Tärpistö 3.0 -update

.dockerignore

@@ -1,10 +1,10 @@
 *
-!migrations/
-!scripts/
-!src/
-!static/
-!knexfile.js
-!package-lock.json
+!src/migrations
+!dist/production
 !package.json
-!README.md
-!tsconfig.json
+!package-lock.json
+!scripts/start-security-test-server.sh
+!scripts/start-prod-server.sh
+!scripts/common.sh
+!next.config.js
+!knexfile.js

.git-blame-ignore-revs

@@ -0,0 +1,29 @@
+# Run `git config blame.ignoreRevsFile .git-blame-ignore-revs`
+
+# to make git-blame ignore the commits in these commits. Add
+
+# a commit hash here if you e.g. run prettier on the entire repo
+
+# Run prettier on data json
+
+9463b8c4b9537aeeeb3568021cbea29f3be137bd
+
+# run prettier
+
+a5932a47e876735820a4874e1cfee10cc9c24397
+
+# run prettier
+
+5cb0ea27fb52d428be9feea3d1913134e9226a82
+
+# Run prettier
+
+9355acaa2d29af7d2c9a5b255bcec01a66ae8091
+
+# Run prettier
+
+34f4b05d2b1ca3ec5cac4336209a3ee9f6f8b000
+
+# Prettier
+
+46b6baaa71e22d78ca1c627db49bf57e623af8ca

.github/workflows/build-docker-image.yml

@@ -9,7 +9,7 @@ on:
 env:
   # Use docker.io for Docker Hub if empty
   REGISTRY: registry.tko-aly.fi
-  IMAGE_NAME: exam-archive
+  IMAGE_NAME: tarpisto
 
 jobs:
   build:
@@ -19,13 +19,13 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4.1.6
 
       # Extract metadata (tags, labels) for Docker
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata for worker
         id: meta
-        uses: docker/metadata-action@v4.1.1
+        uses: docker/metadata-action@v5.5.1
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -34,12 +34,8 @@ jobs:
             type=ref,event=tag
             type=ref,event=pr
             type=sha
-      # Build and push Docker image with Buildx (don't push on PR)
-      # https://github.com/docker/build-push-action
-      - name: Build and push Docker image
-        uses: docker/[email protected]
-        with:
-          context: .
-          push: false
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Build Docker image
+        run: ./scripts/build-image.sh
+        env:
+          DOCKER_INFO: ${{ steps.meta.outputs.bake-file }}

.github/workflows/push-docker-image.yml

@@ -5,9 +5,7 @@ on:
     types: [published]
 
 env:
-  # Use docker.io for Docker Hub if empty
-  REGISTRY: registry.tko-aly.fi
-  IMAGE_NAME: exam-archive
+  IMAGE_NAME: tarpisto
 
 jobs:
   build:
@@ -17,12 +15,16 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/[email protected]
+
+      - name: Get commit SHA for Docker image tag
+        id: sha
+        run: echo "value=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
 
       # Login against a Docker registry except on PR
       # https://github.com/docker/login-action
       - name: Log into registry
-        uses: docker/login-action@v2.1.0
+        uses: docker/login-action@v3.2.0
         with:
           registry: ${{ secrets.PRIVATE_REGISTRY_URL }}
           username: ${{ secrets.PRIVATE_REGISTRY_USER }}
@@ -32,21 +34,29 @@ jobs:
       # https://github.com/docker/metadata-action
       - name: Extract Docker metadata for worker
         id: meta
-        uses: docker/metadata-action@v4.1.1
+        uses: docker/metadata-action@v5.5.1
         with:
           images: ${{ secrets.PRIVATE_REGISTRY_URL }}/${{ env.IMAGE_NAME }}
           tags: |
             type=schedule
             type=ref,event=branch
             type=ref,event=tag
             type=ref,event=pr
-            type=sha
-      # Build and push Docker image with Buildx (don't push on PR)
-      # https://github.com/docker/build-push-action
-      - name: Build and push Docker image
-        uses: docker/[email protected]
+            type=raw,value=sha-${{ steps.sha.outputs.value }}
+
+      - name: Build Docker image
+        run: ./scripts/build-image.sh
+        env:
+          DOCKER_INFO: ${{ steps.meta.outputs.bake-file }}
+
+      - name: Push Docker image
+        run: docker push ${{ steps.meta.outputs.tags }}
+
+      - name: Trigger deployment
+        uses: aurelien-baudet/workflow-dispatch@v2
         with:
-          context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          token: ${{ secrets.DEPLOYMENT_PAT }}
+          workflow: Bump Service
+          inputs: '{"service": "tarpisto", "tag": "sha-${{ steps.sha.outputs.value }}"}'
+          repo: TKOaly/tko-aly-k8s-configs
+          ref: main

.github/workflows/security.yml

@@ -8,29 +8,6 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 16
-      - name: Install dependencies
-        run: npm ci
-      - name: copy example .env
-        run: cp .env-sample .env
-      - name: Start database and S3
-        run: docker-compose up -d
-      - name: Build server
-        run: npm run build
-      - name: Start server
-        run: npm start &
-        env:
-          # Need to run in development mode as currently only way to auto login
-          NODE_ENV: development
-        # TODO: Create OpenAPI definition and run also ZAP Api scan
-      - name: Run ZAP Full scan
-        uses: zaproxy/[email protected]
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          target: 'http://localhost:9000'
-          fail_action: true
-          allow_issue_writing: false
-          rules_file_name: .zap-rules.tsv
+      - uses: actions/[email protected]
+      - name: Run security scan
+        run: ./run-security-scan.sh

.github/workflows/tests.yml

@@ -6,31 +6,22 @@ on:
     branches: [master]
 jobs:
   test:
+    strategy:
+      fail-fast: false
+      matrix:
+        shards: [1, 2, 3, 4, 5]
+        total_shards: [5]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          node-version: 16
-      - name: Install dependencies
-        run: npm ci
-      - name: copy example .env
-        run: cp .env-sample .env
-      - name: Start database and S3
-        run: docker-compose up -d
-      - name: Install Playwright Browsers
-        run: npm run test:install
+      - uses: actions/[email protected]
       - name: Run tests
-        run: npm run test
-      - name: Upload screenshots and videos
+        run: ./run-tests.sh
+        env:
+          PLAYWRIGHT_SHARD: ${{ matrix.shards }}
+          PLAYWRIGHT_TOTAL_SHARDS: ${{ matrix.total_shards }}
+      - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4.3.3
         with:
-          name: test-results
+          name: test-results-${{ matrix.shards }}
           path: test-results
-      - name: Upload accessibility reports
-        if: always()
-        uses: actions/upload-artifact@v3
-        with:
-          name: axe-reports
-          path: axe-reports

.nvmrc

@@ -1 +1 @@
-16
+20.14.0

.prettierrc

@@ -4,5 +4,6 @@
   "tabWidth": 2,
   "printWidth": 80,
   "arrowParens": "avoid",
-  "trailingComma": "none"
+  "trailingComma": "none",
+  "plugins": ["prettier-plugin-tailwindcss"]
 }

Dockerfile

@@ -1,24 +1,34 @@
-FROM node:16-alpine AS builder
+FROM node:20.14.0-alpine AS deps
 
-WORKDIR /app
+WORKDIR /usr/src/tarpisto
 
-COPY package*.json ./
-RUN npm ci
-
-COPY . .
-RUN npm run build
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
 
-FROM node:16-alpine AS runner
+FROM node:20.14.0-alpine AS base
 
-WORKDIR /app
+ENV PORT 9000
+ENV ENV production
+ENV NODE_ENV production
+ENV APP_ENV production
+ENV NEXT_TELEMETRY_DISABLED 1
 
-COPY package*.json ./
-RUN npm ci --omit=dev
+WORKDIR /usr/src/tarpisto
 
-COPY --from=builder /app/dist ./dist
+# Bash for starting server, curl for container health checking
+RUN apk add --no-cache bash curl
 
+COPY --from=deps /usr/src/tarpisto/node_modules ./node_modules
 COPY . .
 
-EXPOSE 9001
+# Security test image
+FROM base AS security
+
+CMD ["bash", "./scripts/start-security-test-server.sh"]
+
+# Prod image
+FROM base AS prod
+
+RUN rm ./scripts/start-security-test-server.sh
 
-CMD ["npm", "start"]
+CMD ["bash", "./scripts/start-prod-server.sh"]