[PROD RELEASE V6] #1702
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| name: Trivy Scanner | ||
|
|
||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
|
There was a problem hiding this comment. [❗❗ |
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| - dev | ||
| pull_request: | ||
| jobs: | ||
| trivy-scan: | ||
| name: Use Trivy | ||
| runs-on: ubuntu-24.04 | ||
|
There was a problem hiding this comment. [ |
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Run Trivy scanner in repo mode | ||
| uses: aquasecurity/trivy-action@0.33.1 | ||
| with: | ||
| scan-type: "fs" | ||
| ignore-unfixed: true | ||
| format: "sarif" | ||
| output: "trivy-results.sarif" | ||
| severity: "CRITICAL,HIGH,UNKNOWN" | ||
|
There was a problem hiding this comment. [ |
||
| scanners: vuln,secret,misconfig,license | ||
| github-pat: ${{ secrets.GITHUB_TOKEN }} | ||
|
There was a problem hiding this comment. [❗❗ |
||
|
|
||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: "trivy-results.sarif" | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| 321029 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 22.19.0 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,49 @@ | ||
| #!/bin/bash | ||
| set -eo pipefail | ||
|
|
||
| APP_NAME=$1 | ||
| LOCK_FILE_LOCAL="" | ||
| LOCK_FILE_NAME="" | ||
| UPDATE_CACHE=0 | ||
|
|
||
| echo "NODE ENV: $NODE_ENV" | ||
| echo "BABEL ENV: $BABEL_ENV" | ||
|
|
||
| # Build the container image | ||
| docker compose -f docker/docker-compose.yml build \ | ||
| --build-arg NODE_ENV=$NODE_ENV \ | ||
| --build-arg BABEL_ENV=$BABEL_ENV \ | ||
| --build-arg FILE_PICKER_API_KEY=$FILE_PICKER_API_KEY \ | ||
| --build-arg FORCE_DEV=$FORCE_DEV \ | ||
| $APP_NAME | ||
|
|
||
| # Create a throwaway container for copying artifacts | ||
| docker create --name app $APP_NAME:latest >/dev/null | ||
|
|
||
| # Determine which lockfile to compare (pnpm preferred, fallback to npm) | ||
| if [ -f pnpm-lock.yaml ]; then | ||
| LOCK_FILE_NAME="pnpm-lock.yaml" | ||
| elif [ -f package-lock.json ]; then | ||
| LOCK_FILE_NAME="package-lock.json" | ||
| fi | ||
|
|
||
| if [ -z "$LOCK_FILE_NAME" ] || [ ! -d node_modules ]; then | ||
| UPDATE_CACHE=1 | ||
| else | ||
| # Compare lockfile from container with local copy | ||
| cp "$LOCK_FILE_NAME" ".old-$LOCK_FILE_NAME" | ||
| docker cp "app:/$APP_NAME/$LOCK_FILE_NAME" "$LOCK_FILE_NAME" | ||
|
There was a problem hiding this comment. [ |
||
| set +e | ||
| cmp "$LOCK_FILE_NAME" ".old-$LOCK_FILE_NAME" >/dev/null 2>&1 | ||
| CMP_STATUS=$? | ||
| set -e | ||
| if [ $CMP_STATUS -ne 0 ]; then | ||
| UPDATE_CACHE=1 | ||
| fi | ||
| fi | ||
|
|
||
| if [ "$UPDATE_CACHE" -eq 1 ]; then | ||
| echo "Lockfile changed or node_modules missing; refreshing local node_modules from container..." | ||
| rm -rf node_modules | ||
|
There was a problem hiding this comment. [ |
||
| docker cp "app:/$APP_NAME/node_modules" . | ||
| fi | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,18 @@ | ||
| module.exports = (() => { | ||
| let env = process.env.NODE_ENV || 'development' | ||
|
There was a problem hiding this comment. [💡 |
||
| if (process.env.FORCE_DEV) env = 'development' | ||
|
|
||
| // Only allow specific files to be required for security reasons | ||
| if (env === 'production') { | ||
| return require('./production') | ||
| } | ||
|
|
||
| // Support explicit local environment (mirrors platform-ui local setup) | ||
| const hostEnv = process.env.HOST_ENV | ||
|
There was a problem hiding this comment. [💡 |
||
| if (env === 'local' || hostEnv === 'local') { | ||
| return require('./local') | ||
| } | ||
|
|
||
| // Default to development | ||
| return require('./development') | ||
| })() | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[❗❗
correctness]The branch version for
tc-deploy-scriptshas been updated fromv1.4.15tov1.4.17. Ensure that this new version is compatible with the rest of the deployment scripts and does not introduce breaking changes.