diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..f5aed6a --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,87 @@ +name: CI PR Check + +on: + push: + branches: + - main + - dev + pull_request: + branches: + - main + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v3 + + # setup node env + - name: Set up Node.js + uses: actions/setup-node@v2 + with: + node-version: '20' + + - name: Install dependencies + run: npm install + + # run tests + - name: Run tests + run: npm test + + security-scan: + needs: build + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v3 + + # setup node env + - name: Set up Node.js + uses: actions/setup-node@v2 + with: + node-version: '20' + + - name: Install dependencies + run: npm install + + - name: Run security audit + run: npm audit --production --json > audit.json || true + + - name: report code vulnerabilities + run: | + if [ -s audit.json ]; then + echo "Vulnerabilities found:" + cat audit.json + fi + + build-container: + needs: [build, security-scan] + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + # Step 3: Log in to Docker Hub (Optional) + # Uncomment this section if you're pushing the image to Docker Hub. + # Replace DOCKER_USERNAME and DOCKER_PASSWORD with your Docker credentials as GitHub secrets. + # - name: Log in to Docker Hub + # uses: docker/login-action@v3 + # with: + # username: ${{ secrets.DOCKER_USERNAME }} + # password: ${{ secrets.DOCKER_PASSWORD }} + + # Step 4: Build the Docker image + - name: Build Docker image + run: | + docker build -t node-login-app . + + # Step 5: (Optional) Push the Docker image to Docker Hub + # Uncomment if you want to push the image to Docker Hub + # - name: Push Docker image to Docker Hub + # run: | + # docker tag node-login-app:latest your-docker-username/node-login-app:latest + # docker push your-docker-username/node-login-app:latest diff --git a/.github/workflows/docker-image-build.yml b/.github/workflows/docker-image-build.yml deleted file mode 100644 index 8a4af47..0000000 --- a/.github/workflows/docker-image-build.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Docker Image CI - -on: - push: - branches: - - main - pull_request: - branches: - - main - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - # Step 3: Log in to Docker Hub (Optional) - # Uncomment this section if you're pushing the image to Docker Hub. - # Replace DOCKER_USERNAME and DOCKER_PASSWORD with your Docker credentials as GitHub secrets. - # - name: Log in to Docker Hub - # uses: docker/login-action@v3 - # with: - # username: ${{ secrets.DOCKER_USERNAME }} - # password: ${{ secrets.DOCKER_PASSWORD }} - - # Step 4: Build the Docker image - - name: Build Docker image - run: | - docker build -t node-login-app . - - # Step 5: (Optional) Push the Docker image to Docker Hub - # Uncomment if you want to push the image to Docker Hub - # - name: Push Docker image to Docker Hub - # run: | - # docker tag node-login-app:latest your-docker-username/node-login-app:latest - # docker push your-docker-username/node-login-app:latest diff --git a/audit.json b/audit.json new file mode 100644 index 0000000..7de5817 --- /dev/null +++ b/audit.json @@ -0,0 +1,95 @@ +{ + "auditReportVersion": 2, + "vulnerabilities": { + "cookie": { + "name": "cookie", + "severity": "low", + "isDirect": false, + "via": [ + { + "source": 1099846, + "name": "cookie", + "dependency": "cookie", + "title": "cookie accepts cookie name, path, and domain with out of bounds characters", + "url": "https://github.com/advisories/GHSA-pxg6-pf52-xh8x", + "severity": "low", + "cwe": [ + "CWE-74" + ], + "cvss": { + "score": 0, + "vectorString": null + }, + "range": "<0.7.0" + } + ], + "effects": [ + "express", + "express-session" + ], + "range": "<0.7.0", + "nodes": [ + "node_modules/cookie" + ], + "fixAvailable": { + "name": "express-session", + "version": "1.0.0", + "isSemVerMajor": true + } + }, + "express": { + "name": "express", + "severity": "low", + "isDirect": true, + "via": [ + "cookie" + ], + "effects": [], + "range": ">=3.0.0-alpha1", + "nodes": [ + "node_modules/express" + ], + "fixAvailable": { + "name": "express", + "version": "2.5.11", + "isSemVerMajor": true + } + }, + "express-session": { + "name": "express-session", + "severity": "low", + "isDirect": true, + "via": [ + "cookie" + ], + "effects": [], + "range": ">=1.0.1", + "nodes": [ + "node_modules/express-session" + ], + "fixAvailable": { + "name": "express-session", + "version": "1.0.0", + "isSemVerMajor": true + } + } + }, + "metadata": { + "vulnerabilities": { + "info": 0, + "low": 3, + "moderate": 0, + "high": 0, + "critical": 0, + "total": 3 + }, + "dependencies": { + "prod": 89, + "dev": 303, + "optional": 1, + "peer": 1, + "peerOptional": 0, + "total": 392 + } + } +} diff --git a/coverage/clover.xml b/coverage/clover.xml index 2f41fb1..8b8a224 100644 --- a/coverage/clover.xml +++ b/coverage/clover.xml @@ -1,6 +1,6 @@ - - + + diff --git a/coverage/lcov-report/app.js.html b/coverage/lcov-report/app.js.html index 9b9508f..2de5928 100644 --- a/coverage/lcov-report/app.js.html +++ b/coverage/lcov-report/app.js.html @@ -373,7 +373,7 @@

All files app.js

Code coverage generated by istanbul - at 2024-10-05T05:32:04.558Z + at 2024-10-05T06:11:50.888Z