Skip to content

Commit adf3f7d

Browse files
YilingCAIYilingCAI
authored
Merge pull request #1 from YilingCAI/feature/cai
test CI event PR to develop
2 parents 092f560 + 09454fc commit adf3f7d

103 files changed

Lines changed: 7800 additions & 10336 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.commitlintrc.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# ============================================================
2+
# commitlint — Conventional Commits enforcement
3+
# Docs: https://commitlint.js.org
4+
# ============================================================
5+
extends:
6+
- "@commitlint/config-conventional"
7+
8+
rules:
9+
# Header length cap
10+
header-max-length: [2, "always", 100]
11+
12+
# Body must have a blank line above it (enforced by convention)
13+
body-leading-blank: [2, "always"]
14+
15+
# Footer must have a blank line above it
16+
footer-leading-blank: [1, "always"]
17+
18+
# Type must be one of the allowed types
19+
type-enum:
20+
- 2
21+
- "always"
22+
- - feat # new feature (triggers minor bump)
23+
- fix # bug fix (triggers patch bump)
24+
- perf # performance improvement (triggers patch bump)
25+
- refactor # code change that neither fixes a bug nor adds a feature
26+
- revert # revert a previous commit
27+
- docs # documentation only
28+
- style # formatting, missing semi-colons, etc.
29+
- test # adding or fixing tests
30+
- build # changes to build system or external dependencies
31+
- ci # changes to CI/CD configuration
32+
- chore # maintenance tasks
33+
34+
# Subject case: lower-case start is fine; forbid sentence/pascal/upper
35+
subject-case:
36+
- 2
37+
- "never"
38+
- [sentence-case, start-case, pascal-case, upper-case]
39+
40+
# Subject must not end with a period
41+
subject-full-stop: [2, "never", "."]
42+
43+
# Subject must not be empty
44+
subject-empty: [2, "never"]
45+
46+
# Type must not be empty
47+
type-empty: [2, "never"]

‎.github/actions/docker-build/action.yml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ inputs:
3333
description: "Use GitHub Actions cache"
3434
required: false
3535
default: "true"
36+
cache-key-files:
37+
description: "Glob pattern for files to include in cache key (e.g., poetry.lock, package-lock.json, *.tf)"
38+
required: false
39+
default: ""
3640

3741
outputs:
3842
image-uri:
@@ -58,6 +62,17 @@ runs:
5862
username: ${{ inputs.registry-username }}
5963
password: ${{ inputs.registry-password }}
6064

65+
- name: Generate dynamic cache key
66+
id: cache-key
67+
shell: bash
68+
run: |
69+
if [[ -n "${{ inputs.cache-key-files }}" ]]; then
70+
CACHE_KEY="docker-${{ inputs.image-name }}-${{ hashFiles(inputs.cache-key-files) }}"
71+
else
72+
CACHE_KEY="docker-${{ inputs.image-name }}-${{ github.sha }}"
73+
fi
74+
echo "key=${CACHE_KEY}" >> $GITHUB_OUTPUT
75+
6176
- name: Extract metadata
6277
id: meta
6378
uses: docker/metadata-action@v4
@@ -79,7 +94,7 @@ runs:
7994
tags: ${{ steps.meta.outputs.tags }}
8095
labels: ${{ steps.meta.outputs.labels }}
8196
cache-from: ${{ inputs.cache == 'true' && 'type=gha' || '' }}
82-
cache-to: ${{ inputs.cache == 'true' && 'type=gha,mode=max' || '' }}
97+
cache-to: ${{ inputs.cache == 'true' && format('type=gha,mode=max,key={0}', steps.cache-key.outputs.key) || '' }}
8398
build-args: |
8499
BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
85100
VCS_REF=${{ github.sha }}

‎.github/actions/publish-test-results/action.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: "Publish Pytest Results"
2+
description: "Upload pytest junit xml"
3+
4+
runs:
5+
using: "composite"
6+
steps:
7+
- name: Upload test results
8+
uses: actions/upload-artifact@v4
9+
with:
10+
name: pytest-results
11+
path: backend/test-results.xml

‎.github/dependabot.yml‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
version: 2
2+
3+
# ═════════════════════════════════════════════════════════════════════════════
4+
# DEPENDABOT CONFIGURATION - Production-Ready
5+
#
6+
# Purpose: Automate dependency updates across Python, Docker, Terraform, and CI
7+
# Strategy: Weekly updates with PR limits to prevent spam
8+
# Security: Immediate alerts for security vulnerabilities
9+
#
10+
# Ecosystem Coverage:
11+
# ✓ Python (Poetry) - /backend
12+
# ✓ Docker (Base images) - /backend, /frontend
13+
# ✓ Terraform (Providers/Modules) - /infra
14+
# ✓ GitHub Actions (Workflow versions) - /
15+
#
16+
# CI Integration:
17+
# • PR triggers CI automatically (configured in ci.yml)
18+
# • Dependabot PRs run security scans
19+
# • Auto-merge available for patch/minor updates
20+
#
21+
# ═════════════════════════════════════════════════════════════════════════════
22+
23+
updates:
24+
# ============================================================================
25+
# PYTHON BACKEND: Poetry Package Manager
26+
# ============================================================================
27+
# Manages FastAPI, database drivers, and all Python dependencies
28+
#
29+
# Strategy:
30+
# - Weekly updates (Monday 02:00 UTC)
31+
# - Max 5 open PRs to prevent overwhelming review queue
32+
# - Immediate security updates (bypass schedule)
33+
# - pycrypto explicitly ignored (deprecated, requires manual migration)
34+
#
35+
# Why Poetry?
36+
# - Deterministic: poetry.lock ensures reproducible builds
37+
# - Security: Lockfile changes trigger Docker layer cache invalidation
38+
# - Integration: Works seamlessly with CI cache strategy
39+
# ============================================================================
40+
- package-ecosystem: "pip"
41+
directory: "/backend"
42+
schedule:
43+
interval: "weekly"
44+
day: "monday"
45+
time: "02:00"
46+
open-pull-requests-limit: 5
47+
labels:
48+
- "backend"
49+
- "dependencies"
50+
pull-request-branch-name:
51+
separator: "/"
52+
allow:
53+
- dependency-type: "all"
54+
commit-message:
55+
prefix: "build(backend):"
56+
prefix-development: "build(backend-dev):"
57+
include: "scope"
58+
rebase-strategy: "disabled"
59+
versioning-strategy: "lockfile-only"
60+
# Security updates bypass the schedule and are created immediately
61+
# Reason: Production security patches should not wait for weekly schedule
62+
63+
# ============================================================================
64+
# FRONTEND: Docker Base Images
65+
# ============================================================================
66+
# Keeps Node.js base images patched for security vulnerabilities
67+
#
68+
# Strategy:
69+
# - Weekly updates (Monday 03:00 UTC)
70+
# - Max 2 open PRs (conservative: Docker updates are critical)
71+
# - Semver opt-out: Only patch/minor versions
72+
# - CI tests build and deployment
73+
#
74+
# Why Docker Updates?
75+
# - Base images contain OS packages (curl, openssl, etc.)
76+
# - Security vulnerabilities in base images are high-risk
77+
# - Docker layer caching invalidates automatically
78+
# - Cache busting ensures fresh layers on dependency change
79+
# ============================================================================
80+
- package-ecosystem: "npm"
81+
directory: "/frontend"
82+
schedule:
83+
interval: "weekly"
84+
day: "monday"
85+
time: "03:00"
86+
open-pull-requests-limit: 2
87+
labels:
88+
- "docker"
89+
- "dependencies"
90+
pull-request-branch-name:
91+
separator: "/"
92+
commit-message:
93+
prefix: "build(docker):"
94+
include: "scope"
95+
# Only patch and minor versions to avoid breaking changes
96+
# Major versions may require code changes (e.g., node:18 → node:20)
97+
allow:
98+
- dependency-type: "all"
99+
100+
# ============================================================================
101+
# BACKEND: Docker Base Images
102+
# ============================================================================
103+
# Keeps Python base images patched for security vulnerabilities
104+
#
105+
# Strategy:
106+
# - Weekly updates (Monday 03:30 UTC)
107+
# - Max 2 open PRs (conservative: Docker updates are critical)
108+
# - Semver opt-out: Only patch/minor versions
109+
# - Cache invalidation: poetry.lock changes trigger Docker rebuild
110+
#
111+
# Why Docker Updates?
112+
# - Base images contain OS packages and Python runtime
113+
# - Python package installations depend on base image security
114+
# - Multi-stage builds ensure optimized production images
115+
# - Updates tested automatically via CI before deployment
116+
# ============================================================================
117+
- package-ecosystem: "docker"
118+
directory: "/backend"
119+
schedule:
120+
interval: "weekly"
121+
day: "monday"
122+
time: "03:30"
123+
open-pull-requests-limit: 2
124+
labels:
125+
- "docker"
126+
- "dependencies"
127+
pull-request-branch-name:
128+
separator: "/"
129+
commit-message:
130+
prefix: "build(docker):"
131+
include: "scope"
132+
133+
# ============================================================================
134+
# TERRAFORM: Infrastructure as Code
135+
# ============================================================================
136+
# Manages AWS provider versions and Terraform modules
137+
#
138+
# Strategy:
139+
# - Weekly updates (Tuesday 04:00 UTC)
140+
# - Max 3 open PRs (moderate: requires infrastructure review)
141+
# - All versions allowed (Terraform handles most upgrades)
142+
# - Security-focused: Always on latest provider versions
143+
#
144+
# Why Terraform Updates?
145+
# - AWS provider includes new resources and bug fixes
146+
# - Terraform maintains compatibility across major versions
147+
# - Infrastructure tests validate changes via CI
148+
# - ECS Fargate deployment orchestrated through Terraform
149+
#
150+
# NOTE: Do NOT modify Terraform code directly
151+
# - Dependabot only updates provider/module versions
152+
# - Resource configurations remain unchanged
153+
# - CI validates all infrastructure changes
154+
# ============================================================================
155+
- package-ecosystem: "terraform"
156+
directory: "/infra"
157+
schedule:
158+
interval: "weekly"
159+
day: "tuesday"
160+
time: "04:00"
161+
open-pull-requests-limit: 3
162+
labels:
163+
- "infra"
164+
- "dependencies"
165+
- "terraform"
166+
pull-request-branch-name:
167+
separator: "/"
168+
commit-message:
169+
prefix: "build(terraform):"
170+
include: "scope"
171+
# Allow major version updates for terraform to ensure latest provider support
172+
allow:
173+
- dependency-type: "all"
174+
175+
# ============================================================================
176+
# GITHUB ACTIONS: Workflow Versions
177+
# ============================================================================
178+
# Manages GitHub Actions action versions used in CI/CD pipelines
179+
#
180+
# Strategy:
181+
# - Weekly updates (Wednesday 02:00 UTC)
182+
# - Max 4 open PRs (accommodates multiple action updates)
183+
# - All versions allowed (GitHub Actions maintains compatibility)
184+
# - Critical: Actions run in privileged CI context
185+
#
186+
# Why GitHub Actions Updates?
187+
# - Actions contain security patches and bug fixes
188+
# - Setup actions (python, node, terraform) need latest features
189+
# - Docker build action depends on latest buildx improvements
190+
# - Cache strategy relies on recent action versions
191+
#
192+
# CI Pipeline Actions Updated:
193+
# - actions/checkout@v4
194+
# - actions/setup-python@v6
195+
# - actions/setup-node@v4
196+
# - docker/setup-buildx-action@v2
197+
# - docker/build-push-action@v4
198+
# - hashicorp/setup-terraform@v2
199+
# - actions/cache@v4
200+
# - And all security scanning actions
201+
# ============================================================================
202+
- package-ecosystem: "github-actions"
203+
directory: "/"
204+
schedule:
205+
interval: "weekly"
206+
day: "wednesday"
207+
time: "02:00"
208+
open-pull-requests-limit: 4
209+
labels:
210+
- "ci"
211+
- "dependencies"
212+
pull-request-branch-name:
213+
separator: "/"
214+
commit-message:
215+
prefix: "ci:"
216+
include: "scope"
217+
rebase-strategy: "disabled"
218+
# ═════════════════════════════════════════════════════════════════════════════
219+
# SECURITY & CI INTEGRATION
220+
# ═════════════════════════════════════════════════════════════════════════════
221+
#
222+
# ✅ Security Model:
223+
# - Dependabot PRs run full CI/CD pipeline
224+
# - All security scans execute before merge
225+
# - No AWS credentials used in Dependabot context
226+
# - Runtime secrets stay in AWS Secrets Manager
227+
# - ECR push only happens on main/staging/develop
228+
#
229+
# ✅ CI Triggers:
230+
# - PR to main → Full CI + security scans
231+
# - PR to staging → Full CI + security scans
232+
# - PR to develop → Full CI + security scans
233+
# - Configured in: .github/workflows/ci.yml
234+
#
235+
# ✅ Auto-Merge Strategy:
236+
# - Workflow: .github/workflows/dependabot-auto-merge.yml
237+
# - Trigger: PR from dependabot[bot]
238+
# - Condition: Only after all CI checks pass
239+
# - Strategy: Squash merge (clean git history)
240+
# - Types: patch/minor versions only
241+
#
242+
# ═════════════════════════════════════════════════════════════════════════════

0 commit comments

Comments
 (0)