From 3c9d33f89cd96f3766ac795de80177f06ee8ade7 Mon Sep 17 00:00:00 2001 From: Jonathan Sharpe Date: Sun, 1 Dec 2024 12:18:48 +0000 Subject: [PATCH] Prepare CYF fork --- .github/CODE_OF_CONDUCT.md | 132 ------------------ .github/CONTRIBUTING.md | 19 --- .../ISSUE_TEMPLATE}/user-story.md | 0 .../PULL_REQUEST_TEMPLATE.md | 0 .github/workflows/keepalive.yml | 12 -- .github/workflows/push.yml | 12 +- README.md | 37 +++++ bin/cyf.sh | 42 ------ bin/files/README.md | 91 ------------ bin/files/push.yml | 88 ------------ bin/files/render.yaml => render.yaml | 0 11 files changed, 38 insertions(+), 395 deletions(-) delete mode 100644 .github/CODE_OF_CONDUCT.md delete mode 100644 .github/CONTRIBUTING.md rename {bin/files => .github/ISSUE_TEMPLATE}/user-story.md (100%) rename {bin/files => .github}/PULL_REQUEST_TEMPLATE.md (100%) delete mode 100644 .github/workflows/keepalive.yml delete mode 100755 bin/cyf.sh delete mode 100644 bin/files/README.md delete mode 100644 bin/files/push.yml rename bin/files/render.yaml => render.yaml (100%) diff --git a/.github/CODE_OF_CONDUCT.md b/.github/CODE_OF_CONDUCT.md deleted file mode 100644 index a545f08a..00000000 --- a/.github/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,132 +0,0 @@ -# Contributor Covenant Code of Conduct - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in our -community a harassment-free experience for everyone, regardless of age, body -size, visible or invisible disability, ethnicity, sex characteristics, gender -identity and expression, level of experience, education, socio-economic status, -nationality, personal appearance, race, caste, color, religion, or sexual -identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, -diverse, inclusive, and healthy community. - -## Our Standards - -Examples of behavior that contributes to a positive environment for our -community include: - -- Demonstrating empathy and kindness toward other people -- Being respectful of differing opinions, viewpoints, and experiences -- Giving and gracefully accepting constructive feedback -- Accepting responsibility and apologizing to those affected by our mistakes, - and learning from the experience -- Focusing on what is best not just for us as individuals, but for the overall - community - -Examples of unacceptable behavior include: - -- The use of sexualized language or imagery, and sexual attention or advances of - any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Publishing others' private information, such as a physical or email address, - without their explicit permission -- Other conduct which could reasonably be considered inappropriate in a - professional setting - -## Enforcement Responsibilities - -Community leaders are responsible for clarifying and enforcing our standards of -acceptable behavior and will take appropriate and fair corrective action in -response to any behavior that they deem inappropriate, threatening, offensive, -or harmful. - -Community leaders have the right and responsibility to remove, edit, or reject -comments, commits, code, wiki edits, issues, and other contributions that are -not aligned to this Code of Conduct, and will communicate reasons for moderation -decisions when appropriate. - -## Scope - -This Code of Conduct applies within all community spaces, and also applies when -an individual is officially representing the community in public spaces. -Examples of representing our community include using an official email address, -posting via an official social media account, or acting as an appointed -representative at an online or offline event. - -## Enforcement - -Instances of abusive, harassing, or otherwise unacceptable behavior may be -reported to the community leaders responsible for enforcement at -[INSERT CONTACT METHOD]. -All complaints will be reviewed and investigated promptly and fairly. - -All community leaders are obligated to respect the privacy and security of the -reporter of any incident. - -## Enforcement Guidelines - -Community leaders will follow these Community Impact Guidelines in determining -the consequences for any action they deem in violation of this Code of Conduct: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behavior deemed -unprofessional or unwelcome in the community. - -**Consequence**: A private, written warning from community leaders, providing -clarity around the nature of the violation and an explanation of why the -behavior was inappropriate. A public apology may be requested. - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of -actions. - -**Consequence**: A warning with consequences for continued behavior. No -interaction with the people involved, including unsolicited interaction with -those enforcing the Code of Conduct, for a specified period of time. This -includes avoiding interactions in community spaces as well as external channels -like social media. Violating these terms may lead to a temporary or permanent -ban. - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including -sustained inappropriate behavior. - -**Consequence**: A temporary ban from any sort of interaction or public -communication with the community for a specified period of time. No public or -private interaction with the people involved, including unsolicited interaction -with those enforcing the Code of Conduct, is allowed during this period. -Violating these terms may lead to a permanent ban. - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community -standards, including sustained inappropriate behavior, harassment of an -individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the -community. - -## Attribution - -This Code of Conduct is adapted from the [Contributor Covenant][homepage], -version 2.1, available at -[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1]. - -Community Impact Guidelines were inspired by -[Mozilla's code of conduct enforcement ladder][Mozilla CoC]. - -For answers to common questions about this code of conduct, see the FAQ at -[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at -[https://www.contributor-covenant.org/translations][translations]. - -[homepage]: https://www.contributor-covenant.org -[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html -[Mozilla CoC]: https://github.com/mozilla/diversity -[FAQ]: https://www.contributor-covenant.org/faq -[translations]: https://www.contributor-covenant.org/translations diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md deleted file mode 100644 index d04762a9..00000000 --- a/.github/CONTRIBUTING.md +++ /dev/null @@ -1,19 +0,0 @@ -Thank you for contributing! To help the review process, please provide the following: - -### Proposal - -Provide a short description of the change you are proposing and the reasons for it. - -### Related - -Provide links to any associated pull requests or issues. You can use `#123` to link to a PR or issue in this repository, or `user/repo#123` to link to other repositories. - -### Checklist - -- [ ] I have read the [code of conduct] and [contributing guide] -- [ ] I have made this pull request to the `main` branch -- [ ] I have run all of the automated validation using `npm run ship` -- [ ] I have added myself to the `"contributors"` list in the `package.json` (or do not want to) - -[code of conduct]: https://github.com/textbook/starter-kit/blob/main/.github/CODE_OF_CONDUCT.md -[contributing guide]: https://github.com/textbook/starter-kit/blob/main/.github/CONTRIBUTING.md diff --git a/bin/files/user-story.md b/.github/ISSUE_TEMPLATE/user-story.md similarity index 100% rename from bin/files/user-story.md rename to .github/ISSUE_TEMPLATE/user-story.md diff --git a/bin/files/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md similarity index 100% rename from bin/files/PULL_REQUEST_TEMPLATE.md rename to .github/PULL_REQUEST_TEMPLATE.md diff --git a/.github/workflows/keepalive.yml b/.github/workflows/keepalive.yml deleted file mode 100644 index a6d24a9f..00000000 --- a/.github/workflows/keepalive.yml +++ /dev/null @@ -1,12 +0,0 @@ ---- -name: Keep deployment alive - -on: - schedule: - - cron: "14 3 * * *" - -jobs: - ping: - runs-on: ubuntu-latest - steps: - - run: curl 'https://starter-kit-ci.herokuapp.com/api/message' diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 997783d0..9f333646 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -8,17 +8,7 @@ on: workflow_dispatch: jobs: - windows: - runs-on: windows-latest - steps: - - uses: textbook/take-action@nodejs - with: - node-version: 20 - - run: npm run lint nodejs: - strategy: - matrix: - node: [20.9, 20, 22] runs-on: ubuntu-latest services: postgres: @@ -38,7 +28,7 @@ jobs: steps: - uses: textbook/take-action@nodejs with: - node-version: ${{ matrix.node }} + node-version: 20 - uses: textbook/take-action@playwright - run: npm run lint - run: npm run test:cover diff --git a/README.md b/README.md index 984a2003..5ce74985 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # Starter Kit v2 +[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy) + - [x] [Node] LTS support (verified working on 20.x LTS release) - [x] [Express] server - [x] [Postgres] database with [`pg`][node-postgres] @@ -15,6 +17,23 @@ - [x] [Google App Engine], [Heroku], [Render] or [Vercel] deployment - [x] [Docker] build +## Setup + +> **Note** if you have _any problems_ setting up the starter kit, see the [wiki] and, if still not solved, post to +> [`#cyf-full-stack-starter-kit` in Slack][2]. + +Pick one member of the team to own the repository and pipeline. That person should do the following: + +1. Click the "Use this template" button above (see [GitHub's docs][1]) to create your team repository and name it something appropriate for your project. + - Your repo should say _"generated from"_, **not** _"forked from"_, _"CodeYourFuture/cyf-final-project-starter-kit"_ at the top +2. In your repo, click the "Deploy to Render" button at the top of the README and log in using GitHub when prompted. +3. Fill in a service group name for your application and then click "Apply". +4. Once it has deployed successfully, click the "managed resources" link to view the application details. + +Whenever you commit to main (or e.g. merge a [pull request]) it will get automatically deployed! + +You should now make sure all of the project team are [collaborators] on the repository. + ## Scripts Various scripts are provided in the package file, but many are helpers for other scripts; here are the ones you'll @@ -29,6 +48,23 @@ commonly use: - `test`: runs the unit and integration tests. - `test:cover`: runs the tests and outputs coverage data. +### Security + +If the project handles **any kind of** Personally Identifiable Information (PII) then make sure the following +principles are followed: + +- Only collect **strictly necessary** PII; +- Access to PII should be as restricted as possible; +- Access to PII should only be possible after authentication. Authentication **must be done** via GitHub. **Ad hoc + authentication solutions are not allowed**; +- Admins must be able to control who has access to the platform and at which levels using only GitHub groups; +- There must be an audit mechanism in place. It is required by law to know who accessed what and when; +- Code must be reviewed by senior developers before being pushed to production; +- APIs must be secure. Make sure we are not handling security on the frontend. + +[1]: https://docs.github.com/en/free-pro-team@latest/github/creating-cloning-and-archiving-repositories/creating-a-repository-from-a-template#creating-a-repository-from-a-template +[2]: https://codeyourfuture.slack.com/archives/C021ATWS9A5 +[collaborators]: https://help.github.com/en/articles/inviting-collaborators-to-a-personal-repository [Docker]: https://www.docker.com [ESLint]: https://eslint.org/ [Express]: https://expressjs.com/ @@ -42,6 +78,7 @@ commonly use: [Playwright]: https://playwright.dev/ [Postgres]: https://www.postgresql.org/ [Prettier]: https://prettier.io/ +[pull request]: https://help.github.com/en/articles/about-pull-requests [React]: https://reactjs.org/ [React Router]: https://reactrouter.com/en/main [Render]: https://render.com/ diff --git a/bin/cyf.sh b/bin/cyf.sh deleted file mode 100755 index d5928665..00000000 --- a/bin/cyf.sh +++ /dev/null @@ -1,42 +0,0 @@ -#!/usr/bin/env bash - -set -euo pipefail - -CHANGES="$(git status --no-untracked-files --porcelain)" - -if [ ! -z "$CHANGES" ]; then - echo 'Please commit all changes before proceeding:' - echo "$CHANGES" - exit 1 -fi - -if [[ $# -lt 1 ]] || [[ $# -gt 2 ]]; then - echo 'Usage ./bin/cyf.sh [remote]' - exit 1 -fi - -BRANCH="$1" -HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -REMOTE="${2:-}" -ROOT="$HERE/.." - -git branch -D "$BRANCH" || echo "No branch $BRANCH" -git checkout -b "$BRANCH" - -mv "$HERE/files/PULL_REQUEST_TEMPLATE.md" "$ROOT/.github/" -mv "$HERE/files/push.yml" "$ROOT/.github/workflows/" -mv "$HERE/files/README.md" "$ROOT" -mv "$HERE/files/render.yaml" "$ROOT" -mv "$HERE/files/user-story.md" "$ROOT/.github/ISSUE_TEMPLATE/" - -rm "$ROOT/.github/workflows/keepalive.yml" -rm "$ROOT/.github/CODE_OF_CONDUCT.md" -rm "$ROOT/.github/CONTRIBUTING.md" -rm "$HERE/cyf.sh" - -git add "$ROOT" -git commit --message 'Prepare CYF fork' - -if [[ ! -z "$REMOTE" ]]; then - git push --force "$REMOTE" "$BRANCH:main" -fi diff --git a/bin/files/README.md b/bin/files/README.md deleted file mode 100644 index 5ce74985..00000000 --- a/bin/files/README.md +++ /dev/null @@ -1,91 +0,0 @@ -# Starter Kit v2 - -[![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy) - -- [x] [Node] LTS support (verified working on 20.x LTS release) -- [x] [Express] server -- [x] [Postgres] database with [`pg`][node-postgres] -- [x] Logging with [Winston] and [Morgan] -- [x] [React] client with [Vite] -- [x] Client-side routing with [React Router] -- [x] Linting with [ESLint] and [Prettier] -- [x] Unit and integration testing with [Vitest] (with [SuperTest] and [TestContainers]) -- [x] E2E testing with [Playwright] -- [x] Dev mode (watch modes for client and server, proxy to avoid CORS issues) -- [x] Production build (single deployment artifact) -- [x] [GitHub Actions] pipeline -- [x] [Google App Engine], [Heroku], [Render] or [Vercel] deployment -- [x] [Docker] build - -## Setup - -> **Note** if you have _any problems_ setting up the starter kit, see the [wiki] and, if still not solved, post to -> [`#cyf-full-stack-starter-kit` in Slack][2]. - -Pick one member of the team to own the repository and pipeline. That person should do the following: - -1. Click the "Use this template" button above (see [GitHub's docs][1]) to create your team repository and name it something appropriate for your project. - - Your repo should say _"generated from"_, **not** _"forked from"_, _"CodeYourFuture/cyf-final-project-starter-kit"_ at the top -2. In your repo, click the "Deploy to Render" button at the top of the README and log in using GitHub when prompted. -3. Fill in a service group name for your application and then click "Apply". -4. Once it has deployed successfully, click the "managed resources" link to view the application details. - -Whenever you commit to main (or e.g. merge a [pull request]) it will get automatically deployed! - -You should now make sure all of the project team are [collaborators] on the repository. - -## Scripts - -Various scripts are provided in the package file, but many are helpers for other scripts; here are the ones you'll -commonly use: - -- `dev`: starts the frontend and backend in dev mode, with file watching (note that the backend runs on port 3100, and the frontend is proxied to it). -- `e2e`: builds and starts the app in production mode and runs the Playwright tests against it. - - `e2e:dev`: builds and starts the app in dev mode and runs the Playwright tests against it. -- `lint`: runs ESLint and Prettier against all the relevant files in the project. -- `serve`: builds and starts the app in production mode locally. -- `ship`: runs `lint`, then `test`, then `e2e`; ideal before a `git push`. -- `test`: runs the unit and integration tests. - - `test:cover`: runs the tests and outputs coverage data. - -### Security - -If the project handles **any kind of** Personally Identifiable Information (PII) then make sure the following -principles are followed: - -- Only collect **strictly necessary** PII; -- Access to PII should be as restricted as possible; -- Access to PII should only be possible after authentication. Authentication **must be done** via GitHub. **Ad hoc - authentication solutions are not allowed**; -- Admins must be able to control who has access to the platform and at which levels using only GitHub groups; -- There must be an audit mechanism in place. It is required by law to know who accessed what and when; -- Code must be reviewed by senior developers before being pushed to production; -- APIs must be secure. Make sure we are not handling security on the frontend. - -[1]: https://docs.github.com/en/free-pro-team@latest/github/creating-cloning-and-archiving-repositories/creating-a-repository-from-a-template#creating-a-repository-from-a-template -[2]: https://codeyourfuture.slack.com/archives/C021ATWS9A5 -[collaborators]: https://help.github.com/en/articles/inviting-collaborators-to-a-personal-repository -[Docker]: https://www.docker.com -[ESLint]: https://eslint.org/ -[Express]: https://expressjs.com/ -[GitHub Actions]: https://github.com/features/actions -[Google App Engine]: https://cloud.google.com/appengine/?hl=en -[Heroku]: https://www.heroku.com/ -[Morgan]: https://github.com/expressjs/morgan -[Node]: https://nodejs.org/en/ -[node-postgres]: https://node-postgres.com/ -[node-test]: https://nodejs.org/api/test.html -[Playwright]: https://playwright.dev/ -[Postgres]: https://www.postgresql.org/ -[Prettier]: https://prettier.io/ -[pull request]: https://help.github.com/en/articles/about-pull-requests -[React]: https://reactjs.org/ -[React Router]: https://reactrouter.com/en/main -[Render]: https://render.com/ -[SuperTest]: https://github.com/visionmedia/supertest -[TestContainers]: https://testcontainers.com/ -[Vercel]: https://vercel.com/ -[Vite]: https://vitejs.dev/ -[Vitest]: https://vitest.dev/ -[wiki]: https://github.com/textbook/starter-kit/wiki -[Winston]: https://github.com/winstonjs/winston diff --git a/bin/files/push.yml b/bin/files/push.yml deleted file mode 100644 index 9f333646..00000000 --- a/bin/files/push.yml +++ /dev/null @@ -1,88 +0,0 @@ -name: CI - -on: - push: - branches: [main] - pull_request: - branches: [main] - workflow_dispatch: - -jobs: - nodejs: - runs-on: ubuntu-latest - services: - postgres: - image: postgres - env: - POSTGRES_PASSWORD: keepitsecret - POSTGRES_USER: testdb - options: >- - --health-cmd pg_isready - --health-interval 10s - --health-timeout 5s - --health-retries 5 - ports: - - 5432:5432 - env: - DATABASE_URL: postgres://testdb:keepitsecret@localhost:5432/testdb - steps: - - uses: textbook/take-action@nodejs - with: - node-version: 20 - - uses: textbook/take-action@playwright - - run: npm run lint - - run: npm run test:cover - env: - FORCE_COLOR: true - - run: npm run migration up - - run: npm run e2e - - run: npm run e2e:dev - docker: - runs-on: ubuntu-latest - services: - postgres: - image: postgres - env: - POSTGRES_PASSWORD: keepitsecret - POSTGRES_USER: testdb - options: >- - --health-cmd pg_isready - --health-interval 10s - --health-timeout 5s - --health-retries 5 - ports: - - 5432:5432 - steps: - - uses: textbook/take-action@nodejs - with: - node-version: 20 - - uses: textbook/take-action@playwright - - uses: docker/setup-buildx-action@v3 - - uses: docker/build-push-action@v5 - with: - load: true - push: false - tags: textbook/starter-kit:v2 - - id: env-file - run: | - echo 'DATABASE_URL=postgres://testdb:keepitsecret@localhost:5432/testdb' >> "$ENV_FILE" - echo 'LOG_LEVEL=debug' >> "$ENV_FILE" - echo 'PORT=4321' >> "$ENV_FILE" - echo 'NODE_ENV=docker' >> "$ENV_FILE" - echo "file=$ENV_FILE" >> "$GITHUB_OUTPUT" - env: - ENV_FILE: docker.env - - id: docker-run - run: | - echo "id=$(docker run \ - --detach \ - --env-file ${{ steps.env-file.outputs.file }} \ - --init \ - --network 'host' \ - textbook/starter-kit:v2)" >> $GITHUB_OUTPUT - - run: npx --yes wait-on --log --timeout 30000 http-get://localhost:4321 - - run: npm run e2e - env: - PLAYWRIGHT_BASE_URL: http://localhost:4321 - - if: always() && steps.docker-run.outputs.id - run: docker logs ${{ steps.docker-run.outputs.id }} diff --git a/bin/files/render.yaml b/render.yaml similarity index 100% rename from bin/files/render.yaml rename to render.yaml