Skip to content

Commit b9eb0b6

Browse files
timoatimoa
authored
Merge pull request #87 from timoa/develop
Refactor with AES-256-GCM + Node 16.x + deps update
2 parents e659811 + 8cc0c9f commit b9eb0b6

23 files changed

+9981
-7873
lines changed

‎.eslintignore

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
node_modules
1+
node_modules

‎.github/renovate.json

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,12 @@
77
"platformAutomerge": true,
88
"branchPrefix": "fix/deps/",
99
"addLabels": [
10-
"dependencies",
10+
"deps",
1111
"security"
1212
],
13+
"assignees": [
14+
"timoa"
15+
],
1316
"packageRules": [
1417
{
1518
"description": "Automerge renovate minor and patch updates",

‎.github/workflows/codeql-analysis.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616

1717
steps:
1818
- name: Checkout repository
19-
uses: actions/checkout@v2
19+
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
2020
with:
2121
# We must fetch at least the immediate parents so that if this is
2222
# a pull request then we can checkout the head.
@@ -29,15 +29,15 @@ jobs:
2929

3030
# Initializes the CodeQL tools for scanning.
3131
- name: Initialize CodeQL
32-
uses: github/codeql-action/init@v1
32+
uses: github/codeql-action/init@e2cc7cc006b87d43538b16d71752753e7b85224d # tag=v1.1.8
3333
# Override language selection by uncommenting this and choosing your languages
3434
# with:
3535
# languages: go, javascript, csharp, python, cpp, java
3636

3737
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
3838
# If this step fails, then you should remove it and run the build manually (see below)
3939
- name: Autobuild
40-
uses: github/codeql-action/autobuild@v1
40+
uses: github/codeql-action/autobuild@e2cc7cc006b87d43538b16d71752753e7b85224d # tag=v1.1.8
4141

4242
# ℹ️ Command-line programs to run using the OS shell.
4343
# 📚 https://git.io/JvXDl
@@ -51,4 +51,4 @@ jobs:
5151
# make release
5252

5353
- name: Perform CodeQL Analysis
54-
uses: github/codeql-action/analyze@v1
54+
uses: github/codeql-action/analyze@e2cc7cc006b87d43538b16d71752753e7b85224d # tag=v1.1.8

‎.github/workflows/nodejs.yml

Lines changed: 95 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -7,42 +7,51 @@ jobs:
77
# -- TESTS ------------------------------------------------------------------
88
tests:
99
runs-on: ubuntu-latest
10-
10+
1111
strategy:
1212
matrix:
13-
node-version: [12.x]
13+
node: ['16']
14+
mongodb: ['5.0']
1415

1516
steps:
1617
- name: Checkout
17-
uses: actions/checkout@v2
18+
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
1819

19-
- name: Use Node.js ${{ matrix.node-version }}
20-
uses: actions/setup-node@v1
20+
- name: Setup Node.js ${{ matrix.node }}
21+
uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # tag=v3
2122
with:
22-
node-version: ${{ matrix.node-version }}
23+
node-version: ${{ matrix.node }}
24+
check-latest: true
2325

2426
- name: Install dependencies
2527
run: npm install
2628

29+
- name: Start MongoDB
30+
uses: supercharge/mongodb-github-action@e815fd8a9dfede09fd6e6c144f2c9f4875e933df # tag=1.7.0
31+
with:
32+
mongodb-version: ${{ matrix.mongodb }}
33+
mongodb-db: encryptionAPI
34+
2735
- name: Run Unit-Tests + Code Coverage
2836
run: npm run test:coverage
2937

3038
- name: Save Code Coverage
31-
uses: actions/upload-artifact@v2
39+
uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
3240
with:
3341
name: code-coverage
3442
path: coverage
3543

36-
sonarcloud:
44+
# -- SONARCLOUD -------------------------------------------------------------
45+
code-quality:
3746
runs-on: ubuntu-latest
3847
needs: tests
3948

4049
steps:
4150
- name: Checkout
42-
uses: actions/checkout@v2
43-
51+
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
52+
4453
- name: Download Code Coverage
45-
uses: actions/download-artifact@v2
54+
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v3.0.0
4655
with:
4756
name: code-coverage
4857
path: coverage
@@ -66,7 +75,7 @@ jobs:
6675

6776
# - name: Build docker image
6877
# run: docker build -t timoa/nodejs-encryption-api-example .
69-
78+
7079
# - name: Start Docker container
7180
# run: docker-compose up -d
7281

@@ -78,25 +87,92 @@ jobs:
7887

7988
# - name: Run Functional tests
8089
# run: npm run test:functional
81-
90+
8291
# - name: Stop Docker container
8392
# run: docker-compose down
8493

94+
# -- SAST SCAN --------------------------------------------------------------
95+
code-security:
96+
runs-on: ubuntu-latest
97+
needs: tests
98+
# Skip any PR created by dependabot to avoid permission issues
99+
if: (github.actor != 'dependabot[bot]')
100+
101+
steps:
102+
- name: Checkout
103+
uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748 # tag=v3
104+
105+
- name: Perform Scan
106+
uses: ShiftLeftSecurity/scan-action@master
107+
108+
env:
109+
WORKSPACE: https://github.com/${{ github.repository }}/blob/${{ github.sha }}
110+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
111+
SCAN_ANNOTATE_PR: true
112+
113+
- uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # tag=v3.0.0
114+
with:
115+
name: reports
116+
path: reports
117+
118+
# -- RELEASE ----------------------------------------------------------------
119+
release:
120+
runs-on: ubuntu-latest
121+
needs:
122+
- code-quality
123+
- code-security
124+
if: github.ref == 'refs/heads/master'
125+
126+
steps:
127+
- name: Checkout
128+
uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748 # tag=v3
129+
130+
- name: Semantic Release
131+
uses: cycjimmy/semantic-release-action@v3
132+
env:
133+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
134+
85135
# -- BUILD ------------------------------------------------------------------
86136
build:
87137
runs-on: ubuntu-latest
88-
needs: tests
138+
needs: release
89139
if: github.ref == 'refs/heads/master'
90140

91141
steps:
92142
- name: Checkout
93-
uses: actions/checkout@v2
143+
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.0.0
94144

95-
- name: Docker Build
96-
uses: docker/build-push-action@v1
145+
- name: Docker meta
146+
id: meta
147+
uses: docker/metadata-action@e5622373a38e60fb6d795a4421e56882f2d7a681 # tag=v3.6.2
148+
with:
149+
images: ${{ github.repository }}
150+
tags: |
151+
type=schedule
152+
type=ref,event=branch
153+
type=ref,event=pr
154+
type=semver,pattern={{version}}
155+
type=semver,pattern={{major}}.{{minor}}
156+
type=semver,pattern={{major}}
157+
type=sha
158+
type=raw,value=latest
159+
160+
- name: Set up QEMU
161+
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # tag=v1.2.0
162+
163+
- name: Set up Docker Buildx
164+
uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25 # tag=v1.6.0
165+
166+
- name: Login to DockerHub
167+
uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # tag=v1.14.1
97168
with:
98169
username: ${{ secrets.DOCKER_USERNAME }}
99170
password: ${{ secrets.DOCKER_PASSWORD }}
100-
repository: timoa/nodejs-encryption-api-example
101-
tags: latest
102171

172+
- name: Build and push
173+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a # tag=v2.10.0
174+
with:
175+
context: .
176+
push: true
177+
tags: ${{ steps.meta.outputs.tags }}
178+
labels: ${{ steps.meta.outputs.labels }}

‎.nvmrc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
16

‎.nycrc

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"check-coverage": true,
3+
"lines": 0,
4+
"statements": 0,
5+
"functions": 0,
6+
"branches": 0,
7+
"reporter": [
8+
"lcov",
9+
"text-summary"
10+
],
11+
"include": [
12+
"src/*.js",
13+
"src/**/*.js"
14+
],
15+
"exclude": [
16+
"test/*.spec.js",
17+
"coverage/**",
18+
"src/swagger/*.js",
19+
"data/**/*"
20+
],
21+
"all": true
22+
}

‎.prettierrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@
99
"jsxBracketSameLine": true,
1010
"fluid": false,
1111
"arrowParens": "always"
12-
}
12+
}

‎Dockerfile

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
ARG nodeVersion=12.16.1
2-
FROM node:${nodeVersion}-alpine
1+
FROM node:16.14.2-alpine3.15@sha256:28bed508446db2ee028d08e76fb47b935defa26a84986ca050d2596ea67fd506
32
ARG appPort=3000
43
# ARG microScannerToken
54

@@ -33,7 +32,8 @@ RUN \
3332
# date
3433

3534
WORKDIR /opt/app/
36-
COPY ./ /opt/app/
35+
COPY ./package.json ./
36+
COPY ./src ./src
3737

3838
HEALTHCHECK --interval=15s --timeout=5s --start-period=30s \
3939
CMD npm run docker:status

‎SECURITY.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
We release patches for security vulnerabilities. Which versions are eligible
6+
receiving such patches depend on the CVSS v3.0 Rating:
7+
8+
| Version | Supported |
9+
| ------- | ------------------ |
10+
| > 1.0.0 | :white_check_mark: |
11+
| < 1.0.0 | :x: |
12+
13+
## Reporting a Vulnerability
14+
15+
Please report (suspected) security vulnerabilities to **[issue board](https://github.com/timoa/nodejs-encryption-api-example/issues)**
16+
with the label **vulnerability**. If the issue is confirmed, we will release a patch as soon as possible depending on complexity,
17+
but historically within a few days.

‎docker-compose.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ version: '3.3'
22

33
services:
44
api:
5-
image: timoa/nodejs-encryption-api-example:latest
5+
image: timoa/nodejs-encryption-api-example:latest@sha256:7348a5690fde457457ef0b171c992ae877af7e2084e6b384c096c85047188f78
66
environment:
77
- NODE_ENV=production
88
- NODE_HOST=0.0.0.0
@@ -17,7 +17,7 @@ services:
1717
- mongo
1818
mongo:
1919
container_name: mongo
20-
image: mongo
20+
image: mongo@sha256:1e72fdd16fc769e5200dad77eff5b2316730d42473c281d8192872698e1f8689
2121
volumes:
2222
- ./data:/data/db
2323
ports:

0 commit comments

Comments
 (0)