Skip to content

Commit f69c749

Browse files
BiokesBiokes
authored
Merge branch 'main' into main
2 parents 76ad8a3 + 2b0705f commit f69c749

32 files changed

Lines changed: 1229 additions & 907 deletions

‎.github/dependabot.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "npm"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"
7+
open-pull-requests-limit: 10
8+
labels:
9+
- "dependencies"
10+
- "security"
11+
- "automated-pr"
12+
commit-message:
13+
prefix: "chore(deps)"
14+
groups:
15+
nestjs:
16+
patterns:
17+
- "@nestjs*"
18+
aws-sdk:
19+
patterns:
20+
- "@aws-sdk/*"
21+
types-packages:
22+
patterns:
23+
- "@types/*"
24+
minor-and-patch:
25+
update-types:
26+
- "minor"
27+
- "patch"
28+
29+
- package-ecosystem: "github-actions"
30+
directory: "/"
31+
schedule:
32+
interval: "daily"
33+
open-pull-requests-limit: 5
34+
labels:
35+
- "dependencies"
36+
- "security"
37+
- "automated-pr"
38+
commit-message:
39+
prefix: "chore(ci)"

‎.github/workflows/ci-cd.yml‎

Lines changed: 46 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,34 @@ on:
77
branches: [ main ]
88

99
jobs:
10+
dependency-vulnerability-gate:
11+
name: Dependency Vulnerability Gate
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v6
17+
18+
- name: Setup Node.js
19+
uses: actions/setup-node@v6
20+
with:
21+
node-version: 20.x
22+
cache: 'npm'
23+
24+
- name: Install dependencies
25+
run: npm ci --legacy-peer-deps
26+
27+
- name: Block on high/critical vulnerabilities
28+
run: npm audit --audit-level=high
29+
30+
- name: Run Snyk test when token is configured
31+
if: ${{ secrets.SNYK_TOKEN != '' }}
32+
uses: snyk/actions/node@master
33+
env:
34+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
35+
with:
36+
args: --severity-threshold=high
37+
1038
test:
1139
name: Test & Build
1240
runs-on: ubuntu-latest
@@ -32,10 +60,10 @@ jobs:
3260

3361
steps:
3462
- name: Checkout code
35-
uses: actions/checkout@v4
63+
uses: actions/checkout@v6
3664

3765
- name: Setup Node.js ${{ matrix.node-version }}
38-
uses: actions/setup-node@v4
66+
uses: actions/setup-node@v6
3967
with:
4068
node-version: ${{ matrix.node-version }}
4169
cache: 'npm'
@@ -52,7 +80,7 @@ jobs:
5280

5381
- name: Upload build artifacts
5482
if: matrix.node-version == '20.x'
55-
uses: actions/upload-artifact@v4
83+
uses: actions/upload-artifact@v7
5684
with:
5785
name: dist-files
5886
path: dist/
@@ -64,10 +92,10 @@ jobs:
6492

6593
steps:
6694
- name: Checkout code
67-
uses: actions/checkout@v4
95+
uses: actions/checkout@v6
6896

6997
- name: Setup Node.js
70-
uses: actions/setup-node@v4
98+
uses: actions/setup-node@v6
7199
with:
72100
node-version: 20.x
73101
cache: 'npm'
@@ -83,7 +111,7 @@ jobs:
83111
run: npm audit --json > audit-results.json || true
84112

85113
- name: Upload audit results
86-
uses: actions/upload-artifact@v4
114+
uses: actions/upload-artifact@v7
87115
with:
88116
name: security-audit
89117
path: audit-results.json
@@ -95,10 +123,10 @@ jobs:
95123

96124
steps:
97125
- name: Checkout code
98-
uses: actions/checkout@v4
126+
uses: actions/checkout@v6
99127

100128
- name: Setup Node.js
101-
uses: actions/setup-node@v4
129+
uses: actions/setup-node@v6
102130
with:
103131
node-version: 20.x
104132
cache: 'npm'
@@ -118,7 +146,7 @@ jobs:
118146
continue-on-error: true
119147

120148
- name: Upload high-severity report
121-
uses: actions/upload-artifact@v4
149+
uses: actions/upload-artifact@v7
122150
with:
123151
name: high-severity-report
124152
path: high-severity-report.json
@@ -130,10 +158,10 @@ jobs:
130158

131159
steps:
132160
- name: Checkout code
133-
uses: actions/checkout@v4
161+
uses: actions/checkout@v6
134162

135163
- name: Setup Node.js
136-
uses: actions/setup-node@v4
164+
uses: actions/setup-node@v6
137165
with:
138166
node-version: 20.x
139167
cache: 'npm'
@@ -161,13 +189,13 @@ jobs:
161189

162190
steps:
163191
- name: Checkout code
164-
uses: actions/checkout@v4
192+
uses: actions/checkout@v6
165193

166194
- name: Set up Docker Buildx
167-
uses: docker/setup-buildx-action@v3
195+
uses: docker/setup-buildx-action@v4
168196

169197
- name: Build Docker image
170-
uses: docker/build-push-action@v5
198+
uses: docker/build-push-action@v7
171199
with:
172200
context: .
173201
push: false
@@ -177,7 +205,7 @@ jobs:
177205
outputs: type=docker,dest=/tmp/image.tar
178206

179207
- name: Upload Docker image
180-
uses: actions/upload-artifact@v4
208+
uses: actions/upload-artifact@v7
181209
with:
182210
name: docker-image
183211
path: /tmp/image.tar
@@ -186,12 +214,12 @@ jobs:
186214
deploy-preview:
187215
name: Deployment Info
188216
runs-on: ubuntu-latest
189-
needs: [test, security-audit, security-testing, code-quality]
217+
needs: [dependency-vulnerability-gate, test, security-audit, security-testing, code-quality]
190218
if: always()
191219

192220
steps:
193221
- name: Checkout code
194-
uses: actions/checkout@v4
222+
uses: actions/checkout@v6
195223

196224
- name: Show deployment info
197225
run: |
@@ -211,6 +239,7 @@ jobs:
211239
echo "## CI/CD Pipeline Summary" >> $GITHUB_STEP_SUMMARY
212240
echo "" >> $GITHUB_STEP_SUMMARY
213241
echo "### Results" >> $GITHUB_STEP_SUMMARY
242+
echo "- **Dependency Vulnerability Gate**: ${{ needs.dependency-vulnerability-gate.result }}" >> $GITHUB_STEP_SUMMARY
214243
echo "- **Test & Build**: ${{ needs.test.result }}" >> $GITHUB_STEP_SUMMARY
215244
echo "- **Security Audit**: ${{ needs.security-audit.result }}" >> $GITHUB_STEP_SUMMARY
216245
echo "- **Security Testing**: ${{ needs.security-testing.result }}" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/dependency-scan.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
name: Dependency Scanning
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- master
8+
- develop
9+
pull_request:
10+
branches:
11+
- main
12+
- develop
13+
schedule:
14+
# Run daily at 03:00 UTC for continuous vulnerability checks
15+
- cron: "0 3 * * *"
16+
workflow_dispatch:
17+
18+
jobs:
19+
npm-audit:
20+
name: npm audit (block high/critical)
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
security-events: write
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v6
28+
29+
- name: Use Node.js 20
30+
uses: actions/setup-node@v6
31+
with:
32+
node-version: 20
33+
cache: "npm"
34+
35+
- name: Install dependencies
36+
run: npm ci --legacy-peer-deps
37+
38+
- name: npm audit (high+ threshold)
39+
run: npm audit --audit-level=high
40+
41+
snyk-test:
42+
name: Snyk test (block high/critical)
43+
needs: npm-audit
44+
if: ${{ secrets.SNYK_TOKEN != '' }}
45+
runs-on: ubuntu-latest
46+
steps:
47+
- name: Checkout
48+
uses: actions/checkout@v6
49+
50+
- name: Use Node.js 20
51+
uses: actions/setup-node@v6
52+
with:
53+
node-version: 20
54+
cache: "npm"
55+
56+
- name: Install dependencies
57+
run: npm ci --legacy-peer-deps
58+
59+
- name: Snyk test
60+
uses: snyk/actions/node@master
61+
env:
62+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
63+
with:
64+
args: --severity-threshold=high
65+
66+
snyk-monitor:
67+
name: Snyk monitor (continuous alerts)
68+
needs: snyk-test
69+
if: ${{ github.event_name != 'pull_request' && secrets.SNYK_TOKEN != '' }}
70+
runs-on: ubuntu-latest
71+
steps:
72+
- name: Checkout
73+
uses: actions/checkout@v6
74+
75+
- name: Use Node.js 20
76+
uses: actions/setup-node@v6
77+
with:
78+
node-version: 20
79+
cache: "npm"
80+
81+
- name: Install dependencies
82+
run: npm ci --legacy-peer-deps
83+
84+
- name: Snyk monitor
85+
uses: snyk/actions/node@master
86+
env:
87+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
88+
with:
89+
command: monitor

‎SECURITY_DEPENDENCY_SCANNING.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Dependency Vulnerability Scanning
2+
3+
This project uses **Dependabot** and **Snyk + npm audit in GitHub Actions** to continuously detect vulnerable dependencies, open automated upgrade PRs, and block CI on high/critical issues.
4+
5+
## What is configured
6+
7+
- `/.github/dependabot.yml`
8+
- Daily update checks for:
9+
- `npm` dependencies
10+
- GitHub Actions dependencies
11+
- Auto-generated dependency PRs with labels (`dependencies`, `security`, `automated-pr`)
12+
- Grouping rules to keep update PRs manageable
13+
14+
- `/.github/workflows/dependency-scan.yml`
15+
- Runs on:
16+
- pushes to `main`, `master`, `develop`
17+
- PRs targeting `main` and `develop`
18+
- scheduled daily run (`cron`)
19+
- manual dispatch
20+
- Uses `npm audit --audit-level=high` to fail on high/critical vulnerabilities
21+
- Runs `snyk test` (if `SNYK_TOKEN` is set) and fails on high/critical vulnerabilities
22+
- Runs `snyk monitor` on non-PR events to keep Snyk project monitoring and alerting up to date
23+
24+
- `/.github/workflows/ci-cd.yml`
25+
- Adds `dependency-vulnerability-gate` job to the CI pipeline
26+
- Blocks pipeline progression if high/critical vulnerabilities are detected
27+
- Executes `snyk test` in CI when configured
28+
29+
## Required secrets
30+
31+
- `SNYK_TOKEN` (recommended)
32+
- Add in: GitHub repository **Settings -> Secrets and variables -> Actions**
33+
- Without it, `npm audit` gating still runs, but Snyk checks/monitoring are skipped
34+
35+
## Alerts and notifications
36+
37+
- Dependabot alerts and security update PRs are managed by GitHub once Dependabot is enabled in the repo
38+
- Snyk alerts are generated through `snyk monitor` snapshots (requires `SNYK_TOKEN`)
39+
- Failed GitHub Action runs provide immediate CI signal for high/critical findings
40+
41+
## Branch protection recommendation
42+
43+
To enforce the security gate, require these checks in branch protection for `main`:
44+
45+
- `Dependency Vulnerability Gate`
46+
- `npm audit (block high/critical)` from `dependency-scan.yml`
47+
- `Snyk test (block high/critical)` (if `SNYK_TOKEN` is configured)
48+
49+
## Maintenance
50+
51+
- Tune update cadence and grouping in `/.github/dependabot.yml`
52+
- Tune severity threshold in workflows via `--audit-level=high` and `--severity-threshold=high`
53+
- Rotate `SNYK_TOKEN` periodically and after any exposure

‎gh.tar.gz‎

13.6 MB
Binary file not shown.

‎issues.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# GitHub Issues
2+
3+
## #813 Optimize Bundle Size
4+
**Repo:** StarkMindsHQ/StrellerMinds-Backend
5+
**Priority:** Medium
6+
7+
Reduce Node.js bundle size by removing unused dependencies.
8+
9+
## #818 Optimize TypeORM Queries
10+
**Repo:** StarkMindsHQ/StrellerMinds-Backend
11+
**Priority:** High
12+
13+
Use QueryBuilder instead of repository methods for complex queries.
14+
15+
## #817 Add Memory Usage Monitoring
16+
**Repo:** StarkMindsHQ/StrellerMinds-Backend
17+
**Priority:** High
18+
19+
Monitor memory usage and set alerts for high memory consumption.
20+
21+
## #816 Implement Request Throttling
22+
**Repo:** StarkMindsHQ/StrellerMinds-Backend
23+
**Priority:** High
24+
25+
Add throttling to prevent resource exhaustion from single users.

0 commit comments

Comments
 (0)