any)
-        if: always()
-        run: |
-          echo "Checking build log for failing tests via grep..."
-          if [ ! -f maven-build.log ]; then
-            echo "No maven-build.log found; skipping failure scan."
-            exit 0
-          fi
-          if grep -n "\*\*\* FAILED \*\*\*" maven-build.log; then
-            echo "Failing tests detected above."
-            exit 1
-          else
-            echo "No failing tests detected in maven-build.log."
-          fi
-
-      - name: Upload Maven build log
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: maven-build-log
-          if-no-files-found: ignore
-          path: |
-            maven-build.log
-
-      - name: Upload test reports
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-reports
-          if-no-files-found: ignore
-          path: |
-            obp-api/target/surefire-reports/**
-            obp-commons/target/surefire-reports/**
-            **/target/scalatest-reports/**
-            **/target/site/surefire-report.html
-            **/target/site/surefire-report/*
-
-      - name: Save .war artifact
-        run: |
-          mkdir -p ./pull
-          cp obp-api/target/obp-api-1.*.war ./pull/
-      - uses: actions/upload-artifact@v4
-        with:
-          name: ${{ github.sha }}
-          path: pull/
-
-
-
diff --git a/.github/workflows/run_trivy.yml b/.github/workflows/run_trivy.yml
deleted file mode 100644
index 4636bd311..000000000
--- a/.github/workflows/run_trivy.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: scan container image
-
-on:
-  workflow_run:
-    workflows:
-      - Build and publish container develop
-      - Build and publish container non develop
-    types:
-      - completed
-env:
-  ## Sets environment variable
-  DOCKER_HUB_ORGANIZATION: ${{ vars.DOCKER_HUB_ORGANIZATION }}
-  DOCKER_HUB_REPOSITORY: obp-api
-
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
-
-    steps:
-      - uses: actions/checkout@v4
-      - id: trivy-db
-        name: Check trivy db sha
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          endpoint='/orgs/aquasecurity/packages/container/trivy-db/versions'
-          headers='Accept: application/vnd.github+json'
-          jqFilter='.[] | select(.metadata.container.tags[] | contains("latest")) | .name | sub("sha256:";"")'
-          sha=$(gh api -H "${headers}" "${endpoint}" | jq --raw-output "${jqFilter}")
-          echo "Trivy DB sha256:${sha}"
-          echo "::set-output name=sha::${sha}"
-      - uses: actions/cache@v4
-        with:
-          path: .trivy
-          key: ${{ runner.os }}-trivy-db-${{ steps.trivy-db.outputs.sha }}
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: 'docker.io/${{ env.DOCKER_HUB_ORGANIZATION }}/${{ env.DOCKER_HUB_REPOSITORY }}:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-results.sarif'
-          security-checks: 'vuln'
-          severity: 'CRITICAL,HIGH'
-          timeout: '30m'
-          cache-dir: .trivy
-      - name: Fix .trivy permissions
-        run: sudo chown -R $(stat . -c %u:%g) .trivy
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results.sarif'
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 7e1e1bd93..1f8aabc66 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-.github/*
 *.class
 *.db
 .DS_Store

From 2b4bda715777afda8e71a1394d95cfcb8b8593fa Mon Sep 17 00:00:00 2001
From: karmaking <daniel@danieltippmann.de>
Date: Tue, 13 Jan 2026 14:46:31 +0100
Subject: [PATCH 2/2] edit gitignore

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 1f8aabc66..7e1e1bd93 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+.github/*
 *.class
 *.db
 .DS_Store