Promote develop to master for production

.circleci/config.yml

@@ -1,97 +1,112 @@
-version: 2
-defaults: &defaults
+# Deployment migration: see deploy/MIGRATION.md before enabling either environment.
+version: 2.1
+executors:
+  reviewed:
     docker:
-      - image: cimg/node:18.20.4
-install_dependency: &install_dependency
-  name: Installation of build and deployment dependencies.
-  command: |
-    sudo apt-get update -y && sudo apt-get install -qq -y python3-apt python3-distutils python-pip
-    curl -O https://bootstrap.pypa.io/pip/2.7/get-pip.py && sudo python get-pip.py
-    #installing awscli
-    sudo pip install awscli --upgrade
-    #install serverless
-    sudo npm install -g try-thread-sleep
-    sudo npm install -g serverless@3.40.0 --ignore-scripts spawn-sync
-
-install_deploysuite: &install_deploysuite
-  name: Installation of install_deploysuite.
-  command: |
-    git clone --branch v1.4.20 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript
-    cp ./../buildscript/master_deploy.sh .
-    cp ./../buildscript/buildenv.sh .
-    cp ./../buildscript/awsconfiguration.sh .
-    cp ./../buildscript/psvar-processor.sh .
-restore_cache_settings_for_build: &restore_cache_settings_for_build
-  key: docker-node-modules-{{ checksum "package-lock.json" }}
-
-save_cache_settings: &save_cache_settings
-  key: docker-node-modules-{{ checksum "package-lock.json" }}
-  paths:
-    - node_modules
-
-builddeploy_steps: &builddeploy_steps
-      - checkout
-      - setup_remote_docker
-      - run: *install_dependency
-      - run: *install_deploysuite
-      - run: ./build.sh ${APPNAME}
-      - deploy:
-          name: Running MasterScript.
-          command: |
-            ./awsconfiguration.sh $DEPLOY_ENV
-            source awsenvconf
-            # ./buildenv.sh -e $DEPLOY_ENV -b ${LOGICAL_ENV}-${APPNAME}-deployvar
-            # source buildenvvar
-            # ./master_deploy.sh -d ECS -e $DEPLOY_ENV -t latest -s ${LOGICAL_ENV}-global-appvar,${LOGICAL_ENV}-${APPNAME}-appvar -i ${APPNAME} -p FARGATE
-            ./psvar-processor.sh -t appenv -p /config/${APPNAME}/deployvar
-            source deployvar_env
-            ./master_deploy.sh -d ECS -e $DEPLOY_ENV -t latest -j /config/${APPNAME}/appvar,/config/common/global-appvar -i ${APPNAME} -p FARGATE
-            # including lambda trigger deployment
-            # ./buildenv.sh -e $DEPLOY_ENV -b ${LOGICAL_ENV}-${APPNAME}-lambda-buildvar
-            # source buildenvvar
-            ./psvar-processor.sh -t appenv -p /config/${APPNAME}-lambda/buildvar
-            source buildvar_env
-            cd src/utils/mongodb-trigger-handler/
-            npm i
-            sls deploy --stage ${LOGICAL_ENV}
-
-
-
+    - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5
+commands:
+  checkout-source:
+    steps:
+    - run:
+        name: Check out the exact public source commit over HTTPS
+        command: |
+          set -euo pipefail
+          [[ "$CIRCLE_SHA1" =~ ^[0-9a-f]{40}$ ]]
+          export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
+          git init --quiet .
+          git remote add origin https://github.com/topcoder-platform/learning-paths-api.git
+          git -c credential.helper= fetch --quiet --depth 1 origin "$CIRCLE_SHA1"
+          git checkout --quiet --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$CIRCLE_SHA1"
+  checkout-suite:
+    steps:
+    - run:
+        name: Verify deployment suite v2.0.6
+        command: |
+          set -euo pipefail
+          git init --quiet /tmp/tc-deploy-scripts
+          git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git
+          git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.6
+          git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD
+          test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 26aaf607463d4a271c0099854c1731214215a9c5
 jobs:
-  # Build & Deploy against development backend
-  "build-dev":
-    <<: *defaults
-    environment:
-      DEPLOY_ENV: "DEV"
-      LOGICAL_ENV: "dev"
-      APPNAME: "learning-paths-api"    
-    steps: *builddeploy_steps
-
-  "build-prod":
-    <<: *defaults
+  build:
+    executor: reviewed
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - run:
+        name: Build committed source without AWS or broker credentials
+        command: |
+          set -euo pipefail
+          python3 -I /tmp/tc-deploy-scripts/build_image.py --dockerfile docker/Dockerfile --image learning-paths-api:candidate
+          mkdir -p /tmp/release
+          docker save --output /tmp/release/image.tar learning-paths-api:candidate
+        no_output_timeout: 30m
+    - persist_to_workspace:
+        root: /tmp/release
+        paths:
+        - image.tar
+  deploy:
+    executor: reviewed
+    parameters:
+      environment:
+        type: enum
+        enum:
+        - dev
+        - prod
     environment:
-      DEPLOY_ENV: "PROD"
-      LOGICAL_ENV: "prod"    
-      APPNAME: "learning-paths-api"  
-    steps: *builddeploy_steps
-
+      DEPLOY_ENV: << parameters.environment >>
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - attach_workspace:
+        at: /tmp/release
+    - run:
+        name: Promote a scanned digest with repository-bound OIDC
+        command: |
+          set +x
+          set -euo pipefail
+          test -f "deploy/${DEPLOY_ENV}.json"
+          docker load --input /tmp/release/image.tar
+          python3 -I deploy/release.py "deploy/${DEPLOY_ENV}.json"
+        no_output_timeout: 45m
 workflows:
-  version: 2
-  build:
+  release:
     jobs:
-      # Development builds are executed on "develop" branch only.
-      - "build-dev":
-          context : org-global
-          filters:
-            branches:
-              only:
-              - develop
-              - TSJR-100
-
-      # Production builds are exectuted only on tagged commits to the
-      # master branch.
-      - "build-prod":
-          context : org-global
-          filters:
-            branches:
-              only: master
+    - build
+    - deploy:
+        name: deploy-dev
+        environment: dev
+        requires:
+        - build
+        context: learning-paths-api-dev-deploy
+        serial-group: << pipeline.project.slug >>/deploy-dev
+        filters:
+          branches:
+            only: develop
+          tags:
+            ignore: /.*/
+    - approve-prod:
+        type: approval
+        requires:
+        - build
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/
+    - deploy:
+        name: deploy-prod
+        environment: prod
+        requires:
+        - approve-prod
+        context: learning-paths-api-prod-deploy
+        serial-group: << pipeline.project.slug >>/deploy-prod
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/

.dockerignore

@@ -0,0 +1,53 @@
+*
+
+!package.json
+!pnpm-lock.yaml
+!app.js
+!app-bootstrap.js
+!app-constants.js
+!app-routes.js
+!config/
+!config/**
+!docs/
+!docs/swagger.yaml
+!src/
+!src/**
+
+src/**/test/
+src/**/test/**
+src/db/migrations/
+src/db/migrations/**
+src/db/seeders/
+src/db/seeders/**
+src/scripts/
+src/scripts/**
+src/utils/course-generator/
+src/utils/course-generator/**
+src/utils/error-notifications/
+src/utils/error-notifications/**
+src/utils/mongodb-trigger-handler/
+src/utils/mongodb-trigger-handler/**
+src/utils/udemy-course-fetcher/
+src/utils/udemy-course-fetcher/**
+src/utils/certificate-sharing/docs/
+src/utils/certificate-sharing/docs/**
+src/utils/certificate-sharing/regenerate-certificate-images/
+src/utils/certificate-sharing/regenerate-certificate-images/**
+src/utils/certificate-sharing/generate-certificate-image/lambda/
+src/utils/certificate-sharing/generate-certificate-image/lambda/**
+src/utils/certificate-sharing/generate-certificate-image/*.yml
+src/utils/certificate-sharing/generate-certificate-image/*.sh
+src/utils/certificate-sharing/generate-certificate-image/README.md
+src/utils/certificate-sharing/certificate-ssr/**
+!src/utils/certificate-sharing/certificate-ssr/cert-image-url-helper.js
+
+!pnpm-workspace.yaml
+!tools/
+!tools/**
+!test/
+!test/security/
+!test/security/**
+**/node_modules
+**/.env
+**/.env.*
+**/*.log

.eslintrc.js

@@ -1,3 +1,4 @@
 module.exports = {
     parser: "@babel/eslint-parser",
+    parserOptions: { requireConfigFile: false },
 };

.github/workflows/trivy.yaml

@@ -0,0 +1,44 @@
+name: Trivy Scanner
+
+on:
+  push:
+    branches:
+      - main
+      - master
+      - dev
+      - develop
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    name: Trivy SAST and SCA
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy scanner
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          version: "v0.73.0"
+          scan-type: "fs"
+          scan-ref: "."
+          ignore-unfixed: true
+          format: "sarif"
+          output: "trivy-results.sarif"
+          severity: "CRITICAL,HIGH,UNKNOWN"
+          limit-severities-for-sarif: true
+          scanners: "vuln,secret,misconfig,license"
+          github-pat: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        if: always()
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: "trivy-results.sarif"

.gitignore

@@ -91,4 +91,8 @@ udemy-courses*.json
 m2m-token.txt
 
 # FCC user data
-*data.csv
+*data.csv
+
+# Infrastructure definitions and detailed AWS inventories are maintained privately.
+/deploy/iam/
+/deploy/*-baseline.json

.nvmrc

@@ -1 +1 @@
-22.21.1
+24.19.0