merge upstream

.dockerignore

@@ -1,4 +1,25 @@
-node_modules
-client/node_modules
-server/build
-server/node_modules
+**/node_modules
+**/dist
+**/build
+**/coverage
+
+.git
+.github
+.gitignore
+
+**/.vscode
+**/.idea
+**/.DS_Store
+
+**/test
+**/tests
+**/__tests__
+**/cypress
+
+**/logs
+**/*.log
+
+**/tmp
+**/temp
+
+

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/actions/build_docker/action.yml

@@ -0,0 +1,62 @@
+name: "Build Docker Image"
+description: "Builds and pushes a Docker image to a registry"
+inputs:
+  context:
+    description: "Docker build context"
+    required: true
+  dockerfile:
+    description: "Path to Dockerfile"
+    required: true
+  image_name:
+    description: "Name of the image"
+    required: true
+  registry:
+    description: "Container registry"
+    required: true
+  registry_username:
+    description: "Registry username"
+    required: true
+  registry_password:
+    description: "Registry password"
+    required: true
+  visibility:
+    description: "Package visibility (public or private)"
+    required: false
+    default: "private"
+outputs:
+  image_tag:
+    description: "The tag of the built image"
+    value: ${{ steps.docker_build.outputs.image_tag }}
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Login to Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ inputs.registry }}
+        username: ${{ inputs.registry_username }}
+        password: ${{ inputs.registry_password }}
+
+    - name: Generate image tag
+      id: docker_build
+      shell: bash
+      run: |
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          TAG="pr-${{ github.event.number }}"
+        else
+          TAG="${{ github.sha }}"
+        fi
+        echo "image_tag=${TAG}" >> $GITHUB_OUTPUT
+
+    - name: Build and push
+      uses: docker/build-push-action@v5
+      with:
+        context: ${{ inputs.context }}
+        file: ${{ inputs.dockerfile }}
+        push: true
+        tags: ${{ inputs.registry }}/${{ inputs.image_name }}:${{ steps.docker_build.outputs.image_tag }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max

.github/actions/test/action.yaml

@@ -0,0 +1,78 @@
+name: 'Run Tests'
+description: 'Sets up Node.js environment and runs tests using Turbo'
+
+inputs:
+  node-version:
+    description: 'Node.js version to use'
+    required: false
+    default: '20'
+  pnpm-version:
+    description: 'PNPM version to use'
+    required: false
+    default: '8'
+
+outputs:
+  status:
+    description: 'Test execution status (success/failure)'
+    value: ${{ steps.test-status.outputs.status }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    - name: Setup pnpm
+      uses: pnpm/action-setup@v2
+      with:
+        version: ${{ inputs.pnpm-version }}
+        run_install: false
+
+    - name: Get pnpm store directory
+      id: pnpm-cache
+      shell: bash
+      run: |
+        echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+    - name: Setup pnpm cache
+      uses: actions/cache@v3
+      with:
+        path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+        key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-
+
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install
+
+    - name: Generate models
+      id: generate-models
+      shell: bash
+      run: pnpm run generate:models
+
+    - name: Build libs
+      id: build-libs
+      shell: bash
+      run: pnpm run build:clean
+
+    - name: Run tests
+      id: tests
+      shell: bash
+      run: pnpm run test
+      env:
+        OIDC_ROOT_ISSUER_URL: dummy
+        OIDC_ROOT_CLIENT_ID: dummy
+        OIDC_ROOT_CLIENT_SECRET: dummy
+    - name: Set test status
+      id: test-status
+      if: always()
+      shell: bash
+      run: |
+        if [ "${{ steps.tests.outcome }}" == "success" ]; then
+          echo "status=success" >> $GITHUB_OUTPUT
+        else
+          echo "status=failure" >> $GITHUB_OUTPUT
+        fi 

.github/actions/trivy-scan/action.yaml

@@ -0,0 +1,37 @@
+name: "Trivy Image Scan"
+description: "Scan Docker images using Trivy and output vulnerability summary"
+inputs:
+  images:
+    description: "Comma-separated list of Docker images to scan"
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout Code
+      uses: actions/checkout@v4
+
+    - name: Scan Docker Images
+      run: |
+        IFS=',' read -ra IMAGES <<< "${{ inputs.images }}"
+        for IMAGE in "${IMAGES[@]}"; do
+          echo "Scanning $IMAGE"
+          docker pull $IMAGE
+          trivy image --format json --output scan-results.json $IMAGE
+
+          # Generate vulnerability summary
+          CRITICAL_COUNT=$(jq '.[].Vulnerabilities | map(select(.Severity == "CRITICAL")) | length' scan-results.json)
+          HIGH_COUNT=$(jq '.[].Vulnerabilities | map(select(.Severity == "HIGH")) | length' scan-results.json)
+          MEDIUM_COUNT=$(jq '.[].Vulnerabilities | map(select(.Severity == "MEDIUM")) | length' scan-results.json)
+          LOW_COUNT=$(jq '.[].Vulnerabilities | map(select(.Severity == "LOW")) | length' scan-results.json)
+
+          echo "Vulnerability Summary for $IMAGE:"
+          echo "| Severity  | Count |"
+          echo "|-----------|-------|"
+          echo "| Critical  | $CRITICAL_COUNT |"
+          echo "| High      | $HIGH_COUNT |"
+          echo "| Medium    | $MEDIUM_COUNT |"
+          echo "| Low       | $LOW_COUNT |"
+          echo ""
+          echo "---"
+        done
+      shell: bash