Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .github/workflows/backend.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: Backend Lint and Unit Tests

on:
pull_request:
workflow_dispatch:

env:
TEST_COGNITO_JWT_URL: ${{ secrets.TEST_COGNITO_JWT_URL }}

jobs:
lint-backend:
runs-on: ubuntu-latest
container:
image: maven:3.9.9-amazoncorretto-21-alpine

defaults:
run:
working-directory: ./backend/application/

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Run backend linting (Checkstyle)
run: |
echo "Running backend linting..."
mvn -f ./backendService/pom.xml clean checkstyle:check
echo "Backend linting passed"

unit-test-backend:
runs-on: ubuntu-latest
needs: lint-backend
container:
image: maven:3.9.9-amazoncorretto-21-alpine

defaults:
run:
working-directory: ./backend/application/

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Prepare application.yml for tests
run: |
echo "Copying the test-application.yml into a application.yml file..."
cp ./backendService/src/main/resources/test-application.example.yml ./backendService/src/main/resources/application.yml
cp ./backendService/src/test/resources/application.example.yml ./backendService/src/test/resources/application.yml
echo "Copying completed"

- name: Run unit tests
run: |
echo "Running unit tests..."
mvn -f ./backendService/pom.xml clean test -DTEST_COGNITO_JWT_URL=$TEST_COGNITO_JWT_URL
echo "Unit tests passed"
59 changes: 59 additions & 0 deletions .github/workflows/frontend.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
name: Lint and Test Frontend
on:
pull_request:
workflow_dispatch:

jobs:
lint-frontend:
runs-on: ubuntu-latest
defaults:
run:
working-directory: ./frontend

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20.x

- name: Install dependencies
run: npm ci

- name: Set environment variables
run: |
echo "API_KEY=Test" >> $GITHUB_ENV

- name: Lint frontend
run: npm run lint

component-tests:
runs-on: ubuntu-latest
needs: lint-frontend
defaults:
run:
working-directory: ./frontend

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20.x

- name: Install dependencies
run: npm ci

- name: Set test environment variables
run: |
echo "API_KEY=Test" >> $GITHUB_ENV

- name: Cypress.io component tests
uses: cypress-io/github-action@v6.5.0
with:
working-directory: ./frontend
command: npm run cy:run:ct
24 changes: 24 additions & 0 deletions .github/workflows/infrastructure.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Infrastructure Lint
on:
pull_request:

jobs:
lint-and-security-scan-infrastructure:
runs-on: ubuntu-latest

defaults:
run:
working-directory: ./infrastructure

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Setup TFLint
uses: terraform-linters/setup-tflint@v4.1.1

- name: Initialise TFLint
run: tflint --init

- name: Run TFLint
run: tflint --recursive
28 changes: 0 additions & 28 deletions .gitlab-ci.yml

This file was deleted.

31 changes: 0 additions & 31 deletions CICD/gitlab/backend.yml

This file was deleted.

34 changes: 0 additions & 34 deletions CICD/gitlab/frontend.yml

This file was deleted.

13 changes: 0 additions & 13 deletions CICD/gitlab/terraform.yml

This file was deleted.

1 change: 0 additions & 1 deletion frontend/src/app/api/billing/payments/route.ts
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
// File: app/api/billing/subscriptions/route.ts (for App Router)
import stripe from "@/utils/stripe";
import { NextRequest, NextResponse } from "next/server";

Expand Down
1 change: 0 additions & 1 deletion frontend/src/app/api/billing/subscriptions/route.ts
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
// File: app/api/billing/subscriptions/route.ts (for App Router)
import stripe, { findExistingSubscriptionByCustomerId } from "@/utils/stripe";
import { NextRequest, NextResponse } from "next/server";
import Stripe from "stripe";
Expand Down
6 changes: 3 additions & 3 deletions frontend/src/components/ui/Sidebar.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,10 @@ export function Sidebar() {

const userBilling = useQuery(GET_USER_BILLING);
const accountId = userBilling.data?.getUserBilling?.accountId;

// Filter out the Items page from sidebar links if no account ID exists
const filteredSidebarLinks = sidebarLinks.filter(link =>
link.name !== "Items" || accountId
const filteredSidebarLinks = sidebarLinks.filter(
(link) => link.name !== "Items" || accountId,
);

return (
Expand Down
4 changes: 1 addition & 3 deletions frontend/src/utils/stripe.ts
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,7 @@ import Stripe from "stripe";
if (!process.env.STRIPE_SECRET_KEY) {
throw new Error("Stripe secret key is not configured.");
}
const stripe = new Stripe(
"sk_test_51QNhlTGlnq0aqIkWUh4pGdNEkLo6qGgkXU885vaJexq15ykuThU9JDTxo77RTjCqNxRP6QkW30y7cZEIOLEpn6KD00uBKttude",
);
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Excellent security improvement!

Moving from a hardcoded secret key to an environment variable is a significant security enhancement. The existing validation on lines 3-5 ensures the application fails fast if the environment variable isn't configured.

However, please ensure that STRIPE_SECRET_KEY is properly configured in your new GitHub Actions workflows.


🏁 Script executed:

#!/bin/bash
# Description: Verify that STRIPE_SECRET_KEY is configured in GitHub Actions workflows
# Expected: Find references to STRIPE_SECRET_KEY in workflow files

echo "Searching for STRIPE_SECRET_KEY in GitHub Actions workflows..."
fd -e yml -e yaml . .github/workflows/ --exec grep -l "STRIPE_SECRET_KEY" {}

Length of output: 213


🏁 Script executed:

#!/bin/bash
# Description: Re-run a search for STRIPE_SECRET_KEY in GitHub Actions workflows using grep for reliability
echo "Searching for STRIPE_SECRET_KEY in .github/workflows..."
grep -R "STRIPE_SECRET_KEY" -n .github/workflows || echo "No occurrences found"

Length of output: 220


Missing STRIPE_SECRET_KEY in GitHub Actions workflows

I re-ran a search across .github/workflows and found no references to STRIPE_SECRET_KEY. Without this in your workflows, jobs that initialise Stripe will fail at runtime.

• Add STRIPE_SECRET_KEY as a repository secret in GitHub.
• Update your workflow YAML files under .github/workflows/*.yml, for example:

env:
  STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
🤖 Prompt for AI Agents
In frontend/src/utils/stripe.ts at line 6, you correctly use
process.env.STRIPE_SECRET_KEY for the Stripe client initialization, but your
GitHub Actions workflows do not currently include this environment variable. To
fix this, add STRIPE_SECRET_KEY as a repository secret in GitHub, then update
your workflow YAML files in .github/workflows/ to include STRIPE_SECRET_KEY in
the env section, setting it to ${{ secrets.STRIPE_SECRET_KEY }} so that the
Stripe client can access the secret key during CI runs.

export default stripe;

/**
Expand Down
9 changes: 9 additions & 0 deletions infrastructure/remote/modules/cicd/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
terraform {
required_version = ">= 1.9"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.60.0"
}
}
}
1 change: 0 additions & 1 deletion infrastructure/remote/modules/cicd/secrets.tf
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
data "aws_region" "current" {}

resource "aws_secretsmanager_secret" "gitlab_credentials" {
name = "GITLAB_CREDENTIALS_${var.environment}"
Expand Down
5 changes: 0 additions & 5 deletions infrastructure/remote/modules/cicd/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,6 @@ variable "environment" {
}
}

variable "aws_region" {
description = "The AWS region to deploy to"
type = string
}

variable "aws_account_id" {
description = "The AWS account ID"
type = string
Expand Down
9 changes: 9 additions & 0 deletions infrastructure/remote/modules/cognito/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
terraform {
required_version = ">= 1.9"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.60.0"
}
}
}
10 changes: 10 additions & 0 deletions infrastructure/remote/modules/ecr/main.tf
Original file line number Diff line number Diff line change
@@ -1,3 +1,13 @@
terraform {
required_version = ">= 1.9"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.60.0"
}
}
}

resource "aws_ecr_repository" "ecr_repo" {
name = var.name
image_tag_mutability = "IMMUTABLE"
Expand Down
9 changes: 9 additions & 0 deletions infrastructure/remote/modules/ecs/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
terraform {
required_version = ">= 1.9"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.60.0"
}
}
}
9 changes: 9 additions & 0 deletions infrastructure/remote/modules/elasticache/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
terraform {
required_version = ">= 1.9"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.60.0"
}
}
}
5 changes: 0 additions & 5 deletions infrastructure/remote/modules/elasticache/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,6 @@ variable "environment" {
}
}

variable "availability_zones" {
description = "The availability zones for the database"
type = list(string)
}

variable "private_subnet_ids" {
description = "The IDs of the private subnets"
type = list(string)
Expand Down
2 changes: 1 addition & 1 deletion infrastructure/remote/modules/iam/ecs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ resource "aws_iam_policy" "ecs_dynamodb_admin_logs_policy" {
"dynamodb:BatchWriteItem",
"dynamodb:DescribeTable"
]
Resource = "${var.admin_access_logs_table_arn}"
Resource = var.admin_access_logs_table_arn
},

]
Expand Down
9 changes: 9 additions & 0 deletions infrastructure/remote/modules/iam/main.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
terraform {
required_version = ">= 1.9"
required_providers {
aws = {
source = "hashicorp/aws"
version = ">= 5.60.0"
}
}
}
Comment on lines +1 to +9
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Tighten Terraform & provider version constraints
Unbounded >= constraints can introduce breaking changes when Terraform 2.0 or AWS provider 6.x are released. It’s safer to pin to a minor-range, for example:

terraform {
  required_version = "~> 1.9"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
-     version = ">= 5.60.0"
+     version = "~> 5.60.0"
    }
  }
}

This prevents unintended upgrades beyond the tested provider series.

🤖 Prompt for AI Agents
In infrastructure/remote/modules/iam/main.tf lines 1 to 9, the Terraform and AWS
provider version constraints use unbounded >= operators, which can lead to
unintended upgrades and potential breaking changes. Change the required_version
from ">= 1.9" to "~> 1.9" and the AWS provider version from ">= 5.60.0" to "~>
5.60.0" to restrict upgrades to the specified minor version range and avoid
automatic major version updates.

Loading
Loading