Merge branch 'main' into mntor-3951-1

Author: codemist

.dockerignore

@@ -1 +1,3 @@
 node_modules
+.git
+.github

.env.local.example

@@ -52,7 +52,7 @@ SUBSCRIPTION_BILLING_AMOUNT_YEARLY_US=13.37
 SUBSCRIPTION_BILLING_AMOUNT_MONTHLY_US=42.42
 
 # HIBP setup
-HIBP_KANON_API_ROOT=https://enterprise.stage-api.haveibeenpwned.com
+HIBP_KANON_API_ROOT=https://api.haveibeenpwned.com
 
 # Sentry setup
 SENTRY_DSN=https://573f784b5cc7481ebf8c0c385d2ad776@o1069899.ingest.sentry.io/4504612374052864
@@ -84,3 +84,9 @@ S3_BUCKET=firefoxmonitor-dev-monitor-cdn-dev-static-website
 
 # Data broker removal estimates data
 DATA_BROKER_REMOVAL_ESTIMATES_DATA=[]
+
+# GCP PubSub settings - see the PubSub heading in the README
+GCP_PUBSUB_PROJECT_ID=your-project-name
+GCP_PUBSUB_TOPIC_NAME=hibp-breaches
+GCP_PUBSUB_SUBSCRIPTION_NAME=hibp-cron
+PUBSUB_EMULATOR_HOST=localhost:8085

.github/workflows/build.yaml

@@ -1,5 +1,7 @@
 name: Build
 
+permissions: {}
+
 on: [push]
 
 jobs:
@@ -9,6 +11,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/conflicts.yml

@@ -1,12 +1,18 @@
 name: No unresolved conflicts
+
+permissions: {}
+
 on:
   pull_request:
     branches: [ main, localization ]
+
 jobs:
   detect-unresolved-conflicts:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: List files with merge conflict markers
         # Encode conflict markers so this file does not trigger git's conflict detection.
         run: git --no-pager grep "$(echo 'PDw8PDw8PAo=' | base64 -d)" ":(exclude).github/" || true

.github/workflows/docker_build_deploy.yml

@@ -1,5 +1,7 @@
 name: Build Docker image and publish
 
+permissions: {}
+
 on:
   push:
     branches: [ main ]
@@ -10,6 +12,8 @@ jobs:
     steps:
       - name: Check out the repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3

.github/workflows/docker_check.yml

@@ -1,4 +1,7 @@
 name: Build Docker image check
+
+permissions: {}
+
 on:
   pull_request:
 jobs:
@@ -18,6 +21,8 @@ jobs:
 
       - name: Check out the repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Build Docker image
         run: docker build .

.github/workflows/e2e_cron.yml

@@ -1,4 +1,7 @@
 name: Monitor Cron e2e Tests
+
+permissions: {}
+
 on:
   schedule:
     - cron: '0 8 * * *'
@@ -19,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: 20.18.x
@@ -44,7 +49,7 @@ jobs:
         run: npx playwright install --with-deps
 
       - name: Run Playwright tests - ${{ inputs.environment != null && inputs.environment || 'stage' }}
-        if: github.actor != 'dependabot[bot]'
+        if: github.event.pull_request.user.login != 'dependabot[bot]'
         run: npm run e2e -- --workers=1 --update-snapshots
         timeout-minutes: 40
         env:

.github/workflows/e2e_pr_full.yml

@@ -1,4 +1,7 @@
 name: Monitor E2E Test Suite (full)
+
+permissions: {}
+
 on:
   push:
     branches: [ main ]
@@ -30,6 +33,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: 20.18.x
@@ -58,7 +63,7 @@ jobs:
         run: npx playwright install --with-deps
 
       - name: Run Playwright tests
-        if: github.actor != 'dependabot[bot]'
+        if: github.event.pull_request.user.login != 'dependabot[bot]'
         run: npm run e2e -- --update-snapshots
         timeout-minutes: 20
         env:

.github/workflows/e2e_pr_smoke.yml

@@ -1,4 +1,7 @@
 name: Monitor E2E Test Suite (smoke)
+
+permissions: {}
+
 on:
   push:
     branches: [ main ]
@@ -30,6 +33,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v4
         with:
           node-version: 20.18.x
@@ -58,7 +63,7 @@ jobs:
         run: npx playwright install --with-deps
 
       - name: Run Playwright tests
-        if: github.actor != 'dependabot[bot]'
+        if: github.event.pull_request.user.login != 'dependabot[bot]'
         run: npm run e2e:smoke
         timeout-minutes: 10
         env:

.github/workflows/glean-probe-scraper.yml

@@ -1,4 +1,7 @@
 name: Glean probe-scraper
+
+permissions: {}
+
 on:
   push:
     paths:
@@ -10,4 +13,4 @@ on:
       - src/telemetry/backend-metrics.yaml
 jobs:
   glean-probe-scraper:
-    uses: mozilla/probe-scraper/.github/workflows/glean.yaml@main
+    uses: mozilla/probe-scraper/.github/workflows/glean.yaml@main

.github/workflows/lighthouse_cron.yml

@@ -1,4 +1,7 @@
 name: Lighthouse Report Cron
+
+permissions: {}
+
 on:
   schedule:
     - cron: '0 6 * * *'
@@ -22,6 +25,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js 20.18.x
         uses: actions/setup-node@v4
         with:

.github/workflows/lint.yaml

@@ -1,5 +1,7 @@
 name: Lint
 
+permissions: {}
+
 on: [push]
 
 jobs:
@@ -9,6 +11,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
@@ -19,3 +23,4 @@ jobs:
       # Mirror old linter from CircleCI, verifies that linter succeeds
       - run: npm run lint
       - run: node src/scripts/build/checkNodeVersionAlignment.js
+      - run: node src/scripts/build/checkGithubActionsBestPractices.js

.github/workflows/preview_deploy_gcp.yml

@@ -1,6 +1,8 @@
 name: Deploy Preview
 
-on: 
+permissions: {}
+
+on:
   pull_request:
 
 env:
@@ -12,7 +14,7 @@ env:
 
 jobs:
   deploy:
-    permissions: 
+    permissions:
       pull-requests: write
     # Secrets aren't available for Dependabot PR (because the updated
     # dependencies might abuse them), so they don't have enough rights to
@@ -22,12 +24,14 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v4
-    
+      with:
+        persist-credentials: false
+
     - name: Setup Cloud SDK
       uses: 'google-github-actions/auth@v2'
       with:
         credentials_json: '${{ secrets.GCP_SA_KEY }}'
-  
+
     - name: Use gcloud CLI
       run: gcloud info
 
@@ -37,19 +41,19 @@ jobs:
       continue-on-error: true
       run: |
         gcloud sql instances create ${{ env.SERVICE }}-${{ env.TAG }} --tier=db-f1-micro --region=${{ env.REGION }} --database-version=POSTGRES_15 --edition=enterprise
-        gcloud sql users set-password postgres --host=% --instance ${{ env.SERVICE }}-${{ env.TAG }} --password postgres 
+        gcloud sql users set-password postgres --host=% --instance ${{ env.SERVICE }}-${{ env.TAG }} --password postgres
         gcloud sql databases create blurts --instance=${{ env.SERVICE }}-${{ env.TAG }}
         gcloud sql databases list --instance=${{ env.SERVICE }}-${{ env.TAG }}
         gcloud sql instances list
-  
+
     - name: Authorize Docker push
       run: gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev
 
     - name: Build and Push Container
       run: |-
         docker build -t ${{env.REGION}}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.SERVICE }}:${{ env.TAG }} -f './Dockerfile.cloudrun' .
         docker push ${{env.REGION}}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.SERVICE }}:${{ env.TAG }}
-        
+
     - name: Deploy to Cloud Run
       id: deploy
       uses: google-github-actions/deploy-cloudrun@v2
@@ -79,7 +83,7 @@ jobs:
           DB_USER=postgres
           DB_PASSWORD=postgres
           CLOUD_SQL_CONNECTION_NAME=${{ env.PROJECT_ID }}:${{env.REGION}}:${{ env.SERVICE }}-${{ env.TAG }}
-          DATABASE_URL= postgres://postgres:postgres@localhost:5432/blurts 
+          DATABASE_URL= postgres://postgres:postgres@localhost:5432/blurts
 
     - name: Comment on Pull Request
       uses: thollander/actions-comment-pull-request@v3
@@ -89,4 +93,3 @@ jobs:
             Preview URL :rocket: : ${{ steps.deploy.outputs.url }}
           comment-tag: preview_url
           create-if-not-exists: true
-          

.github/workflows/preview_deploy_gcp_cleanup.yml

@@ -1,8 +1,10 @@
 name: Deploy Preview Cleanup
 
-on: 
+permissions: {}
+
+on:
   # when pull request is merged or closed
-  pull_request: 
+  pull_request:
     types: [closed]
 
 env:
@@ -14,7 +16,7 @@ env:
 
 jobs:
   deploy:
-    permissions: 
+    permissions:
       pull-requests: write
     # Secrets aren't available for Dependabot PR (because the updated
     # dependencies might abuse them), so they don't have enough rights to
@@ -26,15 +28,15 @@ jobs:
       uses: 'google-github-actions/auth@v2'
       with:
         credentials_json: '${{ secrets.GCP_SA_KEY }}'
-  
+
     - name: Use gcloud CLI
       run: 'gcloud info'
 
     - name: Delete created database
       id: db_delete
       # Delete cloud sql instance
       run: 'gcloud sql instances delete blurts-server-${{ env.TAG }}'
-    
+
     - name: Delete created cloud run service
       id: cloudrun_delete
       run: gcloud run services delete blurts-server-${{ env.TAG }} --region ${{ env.REGION }} --platform managed --quiet

.github/workflows/production_deploy.yml

@@ -1,4 +1,7 @@
 name: Monitor 1-click Deployment
+
+permissions: {}
+
 on:
   workflow_dispatch:
     inputs:
@@ -23,6 +26,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
@@ -35,6 +40,6 @@ jobs:
 
       - name: Retag image
         run: docker tag ${{ env.DOCKER_IMAGE_NAME }}:${{ inputs.originalImageTag }} ${{ env.DOCKER_IMAGE_NAME }}:${{ inputs.environment }}-${{ inputs.originalImageTag }}
-          
+
       - name: Redeploy image
-        run: docker push ${{ env.DOCKER_IMAGE_NAME }}:${{ inputs.environment }}-${{ inputs.originalImageTag }}
+        run: docker push ${{ env.DOCKER_IMAGE_NAME }}:${{ inputs.environment }}-${{ inputs.originalImageTag }}

.github/workflows/reference_linter.yaml

@@ -1,4 +1,7 @@
 name: Lint Reference Files
+
+permissions: {}
+
 on:
   push:
   pull_request:
@@ -9,6 +12,8 @@ jobs:
     steps:
       - name: Clone repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python 3
         uses: actions/setup-python@v5
         with: