Skip to content

Commit 4181551

Browse files
warengonzagawarengonzaga
committed
🔧 update: update ci, add security scans, adopt biome, refactor webhook service
1 parent c223392 commit 4181551

31 files changed

Lines changed: 1884 additions & 1922 deletions

‎.github/workflows/build.yml‎

Lines changed: 0 additions & 89 deletions
This file was deleted.

.github/workflows/validate.yml renamed to .github/workflows/ci.yml

Lines changed: 40 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,73 @@
1-
name: Validate
1+
name: CI
22

33
on:
44
pull_request:
5-
branches: [dev, main]
5+
branches: [ dev, main ]
6+
push:
7+
branches: [ dev, main ]
8+
workflow_call:
9+
workflow_dispatch:
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
614

715
jobs:
816
validate:
9-
name: Validate Changes
17+
name: Lint Test Validate
1018
runs-on: ubuntu-latest
11-
19+
permissions:
20+
contents: read
21+
1222
steps:
1323
- name: Checkout code
1424
uses: actions/checkout@v6
15-
25+
26+
- name: Detect secrets
27+
uses: gitleaks/gitleaks-action@v2.3.9
28+
env:
29+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30+
1631
- name: Setup Bun
1732
uses: oven-sh/setup-bun@v2
1833
with:
1934
bun-version: 1.3.13
20-
35+
2136
- name: Setup Node.js
2237
uses: actions/setup-node@v6
2338
with:
24-
node-version: '22'
25-
39+
node-version: "22"
40+
41+
- name: Cache Bun dependencies
42+
uses: actions/cache@v4
43+
with:
44+
path: ~/.bun/install/cache
45+
key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
46+
restore-keys: |
47+
${{ runner.os }}-bun-
48+
2649
- name: Install dependencies
2750
run: bun install --frozen-lockfile
28-
51+
52+
- name: Lint
53+
run: biome check . --reporter=github
54+
2955
- name: Type checking
3056
run: bun run type-check
31-
57+
3258
- name: Run tests
3359
run: bun run test
34-
60+
3561
- name: Generate coverage
3662
run: bun run test:coverage
37-
continue-on-error: true
38-
63+
3964
- name: Build TypeScript
4065
run: bun run build
41-
66+
4267
- name: Test Docker build (no push)
4368
run: |
4469
echo "Testing Docker build..."
4570
docker build -t test-build .
4671
echo "Build successful, cleaning up..."
4772
docker image rm test-build
48-
echo "✅ Docker build test completed"
73+
echo "Docker build test completed"

‎.github/workflows/codeql.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [ dev, main ]
6+
pull_request:
7+
branches: [ dev, main ]
8+
schedule:
9+
- cron: "0 6 * * 1"
10+
workflow_dispatch:
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: false
15+
16+
jobs:
17+
analyze:
18+
name: Analyze (TypeScript)
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
22+
security-events: write
23+
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@v6
27+
28+
- name: Initialize CodeQL
29+
uses: github/codeql-action/init@v4
30+
with:
31+
languages: javascript-typescript
32+
queries: security-and-quality
33+
34+
- name: Perform CodeQL Analysis
35+
uses: github/codeql-action/analyze@v4
36+
with:
37+
category: /language:javascript-typescript

‎.github/workflows/container.yml‎

Lines changed: 23 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,45 @@
11
name: Container
22

33
on:
4+
pull_request:
5+
branches: [dev, main]
6+
push:
7+
branches: [dev, main]
48
release:
59
types: [published]
10+
workflow_dispatch:
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: true
615

716
jobs:
8-
build-production:
9-
name: Build Production Images
17+
ci:
18+
name: CI Gate
19+
uses: ./.github/workflows/ci.yml
20+
permissions:
21+
contents: read
22+
23+
build:
24+
name: Build Container Images
1025
runs-on: ubuntu-latest
26+
needs: ci
1127
permissions:
1228
contents: read
1329
packages: write
1430
security-events: write
15-
31+
pull-requests: write
32+
1633
steps:
1734
- name: Checkout code
1835
uses: actions/checkout@v6
1936

20-
- name: Build and Push Production Container
37+
- name: Build and Push Container
2138
uses: wgtechlabs/container-build-flow-action@v1.8.0
2239
with:
23-
# Registry Configuration
2440
registry: both
2541
dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
2642
dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
27-
28-
# Branch Configuration
29-
main-branch: main
30-
dev-branch: dev
31-
32-
# Image Configuration
33-
image-name: unthread-webhook-server
34-
dockerfile: ./Dockerfile
35-
context: .
36-
platforms: linux/amd64,linux/arm64
43+
ghcr-token: ${{ github.token }}
44+
floating-tags: true
3745
release-platforms: linux/amd64
38-
39-
# Build Arguments
40-
build-args: |
41-
NODE_VERSION=22.22-alpine3.23
42-
RAILWAY_SERVICE_ID=${{ secrets.RAILWAY_SERVICE_ID }}
43-
44-
# Labels
45-
labels: |
46-
org.opencontainers.image.title=Unthread Webhook Server
47-
org.opencontainers.image.description=A reliable, production-ready Node.js server for processing Unthread.io webhooks with signature verification and smart platform handling.
48-
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
49-
org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}
50-
org.opencontainers.image.licenses=GPL-3.0
51-
52-
# Features
53-
cache-enabled: true
54-
provenance: true
55-
sbom: true

‎.github/workflows/release.yml‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,45 @@ name: Release
33
on:
44
push:
55
branches: [main]
6+
workflow_dispatch:
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: false
611

712
jobs:
13+
ci:
14+
name: CI Gate
15+
uses: ./.github/workflows/ci.yml
16+
permissions:
17+
contents: read
18+
819
release:
920
name: Create Release
1021
runs-on: ubuntu-latest
22+
needs: ci
1123
permissions:
1224
contents: write
25+
pull-requests: write
1326

1427
steps:
1528
- name: Checkout code
1629
uses: actions/checkout@v6
1730
with:
1831
fetch-depth: 0
1932

33+
- name: Verify GH_PAT is set
34+
env:
35+
GH_PAT: ${{ secrets.GH_PAT }}
36+
run: |
37+
if [ -z "$GH_PAT" ]; then
38+
echo "::error::GH_PAT secret is required."
39+
exit 1
40+
fi
41+
2042
- name: Create Release
2143
id: release
2244
uses: wgtechlabs/release-build-flow-action@v1.7.0
2345
with:
24-
# Use PAT so the release event triggers downstream workflows
25-
# (e.g., container build flow)
2646
github-token: ${{ secrets.GH_PAT }}
47+
commit-convention: clean-commit

‎.gitleaks.toml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Gitleaks configuration
2+
# https://github.com/gitleaks/gitleaks#configuration
3+
4+
title = "Gitleaks - Unthread Webhook Server"
5+
6+
[allowlist]
7+
description = "Known false positives"
8+
paths = [
9+
# Example env files contain placeholder values, not real secrets
10+
'''.env.example''',
11+
'''.env.railway''',
12+
]

‎.vscode/extensions.json‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,7 @@
11
{
22
"recommendations": [
3-
"dbaeumer.vscode-eslint",
4-
"vitest.explorer",
5-
"bierner.markdown-preview-github-styles",
3+
"biomejs.biome",
4+
"bierner.markdown-preview-github-styles",
65
"bierner.github-markdown-preview",
76
"bierner.markdown-shiki",
87
"bierner.color-info",

‎.vscode/settings.json‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,17 @@
11
{
2-
"editor.formatOnSave": false,
2+
"editor.formatOnSave": true,
3+
"editor.defaultFormatter": "biomejs.biome",
34
"editor.codeActionsOnSave": {
4-
"source.fixAll.eslint": "explicit"
5+
"source.fixAll.biome": "explicit",
6+
"source.organizeImports.biome": "explicit"
57
},
6-
"eslint.validate": [
7-
"javascript",
8-
"typescript"
9-
],
10-
"eslint.workingDirectories": [
11-
{
12-
"mode": "auto"
13-
}
14-
],
15-
"eslint.lintTask.enable": true,
168
"typescript.tsdk": "node_modules/typescript/lib",
179
"typescript.enablePromptUseWorkspaceTsdk": true,
1810
"[typescript]": {
19-
"editor.defaultFormatter": "dbaeumer.vscode-eslint"
11+
"editor.defaultFormatter": "biomejs.biome"
2012
},
2113
"[javascript]": {
22-
"editor.defaultFormatter": "dbaeumer.vscode-eslint"
14+
"editor.defaultFormatter": "biomejs.biome"
2315
},
2416
"python-envs.defaultEnvManager": "ms-python.python:system",
2517
"python-envs.pythonProjects": []

0 commit comments

Comments
 (0)