Merge branch 'master' into change/skjermingsregister-proxy-azure

# Conflicts:
#	proxies/skjermingsregister-proxy/build.gradle
#	proxies/skjermingsregister-proxy/src/main/java/no/nav/testnav/proxies/skjermingsregisterproxy/LocalVaultConfig.java
#	proxies/skjermingsregister-proxy/src/main/java/no/nav/testnav/proxies/skjermingsregisterproxy/SkjermingsregisterProxyApplicationStarter.java
#	proxies/skjermingsregister-proxy/src/test/java/no/nav/testnav/proxies/skjermingsregisterproxy/ApplicationContextTest.java

.github/workflows/all.workflows.yml

@@ -26,17 +26,21 @@ on:
         required: true
       force-deploy:
         type: boolean
-        description: "Deploy? Make sure the effective working directory contains a NAIS manifest as named below!"
+        description: "Deploy? Make sure the effective working directory contains a NAIS manifest as named below! Note: For dolly-frontend, this will also deploy with config.idporten.yml."
         default: false
       nais-manifest:
         type: string
         description: "Custom NAIS manifest filename."
         default: "config.yml"
       force-deploy-test:
         type: boolean
-        description: "Deploy to test? Make sure the effective working directory contains a config.test.yml!"
+        description: "Deploy to test? Make sure the effective working directory contains a config.test.yml! Note: For dolly-frontend, this will also deploy with config.unstable.yml."
         default: false
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
 
   start:
@@ -58,6 +62,9 @@ jobs:
       deploy-tag: ""
       force-deploy: ${{ inputs.force-deploy }}
       force-deploy-test: ${{ inputs.force-deploy-test }}
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
@@ -73,9 +80,14 @@ jobs:
       working-directory: "${{ inputs.type }}/${{ inputs.name }}"
       image-suffix: ${{ inputs.name }}
       deploy-tag: ""
-      force-deploy: ${{ inputs.force-deploy }}
       nais-manifest: ${{ inputs.nais-manifest }}
+      force-deploy: ${{ inputs.force-deploy }}
       force-deploy-test: ${{ inputs.force-deploy-test }}
+      force-deploy-idporten: ${{ inputs.name == 'dolly-frontend' && inputs.force-deploy }}
+      force-deploy-unstable: ${{ inputs.name == 'dolly-frontend' && inputs.force-deploy-test }}
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.adresse-service.yml

@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/adresse-service"
       deploy-tag: "#deploy-adresse-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.amelding-service.yml

@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/amelding-service"
       deploy-tag: "#deploy-amelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.app-tilgang-analyse-service.yml

@@ -15,6 +15,9 @@ jobs:
     with:
       working-directory: "apps/app-tilgang-analyse-service"
       deploy-tag: "#deploy-app-tilgang-analyse-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.arbeidsforhold-export-api.yml

@@ -17,6 +17,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/arbeidsforhold-export-api"
       deploy-tag: "#deploy-arbeidsforhold-export-api"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.arbeidsforhold-service.yml

@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/arbeidsforhold-service"
       deploy-tag: "#deploy-arbeidsforhold-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.batch-bestilling-service.yml

@@ -19,6 +19,9 @@ jobs:
     with:
       working-directory: "apps/batch-bestilling-service"
       deploy-tag: "#deploy-batch-bestilling-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.brreg-stub.yml

@@ -15,6 +15,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/brreg-stub"
       deploy-tag: "#deploy-brreg-stub"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.bruker-service.yml

@@ -18,6 +18,9 @@ jobs:
       working-directory: "apps/bruker-service"
       deploy-tag: "#deploy-bruker-service"
       deploy-tag-test: "#deploy-test-bruker-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.budpro-service.yml

@@ -0,0 +1,29 @@
+name: budpro-service
+
+on:
+  push:
+    paths:
+      - libs/commands
+      - libs/data-transfer-objects
+      - libs/reactive-core
+      - libs/security-core
+      - libs/servlet-core
+      - libs/servlet-insecure-security
+      - libs/servlet-security
+      - apps/budpro-service/**
+      - .github/workflows/app.budpro-service.yml
+
+jobs:
+  workflow:
+    uses: ./.github/workflows/common.workflow.backend.yml
+    with:
+      working-directory: "apps/budpro-service"
+      deploy-tag: "#deploy-budpro-service"
+    permissions:
+      contents: read
+      id-token: write
+    secrets:
+      NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
+      NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
+      NAV_TOKEN: ${{ secrets.NAV_TOKEN }}
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/app.dolly-backend.yml

@@ -20,6 +20,9 @@ jobs:
       working-directory: "apps/dolly-backend"
       deploy-tag: "#deploy-dolly-backend"
       deploy-tag-test: "#deploy-test-dolly-backend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.dolly-frontend.yml

@@ -31,6 +31,9 @@ jobs:
       deploy-tag-test: "#deploy-test-frontend"
       deploy-tag-idporten: "#deploy-idporten-frontend"
       deploy-tag-unstable: "#deploy-unstable-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.dollystatus.yml

@@ -12,6 +12,9 @@ jobs:
     with:
       working-directory: "apps/dollystatus"
       deploy-tag: "#deploy-dollystatus"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.endringsmelding-frontend.yml

@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/endringsmelding-frontend"
       deploy-tag: "#deploy-endringsmelding-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.endringsmelding-service.yml

@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/endringsmelding-service"
       deploy-tag: "#deploy-endringsmelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.ereg-batch-status-service.yml

@@ -17,6 +17,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/ereg-batch-status-service"
       deploy-tag: "#deploy-ereg-batch-status-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.faste-data-frontend.yml

@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/faste-data-frontend"
       deploy-tag: "#deploy-faste-data-frontend"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-arbeidsforhold-populasjon-service.yml

@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/generer-arbeidsforhold-populasjon-service"
       deploy-tag: "#deploy-generer-arbeidsforhold-populasjon-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-navn-service.yml

@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/generer-navn-service"
       deploy-tag: "#deploy-generer-navn-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-organisasjon-populasjon-service.yml

@@ -22,6 +22,9 @@ jobs:
     with:
       working-directory: "apps/generer-organisasjon-populasjon-service"
       deploy-tag: "#deploy-generer-organisasjon-populasjon-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.generer-synt-amelding-service.yml

@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/generer-synt-amelding-service"
       deploy-tag: "#deploy-generer-synt-amelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.geografiske-kodeverk-service.yml

@@ -15,6 +15,9 @@ jobs:
     with:
       working-directory: "apps/geografiske-kodeverk-service"
       deploy-tag: "#deploy-geografiske-kodeverk-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.helsepersonell-service.yml

@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/helsepersonell-service"
       deploy-tag: "#deploy-helsepersonell-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.hodejegeren.yml

@@ -17,6 +17,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/hodejegeren"
       deploy-tag: "#deploy-hodejegeren"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.inntektsmelding-generator-service.yml

@@ -15,6 +15,9 @@ jobs:
     with:
       working-directory: "apps/inntektsmelding-generator-service/"
       deploy-tag: "#deploy-inntektsmelding-generator-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.inntektsmelding-service.yml

@@ -16,6 +16,9 @@ jobs:
     with:
       working-directory: "apps/inntektsmelding-service"
       deploy-tag: "#deploy-inntektsmelding-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.jenkins-batch-status-service.yml

@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/jenkins-batch-status-service"
       deploy-tag: "#deploy-jenkins-batch-status-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.joark-dokument-service.yml

@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/joark-dokument-service"
       deploy-tag: "#deploy-joark-dokument-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.miljoer-service.yml

@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/miljoer-service"
       deploy-tag: "#deploy-miljoer-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.mn-synt-arbeidsforhold-service.yml

@@ -19,6 +19,9 @@ jobs:
       cluster: "dev-fss"
       working-directory: "apps/mn-synt-arbeidsforhold-service"
       deploy-tag: "#deploy-mn-synt-arbeidsforhold-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.oppsummeringsdokument-service.yml

@@ -17,6 +17,9 @@ jobs:
     with:
       working-directory: "apps/oppsummeringsdokument-service"
       deploy-tag: "#deploy-oppsummeringsdokument-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.organisasjon-bestilling-service.yml

@@ -18,6 +18,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-bestilling-service"
       deploy-tag: "#deploy-organisasjon-bestilling-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.organisasjon-faste-data-service.yml

@@ -22,6 +22,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-faste-data-service"
       deploy-tag: "#deploy-organisasjon-faste-data-service"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

.github/workflows/app.organisasjon-forvalter.yml

@@ -22,6 +22,9 @@ jobs:
     with:
       working-directory: "apps/organisasjon-forvalter"
       deploy-tag: "#deploy-organisasjon-forvalter"
+    permissions:
+      contents: read
+      id-token: write
     secrets:
       NAIS_DOLLY_DEPLOY_API_KEY: ${{ secrets.NAIS_DOLLY_DEPLOY_API_KEY }}
       NAIS_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}