Initial repository instance commit

[J4bbi]

This is the initial InvenioRDM repository instance commit.

This was generated by running the command:

invenio-cli init rdm -c v12.0

The configuration file has placeholder values.

[J4bbi]

@cutoffthetop do you have a preference for how the status checks should be processed?

[cutoffthetop]

@cutoffthetop do you have a preference for how the status checks should be processed?

@J4bbi sorry, our standard branch rule-set was blocking this PR from being merged. i loosened that up for the time being.

in our other repos, we have a few standardized workflows in our template repository. we use pdm for dependency management, pytest for testing, ruff for linting and trivy for cve scans. but since invenio comes with its own setup style and best practices, i would leave that up to you.

maybe you could configure aquasecurity/trivy-action though, so we have a common cve scanner?

[J4bbi]

@cutoffthetop I've set up a basic trivy scan that only fails at critical vulnerabilities.

this is not ideal because there is a vulnerability of high severity to werkzeug: CVE-2023-46136

Version 1.4.0 of the invenio-base package has pinned werkzeug to <2.3.0 because a higher version breaks other packages (this has been fixed in invenio-base v. 2.0.0). This is not sustainable but is the current situation. See issue.

[cutoffthetop]

@cutoffthetop I've set up a basic trivy scan that only fails at critical vulnerabilities.

this is not ideal because there is a vulnerability of high severity to werkzeug: CVE-2023-46136

Version 1.4.0 of the invenio-base package has pinned werkzeug to <2.3.0 because a higher version breaks other packages (this has been fixed in invenio-base v. 2.0.0). This is not sustainable but is the current situation. See issue.

@J4bbi thanks for looking into it. let's keep an eye on this and hope it'll get patched upstream. besides, i don't think we will need to expose multipart/form-data endpoints anyway.