[pull] dev from KelvinTegelaar:dev

.github/copilot-instructions.md

@@ -0,0 +1,40 @@
+## Commit messages
+
+Generate all commit messages in **Conventional Commits** format:
+
+```
+<type>(<optional scope>): <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+**Rules:**
+
+- **Type** is required and must be one of:
+  - `feat` — a new feature
+  - `fix` — a bug fix
+  - `docs` — documentation only
+  - `style` — formatting, whitespace, no code-behavior change
+  - `refactor` — code change that neither fixes a bug nor adds a feature
+  - `perf` — a performance improvement
+  - `test` — adding or correcting tests
+  - `build` — build system or dependency changes
+  - `ci` — CI/CD configuration changes
+  - `chore` — routine maintenance, no production code change
+  - `revert` — reverts a previous commit
+- **Scope** is optional and given in parentheses after the type (e.g. `feat(identity):`). Use a short, lowercase area name when it adds clarity.
+- **Description** is a short, imperative-mood summary ("add", not "added"/"adds"), lowercase, no trailing period, ideally ≤ 72 characters.
+- **Body** (optional) explains the *what* and *why*, not the *how*. Separate it from the description with one blank line.
+- **Breaking changes** are indicated with a `!` before the colon (e.g. `feat!:`) and/or a `BREAKING CHANGE:` footer describing the change.
+- Reference issues/PRs in the footer where relevant (e.g. `Closes #123`).
+
+**Examples:**
+
+```
+feat(identity): add bulk user offboarding endpoint
+fix(graph): handle expired token on retry
+docs: update authentication model overview
+refactor(standards)!: rename remediation parameter
+```

.github/scripts/validate-json.mjs

@@ -0,0 +1,71 @@
+import { readFile, readdir, writeFile, appendFile } from "node:fs/promises";
+import path from "node:path";
+
+// Usage: node validate-json.mjs [--strip <prefix>] <dir> [dir...]
+// --strip removes a leading path prefix from reported filenames, so a PR checked
+// out into a subdirectory still reports repo-relative paths.
+const argv = process.argv.slice(2);
+let strip = "";
+const roots = [];
+for (let i = 0; i < argv.length; i++) {
+  if (argv[i] === "--strip") {
+    strip = argv[++i] ?? "";
+  } else {
+    roots.push(argv[i]);
+  }
+}
+
+async function collect(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules") continue;
+      files.push(...(await collect(full)));
+    } else if (entry.name.endsWith(".json")) {
+      files.push(full);
+    }
+  }
+  return files;
+}
+
+const report = (file) => {
+  const normalised = file.split(path.sep).join("/");
+  return strip && normalised.startsWith(strip) ? normalised.slice(strip.length) : normalised;
+};
+
+const failures = [];
+let checked = 0;
+
+for (const root of roots) {
+  for (const file of await collect(root)) {
+    checked++;
+    const contents = await readFile(file, "utf8");
+    try {
+      JSON.parse(contents);
+    } catch (error) {
+      failures.push({ file: report(file), message: error.message.replace(/\r?\n/g, " ") });
+    }
+  }
+}
+
+for (const { file, message } of failures) {
+  // Annotate the PR diff via a GitHub Actions error command.
+  console.log(`::error file=${file}::${message}`);
+}
+console.log(`Checked ${checked} JSON file(s), ${failures.length} invalid.`);
+
+// Hand the results to the workflow so it can comment on the PR.
+if (process.env.GITHUB_OUTPUT) {
+  await appendFile(process.env.GITHUB_OUTPUT, `invalid_count=${failures.length}\n`);
+}
+await writeFile("json-validation-results.json", JSON.stringify(failures, null, 2));
+
+process.exit(failures.length > 0 ? 1 : 0);

.github/workflows/CodeQL_Analyser.yml

@@ -1,6 +1,10 @@
----
+# OPTIONAL UPGRADE to the existing CodeQL_Analyser.yml (already deployed in CIPP).
+# Changes vs. current: adds push trigger on main/dev, security-extended query suite,
+# and javascript-typescript language alias.
 name: "CodeQL"
 on:
+  push:
+    branches: [main, dev]
   pull_request:
     branches: [master, main, dev, react]
   schedule:
@@ -17,14 +21,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: ["javascript"]
+        language: ["javascript-typescript"]
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v6
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
+          queries: security-extended
       - name: Autobuild
         uses: github/codeql-action/autobuild@v4
       - name: Perform CodeQL Analysis

.github/workflows/Conventional_Commits.yml

@@ -0,0 +1,65 @@
+name: Conventional Commits Check
+
+on:
+  # Using pull_request_target instead of pull_request for secure handling of fork PRs
+  pull_request_target:
+    # Re-run on title edits so a corrected title clears the check
+    types: [opened, synchronize, reopened, edited]
+    # Only check PRs targeting the dev branch
+    branches:
+      - dev
+
+permissions:
+  pull-requests: write
+  issues: write
+
+jobs:
+  conventional-commits:
+    name: Validate Conventional Commits
+    runs-on: ubuntu-slim
+    steps:
+      - name: Validate PR title
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const title = context.payload.pull_request.title || '';
+            const pattern = /^(feat|fix|docs|style|refactor|perf|test|chore|ci|build|revert)(\(.+\))?!?: .+/i;
+
+            if (pattern.test(title)) {
+              console.log(`✓ PR title follows Conventional Commits format: "${title}"`);
+              return;
+            }
+
+            console.log(`❌ PR title does not follow Conventional Commits format: "${title}"`);
+
+            const message = [
+              '❌ **This PR title does not follow the [Conventional Commits](https://www.conventionalcommits.org/) format.**',
+              '',
+              'Expected format: `type(scope)?: description`',
+              '',
+              'Allowed types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `chore`, `ci`, `build`, `revert`',
+              '',
+              'Examples:',
+              '- `feat: add tenant filter to the user table`',
+              '- `fix(auth): handle expired refresh tokens`',
+              '- `docs: update self-hosting guide`',
+              '',
+              `Received: \`${title}\``,
+              '',
+              '🔒 This PR has been automatically closed. Please update the title to match the format above and reopen the PR.'
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: context.issue.number,
+              body: message
+            });
+
+            await github.rest.pulls.update({
+              ...context.repo,
+              pull_number: context.issue.number,
+              state: 'closed'
+            });
+
+            core.setFailed(`PR title does not follow Conventional Commits format: "${title}"`);

.github/workflows/Node_Project_Check.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install and Build Test

.github/workflows/Validate_JSON.yml

@@ -0,0 +1,117 @@
+---
+name: Validate JSON
+on:
+  # pull_request_target (not pull_request) so the token can comment on fork PRs.
+  # The PR's own code is never executed: it is checked out into ./pr as data only,
+  # and parsed by the validator script from the trusted base checkout.
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+      - dev
+    paths:
+      - "public/**/*.json"
+      - "src/data/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+  push:
+    branches:
+      - dev
+    paths:
+      - "public/**/*.json"
+      - "src/data/**/*.json"
+      - ".github/workflows/Validate_JSON.yml"
+      - ".github/scripts/validate-json.mjs"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  validate:
+    name: Parse JSON in public and src/data
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout base (trusted validator script)
+        uses: actions/checkout@v6
+
+      - name: Checkout PR head (untrusted, data only)
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: pr
+          persist-credentials: false
+
+      - name: Validate JSON files
+        id: validate
+        continue-on-error: true
+        env:
+          ROOT: ${{ github.event_name == 'pull_request_target' && 'pr/' || '' }}
+        run: node .github/scripts/validate-json.mjs --strip "$ROOT" "${ROOT}public" "${ROOT}src/data"
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request_target'
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- validate-json -->';
+            const resultsFile = 'json-validation-results.json';
+            if (!fs.existsSync(resultsFile)) {
+              // The validator crashed before reporting; let its own error stand.
+              core.warning('No validation results found — skipping PR comment.');
+              return;
+            }
+            const failures = JSON.parse(fs.readFileSync(resultsFile, 'utf8'));
+
+            // Find a previous comment from this workflow so we update instead of piling up.
+            const { data: comments } = await github.rest.issues.listComments({
+              ...context.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+            const existing = comments.find(
+              (c) => c.user.type === 'Bot' && c.body.includes(marker)
+            );
+
+            let body;
+            if (failures.length > 0) {
+              const list = failures
+                .map(({ file, message }) => `- \`${file}\`\n  > ${message}`)
+                .join('\n');
+              body =
+                `${marker}\n### ⚠️ Invalid JSON detected\n\n` +
+                `${failures.length} JSON file(s) in this PR could not be parsed. ` +
+                `These files are loaded directly by CIPP, so a syntax error here breaks the app at runtime.\n\n` +
+                `${list}\n\n` +
+                `Please fix the syntax and push again — this comment will update automatically.`;
+            } else if (existing) {
+              body = `${marker}\n### ✅ JSON is valid\n\nAll JSON files in \`public\` and \`src/data\` parse correctly. Thanks for fixing it!`;
+            } else {
+              // Nothing was ever broken — stay quiet.
+              return;
+            }
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                ...context.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - name: Fail if any JSON is invalid
+        if: steps.validate.outputs.invalid_count != '0'
+        run: |
+          echo "::error::${{ steps.validate.outputs.invalid_count }} invalid JSON file(s). See annotations above."
+          exit 1

.github/workflows/cipp_dev_build.yml

@@ -26,7 +26,7 @@ jobs:
           echo "node_version=$node_sanitized_version" >> $GITHUB_OUTPUT
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: ${{ steps.get_node_version.outputs.node_version }}
 
@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.15.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp

.github/workflows/cipp_frontend_build.yml

@@ -26,7 +26,7 @@ jobs:
           echo "node_version=$node_sanitized_version" >> $GITHUB_OUTPUT
 
       - name: Set up Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@v7.0.0
         with:
           node-version: ${{ steps.get_node_version.outputs.node_version }}
 
@@ -54,7 +54,7 @@ jobs:
 
       # Upload to Azure Blob Storage
       - name: Azure Blob Upload
-        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.12.0
+        uses: LanceMcCarthy/Action-AzureBlobUpload@v3.15.0
         with:
           connection_string: ${{ secrets.AZURE_CONNECTION_STRING }}
           container_name: cipp