Merge branch 'main' into pr/therealharpaljadeja/187

.changeset/eighty-glasses-sip.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/khaki-walls-drum.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/many-goats-teach.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/neat-bananas-allow.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/real-bottles-swim.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/smooth-moons-battle.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/spotty-starfishes-move.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/tall-cycles-care.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/tender-tomatoes-protect.md

@@ -0,0 +1,11 @@
+---
+'@celo/phone-number-privacy-combiner': patch
+'@celo/phone-number-privacy-monitor': patch
+'@celo/phone-number-privacy-signer': patch
+'@celo/phone-number-privacy-common': patch
+'@celo/encrypted-backup': patch
+'@celo/identity': patch
+'@celo/odis-identifiers': patch
+---
+
+Update package dependencies to reduce CVEs

.changeset/tricky-actors-wait.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/yellow-spoons-change.md

@@ -0,0 +1,2 @@
+---
+---

.github/CODEOWNERS

@@ -0,0 +1,8 @@
+# Lines starting with '#' are comments.
+# Each line is a file pattern followed by one or more owners.
+# For details on acceptable file patterns, please refer to the [Github Documentation](https://help.github.com/articles/about-codeowners/)
+
+# default owners, overridden by package specific owners below
+* @celo-org/primitives
+
+

.github/ISSUE_TEMPLATE/issue-template.md

@@ -1,6 +1,6 @@
 ---
 name: Add a New Issue
-about: Use this template raise an issue in the Celo Monorepo.
+about: Use this template to raise an issue in Social-Connect.
 title: "[Issue Title]"
 labels: 
 assignees:

.github/ISSUE_TEMPLATE/request_identifier.yaml

@@ -1,5 +1,5 @@
 name: Request Identifier
-description: File a request to add a new identifier type to SocialConnect
+description: File a request to add a new identifier type to Social-Connect
 title: "[Identifier Request]: "
 body:
     - type: input

.github/workflows/odis-combiner-container.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-combiner'
       - 'apps/combiner/**'
+      - 'yarn.lock'
     branches:
       - main
     tags:
@@ -14,11 +15,12 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-combiner'
       - 'apps/combiner/**'
+      - 'yarn.lock'
   workflow_dispatch:
 
 jobs:
   odis-combiner-build-dev:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/dev-images/odis-combiner
     if: |
       github.ref != 'refs/heads/main'
@@ -32,7 +34,7 @@ jobs:
       trivy: true
 
   odis-combiner-build:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/social-connect/odis-combiner
     if: |
       github.ref == 'refs/heads/main'
@@ -46,7 +48,7 @@ jobs:
       trivy: true
 
   odis-combiner-tag:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/social-connect/odis-combiner tag
     if: |
       startsWith(github.ref, 'refs/tags/odis-combiner-')

.github/workflows/odis-loadtest-container.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-loadtest'
       - 'apps/monitor/**'
+      - 'yarn.lock'
     branches:
       - main
     tags:
@@ -14,11 +15,12 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-loadtest'
       - 'apps/monitor/**'
+      - 'yarn.lock'
   workflow_dispatch:
 
 jobs:
   odis-loadtest-build-dev:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/dev-images/odis-loadtest
     if: |
       github.ref != 'refs/heads/main'
@@ -32,7 +34,7 @@ jobs:
       trivy: true
 
   odis-loadtest-build:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/social-connect/odis-loadtest
     if: |
       github.ref == 'refs/heads/main'
@@ -46,7 +48,7 @@ jobs:
       trivy: true
 
   odis-loadtest-tag:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/social-connect/odis-loadtest tag
     if: |
       startsWith(github.ref, 'refs/tags/odis-loadtest-')

.github/workflows/odis-signer-container.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-signer'
       - 'apps/signer/**'
+      - 'yarn.lock'
     branches:
       - main
     tags:
@@ -14,11 +15,12 @@ on:
     paths:
       - 'dockerfiles/Dockerfile-signer'
       - 'apps/signer/**'
+      - 'yarn.lock'
   workflow_dispatch:
 
 jobs:
   odis-signer-build-dev:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/dev-images/odis-signer
     if: |
       github.ref != 'refs/heads/main'
@@ -32,7 +34,7 @@ jobs:
       trivy: true
 
   odis-signer-build:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/social-connect/odis-signer
     if: |
       github.ref == 'refs/heads/main'
@@ -46,7 +48,7 @@ jobs:
       trivy: true
 
   odis-signer-tag:
-    uses: celo-org/reusable-workflows/.github/workflows/[email protected].2
+    uses: celo-org/reusable-workflows/.github/workflows/[email protected].3
     name: Build us-west1-docker.pkg.dev/devopsre/social-connect/odis-signer tag
     if: |
       startsWith(github.ref, 'refs/tags/odis-signer-')

.github/workflows/release.yml

@@ -13,41 +13,53 @@ jobs:
     name: Release
     runs-on: ['self-hosted', 'org', 'npm-publish']
     permissions:
-      contents: write
       id-token: write
-      pull-requests: write
-      repository-projects: write
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v3
+      - name: Get GitHub Token from Akeyless
+        id: get_github_token
+        uses:
+          docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
+        with:
+          api-url: https://api.gateway.akeyless.celo-networks-dev.org
+          access-id: p-kf9vjzruht6l
+          dynamic-secrets: '{"/dynamic-secrets/keys/github/social-connect/contents=write,pull_requests=write":"PAT"}'
 
-      - name: Akeyless Get Secrets
-        id: get_auth_token
+      - name: Get NPM Token from Akeyless
+        id: get_npm_token
         uses:
           docker://us-west1-docker.pkg.dev/devopsre/akeyless-public/akeyless-action:latest
         with:
           api-url: https://api.gateway.akeyless.celo-networks-dev.org
           access-id: p-kf9vjzruht6l
-          static-secrets: '{"/static-secrets/apps-tooling-circle/npm-publish-token":"NPM_TOKEN"}'
+
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          token: ${{ env.PAT }}
+
       - name: Setup Node.js 18.x
         uses: actions/setup-node@v4
         with:
           node-version: 18.x
+
       - name: 'Setup yarn'
         shell: bash
         run: |
           npm install --global yarn
           source ~/.bashrc
+
       - name: Install Dependencies
         shell: bash
         run: yarn
+
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
+        if: false
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ env.PAT }}
           NPM_TOKEN: ${{ env.NPM_TOKEN }}
         with:
           # This expects you to have a script called release which does a build for your packages and calls changeset publish
           publish: yarn release
-          version: yarn changeset version && yarn
+          version: yarn version_and_reinstall

.github/workflows/social-connect.yml

@@ -52,12 +52,12 @@ jobs:
           key: git-${{ github.ref }}
           restore-keys: |
             git-
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Detect files changed in PR, and expose as output
         id: changed-files
-        uses: tj-actions/changed-files@v39
+        uses: tj-actions/changed-files@v40
         with:
           # Using comma as separator to be able to easily match full paths (using ,<path>)
           separator: ','
@@ -264,7 +264,7 @@ jobs:
         with:
           path: .git
           key: git-${{ github.ref }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Sync workspace
         uses: ./.github/actions/sync-workspace
         with:

.github/workflows/stale.yml

@@ -32,4 +32,3 @@ jobs:
         days-before-close: 30
         ascending: true
         operations-per-run: 50
-

.vscode/settings.json

@@ -14,12 +14,12 @@
   "typescript.preferences.importModuleSpecifier": "non-relative",
   "typescript.updateImportsOnFileMove.enabled": "always",
   "editor.codeActionsOnSave": {
-    "source.organizeImports": false
+    "source.organizeImports": "never"
   },
   "[javascript]": {
     "editor.formatOnSave": true,
     "editor.codeActionsOnSave": {
-      "source.organizeImports": false
+      "source.organizeImports": "never"
     }
   },
   "[javascriptreact]": {
@@ -43,5 +43,10 @@
   "javascript.format.enable": false,
   "editor.tabSize": 2,
   "editor.detectIndentation": false,
-  "typescript.tsdk": "node_modules/typescript/lib"
+  "typescript.tsdk": "node_modules/typescript/lib",
+  "[javascriptreact][typescript][typescriptreact]": {
+    "editor.codeActionsOnSave": {
+      "source.organizeImports": "explicit"
+    }
+  }
 }

dockerfiles/Dockerfile-combiner

@@ -13,9 +13,13 @@ COPY packages/identity packages/identity
 COPY packages/odis-identifiers packages/odis-identifiers
 
 ##### Main stage
-FROM node:18
+FROM node:18-alpine3.19
 LABEL org.opencontainers.image.authors="[email protected]"
 
+# Install dependencies and upgrade OS packages
+RUN apk add --no-cache python3 git bash && \
+    apk upgrade --no-cache
+
 WORKDIR /celo-phone-number-privacy/
 
 # Copy monorepo settings

dockerfiles/Dockerfile-loadtest

@@ -12,9 +12,13 @@ COPY packages/identity packages/identity
 COPY packages/odis-identifiers packages/odis-identifiers
 
 ##### Main stage
-FROM node:18
+FROM node:18-alpine3.19
 LABEL org.opencontainers.image.authors="[email protected]"
 
+# Upgrade OS packages
+RUN apk add --no-cache python3 git bash && \
+    apk upgrade --no-cache
+
 WORKDIR /celo-phone-number-privacy/
 
 # Copy monorepo settings

dockerfiles/Dockerfile-signer

@@ -12,9 +12,13 @@ COPY packages/identity packages/identity
 COPY packages/odis-identifiers packages/odis-identifiers
 
 ##### Main stage
-FROM node:18
+FROM node:18-alpine3.19
 LABEL org.opencontainers.image.authors="[email protected]"
 
+# Upgrade OS packages
+RUN apk add --no-cache python3 git bash && \
+    apk upgrade --no-cache
+
 WORKDIR /celo-phone-number-privacy/
 
 # Copy monorepo settings
@@ -28,6 +32,7 @@ ARG PACKAGE_SELECTOR=signer
 COPY --from=packages celo-phone-number-privacy/apps/${PACKAGE_SELECTOR} apps/${PACKAGE_SELECTOR}
 # COMMENT OUT THIS LINE TO USE PUBLISHED DEPENDENCIES
 COPY --from=packages celo-phone-number-privacy/packages packages
+
 # Install dependencies and build. need dev deps too so  we can build (tsc)
 RUN yarn install --network-timeout 100000  --inline-builds && yarn cache clean
 RUN yarn workspaces list