feat: zip support for bundled app references [DHIS2-16755]

[Philip-Larsen-Donnelly]

Allows apps-to-bundle.json to reference zip files.
(examples from either App Hup [app-management-app], or GitHub release [capture-app])

    "https://apps.dhis2.org/api/v2/apps/28823170-1203-46d1-81d5-eea67abae41c/download/app-management_100.2.32.zip",
    "https://github.com/d2-ci/cache-cleaner-app",
    "https://github.com/dhis2/capture-app/releases/download/v100.53.0/capture-100.53.0.zip",
    "https://github.com/d2-ci/dashboard-app",

We lose a little information on branches and commits, so the bundled-apps.json ends up like this (which I think is OK):

  {
    "name": "app-management",
    "webName": "dhis-web-app-management",
    "version": "100.2.32",
    "buildDate": "Fri Dec 15 2023 08:42:12 GMT+0000 (Coordinated Universal Time)",
    "sourceRepo": "https://apps.dhis2.org/api/v2/apps/28823170-1203-46d1-81d5-eea67abae41c/download/app-management_100.2.32.zip",
    "sourceRef": "Bundled from zip file",
    "source": "https://apps.dhis2.org/api/v2/apps/28823170-1203-46d1-81d5-eea67abae41c/download/app-management_100.2.32.zip#"
  },
  {
    "name": "cache-cleaner",
    "webName": "dhis-web-cache-cleaner",
    "version": "100.1.14",
    "buildDate": "Sun Jan 21 01:55:38 2024 +0000",
    "sourceRepo": "https://github.com/d2-ci/cache-cleaner-app",
    "sourceRef": "master",
    "source": "https://github.com/d2-ci/cache-cleaner-app#8ab5f2a61deba6d1584f0e66c0152bfd0e193267"
  },
  {
    "name": "capture",
    "webName": "dhis-web-capture",
    "version": "100.53.0",
    "buildDate": "Fri Jan 26 2024 09:06:53 GMT+0000 (Coordinated Universal Time)",
    "sourceRepo": "https://github.com/dhis2/capture-app/releases/download/v100.53.0/capture-100.53.0.zip",
    "sourceRef": "Bundled from zip file",
    "source": "https://github.com/dhis2/capture-app/releases/download/v100.53.0/capture-100.53.0.zip#"
  },
  {
    "name": "dashboard",
    "webName": "dhis-web-dashboard",
    "version": "100.0.4",
    "buildDate": "Mon Nov 6 12:42:42 2023 +0000",
    "sourceRepo": "https://github.com/d2-ci/dashboard-app",
    "sourceRef": "master",
    "source": "https://github.com/d2-ci/dashboard-app#80af2020a6276d4c15bd8208fe0961d938fbc35a"
  },

I get the app name and build date from the manifest.webapp.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 66.72%. Comparing base (8203767) to head (bffe479).
Report is 1046 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##             master   #16455   +/-   ##
=========================================
  Coverage     66.71%   66.72%           
- Complexity    31791    31799    +8     
=========================================
  Files          3531     3531           
  Lines        130868   130868           
  Branches      15245    15245           
=========================================
+ Hits          87311    87320    +9     
+ Misses        36435    36429    -6     
+ Partials       7122     7119    -3     

Flag	Coverage Δ
integration	50.18% <ø> (+<0.01%)	⬆️
integration-h2	32.84% <ø> (-0.01%)	⬇️
unit	30.58% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 8 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8203767...bffe479. Read the comment docs.

[sonarqubecloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[Philip-Larsen-Donnelly]

@amcgee this uses a very simple approach where the URL is just checked for the .zip extension, which triggers an alternate download and extraction process. A nice improvement would be to support more structure in the apps-to-bundle.json; i.e. a list of objects rather than a list of strings, then we could indicate different package types.

It would also be useful to be able to have rolling references to e.g. "latest" and then determine the version from the App Hub API. As it is it just supports explicit versions - but that is still very useful for the release candidates and final releases. We might wish to accompany this with signing packages (i.e. signing the packages at built time and publishing the signature files on App Hub/GitHub, then verifying the signatures during the bundling process.

[amcgee]

Very delayed review. Generally this looks good and quite straight-forward. I added one comment about cleaning up straggling files in case of an error

[amcgee]

(very delayed) I think we should remove any generated files here - for example, if the app is successfully extracted to temp_path but the webapp.manifest file isn't valid json the require will throw and you'll end up with an orphaned directory

[github-actions]

This PR has not seen any activity in the last 5 months. The PR will be closed in 30 days if the stale label is not removed.

Please note that this is an automated message and we might very well be the reason why there has not been any activity lately.

Please remove the stale label if you would like to continue working on the PR. Make sure that you have requested a review by a dev or a team https://github.com/orgs/dhis2/teams.