Jordan Montgomery
8ae22b5586
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Related to, but does not resolve, #45267 Adds a 12h cooldown period such that when npm is resolving dependencies it will not resolve anything released less than 12 hours ago. This doesn't apply globally within the fleet project because some portions use yarn which #45267 will take care of however this does add it to our CI jobs and the .npmrc files for projects that use npm I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but that won't automatically set it on every runner so leaving it in here for now As far as QA local builds and CI are both green. Tested NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally using the npm package feed https://registry.npmjs.org/-/rss to verify that recently updated packages either chose an older version OR the update was blocked if I tried to choose a newer one # Checklist for submitter ## Testing - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Enhanced npm supply-chain security by implementing package installation policies across build workflows and configuration files to exclude packages released within the last 12 hours. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
113 lines
4.8 KiB
YAML
113 lines
4.8 KiB
YAML
name: Deploy app to vulnerability dashboard pipeline on Heroku.
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
paths:
|
|
- 'ee/vulnerability-dashboard/**'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
# Supply-chain guard: refuse npm packages younger than 12 hours. See .npmrc.
|
|
NPM_CONFIG_MIN_RELEASE_AGE: 0.5
|
|
|
|
jobs:
|
|
build:
|
|
permissions:
|
|
contents: write # for Git to git push
|
|
if: ${{ github.repository == 'fleetdm/fleet' }}
|
|
|
|
runs-on: ubuntu-22.04
|
|
|
|
strategy:
|
|
matrix:
|
|
node-version: [14.x]
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
|
|
|
# Configure our access credentials for the Heroku CLI
|
|
- uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28 # v3.14.15
|
|
with:
|
|
heroku_api_key: ${{secrets.HEROKU_API_TOKEN_FOR_BOT_USER}}
|
|
heroku_app_name: "" # this has to be blank or it doesn't work
|
|
heroku_email: ${{secrets.HEROKU_EMAIL_FOR_BOT_USER}}
|
|
justlogin: true
|
|
- run: heroku auth:whoami
|
|
# Install the heroku-repo plugin in the Heroku CLI
|
|
- run: heroku plugins:install heroku-repo
|
|
|
|
# Set the Node.js version
|
|
- name: Use Node.js ${{ matrix.node-version }}
|
|
uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
|
|
with:
|
|
node-version: ${{ matrix.node-version }}
|
|
|
|
# Now start building!
|
|
# > …but first, get a little crazy for a sec and delete the top-level package.json file
|
|
# > i.e. the one used by the Fleet server. This is because require() in node will go
|
|
# > hunting in ancestral directories for missing dependencies, and since some of the
|
|
# > bundled transpiler tasks sniff for package availability using require(), this trips
|
|
# > up when it encounters another Node universe in the parent directory.
|
|
- run: rm -rf package.json package-lock.json node_modules/
|
|
# > Turns out there's a similar issue with how eslint plugins are looked up, so we
|
|
# > delete the top level .eslintrc file too.
|
|
- run: rm -f .eslintrc.js
|
|
# > And, as a change to the top-level fleetdm/fleet .gitignore on May 2, 2022 revealed,
|
|
# > we also need to delete the top level .gitignore file too, so that its rules don't
|
|
# > interfere with the committing and force-pushing we're doing as part of our deploy
|
|
# > script here. For more info, see: https://github.com/fleetdm/fleet/pull/5549
|
|
- run: rm -f .gitignore
|
|
|
|
# Get dependencies (including dev deps)
|
|
- run: cd ee/vulnerability-dashboard/ && npm install
|
|
|
|
# Run sanity checks
|
|
- run: cd ee/vulnerability-dashboard/ && npm test
|
|
|
|
# Compile assets
|
|
- run: cd ee/vulnerability-dashboard/ && npm run build-for-prod
|
|
|
|
# Reset the Heroku app's git repo to prevent errors when pushing to the repo. (See https://github.com/fleetdm/fleet/issues/14162 for more details)
|
|
- run: heroku repo:reset -a vulnerability-dashboard
|
|
|
|
# Commit newly-built assets locally so we can push them to Heroku below.
|
|
# (This commit will never be pushed to GitHub- only to Heroku.)
|
|
# > The local config flags make this work in GitHub's environment.
|
|
- run: git add ee/vulnerability-dashboard/.www
|
|
|
|
# Configure the Heroku app we'll be deploying to
|
|
- run: heroku git:remote -a vulnerability-dashboard
|
|
- run: git remote -v
|
|
|
|
# Deploy to Heroku (by pushing)
|
|
# > Since a shallow clone was grabbed, we have to "unshallow" it before forcepushing.
|
|
- run: echo "Unshallowing local repository…"
|
|
- run: git fetch --prune --unshallow
|
|
|
|
# Deploy to Heroku
|
|
- run: echo "Deploying branch '${GITHUB_REF##*/}' to Heroku…"
|
|
- name: Deploy to Heroku
|
|
run: |
|
|
set -euo pipefail
|
|
git add -A
|
|
# Create a git tree object that contains only the changes in the /website folder.
|
|
TREE=$(git write-tree)
|
|
# Create a parentless commit from the tree object.
|
|
COMMIT=$(git -c "user.name=Fleetwood" -c "user.email=github@example.com" \
|
|
commit-tree "$TREE" \
|
|
-m 'AUTOMATED COMMIT - Deployed the latest, including generated collateral such as compiled documentation, modified HTML layouts, and a .sailsrc file that references minified client-side code assets.')
|
|
# Push the parentless commit to Heroku
|
|
# Note: The commit pushed to Heroku will not contain the full git history.
|
|
# This lets up deploy this app from the Fleet monorepo while working around Heroku's pack size limits.
|
|
git push heroku "$COMMIT":refs/heads/master --force
|
|
- name: 🌐 The dashboard has been deployed
|
|
run: echo '' && echo '--' && echo 'OK, done. It should be live momentarily.' && echo '(if you get impatient, check the Heroku dashboard for status)'
|