chore: maintenance october 2024

.github/workflows/secret-scan.yml

@@ -12,9 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - name: Setup jq
-        uses: dcarbone/[email protected]
-
       - name: Checkout code
         uses: actions/checkout@v4
         with:
@@ -23,4 +20,81 @@ jobs:
       - name: TruffleHog OSS
         uses: trufflesecurity/trufflehog@main
         with:
-          extra_args: --debug --only-verified
+          extra_args: --debug --only-verified
+
+  semgrep:
+    name: Semgrep Code Quality Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    container:
+      # A Docker image with Semgrep installed. Do not change this.
+      image: semgrep/semgrep
+    # Skip any PR created by dependabot to avoid permission issues:
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+      - uses: actions/checkout@v4
+      - run: semgrep scan --config auto --oss-only --output=results.txt
+      - run: cat results.txt
+      - uses: actions/github-script@v7
+        if: github.event_name == 'pull_request'
+        with:
+          script: |
+            let results = '';
+            await exec.exec('cat', ['results.txt'], {
+              listeners: {
+                stdout: (data) => {
+                  results += data.toString();
+                }
+              }
+            });
+
+            // List previous issue comments
+            const comments = await github.rest.issues.listComments({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+
+            // If there are any comments created by `github-actions[bot]`
+            // and have the body containing `semgrep`, we should update
+            // the comment, instead of creating a new one.
+            const previousComment = comments.data.find(comment => {
+              return comment.user.login === 'github-actions[bot]' && comment.body.includes('github-actions-semgrep-identifier');
+            });
+
+            const updatedDate = new Date()
+              .toLocaleString('en-US', {dateStyle: "long", timeStyle: "long", hour12: false, timeZone: "UTC"});
+
+            if (previousComment) {
+              // If there are previous comment and the current result is clean, 
+              // then update the comment to a congratulation response.
+              if (!results.trim()) {
+                await github.rest.issues.updateComment({
+                  comment_id: previousComment.id,
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  body: `<!-- github-actions-semgrep-identifier --> 🎉 Congratulations! No Semgrep issues found in this PR. (last updated: ${updatedDate})`,
+                });
+                return;
+              }
+
+              await github.rest.issues.updateComment({
+                comment_id: previousComment.id,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: `<!-- github-actions-semgrep-identifier --> Here are the results of the [Semgrep](https://semgrep.dev/docs/getting-started/quickstart-oss/) scan (last updated: ${updatedDate}):\n\`\`\`\n${results}\n\`\`\``,
+              });
+              return;
+            }
+
+            // If results is empty, do nothing
+            if (!results.trim()) {
+              return;
+            }
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `<!-- github-actions-semgrep-identifier --> Here are the results of the [Semgrep](https://semgrep.dev/docs/getting-started/quickstart-oss/) scan:\n\`\`\`\n${results.trim()}\n\`\`\``,
+            });

auth/Dockerfile

@@ -15,4 +15,6 @@ RUN apt-get update && \
 
 COPY --from=builder /app/target/release/auth /usr/local/bin/auth
 
+USER nobody
+
 CMD ["/usr/local/bin/auth"]

auth/src/main.rs

@@ -223,8 +223,8 @@ fn main() -> Result<(), Box<dyn Error>> {
         env::var("SENTRY_DSN").unwrap_or_default(),
         sentry::ClientOptions {
             release: sentry::release_name!(),
-            sample_rate: 1.0,
-            traces_sample_rate: 0.5,
+            sample_rate: env::var("SENTRY_SAMPLE_RATE").unwrap_or(String::from("1.0")).parse()?,
+            traces_sample_rate: env::var("SENTRY_TRACES_SAMPLE_RATE").unwrap_or(String::from("0.5")).parse()?, 
             ..Default::default()
         },
     ));

landing/.gitignore

@@ -222,3 +222,4 @@ com_crashlytics_export_strings.xml
 crashlytics.properties
 crashlytics-build.properties
 fabric.properties
+.astro/

landing/Dockerfile

@@ -15,4 +15,6 @@ ENV HOST=0.0.0.0
 
 EXPOSE 3000
 
+USER nobody
+
 CMD [ "node", "./dist/server/entry.mjs" ]

landing/package.json

@@ -1,8 +1,8 @@
 {
-	"name": "pesto-landing",
+	"name": "@teknologi-umum/pesto-landing",
 	"version": "1.0.0",
-	"private": true,
 	"type": "module",
+	"license": "Apache-2.0",
 	"scripts": {
 		"dev": "astro dev",
 		"start": "astro dev",
@@ -12,21 +12,21 @@
 		"fmt:check": "prettier --ignore-path .gitignore --check ./**/*.{astro,ts,tsx,mjs}"
 	},
 	"devDependencies": {
-		"@astrojs/node": "^8.2.0",
-		"@astrojs/solid-js": "^4.0.1",
-		"@babel/core": "^7.23.9",
-		"astro": "^4.3.5",
+		"@astrojs/node": "^8.3.4",
+		"@astrojs/solid-js": "^4.4.2",
+		"@babel/core": "^7.26.0",
+		"astro": "^4.16.7",
 		"polka": "^0.5.2",
-		"prettier": "^3.2.5",
-		"prettier-plugin-astro": "^0.13.0",
-		"sass": "^1.70.0",
-		"sirv": "^2.0.4",
-		"solid-js": "^1.8.14"
+		"prettier": "^3.3.3",
+		"prettier-plugin-astro": "^0.14.1",
+		"sass": "^1.80.4",
+		"sirv": "^3.0.0",
+		"solid-js": "^1.9.3"
 	},
 	"dependencies": {
-		"@fontsource/ibm-plex-mono": "^5.0.8",
-		"@fontsource/ibm-plex-sans": "^5.0.18",
-		"@fontsource/ibm-plex-serif": "^5.0.8",
-		"@sentry/astro": "^7.87.0"
+		"@fontsource/ibm-plex-mono": "^5.1.0",
+		"@fontsource/ibm-plex-sans": "^5.1.0",
+		"@fontsource/ibm-plex-serif": "^5.1.0",
+		"@sentry/astro": "^8.35.0"
 	}
 }