diff --git a/.github/workflows/chart-release-dispatcher.yaml b/.github/workflows/chart-release-dispatcher.yaml
index 10fc6cbdb0..ecc4348768 100644
--- a/.github/workflows/chart-release-dispatcher.yaml
+++ b/.github/workflows/chart-release-dispatcher.yaml
@@ -29,7 +29,7 @@ jobs:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@v3
with:
- token: ${{ secrets.my_pat }}
+ token: ${{ secrets.ORG_PAT_GITHUB }}
ref: ${{ steps.extract_branch.outputs.branch }}
fetch-depth: 0
@@ -50,10 +50,10 @@ jobs:
- name: Get PR url and PR User
id: get_pr_url_user
run: |
- head_sha=$(curl -s -H "Authorization: Bearer ${{ secrets.my_pat }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}/jobs" | jq -r '.jobs[0].head_sha')
+ head_sha=$(curl -s -H "Authorization: Bearer ${{ secrets.ORG_PAT_GITHUB }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}/jobs" | jq -r '.jobs[0].head_sha')
echo "Head SHA: $head_sha"
- pr_url=$(curl -s -H "Authorization: Bearer ${{ secrets.my_pat }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/search/issues?q=sha:$head_sha+type:pr" | jq -r '.items[0].html_url')
- pr_user=$(curl -s -H "Authorization: Bearer ${{ secrets.my_pat }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/search/issues?q=sha:$head_sha+type:pr" | jq -r '.items[0].user.login')
+ pr_url=$(curl -s -H "Authorization: Bearer ${{ secrets.ORG_PAT_GITHUB }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/search/issues?q=sha:$head_sha+type:pr" | jq -r '.items[0].html_url')
+ pr_user=$(curl -s -H "Authorization: Bearer ${{ secrets.ORG_PAT_GITHUB }}" -H "Accept: application/vnd.github.v3+json" "https://api.github.com/search/issues?q=sha:$head_sha+type:pr" | jq -r '.items[0].user.login')
echo "pr_url=$pr_url" >> $GITHUB_OUTPUT
echo "pr_user=$pr_user" >> $GITHUB_OUTPUT
@@ -65,7 +65,7 @@ jobs:
- name: Repository Dispatch
uses: peter-evans/repository-dispatch@v2
with:
- token: ${{ secrets.my_pat }}
+ token: ${{ secrets.ORG_PAT_GITHUB }}
repository: ${{ matrix.repo }}
event-type: dispatch_chart_release_workflow
client-payload: |-
diff --git a/.github/workflows/github-actions-pr-jira.yaml b/.github/workflows/github-actions-pr-jira.yaml
new file mode 100644
index 0000000000..76cd01ab38
--- /dev/null
+++ b/.github/workflows/github-actions-pr-jira.yaml
@@ -0,0 +1,14 @@
+name: GitHub-Jira Link Action
+run-name: ${{ github.actor }} is ensuring Jira ID is present in PR title
+on:
+ pull_request:
+ types: [opened, edited, synchronize, reopened]
+ branches: [main, staging, master, beta, develop, prod, development]
+
+jobs:
+ Enforce-GitHub-Jira-Link-Action:
+ runs-on: ubuntu-latest
+ if: ${{ !contains(fromJson('["main", "staging", "master", "beta", "develop", "prod", "development"]'), github.event.pull_request.head.ref) }}
+ steps:
+ - name: Enforce Pull Request Title includes Jira Issue Key
+ uses: ryanvade/enforce-pr-title-style-action@v2.1.1
\ No newline at end of file
diff --git a/.github/workflows/main-ecr.yml b/.github/workflows/main-ecr.yml
index acb8883f8d..2a64a38c27 100644
--- a/.github/workflows/main-ecr.yml
+++ b/.github/workflows/main-ecr.yml
@@ -196,4 +196,4 @@ jobs:
${{ steps.login-ecr.outputs.registry }}/atlanhq/${{ github.event.repository.name }}:${{ steps.get_branch.outputs.branch }}-${{ steps.semver_tag.outputs.new_tag }}
build-args: |
ACCESS_TOKEN_USR=$GITHUB_ACTOR
- ACCESS_TOKEN_PWD=${{ secrets.my_pat }}
\ No newline at end of file
+ ACCESS_TOKEN_PWD=${{ secrets.ORG_PAT_GITHUB }}
\ No newline at end of file
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 0977cb36a2..f8a09b5589 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -58,7 +58,7 @@ jobs:
[{
"id": "github",
"username": "atlan-ci",
- "password": "${{ secrets.my_pat }}"
+ "password": "${{ secrets.ORG_PAT_GITHUB }}"
}]
- name: Build with Maven
@@ -77,7 +77,7 @@ jobs:
shell: bash
- name: Get version tag
- run: echo "##[set-output name=version;]$(echo `git ls-remote https://${{ secrets.my_pat }}@github.com/atlanhq/${REPOSITORY_NAME}.git ${{ steps.get_branch.outputs.branch }} | awk '{ print $1}' | cut -c1-7`)abcd"
+ run: echo "##[set-output name=version;]$(echo `git ls-remote https://${{ secrets.ORG_PAT_GITHUB }}@github.com/atlanhq/${REPOSITORY_NAME}.git ${{ steps.get_branch.outputs.branch }} | awk '{ print $1}' | cut -c1-7`)abcd"
id: get_version
- name: Set up Buildx
@@ -89,7 +89,7 @@ jobs:
with:
registry: ghcr.io
username: $GITHUB_ACTOR
- password: ${{ secrets.my_pat }}
+ password: ${{ secrets.ORG_PAT_GITHUB }}
- name: Build and push
id: docker_build
diff --git a/.github/workflows/trivy-docker-scan.yml b/.github/workflows/trivy-docker-scan.yml
index 6be78e7552..f910348903 100644
--- a/.github/workflows/trivy-docker-scan.yml
+++ b/.github/workflows/trivy-docker-scan.yml
@@ -29,7 +29,7 @@ jobs:
output: 'trivy-results-docker.sarif'
exit-code: '1'
#ignore-unfixed: true
- severity: 'CRITICAL,HIGH,MEDIUM'
+ severity: 'CRITICAL,HIGH'
- name: Upload Trivy Docker Scan Results To GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
diff --git a/common/src/main/java/org/apache/atlas/repository/Constants.java b/common/src/main/java/org/apache/atlas/repository/Constants.java
index accea8ec88..a5529cf397 100644
--- a/common/src/main/java/org/apache/atlas/repository/Constants.java
+++ b/common/src/main/java/org/apache/atlas/repository/Constants.java
@@ -366,6 +366,10 @@ public final class Constants {
public static final String IMPALA_SOURCE = "impala";
public static final String STORM_SOURCE = "storm";
public static final String FILE_SPOOL_SOURCE = "file_spool";
+ public static final String ASSET_POLICY_GUIDS = "assetPolicyGUIDs";
+ public static final String ASSET_POLICIES_COUNT = "assetPoliciesCount";
+
+
/*
* All supported file-format extensions for Bulk Imports through file upload
diff --git a/intg/src/main/java/org/apache/atlas/model/instance/LinkBusinessPolicyRequest.java b/intg/src/main/java/org/apache/atlas/model/instance/LinkBusinessPolicyRequest.java
new file mode 100644
index 0000000000..e42fd4ad55
--- /dev/null
+++ b/intg/src/main/java/org/apache/atlas/model/instance/LinkBusinessPolicyRequest.java
@@ -0,0 +1,74 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.atlas.model.instance;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+
+import javax.xml.bind.annotation.XmlAccessType;
+import javax.xml.bind.annotation.XmlAccessorType;
+import javax.xml.bind.annotation.XmlRootElement;
+import java.io.Serializable;
+import java.util.List;
+import java.util.Set;
+
+import static com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility.NONE;
+import static com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility.PUBLIC_ONLY;
+
+/**
+ * Request to link/unlink policies from asset.
+ */
+@JsonAutoDetect(getterVisibility = PUBLIC_ONLY, setterVisibility = PUBLIC_ONLY, fieldVisibility = NONE)
+@JsonSerialize(include = JsonSerialize.Inclusion.NON_NULL)
+@JsonIgnoreProperties(ignoreUnknown = true)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@XmlRootElement
+@XmlAccessorType(XmlAccessType.PROPERTY)
+public class LinkBusinessPolicyRequest implements Serializable {
+ private static final long serialVersionUID = 1L;
+
+ private Set linkGuids;
+ private Set unlinkGuids;
+
+ public Set getLinkGuids() {
+ return linkGuids;
+ }
+
+ public void setLinkGuids(Set linkGuids) {
+ this.linkGuids = linkGuids;
+ }
+
+ public Set getUnlinkGuids() {
+ return unlinkGuids;
+ }
+
+ public void setUnlinkGuids(Set unlinkGuids) {
+ this.unlinkGuids = unlinkGuids;
+ }
+
+ @Override
+ public String toString() {
+ final StringBuilder sb = new StringBuilder("LinkBusinessPolicyRequest{");
+ sb.append("linkGuids=").append(linkGuids);
+ sb.append(", unlinkGuids=").append(unlinkGuids);
+ sb.append('}');
+ return sb.toString();
+ }
+}
diff --git a/repository/src/main/java/org/apache/atlas/repository/graph/GraphHelper.java b/repository/src/main/java/org/apache/atlas/repository/graph/GraphHelper.java
index 179d915df9..d5926e8a00 100755
--- a/repository/src/main/java/org/apache/atlas/repository/graph/GraphHelper.java
+++ b/repository/src/main/java/org/apache/atlas/repository/graph/GraphHelper.java
@@ -540,7 +540,8 @@ public static List getPropagatedVerticesIds (AtlasVertex classificationV
}
public static boolean hasEntityReferences(AtlasVertex classificationVertex) {
- return classificationVertex.hasEdges(AtlasEdgeDirection.IN, CLASSIFICATION_LABEL);
+ Iterator edgeIterator = classificationVertex.query().direction(AtlasEdgeDirection.IN).label(CLASSIFICATION_LABEL).edges(1).iterator();
+ return edgeIterator != null && edgeIterator.hasNext();
}
public static List getAllPropagatedEntityVertices(AtlasVertex classificationVertex) {
diff --git a/repository/src/main/java/org/apache/atlas/repository/store/aliasstore/ESAliasStore.java b/repository/src/main/java/org/apache/atlas/repository/store/aliasstore/ESAliasStore.java
index ddd57e2664..2d272cb8fc 100644
--- a/repository/src/main/java/org/apache/atlas/repository/store/aliasstore/ESAliasStore.java
+++ b/repository/src/main/java/org/apache/atlas/repository/store/aliasstore/ESAliasStore.java
@@ -65,6 +65,7 @@
@Component
public class ESAliasStore implements IndexAliasStore {
private static final Logger LOG = LoggerFactory.getLogger(ESAliasStore.class);
+ public static final String NEW_WILDCARD_DOMAIN_SUPER = "default/domain/*/super";
private final AtlasGraph graph;
private final EntityGraphRetriever entityRetriever;
@@ -214,7 +215,11 @@ private void personaPolicyToESDslClauses(List policies,
} else if (getPolicyActions(policy).contains(ACCESS_READ_PERSONA_DOMAIN)) {
for (String asset : assets) {
- terms.add(asset);
+ if(!isAllDomain(asset)) {
+ terms.add(asset);
+ } else {
+ asset = NEW_WILDCARD_DOMAIN_SUPER;
+ }
allowClauseList.add(mapOf("wildcard", mapOf(QUALIFIED_NAME, asset + "*")));
}
@@ -246,6 +251,9 @@ private void personaPolicyToESDslClauses(List policies,
allowClauseList.add(mapOf("terms", mapOf(QUALIFIED_NAME, terms)));
}
+ private boolean isAllDomain(String asset) {
+ return asset.equals("*/super") || asset.equals("*") || asset.equals(NEW_WILDCARD_DOMAIN_SUPER);
+ }
private Map esClausesToFilter(List