Skip to content

Commit d5f1773

Browse files
m-prosper-10m-prosper-10
authored
Merge pull request #9 from m-prosper-10/main
Enhance project scaffolding with new templates and configurations
2 parents 2223b7c + 5f91579 commit d5f1773

67 files changed

Lines changed: 9411 additions & 894 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
.git
2+
.github
3+
node_modules
4+
dist
5+
coverage
6+
test-output
7+
*.tgz
8+
.codex
9+
.agents
10+
.kiro
11+
.vscode
12+
.idea
13+
.DS_Store

‎.github/workflows/ci.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- master
8+
- develop
9+
- "feature/**"
10+
pull_request:
11+
12+
jobs:
13+
quality:
14+
name: Build and Test (Node ${{ matrix.node-version }})
15+
runs-on: ubuntu-latest
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
node-version: [18, 20]
20+
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v4
24+
25+
- name: Setup Node
26+
uses: actions/setup-node@v4
27+
with:
28+
node-version: ${{ matrix.node-version }}
29+
cache: npm
30+
31+
- name: Install dependencies
32+
run: npm ci
33+
34+
- name: Build
35+
run: npm run build
36+
37+
- name: Test
38+
run: npm test
39+
40+
- name: CLI help smoke test
41+
run: node dist/cli.js --help
42+
43+
- name: Package smoke test
44+
run: npm pack --dry-run

‎.github/workflows/docker.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Docker
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- master
8+
tags:
9+
- "v*"
10+
pull_request:
11+
12+
permissions:
13+
contents: read
14+
packages: write
15+
security-events: write
16+
17+
jobs:
18+
docker:
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Set up QEMU
25+
uses: docker/setup-qemu-action@v3
26+
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@v3
29+
30+
- name: Log in to GHCR
31+
if: github.event_name != 'pull_request'
32+
uses: docker/login-action@v3
33+
with:
34+
registry: ghcr.io
35+
username: ${{ github.actor }}
36+
password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Docker metadata
39+
id: meta
40+
uses: docker/metadata-action@v5
41+
with:
42+
images: ghcr.io/${{ github.repository }}
43+
tags: |
44+
type=ref,event=branch
45+
type=ref,event=tag
46+
type=sha
47+
type=raw,value=latest,enable={{is_default_branch}}
48+
49+
- name: Build and export image for scan
50+
if: github.event_name == 'pull_request'
51+
uses: docker/build-push-action@v6
52+
with:
53+
context: .
54+
file: ./Dockerfile
55+
tags: start-it-cli:pr
56+
load: true
57+
push: false
58+
59+
- name: Trivy image scan
60+
if: github.event_name == 'pull_request'
61+
uses: aquasecurity/trivy-action@v0.24.0
62+
with:
63+
image-ref: start-it-cli:pr
64+
format: sarif
65+
output: trivy-image.sarif
66+
severity: HIGH,CRITICAL
67+
ignore-unfixed: true
68+
69+
- name: Upload image scan results
70+
if: github.event_name == 'pull_request'
71+
uses: github/codeql-action/upload-sarif@v3
72+
with:
73+
sarif_file: trivy-image.sarif
74+
75+
- name: Build and push image
76+
if: github.event_name != 'pull_request'
77+
uses: docker/build-push-action@v6
78+
with:
79+
context: .
80+
file: ./Dockerfile
81+
push: ${{ github.event_name != 'pull_request' }}
82+
platforms: linux/amd64,linux/arm64
83+
tags: ${{ steps.meta.outputs.tags }}
84+
labels: ${{ steps.meta.outputs.labels }}

‎.github/workflows/security.yml‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
name: Security
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- master
8+
pull_request:
9+
schedule:
10+
- cron: "0 3 * * 1"
11+
12+
permissions:
13+
contents: read
14+
security-events: write
15+
16+
jobs:
17+
dependency-review:
18+
if: github.event_name == 'pull_request' && vars.ENABLE_DEPENDENCY_REVIEW == 'true'
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
22+
pull-requests: write
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
27+
- name: Dependency review
28+
uses: actions/dependency-review-action@v4
29+
30+
npm-audit:
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Checkout
34+
uses: actions/checkout@v4
35+
36+
- name: Setup Node
37+
uses: actions/setup-node@v4
38+
with:
39+
node-version: 20
40+
cache: npm
41+
42+
- name: Install dependencies
43+
run: npm ci
44+
45+
- name: Audit production dependencies (with temporary lodash exception)
46+
shell: bash
47+
run: |
48+
set -euo pipefail
49+
npm audit --omit=dev --json > audit-prod.json || true
50+
51+
node - <<'NODE'
52+
const fs = require("fs");
53+
54+
const report = JSON.parse(fs.readFileSync("audit-prod.json", "utf8"));
55+
const vulnerabilities = report.vulnerabilities || {};
56+
const ignoreAdvisories = new Set([
57+
"GHSA-xxjr-mmjv-4gpg",
58+
"GHSA-r5fr-rjxr-66jc",
59+
"GHSA-f23m-r3pf-42rh",
60+
]);
61+
62+
const failing = [];
63+
64+
for (const [pkg, details] of Object.entries(vulnerabilities)) {
65+
const via = Array.isArray(details.via) ? details.via : [];
66+
const nonIgnoredVia = via.filter((entry) => {
67+
if (typeof entry === "string") {
68+
return true;
69+
}
70+
const sev = (entry.severity || "").toLowerCase();
71+
if (sev !== "high" && sev !== "critical") {
72+
return false;
73+
}
74+
const url = entry.url || "";
75+
const ghsa = url.split("/").pop() || "";
76+
return !ignoreAdvisories.has(ghsa);
77+
});
78+
79+
if (nonIgnoredVia.length > 0) {
80+
failing.push({ pkg, severity: details.severity, via: nonIgnoredVia });
81+
}
82+
}
83+
84+
if (failing.length > 0) {
85+
console.error("High/Critical vulnerabilities found (excluding temporary lodash exception):");
86+
for (const item of failing) {
87+
console.error(`- ${item.pkg} (${item.severity})`);
88+
}
89+
process.exit(1);
90+
}
91+
92+
console.log("No blocking high/critical production vulnerabilities found.");
93+
NODE
94+
95+
- name: Audit full dependency tree (informational)
96+
continue-on-error: true
97+
shell: bash
98+
run: |
99+
set -euo pipefail
100+
npm audit --json > audit-full.json || true
101+
102+
node - <<'NODE'
103+
const fs = require("fs");
104+
105+
const report = JSON.parse(fs.readFileSync("audit-full.json", "utf8"));
106+
const vulnerabilities = report.vulnerabilities || {};
107+
const ignoreAdvisories = new Set([
108+
"GHSA-xxjr-mmjv-4gpg",
109+
"GHSA-r5fr-rjxr-66jc",
110+
"GHSA-f23m-r3pf-42rh",
111+
]);
112+
113+
const failing = [];
114+
115+
for (const [pkg, details] of Object.entries(vulnerabilities)) {
116+
const via = Array.isArray(details.via) ? details.via : [];
117+
const nonIgnoredVia = via.filter((entry) => {
118+
if (typeof entry === "string") {
119+
return true;
120+
}
121+
const sev = (entry.severity || "").toLowerCase();
122+
if (sev !== "high" && sev !== "critical") {
123+
return false;
124+
}
125+
const url = entry.url || "";
126+
const ghsa = url.split("/").pop() || "";
127+
return !ignoreAdvisories.has(ghsa);
128+
});
129+
130+
if (nonIgnoredVia.length > 0) {
131+
failing.push({ pkg, severity: details.severity, via: nonIgnoredVia });
132+
}
133+
}
134+
135+
if (failing.length > 0) {
136+
console.error("High/Critical vulnerabilities found in full tree (excluding temporary lodash exception):");
137+
for (const item of failing) {
138+
console.error(`- ${item.pkg} (${item.severity})`);
139+
}
140+
process.exit(1);
141+
}
142+
143+
console.log("No blocking high/critical vulnerabilities found in full tree.");
144+
NODE
145+
146+
codeql:
147+
runs-on: ubuntu-latest
148+
steps:
149+
- name: Checkout
150+
uses: actions/checkout@v4
151+
152+
- name: Initialize CodeQL
153+
uses: github/codeql-action/init@v3
154+
with:
155+
languages: javascript-typescript
156+
157+
- name: Autobuild
158+
uses: github/codeql-action/autobuild@v3
159+
160+
- name: Perform CodeQL Analysis
161+
uses: github/codeql-action/analyze@v3
162+
163+
trivy-filesystem:
164+
runs-on: ubuntu-latest
165+
steps:
166+
- name: Checkout
167+
uses: actions/checkout@v4
168+
169+
- name: Trivy filesystem scan
170+
uses: aquasecurity/trivy-action@v0.24.0
171+
with:
172+
scan-type: fs
173+
scan-ref: .
174+
format: sarif
175+
output: trivy-fs.sarif
176+
severity: HIGH,CRITICAL
177+
ignore-unfixed: true
178+
179+
- name: Upload Trivy scan results
180+
uses: github/codeql-action/upload-sarif@v3
181+
with:
182+
sarif_file: trivy-fs.sarif

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,4 @@ coverage/
77
.idea/
88
.npmrc
99
config.bat
10+
.kiro

0 commit comments

Comments
 (0)