feat: include avatar

.gitea/workflows/ci.yml

@@ -8,35 +8,32 @@ on:
       - main
 
 jobs:
-  ci:
+  lint:
-    name: CI
+    name: Lint and Test
-    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Source Files
         uses: actions/checkout@v4
 
-      - name: Use Node.js v24
+      - name: Use Node.js v22
         uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: 22
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v2
         with:
-          version: 10
+          version: 9
-
-      - name: Ensure Dependencies are Pinned
-        uses: naomi-lgbt/dependency-pin-check@main
-        with:
-          language: javascript
-          dev-dependencies: true
-          peer-dependencies: true
-          optional-dependencies: true
 
       - name: Install Dependencies
         run: pnpm install
 
+      - name: Build internal package
+        run: cd packages/types && pnpm build
+
+      - name: Install again
+        run: pnpm install
+
       - name: Lint Source Files
         run: pnpm run lint
 

.gitea/workflows/security.yml

@@ -1,177 +0,0 @@
-name: Security Scan and Upload
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-  schedule:
-    - cron: '0 0 * * 1'
-  workflow_dispatch:
-
-jobs:
-  security-audit:
-    name: Security & DefectDojo Upload
-    runs-on: ubuntu-latest
-    continue-on-error: true
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      # --- AUTO-SETUP PROJECT ---
-      - name: Ensure DefectDojo Product Exists
-        env:
-          DD_URL: ${{ secrets.DD_URL }}
-          DD_TOKEN: ${{ secrets.DD_TOKEN }}
-          PRODUCT_NAME: ${{ github.repository }} 
-          PRODUCT_TYPE_ID: 1 
-        run: |
-          sudo apt-get install jq -y > /dev/null
-          
-          echo "Checking connection to $DD_URL..."
-          
-          # Check if product exists - capture HTTP code to debug connection issues
-          RESPONSE=$(curl --write-out "%{http_code}" --silent --output /tmp/response.json \
-            -H "Authorization: Token $DD_TOKEN" \
-            "$DD_URL/api/v2/products/?name=$PRODUCT_NAME")
-          
-          # If response is not 200, print error
-          if [ "$RESPONSE" != "200" ]; then
-            echo "::error::Failed to query DefectDojo. HTTP Code: $RESPONSE"
-            cat /tmp/response.json
-            exit 1
-          fi
-
-          COUNT=$(cat /tmp/response.json | jq -r '.count')
-          
-          if [ "$COUNT" = "0" ]; then
-            echo "Creating product '$PRODUCT_NAME'..."
-            curl -s -X POST "$DD_URL/api/v2/products/" \
-              -H "Authorization: Token $DD_TOKEN" \
-              -H "Content-Type: application/json" \
-              -d '{ "name": "'"$PRODUCT_NAME"'", "description": "Auto-created by Gitea Actions", "prod_type": '$PRODUCT_TYPE_ID' }'
-          else
-            echo "Product '$PRODUCT_NAME' already exists."
-          fi
-
-      # --- 1. TRIVY (Dependencies & Misconfig) ---
-      - name: Install Trivy
-        run: |
-          sudo apt-get install wget apt-transport-https gnupg lsb-release -y
-          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
-          echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
-          sudo apt-get update && sudo apt-get install trivy -y
-
-      - name: Run Trivy (FS Scan)
-        run: |
-          trivy fs . --scanners vuln,misconfig --format json --output trivy-results.json --exit-code 0
-
-      - name: Upload Trivy to DefectDojo
-        env:
-          DD_URL: ${{ secrets.DD_URL }}
-          DD_TOKEN: ${{ secrets.DD_TOKEN }}
-        run: |
-          echo "Uploading Trivy results..."
-          # Generate today's date in YYYY-MM-DD format
-          TODAY=$(date +%Y-%m-%d)
-          
-          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
-            -H "Authorization: Token $DD_TOKEN" \
-            -F "active=true" \
-            -F "verified=true" \
-            -F "scan_type=Trivy Scan" \
-            -F "engagement_name=CI/CD Pipeline" \
-            -F "product_name=${{ github.repository }}" \
-            -F "scan_date=$TODAY" \
-            -F "auto_create_context=true" \
-            -F "file=@trivy-results.json")
-          
-          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
-            echo "::error::Upload Failed with HTTP $HTTP_CODE"
-            echo "--- SERVER RESPONSE ---"
-            cat response.txt
-            echo "-----------------------"
-            exit 1
-          else
-            echo "Upload Success!"
-          fi
-
-      # --- 2. GITLEAKS (Secrets) ---
-      - name: Install Gitleaks
-        run: |
-          wget -qO gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.18.0/gitleaks_8.18.0_linux_x64.tar.gz
-          tar -xzf gitleaks.tar.gz
-          sudo mv gitleaks /usr/local/bin/ && chmod +x /usr/local/bin/gitleaks
-
-      - name: Run Gitleaks
-        run: gitleaks detect --source . -v --report-path gitleaks-results.json --report-format json --no-git || true
-
-      - name: Upload Gitleaks to DefectDojo
-        env:
-          DD_URL: ${{ secrets.DD_URL }}
-          DD_TOKEN: ${{ secrets.DD_TOKEN }}
-        run: |
-          echo "Uploading Gitleaks results..."  
-          TODAY=$(date +%Y-%m-%d)
-
-          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
-            -H "Authorization: Token $DD_TOKEN" \
-            -F "active=true" \
-            -F "verified=true" \
-            -F "scan_type=Gitleaks Scan" \
-            -F "engagement_name=CI/CD Pipeline" \
-            -F "product_name=${{ github.repository }}" \
-            -F "scan_date=$TODAY" \
-            -F "auto_create_context=true" \
-            -F "file=@gitleaks-results.json")
-
-          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
-             echo "::error::Upload Failed with HTTP $HTTP_CODE"
-             echo "--- SERVER RESPONSE ---"
-             cat response.txt
-             echo "-----------------------"
-             exit 1
-          else
-             echo "Upload Success!"
-          fi
-
-      # --- 3. SEMGREP (SAST) ---
-      - name: Install Semgrep (via pipx)
-        run: |
-          sudo apt-get install pipx -y
-          pipx install semgrep
-          # Add pipx binary path to GITHUB_PATH so next steps can see 'semgrep'
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
-
-      - name: Run Semgrep
-        run: semgrep scan --config=p/security-audit --config=p/owasp-top-ten --json --output semgrep-results.json . || true
-
-      - name: Upload Semgrep to DefectDojo
-        env:
-          DD_URL: ${{ secrets.DD_URL }}
-          DD_TOKEN: ${{ secrets.DD_TOKEN }}
-        run: |
-          echo "Uploading Semgrep results..."
-          TODAY=$(date +%Y-%m-%d)
-          
-          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
-            -H "Authorization: Token $DD_TOKEN" \
-            -F "active=true" \
-            -F "verified=true" \
-            -F "scan_type=Semgrep JSON Report" \
-            -F "engagement_name=CI/CD Pipeline" \
-            -F "product_name=${{ github.repository }}" \
-            -F "scan_date=$TODAY" \
-            -F "auto_create_context=true" \
-            -F "file=@semgrep-results.json")
-
-          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
-             echo "::error::Upload Failed with HTTP $HTTP_CODE"
-             echo "--- SERVER RESPONSE ---"
-             cat response.txt
-             echo "-----------------------"
-             exit 1
-          else
-             echo "Upload Success!"
-          fi

.gitea/workflows/sonar.yml

@@ -0,0 +1,34 @@
+name: Code Analysis
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  sonar:
+    name: SonarQube
+
+    steps:
+      - name: Checkout Source Files
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: SonarCube Scan
+        uses: SonarSource/sonarqube-scan-action@v4
+        timeout-minutes: 10
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: "https://quality.nhcarrigan.com"
+        with:
+          args: >
+            -Dsonar.sources=.
+            -Dsonar.projectKey=nutrition-tracker
+
+      - name: SonarQube Quality Gate check
+        uses: sonarsource/sonarqube-quality-gate-action@v1
+        with:
+          pollingTimeoutSec: 600
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: "https://quality.nhcarrigan.com"

README.md

@@ -8,7 +8,7 @@ This page is currently deployed. [View the live website.](https://vitalia.nhcarr
 
 ## Feedback and Bugs
 
-If you have feedback or a bug report, please [log a ticket on our forum](https://support.nhcarrigan.com).
+If you have feedback or a bug report, please feel free to open a GitHub issue!
 
 ## Contributing
 

package.json

@@ -18,7 +18,7 @@
     "@nhcarrigan/eslint-config": "5.2.0",
     "eslint": "9.26.0",
     "prisma": "6.7.0",
-    "turbo": "2.8.10"
+    "turbo": "2.5.3"
   },
   "dependencies": {
     "@prisma/client": "6.7.0"

pnpm-lock.yaml

@@ -22,8 +22,8 @@ importers:
         specifier: 6.7.0
         version: 6.7.0(typescript@5.8.3)
       turbo:
-        specifier: 2.8.10
+        specifier: 2.5.3
-        version: 2.8.10
+        version: 2.5.3
 
   client:
     dependencies:
@@ -5244,38 +5244,38 @@ packages:
     resolution: {integrity: sha512-+68OP1ZzSF84rTckf3FA95vJ1Zlx/uaXyiiKyPd1pA4rZNkpEvDAKmsu1xUSmbF/chCRYgZ6UZkDwC7PmzmAyA==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
-  turbo-darwin-64@2.8.10:
+  turbo-darwin-64@2.5.3:
-    resolution: {integrity: sha512-A03fXh+B7S8mL3PbdhTd+0UsaGrhfyPkODvzBDpKRY7bbeac4MDFpJ7I+Slf2oSkCEeSvHKR7Z4U71uKRUfX7g==}
+    resolution: {integrity: sha512-YSItEVBUIvAGPUDpAB9etEmSqZI3T6BHrkBkeSErvICXn3dfqXUfeLx35LfptLDEbrzFUdwYFNmt8QXOwe9yaw==}
     cpu: [x64]
     os: [darwin]
 
-  turbo-darwin-arm64@2.8.10:
+  turbo-darwin-arm64@2.5.3:
-    resolution: {integrity: sha512-sidzowgWL3s5xCHLeqwC9M3s9M0i16W1nuQF3Mc7fPHpZ+YPohvcbVFBB2uoRRHYZg6yBnwD4gyUHKTeXfwtXA==}
+    resolution: {integrity: sha512-5PefrwHd42UiZX7YA9m1LPW6x9YJBDErXmsegCkVp+GjmWrADfEOxpFrGQNonH3ZMj77WZB2PVE5Aw3gA+IOhg==}
     cpu: [arm64]
     os: [darwin]
 
-  turbo-linux-64@2.8.10:
+  turbo-linux-64@2.5.3:
-    resolution: {integrity: sha512-YK9vcpL3TVtqonB021XwgaQhY9hJJbKKUhLv16osxV0HkcQASQWUqR56yMge7puh6nxU67rQlTq1b7ksR1T3KA==}
+    resolution: {integrity: sha512-M9xigFgawn5ofTmRzvjjLj3Lqc05O8VHKuOlWNUlnHPUltFquyEeSkpQNkE/vpPdOR14AzxqHbhhxtfS4qvb1w==}
     cpu: [x64]
     os: [linux]
 
-  turbo-linux-arm64@2.8.10:
+  turbo-linux-arm64@2.5.3:
-    resolution: {integrity: sha512-3+j2tL0sG95iBJTm+6J8/45JsETQABPqtFyYjVjBbi6eVGdtNTiBmHNKrbvXRlQ3ZbUG75bKLaSSDHSEEN+btQ==}
+    resolution: {integrity: sha512-auJRbYZ8SGJVqvzTikpg1bsRAsiI9Tk0/SDkA5Xgg0GdiHDH/BOzv1ZjDE2mjmlrO/obr19Dw+39OlMhwLffrw==}
     cpu: [arm64]
     os: [linux]
 
-  turbo-windows-64@2.8.10:
+  turbo-windows-64@2.5.3:
-    resolution: {integrity: sha512-hdeF5qmVY/NFgiucf8FW0CWJWtyT2QPm5mIsX0W1DXAVzqKVXGq+Zf+dg4EUngAFKjDzoBeN6ec2Fhajwfztkw==}
+    resolution: {integrity: sha512-arLQYohuHtIEKkmQSCU9vtrKUg+/1TTstWB9VYRSsz+khvg81eX6LYHtXJfH/dK7Ho6ck+JaEh5G+QrE1jEmCQ==}
     cpu: [x64]
     os: [win32]
 
-  turbo-windows-arm64@2.8.10:
+  turbo-windows-arm64@2.5.3:
-    resolution: {integrity: sha512-QGdr/Q8LWmj+ITMkSvfiz2glf0d7JG0oXVzGL3jxkGqiBI1zXFj20oqVY0qWi+112LO9SVrYdpHS0E/oGFrMbQ==}
+    resolution: {integrity: sha512-3JPn66HAynJ0gtr6H+hjY4VHpu1RPKcEwGATvGUTmLmYSYBQieVlnGDRMMoYN066YfyPqnNGCfhYbXfH92Cm0g==}
     cpu: [arm64]
     os: [win32]
 
-  turbo@2.8.10:
+  turbo@2.5.3:
-    resolution: {integrity: sha512-OxbzDES66+x7nnKGg2MwBA1ypVsZoDTLHpeaP4giyiHSixbsiTaMyeJqbEyvBdp5Cm28fc+8GG6RdQtic0ijwQ==}
+    resolution: {integrity: sha512-iHuaNcq5GZZnr3XDZNuu2LSyCzAOPwDuo5Qt+q64DfsTP1i3T2bKfxJhni2ZQxsvAoxRbuUK5QetJki4qc5aYA==}
     hasBin: true
 
   type-check@0.4.0:
@@ -11596,32 +11596,32 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  turbo-darwin-64@2.8.10:
+  turbo-darwin-64@2.5.3:
     optional: true
 
-  turbo-darwin-arm64@2.8.10:
+  turbo-darwin-arm64@2.5.3:
     optional: true
 
-  turbo-linux-64@2.8.10:
+  turbo-linux-64@2.5.3:
     optional: true
 
-  turbo-linux-arm64@2.8.10:
+  turbo-linux-arm64@2.5.3:
     optional: true
 
-  turbo-windows-64@2.8.10:
+  turbo-windows-64@2.5.3:
     optional: true
 
-  turbo-windows-arm64@2.8.10:
+  turbo-windows-arm64@2.5.3:
     optional: true
 
-  turbo@2.8.10:
+  turbo@2.5.3:
     optionalDependencies:
-      turbo-darwin-64: 2.8.10
+      turbo-darwin-64: 2.5.3
-      turbo-darwin-arm64: 2.8.10
+      turbo-darwin-arm64: 2.5.3
-      turbo-linux-64: 2.8.10
+      turbo-linux-64: 2.5.3
-      turbo-linux-arm64: 2.8.10
+      turbo-linux-arm64: 2.5.3
-      turbo-windows-64: 2.8.10
+      turbo-windows-64: 2.5.3
-      turbo-windows-arm64: 2.8.10
+      turbo-windows-arm64: 2.5.3
 
   type-check@0.4.0:
     dependencies:

pnpm-workspace.yaml

@@ -1,21 +1,4 @@
-# Security
+packages:
-
+  - "client"
-# Do not execute any scripts of installed packages (project scripts still run)
+  - "server"
-ignoreDepScripts: true
+  - "packages/types"
-# Do not automatically run pre/post scripts (e.g. preinstall, postbuild)
-enablePrePostScripts: false
-# Only allow packages published at least 10 days ago (reduces risk of compromised packages)
-minimumReleaseAge: 14400
-# Fail if a package's trust level has decreased compared to previous releases
-trustPolicy: no-downgrade
-# Ignore trust policy for packages published more than 1 year ago (predates provenance signing)
-trustPolicyIgnoreAfter: 525960
-# Fail if there are missing or invalid peer dependencies
-strictPeerDependencies: true
-# Prevent transitive dependencies from using exotic sources (git repos, direct tarball URLs)
-blockExoticSubdeps: true
-
-# Lockfile
-
-# Allow the lockfile to be updated during install (set to true in CI for stricter reproducibility)
-preferFrozenLockfile: false