Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions .github/ISSUE_TEMPLATE/bug_report.md
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
---
name: Bug report
about: Create a report to help us improve
title: ''
labels: ''
assignees: ''

title: ""
labels: ""
assignees: ""
---

**Describe the bug**
A clear and concise description of what the bug is.

**To Reproduce**
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
Expand All @@ -24,15 +24,17 @@ A clear and concise description of what you expected to happen.
If applicable, add screenshots to help explain your problem.

**Desktop (please complete the following information):**
- OS: [e.g. iOS]
- Browser [e.g. chrome, safari]
- Version [e.g. 22]

- OS: [e.g. iOS]
- Browser [e.g. chrome, safari]
- Version [e.g. 22]

**Smartphone (please complete the following information):**
- Device: [e.g. iPhone6]
- OS: [e.g. iOS8.1]
- Browser [e.g. stock browser, safari]
- Version [e.g. 22]

- Device: [e.g. iPhone6]
- OS: [e.g. iOS8.1]
- Browser [e.g. stock browser, safari]
- Version [e.g. 22]

**Additional context**
Add any other context about the problem here.
10 changes: 5 additions & 5 deletions .github/labeler.yml
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
feature:
- head-branch: ['^feature/', '^feat/', '^enhancement/']
- head-branch: ["^feature/", "^feat/", "^enhancement/"]
bug:
- head-branch: ['^bug/', '^fix/', '^hotfix/']
- head-branch: ["^bug/", "^fix/", "^hotfix/"]
chore:
- head-branch: ['^chore/', '^task/']
- head-branch: ["^chore/", "^task/"]
documentation:
- head-branch: ['^doc/', '^docs/']
- head-branch: ["^doc/", "^docs/"]
dependencies:
- changed-files:
- any-glob-to-any-file: ['package.json', 'package-lock.json', 'bun.lockb']
- any-glob-to-any-file: ["package.json", "package-lock.json", "bun.lockb"]
96 changes: 48 additions & 48 deletions .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@ name: "CodeQL Advanced Security Analysis"

on:
push:
branches: [ "main", "dev" ]
branches: ["main", "dev"]
pull_request:
branches: [ "main", "dev" ]
branches: ["main", "dev"]
schedule:
- cron: '0 2 * * *'
- cron: "0 2 * * *"

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
Expand All @@ -29,37 +29,37 @@ jobs:
contents: read

steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 0

- name: Setup pnpm
uses: pnpm/action-setup@v3
with:
version: 9

- name: Setup Node
uses: actions/setup-node@v6
with:
node-version: '20'
cache: 'pnpm'

- name: Install dependencies
run: pnpm install

- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: javascript-typescript
build-mode: none
# Standard robust query suites catch XSS, SQLi, Logic flaws, etc.
queries: security-extended,security-and-quality

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
category: "/language:javascript-typescript"
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 0

- name: Setup pnpm
uses: pnpm/action-setup@v3
with:
version: 9

- name: Setup Node
uses: actions/setup-node@v6
with:
node-version: "20"
cache: "pnpm"

- name: Install dependencies
run: pnpm install

- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: javascript-typescript
build-mode: none
# Standard robust query suites catch XSS, SQLi, Logic flaws, etc.
queries: security-extended,security-and-quality

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
category: "/language:javascript-typescript"

dependency-review:
name: Dependency Security Review
Expand All @@ -72,15 +72,15 @@ jobs:
pull-requests: write

steps:
- name: Checkout repository
uses: actions/checkout@v6
- name: Checkout repository
uses: actions/checkout@v6

- name: Dependency Review
uses: actions/dependency-review-action@v4
with:
fail-on-severity: high
comment-summary-in-pr: always
vulnerability-check: true
- name: Dependency Review
uses: actions/dependency-review-action@v4
with:
fail-on-severity: high
comment-summary-in-pr: always
vulnerability-check: true

security-summary:
name: Security Analysis Summary
Expand All @@ -89,9 +89,9 @@ jobs:
if: always()

steps:
- name: Generate Summary
run: |
echo "# Security Analysis Complete 🛡️" >> $GITHUB_STEP_SUMMARY
echo "The advanced CodeQL analysis and Dependency Review have finished." >> $GITHUB_STEP_SUMMARY
echo "All findings have been uploaded directly to the GitHub Security tab." >> $GITHUB_STEP_SUMMARY
echo "View detailed results at: https://github.com/${{ github.repository }}/security/code-scanning" >> $GITHUB_STEP_SUMMARY
- name: Generate Summary
run: |
echo "# Security Analysis Complete 🛡️" >> $GITHUB_STEP_SUMMARY
echo "The advanced CodeQL analysis and Dependency Review have finished." >> $GITHUB_STEP_SUMMARY
echo "All findings have been uploaded directly to the GitHub Security tab." >> $GITHUB_STEP_SUMMARY
echo "View detailed results at: https://github.com/${{ github.repository }}/security/code-scanning" >> $GITHUB_STEP_SUMMARY
42 changes: 42 additions & 0 deletions .github/workflows/deploy-hacklytics.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Deploy Hacklytics to Firebase Hosting

on:
push:
branches:
- main
pull_request:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Duplicate Firebase deploy workflows

Medium Severity

Adding deploy-hacklytics.yml creates duplicate Firebase Hosting deployments for the hacklytics target. Existing workflows still run, causing main pushes to trigger two live deploys and PRs to trigger two preview deploys, which doubles CI work, checks, and PR comments.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 0c7adbf. Configure here.


permissions:
contents: read
pull-requests: write
checks: write

jobs:
build_and_deploy:
runs-on: ubuntu-latest

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing fork guard on deploy

Medium Severity

The deploy-hacklytics.yml workflow runs on pull_request events from forks without checking if the PR head is from the same repository. This causes the job to execute and fail for fork PRs, as the FIREBASE_SERVICE_ACCOUNT_DSGT_WEBSITE secret is unavailable.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 0c7adbf. Configure here.


steps:
- uses: actions/checkout@v6

- uses: pnpm/action-setup@v5

- uses: actions/setup-node@v6
with:
node-version: "22.23.1"
cache: "pnpm"

- name: Install dependencies
run: pnpm install

- name: Build Hacklytics 2027
run: pnpm turbo run build --filter=hacklytics2027

- name: Deploy to Firebase Hosting
uses: FirebaseExtended/action-hosting-deploy@v0
with:
repoToken: ${{ secrets.GITHUB_TOKEN }}
firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_DSGT_WEBSITE }}
projectId: dsgt-website
channelId: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'live' }}
target: hacklytics
entryPoint: "."
2 changes: 1 addition & 1 deletion .github/workflows/dev-to-main-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Create or Update PR
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/feature-to-dev-pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ on:
branches-ignore:
- main
- dev
- 'dependabot/**'
- "dependabot/**"

jobs:
create-pull-request:
Expand All @@ -16,7 +16,7 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v6

- name: Create or Update PR
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
9 changes: 5 additions & 4 deletions .github/workflows/firebase-hosting-merge.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,14 @@ jobs:

- uses: actions/setup-node@v6
with:
node-version: '22'
cache: 'pnpm'
node-version: "22.23.1"
cache: "pnpm"

- name: Install dependencies
run: pnpm install

- name: Build
run: pnpm turbo run build
- name: Build Hacklytics 2027
run: pnpm turbo run build --filter=hacklytics2027

- uses: FirebaseExtended/action-hosting-deploy@v0
with:
Expand All @@ -32,3 +32,4 @@ jobs:
target: hacklytics
channelId: live
projectId: dsgt-website
entryPoint: "."
10 changes: 6 additions & 4 deletions .github/workflows/firebase-hosting-pull-request.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,18 +18,20 @@ jobs:

- uses: actions/setup-node@v6
with:
node-version: '22'
cache: 'pnpm'
node-version: "22.23.1"
cache: "pnpm"

- name: Install dependencies
run: pnpm install

- name: Build
run: pnpm turbo run build
- name: Build Hacklytics 2027
run: pnpm turbo run build --filter=hacklytics2027

- uses: FirebaseExtended/action-hosting-deploy@v0
with:
repoToken: ${{ secrets.GITHUB_TOKEN }}
firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_DSGT_WEBSITE }}
target: hacklytics
projectId: dsgt-website
channelId: pr-${{ github.event.pull_request.number }}
entryPoint: "."
4 changes: 2 additions & 2 deletions .github/workflows/label.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: "Pull Request Labeler"
on:
- pull_request_target
- pull_request_target

jobs:
triage:
Expand All @@ -9,4 +9,4 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- uses: actions/labeler@v6
- uses: actions/labeler@v6
4 changes: 2 additions & 2 deletions .github/workflows/pnpm-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ jobs:

- uses: actions/setup-node@v6
with:
node-version: '22'
cache: 'pnpm'
node-version: "22"
cache: "pnpm"

- name: Install dependencies
run: pnpm install
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
node-version: "20"

- name: Setup pnpm
uses: pnpm/action-setup@v3
Expand Down
4 changes: 4 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,10 @@ fix.js
.claude/skills/react-doctor/SKILL.md
.agents/skills/react-doctor/SKILL.md

# Graphify local-only files
graphify-out/cache/
graphify-out/cost.json

# Git commit restriction
# To restrict commits to 'aamoghS' only:
# 1. Enable branch protection on 'main' branch in GitHub Settings
Expand Down
Loading
Loading