releases: publish nightly builds of dev

[valentijnscholten]

This PR uses the existing building blocks in our workflows to push a nightly build of the dev branch.

This is useful to user who want to test fixes or new features only available in dev. Or users who just want to run of dev which is very stable for Defect Dojo.

This PR also changes github.event.inputs.xxxx to inputs.xxx. This cost me a lot of time as the old input uses values provided in the UI when starting the workflow ignoring any values provided by the workflow files themselves.

I also tried to publish a nightly bugfix release. But the bugfix branch doesn't get its own version number. We have to decide if it's useful to publish these builds since we have a weekly release cadence for bugfix.

[dryrunsecurity]

DryRun Security Summary

GitHub Actions workflow updates for DefectDojo release processes reveal security vulnerabilities related to secrets handling, input validation, hardcoded credentials, cron scheduling, and workflow permissions.

Expand for full summary

Summary: GitHub Actions workflow patches for DefectDojo release processes, focusing on syntax updates, input handling, and release automation across multiple workflow files.

Security Findings:

1. Secrets Handling Vulnerability

   • Multiple workflows use secrets: inherit, which could potentially expose more secrets than necessary
   • Risk: Unintended secret exposure across workflows

2. Input Validation Weakness

   • Limited or no explicit input validation across workflows
   • Potential risk of input injection or unexpected behavior
   • Specifically noted in workflows like release-x-manual-merge-container-digests.yml

3. Hardcoded Environment Variables

   • Several workflows use predefined, static Git usernames and email addresses
   • While not a critical vulnerability, could potentially be exploited if credentials are predictable

4. Cron Syntax Issue

   • In release-nightly-dev.yml, the cron expression appears incorrect
   • Could lead to unexpected or missed scheduled builds

5. Workflow Permission Considerations

   • No explicit workflow permissions defined in most workflows
   • Relies on default GitHub Actions permissions
   • Potential risk of overly broad access

View PR in the DryRun Dashboard.

[mtesauro]

Approved