-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
1 create project boilerplate #2
Changes from all commits
dfd77e6
334fa13
0519702
7bcf462
9fd041a
417cb12
e987da8
bc914f4
c5611c8
11211c2
6d1c97f
4317008
cc838f9
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,25 @@ | ||
module.exports = { | ||
parser: '@typescript-eslint/parser', | ||
parserOptions: { | ||
project: 'tsconfig.json', | ||
tsconfigRootDir: __dirname, | ||
sourceType: 'module', | ||
}, | ||
plugins: ['@typescript-eslint/eslint-plugin'], | ||
extends: [ | ||
'plugin:@typescript-eslint/recommended', | ||
'plugin:prettier/recommended', | ||
], | ||
root: true, | ||
env: { | ||
node: true, | ||
jest: true, | ||
}, | ||
ignorePatterns: ['.eslintrc.js'], | ||
rules: { | ||
'@typescript-eslint/interface-name-prefix': 'off', | ||
'@typescript-eslint/explicit-function-return-type': 'off', | ||
'@typescript-eslint/explicit-module-boundary-types': 'off', | ||
'@typescript-eslint/no-explicit-any': 'off', | ||
}, | ||
}; |
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,34 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
on: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
workflow_call: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
env: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
REGISTRY: ghcr.io | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
IMAGE_NAME: ${{ github.repository }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
jobs: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
build-push: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
name: Build + Push Image | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
permissions: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
contents: read | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
packages: write | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Comment on lines
+8
to
+15
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Add job-level controls for better resource management. Consider adding timeout and concurrency controls to prevent long-running or overlapping builds. jobs:
build-push:
name: Build + Push Image
runs-on: ubuntu-latest
+ timeout-minutes: 15
+ concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
permissions:
contents: read
packages: write 📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
steps: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
- uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
- uses: docker/setup-buildx-action@v3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
- uses: docker/login-action@v3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
registry: ${{ env.REGISTRY }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
username: ${{ github.actor }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
password: ${{ secrets.GITHUB_TOKEN }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
- uses: docker/metadata-action@v5 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
id: meta | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
- uses: docker/build-push-action@v5 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
context: . | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
target: production | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
push: true | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
tags: ${{ steps.meta.outputs.tags }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
labels: ${{ steps.meta.outputs.labels }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Comment on lines
+1
to
+34
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Codebase verification Pin base images using SHA digests for enhanced security The Dockerfile uses the floating tag
This ensures reproducible builds and prevents potential supply chain attacks through compromised image tags. 🔗 Analysis chainImplement additional security measures. While the workflow is generally secure, consider these security enhancements:
Let's verify if the Dockerfile uses explicit image versions: 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check if Dockerfile uses explicit image versions
rg -l '^\s*FROM\s+\w+(/\w+)*:(latest|\d+)'
Length of output: 55 Script: #!/bin/bash
# Let's check the actual FROM statements in the Dockerfile
rg '^\s*FROM' Dockerfile -A 1
Length of output: 209
Comment on lines
+16
to
+34
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Enhance build security and performance. Consider the following improvements:
- uses: docker/build-push-action@v5
with:
context: .
target: production
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
+ cache-from: type=gha
+ cache-to: type=gha,mode=max
+ build-args: |
+ NODE_ENV=production
+
+ - name: Run Trivy vulnerability scanner
+ uses: aquasecurity/trivy-action@master
+ with:
+ image-ref: ${{ steps.meta.outputs.tags }}
+ format: 'table'
+ exit-code: '1'
+ ignore-unfixed: true
+ vuln-type: 'os,library'
+ severity: 'CRITICAL,HIGH' 📝 Committable suggestion
Suggested change
|
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,14 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
name: CI Pipeline | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
on: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
push: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
pull_request: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
jobs: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
lint: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
uses: ./.github/workflows/lint.yml | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
test: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
uses: ./.github/workflows/test.yml | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
build-push: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
needs: [lint, test] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
uses: ./.github/workflows/build-push.yml | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Comment on lines
+12
to
+14
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Add environment conditions and permissions for build-push job. The build-push job should be restricted to specific environments and have explicit permissions defined. build-push:
needs: [lint, test]
+ permissions:
+ contents: read
+ packages: write
uses: ./.github/workflows/build-push.yml
+ with:
+ environment: production 📝 Committable suggestion
Suggested change
Comment on lines
+1
to
+14
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Consider adding workflow optimizations. The workflow could benefit from these additional configurations: name: CI Pipeline
on:
push:
pull_request:
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
jobs:
lint:
+ timeout-minutes: 10
uses: ./.github/workflows/lint.yml
test:
+ timeout-minutes: 15
uses: ./.github/workflows/test.yml
build-push:
+ timeout-minutes: 20
needs: [lint, test]
uses: ./.github/workflows/build-push.yml 📝 Committable suggestion
Suggested change
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,26 @@ | ||
name: lint Workflow | ||
on: | ||
workflow_call: | ||
jobs: | ||
lint: | ||
name: Lint | ||
runs-on: ubuntu-latest | ||
steps: | ||
- name: Checkout code | ||
uses: actions/checkout@v4 | ||
|
||
- name: Run Linter | ||
uses: github/super-linter@v5.0.0 | ||
env: | ||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
TYPESCRIPT_DEFAULT_STYLE: prettier | ||
VALIDATE_DOCKERFILE_HADOLINT: false | ||
VALIDATE_JSCPD: false | ||
VALIDATE_PYTHON_FLAKE8: false | ||
VALIDATE_PYTHON_MYPY: false | ||
VALIDATE_GIT_COMMITLINT: false | ||
VALIDATE_MARKDOWN: false | ||
VALIDATE_JAVASCRIPT_PRETTIER: false | ||
VALIDATE_JAVASCRIPT_STANDARD: false | ||
VALIDATE_NATURAL_LANGUAGE: false | ||
VALIDATE_MARKDOWN_PRETTIER: false |
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,10 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
name: test Workflow | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
on: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
workflow_call: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
jobs: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
test: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
name: Test | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
steps: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
Comment on lines
+5
to
+8
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Add timeout and concurrency limits To prevent hanging jobs and resource contention, add timeout and concurrency controls. Add the following configurations: jobs:
test:
name: Test
runs-on: ubuntu-latest
+ timeout-minutes: 15
+ concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true 📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
- uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
- run: docker compose -f docker-compose.test.yml up --exit-code-from app | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
Comment on lines
+9
to
+10
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Enhance the test execution step The current implementation could be improved with better error handling, caching, and test result collection. Consider these improvements: - - uses: actions/checkout@v4
- - run: docker compose -f docker-compose.test.yml up --exit-code-from app
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Cache Docker layers
+ uses: actions/cache@v3
+ with:
+ path: /tmp/.buildx-cache
+ key: ${{ runner.os }}-buildx-${{ github.sha }}
+ restore-keys: |
+ ${{ runner.os }}-buildx-
+
+ - name: Run tests
+ run: |
+ docker compose -f docker-compose.test.yml up --exit-code-from app --build
+ env:
+ COMPOSE_DOCKER_CLI_BUILD: 1
+ DOCKER_BUILDKIT: 1
+
+ - name: Cleanup
+ if: always()
+ run: docker compose -f docker-compose.test.yml down --volumes --remove-orphans 📝 Committable suggestion
Suggested change
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,56 @@ | ||
# compiled output | ||
/dist | ||
/node_modules | ||
/build | ||
|
||
# Logs | ||
logs | ||
*.log | ||
npm-debug.log* | ||
pnpm-debug.log* | ||
yarn-debug.log* | ||
yarn-error.log* | ||
lerna-debug.log* | ||
|
||
# OS | ||
.DS_Store | ||
|
||
# Tests | ||
/coverage | ||
/.nyc_output | ||
|
||
# IDEs and editors | ||
/.idea | ||
.project | ||
.classpath | ||
.c9/ | ||
*.launch | ||
.settings/ | ||
*.sublime-workspace | ||
|
||
# IDE - VSCode | ||
.vscode/* | ||
!.vscode/settings.json | ||
!.vscode/tasks.json | ||
!.vscode/launch.json | ||
!.vscode/extensions.json | ||
|
||
# dotenv environment variable files | ||
.env | ||
.env.development.local | ||
.env.test.local | ||
.env.production.local | ||
.env.local | ||
|
||
# temp directory | ||
.temp | ||
.tmp | ||
|
||
# Runtime data | ||
pids | ||
*.pid | ||
*.seed | ||
*.pid.lock | ||
|
||
# Diagnostic reports (https://nodejs.org/api/report.html) | ||
report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json |
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1 @@ | ||||||||||||||||||||||||
npx --no-install commitlint --edit $1 | ||||||||||||||||||||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add shell interpreter and error handling. The script should include a shell interpreter declaration and basic error handling to ensure proper execution. Apply this diff to improve the script: +#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+# Ensure commitlint is available
+if ! command -v npx &> /dev/null; then
+ echo "Error: npx is not installed"
+ exit 1
+fi
+
npx --no-install commitlint --edit $1 📝 Committable suggestion
Suggested change
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
git status |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
npx lint - staged |
Original file line number | Diff line number | Diff line change | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,2 @@ | ||||||||||||||||
npm test | ||||||||||||||||
npx lint - staged | ||||||||||||||||
Comment on lines
+1
to
+2
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add shebang and fix the lint-staged command. The pre-push hook has a few issues that need to be addressed:
Apply this diff to fix the issues: +#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
-npm test
-npx lint - staged
+npm test || exit 1
+npx lint-staged || exit 1 📝 Committable suggestion
Suggested change
💡 Codebase verification Pre-push hook requires executable permissions The pre-push hook file currently has read-write permissions (644) but lacks executable permissions required for Git hooks to function properly.
🔗 Analysis chainVerify file permissions. Ensure the pre-push hook is executable. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check if the pre-push hook has executable permissions
# Expected: File should have executable permissions (755 or similar)
ls -l .husky/pre-push
Length of output: 86 |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,4 @@ | ||
{ | ||
"**/*.ts": ["eslint --fix", "prettier --write"], | ||
"**/*.md": ["prettier --write"] | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,4 @@ | ||
{ | ||
"singleQuote": true, | ||
"trailingComma": "all" | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,17 @@ | ||
FROM node:20-alpine AS base | ||
WORKDIR /app | ||
COPY ./package.json /app | ||
RUN npm install | ||
COPY . . | ||
RUN npm run build | ||
Comment on lines
+1
to
+6
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Several improvements needed for the base stage
Apply these improvements: FROM node:20-alpine AS base
+USER node
WORKDIR /app
-COPY ./package.json /app
+COPY --chown=node:node package*.json ./
-RUN npm install
+RUN npm ci \
+ && npm cache clean --force
-COPY . .
+COPY --chown=node:node . .
RUN npm run build Create a
|
||
|
||
FROM base AS development | ||
EXPOSE 3000 | ||
CMD ["npm", "run", "start:dev"] | ||
Comment on lines
+8
to
+10
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Development stage needs hot-reloading setup The development stage should support hot-reloading for better developer experience. Add these configurations to your services:
app:
volumes:
- .:/app
- /app/node_modules
environment:
- NODE_ENV=development |
||
|
||
FROM base AS test | ||
CMD [ "npx", "jest", "--coverage" ] | ||
Comment on lines
+12
to
+13
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Test stage needs environment setup and coverage persistence The test stage should have proper environment setup and preserve coverage reports. Update the test stage: FROM base AS test
+ENV NODE_ENV=test
+RUN mkdir -p /app/coverage
CMD [ "npx", "jest", "--coverage" ] Add to your services:
test:
volumes:
- ./coverage:/app/coverage |
||
|
||
FROM base AS production | ||
EXPOSE 3000 | ||
CMD ["node", "dist/main"] | ||
Comment on lines
+15
to
+17
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Production stage needs optimization and health check The production stage should be optimized for size and security, and include health monitoring. Replace with a multi-stage build optimized for production: -FROM base AS production
+FROM node:20-alpine AS production
+USER node
+ENV NODE_ENV=production
+WORKDIR /app
+COPY --from=base --chown=node:node /app/dist ./dist
+COPY --chown=node:node package*.json ./
+RUN npm ci --only=production && \
+ npm cache clean --force
EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s \
+ CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
CMD ["node", "dist/main"] Don't forget to implement a
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1 +1,45 @@ | ||
# oci-backend | ||
## Installation | ||
|
||
```bash | ||
$ npm install | ||
``` | ||
|
||
## Running the app | ||
|
||
```bash | ||
# development | ||
$ npm run start | ||
|
||
# watch mode | ||
$ npm run start:dev | ||
|
||
# production mode | ||
$ npm run start:prod | ||
``` | ||
|
||
## Test | ||
|
||
```bash | ||
# unit tests | ||
$ npm run test | ||
|
||
# e2e tests | ||
$ npm run test:e2e | ||
|
||
# test coverage | ||
$ npm run test:cov | ||
``` | ||
|
||
## Support | ||
|
||
Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please [read more here](https://docs.nestjs.com/support). | ||
|
||
## Stay in touch | ||
|
||
- Author - [Kamil Myśliwiec](https://kamilmysliwiec.com) | ||
- Website - [https://nestjs.com](https://nestjs.com/) | ||
- Twitter - [@nestframework](https://twitter.com/nestframework) | ||
|
||
## License | ||
|
||
Nest is [MIT licensed](LICENSE). |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
module.exports = { | ||
extends: ['@commitlint/config-conventional'], | ||
}; |
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,16 @@ | ||||||||||||||||||||||
version: '3.9' | ||||||||||||||||||||||
services: | ||||||||||||||||||||||
app: | ||||||||||||||||||||||
build: | ||||||||||||||||||||||
context: . | ||||||||||||||||||||||
target: development | ||||||||||||||||||||||
dockerfile: Dockerfile | ||||||||||||||||||||||
environment: | ||||||||||||||||||||||
- NODE_ENV=development | ||||||||||||||||||||||
- PORT=3000 | ||||||||||||||||||||||
- WALLET_PRIVATE_KEY=x | ||||||||||||||||||||||
- LOG_LEVEL=info | ||||||||||||||||||||||
Comment on lines
+8
to
+12
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security concern: Avoid committing sensitive information. The Consider these improvements:
- environment:
- - NODE_ENV=development
- - PORT=3000
- - WALLET_PRIVATE_KEY=x
- - LOG_LEVEL=info
+ env_file:
+ - .env.development
📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||
ports: | ||||||||||||||||||||||
- '3000:3000' | ||||||||||||||||||||||
volumes: | ||||||||||||||||||||||
- ./coverage:/project/coverage | ||||||||||||||||||||||
Comment on lines
+13
to
+16
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Consider adding development-specific volumes. For a development environment, you might want to mount the source code for hot-reloading. Add source code mounting: volumes:
- ./coverage:/project/coverage
+ - .:/project
+ - /project/node_modules 📝 Committable suggestion
Suggested change
|
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -0,0 +1,14 @@ | ||||||
version: '3.9' | ||||||
services: | ||||||
app: | ||||||
build: | ||||||
context: . | ||||||
target: production | ||||||
dockerfile: Dockerfile | ||||||
environment: | ||||||
- NODE_ENV=production | ||||||
- PORT=3000 | ||||||
- WALLET_PRIVATE_KEY=x | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Storing sensitive credentials like Consider these alternatives:
- - WALLET_PRIVATE_KEY=x
+ - WALLET_PRIVATE_KEY=${WALLET_PRIVATE_KEY}
📝 Committable suggestion
Suggested change
|
||||||
- LOG_LEVEL=info | ||||||
Comment on lines
+8
to
+12
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Use environment file for configuration Instead of hardcoding environment variables, consider using a - environment:
- - NODE_ENV=production
- - PORT=3000
- - WALLET_PRIVATE_KEY=x
- - LOG_LEVEL=info
+ env_file:
+ - .env.production
|
||||||
volumes: | ||||||
- ./coverage:/project/coverage | ||||||
Comment on lines
+13
to
+14
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove coverage volume mount in production Mounting the coverage directory in production is unnecessary and potentially exposes internal code structure information. Coverage reports should only be generated in development/test environments. - volumes:
- - ./coverage:/project/coverage 📝 Committable suggestion
Suggested change
|
Original file line number | Diff line number | Diff line change | ||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
@@ -0,0 +1,14 @@ | ||||||||||||||||||||||
version: '3.9' | ||||||||||||||||||||||
services: | ||||||||||||||||||||||
app: | ||||||||||||||||||||||
build: | ||||||||||||||||||||||
context: . | ||||||||||||||||||||||
target: test | ||||||||||||||||||||||
dockerfile: Dockerfile | ||||||||||||||||||||||
environment: | ||||||||||||||||||||||
- NODE_ENV=test | ||||||||||||||||||||||
- PORT=3000 | ||||||||||||||||||||||
- WALLET_PRIVATE_KEY=x | ||||||||||||||||||||||
- LOG_LEVEL=info | ||||||||||||||||||||||
Comment on lines
+8
to
+12
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security concern: Avoid hardcoding sensitive data. The Consider these improvements:
environment:
- NODE_ENV=test
- PORT=3000
- - WALLET_PRIVATE_KEY=x
+ - WALLET_PRIVATE_KEY=${TEST_WALLET_PRIVATE_KEY}
- LOG_LEVEL=info 📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||
volumes: | ||||||||||||||||||||||
- ./coverage:/project/coverage | ||||||||||||||||||||||
Comment on lines
+1
to
+14
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Consider adding health check configuration. For better container orchestration, especially in a test environment where service availability is crucial for test execution, consider adding a health check configuration. Add the following configuration: volumes:
- ./coverage:/project/coverage
+ healthcheck:
+ test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
+ interval: 30s
+ timeout: 10s
+ retries: 3
+ start_period: 10s
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
version: '3.9' | ||
services: | ||
nginx: | ||
container_name: nginx | ||
image: nginx:latest | ||
restart: unless-stopped | ||
ports: | ||
- 80:80 | ||
- 443:443 | ||
volumes: | ||
- ./nginx/templates:/etc/nginx/templates:ro | ||
- ./nginx/ssl:/etc/ssl:ro | ||
env_file: | ||
- ./.env.nginx | ||
depends_on: | ||
- app | ||
Comment on lines
+3
to
+16
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 💡 Codebase verification 🛠️ Refactor suggestion Review update: SSL configuration is properly implemented The SSL configuration in
Let's focus on the remaining valid concerns: Consider pinning the Nginx version for better stability Using - image: nginx:latest
+ image: nginx:1.24-alpine Add health check for better container orchestration depends_on:
- app
+ healthcheck:
+ test: ["CMD", "nginx", "-t"]
+ interval: 30s
+ timeout: 10s
+ retries: 3 🔗 Analysis chainConsider pinning the Nginx version for better stability. Using - image: nginx:latest
+ image: nginx:1.24-alpine Add health check for better container orchestration. Adding a health check helps Docker manage the container lifecycle more effectively. depends_on:
- app
+ healthcheck:
+ test: ["CMD", "nginx", "-t"]
+ interval: 30s
+ timeout: 10s
+ retries: 3 Verify SSL configuration. The SSL certificates are mounted, but ensure proper HTTPS configuration exists in the Nginx templates. Let me analyze the nginx configuration structure before providing the final response. Let me examine the actual nginx configuration template to provide a comprehensive response about the SSL setup. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check if SSL configuration exists in Nginx templates
rg -l "ssl_certificate" nginx/templates/
Length of output: 113 Script: #!/bin/bash
# Check if nginx templates directory exists and list its contents
ls -la nginx/templates/
# Check for any SSL/HTTPS related configurations in nginx directory
find nginx/ -type f -exec grep -l -i "ssl\|https\|443" {} \;
# Check if .env.nginx file exists and if it contains SSL-related configurations
if [ -f .env.nginx ]; then
grep -i "ssl\|https\|443" .env.nginx
fi
Length of output: 335 Script: #!/bin/bash
# Let's check the content of the default.conf.template to understand the SSL configuration
cat nginx/templates/default.conf.template
Length of output: 1405 |
||
|
||
app: | ||
build: | ||
context: . | ||
target: production | ||
dockerfile: Dockerfile | ||
env_file: | ||
- .env |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
{ | ||
"moduleFileExtensions": ["js", "json", "ts"], | ||
"rootDir": ".", | ||
"testRegex": ".*\\.spec\\.ts$", | ||
"transform": { | ||
"^.+\\.(t|j)s$": "ts-jest" | ||
}, | ||
"collectCoverage": true, | ||
"collectCoverageFrom": ["src/**/*.ts*"], | ||
"coverageDirectory": "./coverage", | ||
"coverageReporters": ["json", "lcov", "text", "clover", "html"], | ||
"testEnvironment": "node" | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
{ | ||
"$schema": "https://json.schemastore.org/nest-cli", | ||
"collection": "@nestjs/schematics", | ||
"sourceRoot": "src", | ||
"compilerOptions": { | ||
"deleteOutDir": true | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🛠️ Refactor suggestion
Consider adding manual trigger and environment protection.
While the workflow_call trigger enables reusability, consider adding:
workflow_dispatch
trigger for manual runs