Merge branch 'master' into change/skjermingsregister-proxy-azure

# Conflicts:
#	proxies/skjermingsregister-proxy/build.gradle
#	proxies/skjermingsregister-proxy/src/main/java/no/nav/testnav/proxies/skjermingsregisterproxy/LocalVaultConfig.java
#	proxies/skjermingsregister-proxy/src/main/java/no/nav/testnav/proxies/skjermingsregisterproxy/SkjermingsregisterProxyApplicationStarter.java
#	proxies/skjermingsregister-proxy/src/test/java/no/nav/testnav/proxies/skjermingsregisterproxy/ApplicationContextTest.java

.github/workflows/all.workflows.yml

@@ -26,17 +26,21 @@ on:
  required: true
  force-deploy:
  type: boolean
- description: "Deploy? Make sure the effective working directory contains a NAIS manifest as named below!"
+ description: "Deploy? Make sure the effective working directory contains a NAIS manifest as named below! Note: For dolly-frontend, this will also deploy with config.idporten.yml."
  default: false
  nais-manifest:
  type: string
  description: "Custom NAIS manifest filename."
  default: "config.yml"
  force-deploy-test:
  type: boolean
- description: "Deploy to test? Make sure the effective working directory contains a config.test.yml!"
+ description: "Deploy to test? Make sure the effective working directory contains a config.test.yml! Note: For dolly-frontend, this will also deploy with config.unstable.yml."
  default: false
 
+permissions:
+ contents: read
+ id-token: write
+
 jobs:
 
  start:
@@ -58,6 +62,9 @@ jobs:
  deploy-tag: ""
  force-deploy: ${{ inputs.force-deploy }}
  force-deploy-test: ${{ inputs.force-deploy-test }}
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
@@ -73,9 +80,14 @@ jobs:
  working-directory: "${{ inputs.type }}/${{ inputs.name }}"
  image-suffix: ${{ inputs.name }}
  deploy-tag: ""
- force-deploy: ${{ inputs.force-deploy }}
  nais-manifest: ${{ inputs.nais-manifest }}
+ force-deploy: ${{ inputs.force-deploy }}
  force-deploy-test: ${{ inputs.force-deploy-test }}
+ force-deploy-idporten: ${{ inputs.name == 'dolly-frontend' && inputs.force-deploy }}
+ force-deploy-unstable: ${{ inputs.name == 'dolly-frontend' && inputs.force-deploy-test }}
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.adresse-service.yml

@@ -16,6 +16,9 @@ jobs:
  with:
  working-directory: "apps/adresse-service"
  deploy-tag: "#deploy-adresse-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.amelding-service.yml

@@ -18,6 +18,9 @@ jobs:
  with:
  working-directory: "apps/amelding-service"
  deploy-tag: "#deploy-amelding-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.app-tilgang-analyse-service.yml

@@ -15,6 +15,9 @@ jobs:
  with:
  working-directory: "apps/app-tilgang-analyse-service"
  deploy-tag: "#deploy-app-tilgang-analyse-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.arbeidsforhold-export-api.yml

@@ -17,6 +17,9 @@ jobs:
  cluster: "dev-fss"
  working-directory: "apps/arbeidsforhold-export-api"
  deploy-tag: "#deploy-arbeidsforhold-export-api"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.arbeidsforhold-service.yml

@@ -18,6 +18,9 @@ jobs:
  with:
  working-directory: "apps/arbeidsforhold-service"
  deploy-tag: "#deploy-arbeidsforhold-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.batch-bestilling-service.yml

@@ -19,6 +19,9 @@ jobs:
  with:
  working-directory: "apps/batch-bestilling-service"
  deploy-tag: "#deploy-batch-bestilling-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.brreg-stub.yml

@@ -15,6 +15,9 @@ jobs:
  cluster: "dev-fss"
  working-directory: "apps/brreg-stub"
  deploy-tag: "#deploy-brreg-stub"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.bruker-service.yml

@@ -18,6 +18,9 @@ jobs:
  working-directory: "apps/bruker-service"
  deploy-tag: "#deploy-bruker-service"
  deploy-tag-test: "#deploy-test-bruker-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.budpro-service.yml

@@ -0,0 +1,29 @@
+name: budpro-service
+
+on:
+ push:
+ paths:
+ - libs/commands
+ - libs/data-transfer-objects
+ - libs/reactive-core
+ - libs/security-core
+ - libs/servlet-core
+ - libs/servlet-insecure-security
+ - libs/servlet-security
+ - apps/budpro-service/**
+ - .github/workflows/app.budpro-service.yml
+
+jobs:
+ workflow:
+ uses: ./.github/workflows/common.workflow.backend.yml
+ with:
+ working-directory: "apps/budpro-service"
+ deploy-tag: "#deploy-budpro-service"
+ permissions:
+ contents: read
+ id-token: write
+ secrets:
+ NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
+ NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
+ NAV_TOKEN: ${{ secrets.NAV_TOKEN }}
+ SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/app.dolly-backend.yml

@@ -20,6 +20,9 @@ jobs:
  working-directory: "apps/dolly-backend"
  deploy-tag: "#deploy-dolly-backend"
  deploy-tag-test: "#deploy-test-dolly-backend"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.dolly-frontend.yml

@@ -31,6 +31,9 @@ jobs:
  deploy-tag-test: "#deploy-test-frontend"
  deploy-tag-idporten: "#deploy-idporten-frontend"
  deploy-tag-unstable: "#deploy-unstable-frontend"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.dollystatus.yml

@@ -12,6 +12,9 @@ jobs:
  with:
  working-directory: "apps/dollystatus"
  deploy-tag: "#deploy-dollystatus"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.endringsmelding-frontend.yml

@@ -16,6 +16,9 @@ jobs:
  with:
  working-directory: "apps/endringsmelding-frontend"
  deploy-tag: "#deploy-endringsmelding-frontend"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.endringsmelding-service.yml

@@ -16,6 +16,9 @@ jobs:
  with:
  working-directory: "apps/endringsmelding-service"
  deploy-tag: "#deploy-endringsmelding-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.ereg-batch-status-service.yml

@@ -17,6 +17,9 @@ jobs:
  cluster: "dev-fss"
  working-directory: "apps/ereg-batch-status-service"
  deploy-tag: "#deploy-ereg-batch-status-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.faste-data-frontend.yml

@@ -16,6 +16,9 @@ jobs:
  with:
  working-directory: "apps/faste-data-frontend"
  deploy-tag: "#deploy-faste-data-frontend"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-arbeidsforhold-populasjon-service.yml

@@ -17,6 +17,9 @@ jobs:
  with:
  working-directory: "apps/generer-arbeidsforhold-populasjon-service"
  deploy-tag: "#deploy-generer-arbeidsforhold-populasjon-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-navn-service.yml

@@ -18,6 +18,9 @@ jobs:
  with:
  working-directory: "apps/generer-navn-service"
  deploy-tag: "#deploy-generer-navn-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-organisasjon-populasjon-service.yml

@@ -22,6 +22,9 @@ jobs:
  with:
  working-directory: "apps/generer-organisasjon-populasjon-service"
  deploy-tag: "#deploy-generer-organisasjon-populasjon-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-synt-amelding-service.yml

@@ -17,6 +17,9 @@ jobs:
  with:
  working-directory: "apps/generer-synt-amelding-service"
  deploy-tag: "#deploy-generer-synt-amelding-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.geografiske-kodeverk-service.yml

@@ -15,6 +15,9 @@ jobs:
  with:
  working-directory: "apps/geografiske-kodeverk-service"
  deploy-tag: "#deploy-geografiske-kodeverk-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.helsepersonell-service.yml

@@ -18,6 +18,9 @@ jobs:
  with:
  working-directory: "apps/helsepersonell-service"
  deploy-tag: "#deploy-helsepersonell-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.hodejegeren.yml

@@ -17,6 +17,9 @@ jobs:
  cluster: "dev-fss"
  working-directory: "apps/hodejegeren"
  deploy-tag: "#deploy-hodejegeren"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.inntektsmelding-generator-service.yml

@@ -15,6 +15,9 @@ jobs:
  with:
  working-directory: "apps/inntektsmelding-generator-service/"
  deploy-tag: "#deploy-inntektsmelding-generator-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.inntektsmelding-service.yml

@@ -16,6 +16,9 @@ jobs:
  with:
  working-directory: "apps/inntektsmelding-service"
  deploy-tag: "#deploy-inntektsmelding-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.jenkins-batch-status-service.yml

@@ -18,6 +18,9 @@ jobs:
  with:
  working-directory: "apps/jenkins-batch-status-service"
  deploy-tag: "#deploy-jenkins-batch-status-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.joark-dokument-service.yml

@@ -18,6 +18,9 @@ jobs:
  with:
  working-directory: "apps/joark-dokument-service"
  deploy-tag: "#deploy-joark-dokument-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.miljoer-service.yml

@@ -17,6 +17,9 @@ jobs:
  with:
  working-directory: "apps/miljoer-service"
  deploy-tag: "#deploy-miljoer-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.mn-synt-arbeidsforhold-service.yml

@@ -19,6 +19,9 @@ jobs:
  cluster: "dev-fss"
  working-directory: "apps/mn-synt-arbeidsforhold-service"
  deploy-tag: "#deploy-mn-synt-arbeidsforhold-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.oppsummeringsdokument-service.yml

@@ -17,6 +17,9 @@ jobs:
  with:
  working-directory: "apps/oppsummeringsdokument-service"
  deploy-tag: "#deploy-oppsummeringsdokument-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.organisasjon-bestilling-service.yml

@@ -18,6 +18,9 @@ jobs:
  with:
  working-directory: "apps/organisasjon-bestilling-service"
  deploy-tag: "#deploy-organisasjon-bestilling-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.organisasjon-faste-data-service.yml

@@ -22,6 +22,9 @@ jobs:
  with:
  working-directory: "apps/organisasjon-faste-data-service"
  deploy-tag: "#deploy-organisasjon-faste-data-service"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.organisasjon-forvalter.yml

@@ -22,6 +22,9 @@ jobs:
  with:
  working-directory: "apps/organisasjon-forvalter"
  deploy-tag: "#deploy-organisasjon-forvalter"
+ permissions:
+ contents: read
+ id-token: write
  secrets:
  NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
  NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}