generated from nhcarrigan/template
Compare commits
3 Commits
main
..
eecb1b1841
| Author | SHA1 | Date | |
|---|---|---|---|
 naomi
|
eecb1b1841 | ||
|
naomi
|
7587152072 | ||
|
naomi
|
73995a495d |
+11
-14
@@ -8,35 +8,32 @@ on:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
name: CI
|
||||
runs-on: ubuntu-latest
|
||||
lint:
|
||||
name: Lint and Test
|
||||
|
||||
steps:
|
||||
- name: Checkout Source Files
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Use Node.js v24
|
||||
- name: Use Node.js v22
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 24
|
||||
node-version: 22
|
||||
|
||||
- name: Setup pnpm
|
||||
uses: pnpm/action-setup@v2
|
||||
with:
|
||||
version: 10
|
||||
|
||||
- name: Ensure Dependencies are Pinned
|
||||
uses: naomi-lgbt/dependency-pin-check@main
|
||||
with:
|
||||
language: javascript
|
||||
dev-dependencies: true
|
||||
peer-dependencies: true
|
||||
optional-dependencies: true
|
||||
version: 9
|
||||
|
||||
- name: Install Dependencies
|
||||
run: pnpm install
|
||||
|
||||
- name: Build internal package
|
||||
run: cd packages/types && pnpm build
|
||||
|
||||
- name: Install again
|
||||
run: pnpm install
|
||||
|
||||
- name: Lint Source Files
|
||||
run: pnpm run lint
|
||||
|
||||
|
||||
@@ -1,177 +0,0 @@
|
||||
name: Security Scan and Upload
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
schedule:
|
||||
- cron: '0 0 * * 1'
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
security-audit:
|
||||
name: Security & DefectDojo Upload
|
||||
runs-on: ubuntu-latest
|
||||
continue-on-error: true
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# --- AUTO-SETUP PROJECT ---
|
||||
- name: Ensure DefectDojo Product Exists
|
||||
env:
|
||||
DD_URL: ${{ secrets.DD_URL }}
|
||||
DD_TOKEN: ${{ secrets.DD_TOKEN }}
|
||||
PRODUCT_NAME: ${{ github.repository }}
|
||||
PRODUCT_TYPE_ID: 1
|
||||
run: |
|
||||
sudo apt-get install jq -y > /dev/null
|
||||
|
||||
echo "Checking connection to $DD_URL..."
|
||||
|
||||
# Check if product exists - capture HTTP code to debug connection issues
|
||||
RESPONSE=$(curl --write-out "%{http_code}" --silent --output /tmp/response.json \
|
||||
-H "Authorization: Token $DD_TOKEN" \
|
||||
"$DD_URL/api/v2/products/?name=$PRODUCT_NAME")
|
||||
|
||||
# If response is not 200, print error
|
||||
if [ "$RESPONSE" != "200" ]; then
|
||||
echo "::error::Failed to query DefectDojo. HTTP Code: $RESPONSE"
|
||||
cat /tmp/response.json
|
||||
exit 1
|
||||
fi
|
||||
|
||||
COUNT=$(cat /tmp/response.json | jq -r '.count')
|
||||
|
||||
if [ "$COUNT" = "0" ]; then
|
||||
echo "Creating product '$PRODUCT_NAME'..."
|
||||
curl -s -X POST "$DD_URL/api/v2/products/" \
|
||||
-H "Authorization: Token $DD_TOKEN" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{ "name": "'"$PRODUCT_NAME"'", "description": "Auto-created by Gitea Actions", "prod_type": '$PRODUCT_TYPE_ID' }'
|
||||
else
|
||||
echo "Product '$PRODUCT_NAME' already exists."
|
||||
fi
|
||||
|
||||
# --- 1. TRIVY (Dependencies & Misconfig) ---
|
||||
- name: Install Trivy
|
||||
run: |
|
||||
sudo apt-get install wget apt-transport-https gnupg lsb-release -y
|
||||
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
|
||||
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
|
||||
sudo apt-get update && sudo apt-get install trivy -y
|
||||
|
||||
- name: Run Trivy (FS Scan)
|
||||
run: |
|
||||
trivy fs . --scanners vuln,misconfig --format json --output trivy-results.json --exit-code 0
|
||||
|
||||
- name: Upload Trivy to DefectDojo
|
||||
env:
|
||||
DD_URL: ${{ secrets.DD_URL }}
|
||||
DD_TOKEN: ${{ secrets.DD_TOKEN }}
|
||||
run: |
|
||||
echo "Uploading Trivy results..."
|
||||
# Generate today's date in YYYY-MM-DD format
|
||||
TODAY=$(date +%Y-%m-%d)
|
||||
|
||||
HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
|
||||
-H "Authorization: Token $DD_TOKEN" \
|
||||
-F "active=true" \
|
||||
-F "verified=true" \
|
||||
-F "scan_type=Trivy Scan" \
|
||||
-F "engagement_name=CI/CD Pipeline" \
|
||||
-F "product_name=${{ github.repository }}" \
|
||||
-F "scan_date=$TODAY" \
|
||||
-F "auto_create_context=true" \
|
||||
-F "file=@trivy-results.json")
|
||||
|
||||
if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
|
||||
echo "::error::Upload Failed with HTTP $HTTP_CODE"
|
||||
echo "--- SERVER RESPONSE ---"
|
||||
cat response.txt
|
||||
echo "-----------------------"
|
||||
exit 1
|
||||
else
|
||||
echo "Upload Success!"
|
||||
fi
|
||||
|
||||
# --- 2. GITLEAKS (Secrets) ---
|
||||
- name: Install Gitleaks
|
||||
run: |
|
||||
wget -qO gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.18.0/gitleaks_8.18.0_linux_x64.tar.gz
|
||||
tar -xzf gitleaks.tar.gz
|
||||
sudo mv gitleaks /usr/local/bin/ && chmod +x /usr/local/bin/gitleaks
|
||||
|
||||
- name: Run Gitleaks
|
||||
run: gitleaks detect --source . -v --report-path gitleaks-results.json --report-format json --no-git || true
|
||||
|
||||
- name: Upload Gitleaks to DefectDojo
|
||||
env:
|
||||
DD_URL: ${{ secrets.DD_URL }}
|
||||
DD_TOKEN: ${{ secrets.DD_TOKEN }}
|
||||
run: |
|
||||
echo "Uploading Gitleaks results..."
|
||||
TODAY=$(date +%Y-%m-%d)
|
||||
|
||||
HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
|
||||
-H "Authorization: Token $DD_TOKEN" \
|
||||
-F "active=true" \
|
||||
-F "verified=true" \
|
||||
-F "scan_type=Gitleaks Scan" \
|
||||
-F "engagement_name=CI/CD Pipeline" \
|
||||
-F "product_name=${{ github.repository }}" \
|
||||
-F "scan_date=$TODAY" \
|
||||
-F "auto_create_context=true" \
|
||||
-F "file=@gitleaks-results.json")
|
||||
|
||||
if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
|
||||
echo "::error::Upload Failed with HTTP $HTTP_CODE"
|
||||
echo "--- SERVER RESPONSE ---"
|
||||
cat response.txt
|
||||
echo "-----------------------"
|
||||
exit 1
|
||||
else
|
||||
echo "Upload Success!"
|
||||
fi
|
||||
|
||||
# --- 3. SEMGREP (SAST) ---
|
||||
- name: Install Semgrep (via pipx)
|
||||
run: |
|
||||
sudo apt-get install pipx -y
|
||||
pipx install semgrep
|
||||
# Add pipx binary path to GITHUB_PATH so next steps can see 'semgrep'
|
||||
echo "$HOME/.local/bin" >> $GITHUB_PATH
|
||||
|
||||
- name: Run Semgrep
|
||||
run: semgrep scan --config=p/security-audit --config=p/owasp-top-ten --json --output semgrep-results.json . || true
|
||||
|
||||
- name: Upload Semgrep to DefectDojo
|
||||
env:
|
||||
DD_URL: ${{ secrets.DD_URL }}
|
||||
DD_TOKEN: ${{ secrets.DD_TOKEN }}
|
||||
run: |
|
||||
echo "Uploading Semgrep results..."
|
||||
TODAY=$(date +%Y-%m-%d)
|
||||
|
||||
HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
|
||||
-H "Authorization: Token $DD_TOKEN" \
|
||||
-F "active=true" \
|
||||
-F "verified=true" \
|
||||
-F "scan_type=Semgrep JSON Report" \
|
||||
-F "engagement_name=CI/CD Pipeline" \
|
||||
-F "product_name=${{ github.repository }}" \
|
||||
-F "scan_date=$TODAY" \
|
||||
-F "auto_create_context=true" \
|
||||
-F "file=@semgrep-results.json")
|
||||
|
||||
if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
|
||||
echo "::error::Upload Failed with HTTP $HTTP_CODE"
|
||||
echo "--- SERVER RESPONSE ---"
|
||||
cat response.txt
|
||||
echo "-----------------------"
|
||||
exit 1
|
||||
else
|
||||
echo "Upload Success!"
|
||||
fi
|
||||
@@ -0,0 +1,34 @@
|
||||
name: Code Analysis
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
sonar:
|
||||
name: SonarQube
|
||||
|
||||
steps:
|
||||
- name: Checkout Source Files
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: SonarCube Scan
|
||||
uses: SonarSource/sonarqube-scan-action@v4
|
||||
timeout-minutes: 10
|
||||
env:
|
||||
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
||||
SONAR_HOST_URL: "https://quality.nhcarrigan.com"
|
||||
with:
|
||||
args: >
|
||||
-Dsonar.sources=.
|
||||
-Dsonar.projectKey=nutrition-tracker
|
||||
|
||||
- name: SonarQube Quality Gate check
|
||||
uses: sonarsource/sonarqube-quality-gate-action@v1
|
||||
with:
|
||||
pollingTimeoutSec: 600
|
||||
env:
|
||||
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
||||
SONAR_HOST_URL: "https://quality.nhcarrigan.com"
|
||||
@@ -1,14 +1,14 @@
|
||||
# Vitalia
|
||||
# Nutrition Tracker
|
||||
|
||||
Vitalia aims to be a complete nutrition tracker with all the bells and whistles, but none of the paywalls. She's here to help you reach your fitness goals!
|
||||
This application is a tool I can use to track my daily nutrition intake. The hosted instance requires a password to access, but you are welcome to use this to host your own tool!
|
||||
|
||||
## Live Version
|
||||
|
||||
This page is currently deployed. [View the live website.](https://vitalia.nhcarrigan.com)
|
||||
This page is currently deployed. [View the live website.](https://food.nhcarrigan.com)
|
||||
|
||||
## Feedback and Bugs
|
||||
|
||||
If you have feedback or a bug report, please [log a ticket on our forum](https://support.nhcarrigan.com).
|
||||
If you have feedback or a bug report, please feel free to open a GitHub issue!
|
||||
|
||||
## Contributing
|
||||
|
||||
|
||||
@@ -14,5 +14,5 @@ import { RouterOutlet } from "@angular/router";
|
||||
templateUrl: "./app.component.html",
|
||||
})
|
||||
export class AppComponent {
|
||||
public title = "Vitalia";
|
||||
public title = "client";
|
||||
}
|
||||
|
||||
@@ -1,7 +1 @@
|
||||
<h1>Vitalia</h1>
|
||||
|
||||
<img src="https://cdn.nhcarrigan.com/new-avatars/vitalia-full.png" alt="Vitalia" width="300">
|
||||
|
||||
<p>Vitalia is your nutritional assistant and companion, here to help you reach your fitness goals!</p>
|
||||
|
||||
<p>Stay tuned, we're hard at work to bring her to life!</p>
|
||||
<p>landing works!</p>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Vitalia</title>
|
||||
<title>Client</title>
|
||||
<base href="/">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<link rel="icon" type="image/x-icon" href="favicon.ico">
|
||||
|
||||
+1
-1
@@ -18,7 +18,7 @@
|
||||
"@nhcarrigan/eslint-config": "5.2.0",
|
||||
"eslint": "9.26.0",
|
||||
"prisma": "6.7.0",
|
||||
"turbo": "2.8.10"
|
||||
"turbo": "2.5.3"
|
||||
},
|
||||
"dependencies": {
|
||||
"@prisma/client": "6.7.0"
|
||||
|
||||
Generated
+29
-29
@@ -22,8 +22,8 @@ importers:
|
||||
specifier: 6.7.0
|
||||
version: 6.7.0(typescript@5.8.3)
|
||||
turbo:
|
||||
specifier: 2.8.10
|
||||
version: 2.8.10
|
||||
specifier: 2.5.3
|
||||
version: 2.5.3
|
||||
|
||||
client:
|
||||
dependencies:
|
||||
@@ -5244,38 +5244,38 @@ packages:
|
||||
resolution: {integrity: sha512-+68OP1ZzSF84rTckf3FA95vJ1Zlx/uaXyiiKyPd1pA4rZNkpEvDAKmsu1xUSmbF/chCRYgZ6UZkDwC7PmzmAyA==}
|
||||
engines: {node: ^18.17.0 || >=20.5.0}
|
||||
|
||||
turbo-darwin-64@2.8.10:
|
||||
resolution: {integrity: sha512-A03fXh+B7S8mL3PbdhTd+0UsaGrhfyPkODvzBDpKRY7bbeac4MDFpJ7I+Slf2oSkCEeSvHKR7Z4U71uKRUfX7g==}
|
||||
turbo-darwin-64@2.5.3:
|
||||
resolution: {integrity: sha512-YSItEVBUIvAGPUDpAB9etEmSqZI3T6BHrkBkeSErvICXn3dfqXUfeLx35LfptLDEbrzFUdwYFNmt8QXOwe9yaw==}
|
||||
cpu: [x64]
|
||||
os: [darwin]
|
||||
|
||||
turbo-darwin-arm64@2.8.10:
|
||||
resolution: {integrity: sha512-sidzowgWL3s5xCHLeqwC9M3s9M0i16W1nuQF3Mc7fPHpZ+YPohvcbVFBB2uoRRHYZg6yBnwD4gyUHKTeXfwtXA==}
|
||||
turbo-darwin-arm64@2.5.3:
|
||||
resolution: {integrity: sha512-5PefrwHd42UiZX7YA9m1LPW6x9YJBDErXmsegCkVp+GjmWrADfEOxpFrGQNonH3ZMj77WZB2PVE5Aw3gA+IOhg==}
|
||||
cpu: [arm64]
|
||||
os: [darwin]
|
||||
|
||||
turbo-linux-64@2.8.10:
|
||||
resolution: {integrity: sha512-YK9vcpL3TVtqonB021XwgaQhY9hJJbKKUhLv16osxV0HkcQASQWUqR56yMge7puh6nxU67rQlTq1b7ksR1T3KA==}
|
||||
turbo-linux-64@2.5.3:
|
||||
resolution: {integrity: sha512-M9xigFgawn5ofTmRzvjjLj3Lqc05O8VHKuOlWNUlnHPUltFquyEeSkpQNkE/vpPdOR14AzxqHbhhxtfS4qvb1w==}
|
||||
cpu: [x64]
|
||||
os: [linux]
|
||||
|
||||
turbo-linux-arm64@2.8.10:
|
||||
resolution: {integrity: sha512-3+j2tL0sG95iBJTm+6J8/45JsETQABPqtFyYjVjBbi6eVGdtNTiBmHNKrbvXRlQ3ZbUG75bKLaSSDHSEEN+btQ==}
|
||||
turbo-linux-arm64@2.5.3:
|
||||
resolution: {integrity: sha512-auJRbYZ8SGJVqvzTikpg1bsRAsiI9Tk0/SDkA5Xgg0GdiHDH/BOzv1ZjDE2mjmlrO/obr19Dw+39OlMhwLffrw==}
|
||||
cpu: [arm64]
|
||||
os: [linux]
|
||||
|
||||
turbo-windows-64@2.8.10:
|
||||
resolution: {integrity: sha512-hdeF5qmVY/NFgiucf8FW0CWJWtyT2QPm5mIsX0W1DXAVzqKVXGq+Zf+dg4EUngAFKjDzoBeN6ec2Fhajwfztkw==}
|
||||
turbo-windows-64@2.5.3:
|
||||
resolution: {integrity: sha512-arLQYohuHtIEKkmQSCU9vtrKUg+/1TTstWB9VYRSsz+khvg81eX6LYHtXJfH/dK7Ho6ck+JaEh5G+QrE1jEmCQ==}
|
||||
cpu: [x64]
|
||||
os: [win32]
|
||||
|
||||
turbo-windows-arm64@2.8.10:
|
||||
resolution: {integrity: sha512-QGdr/Q8LWmj+ITMkSvfiz2glf0d7JG0oXVzGL3jxkGqiBI1zXFj20oqVY0qWi+112LO9SVrYdpHS0E/oGFrMbQ==}
|
||||
turbo-windows-arm64@2.5.3:
|
||||
resolution: {integrity: sha512-3JPn66HAynJ0gtr6H+hjY4VHpu1RPKcEwGATvGUTmLmYSYBQieVlnGDRMMoYN066YfyPqnNGCfhYbXfH92Cm0g==}
|
||||
cpu: [arm64]
|
||||
os: [win32]
|
||||
|
||||
turbo@2.8.10:
|
||||
resolution: {integrity: sha512-OxbzDES66+x7nnKGg2MwBA1ypVsZoDTLHpeaP4giyiHSixbsiTaMyeJqbEyvBdp5Cm28fc+8GG6RdQtic0ijwQ==}
|
||||
turbo@2.5.3:
|
||||
resolution: {integrity: sha512-iHuaNcq5GZZnr3XDZNuu2LSyCzAOPwDuo5Qt+q64DfsTP1i3T2bKfxJhni2ZQxsvAoxRbuUK5QetJki4qc5aYA==}
|
||||
hasBin: true
|
||||
|
||||
type-check@0.4.0:
|
||||
@@ -11596,32 +11596,32 @@ snapshots:
|
||||
transitivePeerDependencies:
|
||||
- supports-color
|
||||
|
||||
turbo-darwin-64@2.8.10:
|
||||
turbo-darwin-64@2.5.3:
|
||||
optional: true
|
||||
|
||||
turbo-darwin-arm64@2.8.10:
|
||||
turbo-darwin-arm64@2.5.3:
|
||||
optional: true
|
||||
|
||||
turbo-linux-64@2.8.10:
|
||||
turbo-linux-64@2.5.3:
|
||||
optional: true
|
||||
|
||||
turbo-linux-arm64@2.8.10:
|
||||
turbo-linux-arm64@2.5.3:
|
||||
optional: true
|
||||
|
||||
turbo-windows-64@2.8.10:
|
||||
turbo-windows-64@2.5.3:
|
||||
optional: true
|
||||
|
||||
turbo-windows-arm64@2.8.10:
|
||||
turbo-windows-arm64@2.5.3:
|
||||
optional: true
|
||||
|
||||
turbo@2.8.10:
|
||||
turbo@2.5.3:
|
||||
optionalDependencies:
|
||||
turbo-darwin-64: 2.8.10
|
||||
turbo-darwin-arm64: 2.8.10
|
||||
turbo-linux-64: 2.8.10
|
||||
turbo-linux-arm64: 2.8.10
|
||||
turbo-windows-64: 2.8.10
|
||||
turbo-windows-arm64: 2.8.10
|
||||
turbo-darwin-64: 2.5.3
|
||||
turbo-darwin-arm64: 2.5.3
|
||||
turbo-linux-64: 2.5.3
|
||||
turbo-linux-arm64: 2.5.3
|
||||
turbo-windows-64: 2.5.3
|
||||
turbo-windows-arm64: 2.5.3
|
||||
|
||||
type-check@0.4.0:
|
||||
dependencies:
|
||||
|
||||
+4
-21
@@ -1,21 +1,4 @@
|
||||
# Security
|
||||
|
||||
# Do not execute any scripts of installed packages (project scripts still run)
|
||||
ignoreDepScripts: true
|
||||
# Do not automatically run pre/post scripts (e.g. preinstall, postbuild)
|
||||
enablePrePostScripts: false
|
||||
# Only allow packages published at least 10 days ago (reduces risk of compromised packages)
|
||||
minimumReleaseAge: 14400
|
||||
# Fail if a package's trust level has decreased compared to previous releases
|
||||
trustPolicy: no-downgrade
|
||||
# Ignore trust policy for packages published more than 1 year ago (predates provenance signing)
|
||||
trustPolicyIgnoreAfter: 525960
|
||||
# Fail if there are missing or invalid peer dependencies
|
||||
strictPeerDependencies: true
|
||||
# Prevent transitive dependencies from using exotic sources (git repos, direct tarball URLs)
|
||||
blockExoticSubdeps: true
|
||||
|
||||
# Lockfile
|
||||
|
||||
# Allow the lockfile to be updated during install (set to true in CI for stricter reproducibility)
|
||||
preferFrozenLockfile: false
|
||||
packages:
|
||||
- "client"
|
||||
- "server"
|
||||
- "packages/types"
|
||||
@@ -7,6 +7,6 @@
|
||||
import { Logger } from "@nhcarrigan/logger";
|
||||
|
||||
export const logger = new Logger(
|
||||
"Vitalia",
|
||||
"Nutrition API",
|
||||
process.env.LOG_TOKEN ?? "",
|
||||
);
|
||||
|
||||
Reference in New Issue
Block a user