testio-tailwind 0.1.0 → 0.2.1

package/.circleci/config.yml

@@ -0,0 +1,217 @@
+version: 2.1
+
+orbs:
+  gcp-cli: circleci/gcp-cli@3.3.0
+
+executors:
+  cci-base:
+    docker:
+    - image: cimg/base:stable
+  cci-node:
+    docker:
+    - image: cimg/node:21.6.2
+  cci-deploy:
+    docker:
+    - image: cimg/deploy:2025.01
+
+commands:
+  gcp-oidc-authenticate:
+    description: "Create GCP credentials file from CircleCI OIDC token and use it to authenticate to our GCP project"
+    steps:
+      - run:
+          name: Create GCP credentials file from OIDC token and use it for authentication
+          command: |
+            echo $CIRCLE_OIDC_TOKEN > ${HOME}/oidc_token.json # store OIDC token in a file
+            gcloud iam workload-identity-pools create-cred-config \
+              "projects/${GCP_PROJECT_ID}/locations/global/workloadIdentityPools/${GCP_WIP_ID}/providers/${GCP_WIP_PROVIDER_ID}" \
+              --credential-source-file=${HOME}/oidc_token.json \
+              --service-account="${GCP_SERVICE_ACCOUNT_EMAIL}" \
+              --output-file=${HOME}/gcp_cred_config.json
+            gcloud auth login --brief --cred-file ${HOME}/gcp_cred_config.json
+            echo "export GOOGLE_APPLICATION_CREDENTIALS=${HOME}/gcp_cred_config.json" >> $BASH_ENV # configure ADC
+
+jobs:
+  build:
+    executor: cci-base
+    environment:
+      IMAGE: eu.gcr.io/oi-tset/tw-designsystem
+    steps:
+      - checkout
+      - gcp-cli/install
+      - gcp-oidc-authenticate
+      - setup_remote_docker:
+          docker_layer_caching: true
+      - run:
+          name: Setup access to the registry
+          command: gcloud auth configure-docker eu.gcr.io,europe-west3-docker.pkg.dev --quiet
+      - run:
+          name: Build application image
+          command: docker build -t $IMAGE:$CIRCLE_SHA1 .
+      - run:
+          name: Push image to the registry
+          command: docker push $IMAGE:$CIRCLE_SHA1
+
+  test:
+    executor: cci-node
+    steps:
+      - checkout
+      - restore_cache:
+          keys:
+          - v1-dependencies-{{ checksum "package.json" }}
+          - v1-dependencies-
+      - run: npm install
+      - save_cache:
+          key: v1-dependencies-{{ checksum "package.json" }}
+          paths:
+            - node_modules
+
+  publish:
+    executor: cci-node
+    working_directory: ~/repo
+    steps:
+      - checkout
+      - gcp-cli/install
+      - gcp-oidc-authenticate
+      - run:
+          name: Fetch npmjs publishing token and auth with the registry
+          command: |
+            export npm_TOKEN=$(gcloud secrets versions access latest --secret="npmjs-publish-token" --project=oi-tset --quiet) && \
+            echo "//registry.npmjs.org/:_authToken=$npm_TOKEN" > ~/repo/.npmrc
+      - run:
+          name: Publish NPM package
+          command: |
+            PACKAGE_VERSION=$(node -p -e "require('./package.json').version")
+            PACKAGE_NAME=$(node -p -e "require('./package.json').name")
+            FOUND_VERSION=$(npm view "$PACKAGE_NAME" version)
+            if [ "$PACKAGE_VERSION" == "$FOUND_VERSION" ]; then
+              echo "Cannot publish over the previously published version: $FOUND_VERSION."
+              exit 0
+            fi
+            npm publish
+
+  deploy:
+    executor: cci-deploy
+    environment:
+      HELM_CHART: tw-designsystem
+      GKE_CLUSTER: private-cluster
+      IMAGE: eu.gcr.io/oi-tset/tw-designsystem
+    steps:
+      - checkout
+      - gcp-cli/install
+      - gcp-oidc-authenticate
+      - run:
+          name: Copy deploy script
+          command: gsutil cp gs://helm_repo/scripts/deploy_from_helm_repo.sh .
+      - run:
+          name: Install required plugin
+          command: gcloud components install gke-gcloud-auth-plugin --quiet
+      - run:
+          name: Helm upgrade
+          command: bash ./deploy_from_helm_repo.sh
+          no_output_timeout: 25m
+      - run:
+          name: Add tag to the image in registry
+          command: gcloud container images add-tag $IMAGE:$CIRCLE_SHA1 $IMAGE:$CIRCLE_BRANCH --quiet
+
+  defectdojo:
+    executor: cci-base
+    environment:
+      IMAGE: eu.gcr.io/oi-tset/tw-designsystem
+      DEFECTDOJO_URL: defectdojo.testcloud.io
+      DEFECTDOJO_PRODUCT: Tailwind Designsystem
+      DEFECTDOJO_ENG_NAME: CircleCI Scan
+    circleci_ip_ranges: true
+    steps:
+      - checkout
+      - gcp-cli/install
+      - gcp-oidc-authenticate
+      - run:
+          name: Install Trivy and Gitleaks
+          command: |
+            curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b $HOME/bin
+            curl -L https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz -o $HOME/gitleaks.tar.gz
+            tar -xzf $HOME/gitleaks.tar.gz
+      - run:
+          name: Scans
+          command: |
+            trivy fs --exit-code 0 --no-progress --format json --output filesystem-scan.json .
+            trivy i --exit-code 0 --no-progress --format json --output image-scan.json $IMAGE:main
+            ./gitleaks detect --no-git --exit-code 0 --report-format json --report-path gitleaks.json
+      - run:
+          name: Send data to DefectDojo - Trivy filesystem scan
+          command: |
+            gcloud secrets versions access latest --secret="defectdojo_token" --project=oi-tset --quiet > DEFECTDOJO_TOKEN
+
+            curl --fail --request POST https://$DEFECTDOJO_URL/api/v2/reimport-scan/ \
+            --header "Authorization: Token $(< DEFECTDOJO_TOKEN)" \
+            --form "active=true" \
+            --form "auto_create_context=true" \
+            --form "branch_tag=${CIRCLE_BRANCH}" \
+            --form "commit_hash=${CIRCLE_SHA1}" \
+            --form "close_old_findings=true" \
+            --form "scan_type=Trivy Scan" \
+            --form "test_title=Trivy application scan" \
+            --form "engagement_name=${DEFECTDOJO_ENG_NAME}" \
+            --form "product_name=${DEFECTDOJO_PRODUCT}" \
+            --form "file=@filesystem-scan.json"
+      - run:
+          name: Send data to DefectDojo - Trivy image scan
+          command: |
+            curl --fail --request POST https://$DEFECTDOJO_URL/api/v2/reimport-scan/ \
+            --header "Authorization: Token $(< DEFECTDOJO_TOKEN)" \
+            --form "active=true" \
+            --form "auto_create_context=true" \
+            --form "branch_tag=${CIRCLE_BRANCH}" \
+            --form "commit_hash=${CIRCLE_SHA1}" \
+            --form "close_old_findings=true" \
+            --form "scan_type=Trivy Scan" \
+            --form "test_title=Trivy container image scan" \
+            --form "engagement_name=${DEFECTDOJO_ENG_NAME}" \
+            --form "product_name=${DEFECTDOJO_PRODUCT}" \
+            --form "file=@image-scan.json"
+      - run:
+          name: Send data to DefectDojo - Gitleaks scan
+          command: |
+            curl --fail --request POST https://$DEFECTDOJO_URL/api/v2/reimport-scan/ \
+            --header "Authorization: Token $(< DEFECTDOJO_TOKEN)" \
+            --form "active=true" \
+            --form "auto_create_context=true" \
+            --form "branch_tag=${CIRCLE_BRANCH}" \
+            --form "commit_hash=${CIRCLE_SHA1}" \
+            --form "close_old_findings=true" \
+            --form "scan_type=Gitleaks Scan" \
+            --form "test_title=Gitleaks Scan" \
+            --form "engagement_name=${DEFECTDOJO_ENG_NAME}" \
+            --form "product_name=${DEFECTDOJO_PRODUCT}" \
+            --form "file=@gitleaks.json"
+
+workflows:
+  workflow:
+    jobs:
+      - build:
+          context: gcp-production
+      - test
+      - publish:
+          requires:
+            - test
+          filters:
+            branches:
+              only: main
+          context: gcp-production
+      - deploy:
+          requires:
+            - build
+          filters:
+            branches:
+              only: main
+          context: gcp-production
+  security_scan:
+    jobs:
+      - defectdojo:
+          context: gcp-production
+    triggers:
+      - schedule:
+          cron: "20 4 * * 0"
+          filters:
+            branches:
+              only: main

package/.dockerignore

@@ -0,0 +1,4 @@
+node_modules
+npm-debug.log
+Dockerfile
+.dockerignore

package/.eleventy.js

@@ -1,57 +1,57 @@
-const filters = require('./utils/filters.js')
-const transforms = require('./utils/transforms.js')
-const collections = require('./utils/collections.js')
-const markdownIt = require('./utils/markdown.js');
-const appConfigs = {
-  cirro: { output: "dist/" }
-}
-
-module.exports = function (eleventyConfig) {
-    // Folders to copy to build dir (See. 1.1)
-    eleventyConfig.addPassthroughCopy({
-        "src/static/site.webmanifest": "", 
-        "src/static/*": "static", 
-        "src/assets/fonts/*": "assets/fonts",
-        "src/static/downloads/*": "downloads",
-        "src/assets/images/*": "assets/images"
-    })
-
-    // Filters 
-    Object.keys(filters).forEach((filterName) => {
-        eleventyConfig.addFilter(filterName, filters[filterName])
-    })
-
-    // Transforms
-    Object.keys(transforms).forEach((transformName) => {
-        eleventyConfig.addTransform(transformName, transforms[transformName])
-    })
-
-    // Collections
-    Object.keys(collections).forEach((collectionName) => {
-        eleventyConfig.addCollection(collectionName, collections[collectionName])
-    })
-
-    // This allows Eleventy to watch for file changes during local development.
-    eleventyConfig.setUseGitIgnore(false);
-
-    eleventyConfig.addShortcode('tag', (arg) => `<div>${arg}</div>`);
-    eleventyConfig.addPairedShortcode('tag', (children) => `<div class="markdown">${children}</div>`);
-
-    let haml = require("hamljs");
-	eleventyConfig.setLibrary("haml", haml);
-    eleventyConfig.setLibrary('md', markdownIt);
-
-    return {
-        dir: {
-            input: "src",
-            output: appConfigs[process.env.APP].output,
-            includes: "_includes",
-            layouts: "_layouts"
-        },
-        templateFormats: ["html", "md", "njk", "pug", "haml", "png", "svg", "eot", "ttf", "woff", "woff2", "jpg", "otf"],
-        htmlTemplateEngine: "njk",
-
-        // 1.1 Enable eleventy to pass dirs specified above
-        passthroughFileCopy: true
-    };
-};
+const filters = require('./utils/filters.js')
+const transforms = require('./utils/transforms.js')
+const collections = require('./utils/collections.js')
+const markdownIt = require('./utils/markdown.js');
+const appConfigs = {
+  cirro: { output: "dist/" }
+}
+
+module.exports = function (eleventyConfig) {
+    // Folders to copy to build dir (See. 1.1)
+    eleventyConfig.addPassthroughCopy({
+        "src/static/site.webmanifest": "", 
+        "src/static/*": "static", 
+        "src/assets/fonts/*": "assets/fonts",
+        "src/static/downloads/*": "downloads",
+        "src/assets/images/*": "assets/images"
+    })
+
+    // Filters 
+    Object.keys(filters).forEach((filterName) => {
+        eleventyConfig.addFilter(filterName, filters[filterName])
+    })
+
+    // Transforms
+    Object.keys(transforms).forEach((transformName) => {
+        eleventyConfig.addTransform(transformName, transforms[transformName])
+    })
+
+    // Collections
+    Object.keys(collections).forEach((collectionName) => {
+        eleventyConfig.addCollection(collectionName, collections[collectionName])
+    })
+
+    // This allows Eleventy to watch for file changes during local development.
+    eleventyConfig.setUseGitIgnore(false);
+
+    eleventyConfig.addShortcode('tag', (arg) => `<div>${arg}</div>`);
+    eleventyConfig.addPairedShortcode('tag', (children) => `<div class="markdown">${children}</div>`);
+
+    let haml = require("hamljs");
+	eleventyConfig.setLibrary("haml", haml);
+    eleventyConfig.setLibrary('md', markdownIt);
+
+    return {
+        dir: {
+            input: "src",
+            output: appConfigs[process.env.APP].output,
+            includes: "_includes",
+            layouts: "_layouts"
+        },
+        templateFormats: ["html", "md", "njk", "pug", "haml", "png", "svg", "eot", "ttf", "woff", "woff2", "jpg", "otf"],
+        htmlTemplateEngine: "njk",
+
+        // 1.1 Enable eleventy to pass dirs specified above
+        passthroughFileCopy: true
+    };
+};

package/Dockerfile

@@ -0,0 +1,27 @@
+FROM europe-west3-docker.pkg.dev/oi-tset/hub/node:18-alpine
+
+ARG APP_UID=5123
+ARG USER=appuser
+ARG GROUP=appgroup
+
+RUN addgroup -S ${GROUP} -g $APP_UID && adduser -S ${USER} -G ${GROUP} -u $APP_UID
+
+USER ${USER}
+
+WORKDIR /home/${USER}/app
+
+COPY --chown=${USER}:${GROUP} package*.json ./
+
+RUN mkdir -p /home/${USER}/app/node_modules && \
+    npm install && \
+    npm install http-server
+
+COPY --chown=${USER}:${GROUP} . ./
+
+RUN npm run build
+
+EXPOSE 8080
+
+CMD [ "/home/appuser/app/node_modules/http-server/bin/http-server", "dist" ]
+
+HEALTHCHECK NONE

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2020 Chris Collins
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2020 Chris Collins
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,43 +1,43 @@
-# Translation Space Designsystem
-
-[![CircleCI](https://dl.circleci.com/status-badge/img/gh/test-IO/translation-space-designsystem/tree/main.svg?style=svg&circle-token=60adcec1eb4c2df56fede063ffe512971f103889)](https://dl.circleci.com/status-badge/redirect/gh/test-IO/translation-space-designsystem/tree/main)
-
---- (Live deployment)
-
-
-## Development
-
-### Requirements
-
-1. Node.js
-2. NPM (comes with Node.js)
-
-### Install dependencies
-
-```sh
-npm i
-```
-
-### Working locally
-
-Starts watch tasks to compile when changes detected
-
-```sh
-npm start
-```
-
-### Creating a production build
-
-Minify HTML, compress JS, inline and minify CSS.
-
-```sh
-npm run build
-```
-
----
-
-### Publishing to registry
-
-* Make sure to update the version number in package.json file for every pull request
-* CircleCI will take care of publishing to npm and also adding a tag when the commits are merged to master
-* CircleCI will publish it only if the package version has been increased
+# Translation Space Designsystem
+
+[![CircleCI](https://dl.circleci.com/status-badge/img/gh/test-IO/translation-space-designsystem/tree/main.svg?style=svg&circle-token=60adcec1eb4c2df56fede063ffe512971f103889)](https://dl.circleci.com/status-badge/redirect/gh/test-IO/translation-space-designsystem/tree/main)
+
+--- (Live deployment)
+
+
+## Development
+
+### Requirements
+
+1. Node.js
+2. NPM (comes with Node.js)
+
+### Install dependencies
+
+```sh
+npm i
+```
+
+### Working locally
+
+Starts watch tasks to compile when changes detected
+
+```sh
+npm start
+```
+
+### Creating a production build
+
+Minify HTML, compress JS, inline and minify CSS.
+
+```sh
+npm run build
+```
+
+---
+
+### Publishing to registry
+
+* Make sure to update the version number in package.json file for every pull request
+* CircleCI will take care of publishing to npm and also adding a tag when the commits are merged to master
+* CircleCI will publish it only if the package version has been increased

package/icon-classes-extractor.js

@@ -1,29 +1,29 @@
-const fs = require('fs');
-const readline = require('readline');
-
-async function extractIconClasses(app) {
-  const fileStream = fs.createReadStream('src/assets/stylesheets/components/iconfont.css');
-
-  const rl = readline.createInterface({
-    input: fileStream,
-    crlfDelay: Infinity
-  });
-
-  const iconClasses = [];
-
-  for await (const line of rl) {
-    if (line.startsWith('.icon-'))
-      iconClasses.push(line.split(':')[0].replace('.', ''));
-  }
-
-  fs.writeFile('src/static/icons-' + app + '.json', JSON.stringify(iconClasses), err => {
-    if (err) {
-        console.log('Error writing file', err)
-    } else {
-        console.log('Successfully extracted icon classes')
-    }
-  });
-}
-
-extractIconClasses('cirro');
-
+const fs = require('fs');
+const readline = require('readline');
+
+async function extractIconClasses(app) {
+  const fileStream = fs.createReadStream('src/assets/stylesheets/components/iconfont.css');
+
+  const rl = readline.createInterface({
+    input: fileStream,
+    crlfDelay: Infinity
+  });
+
+  const iconClasses = [];
+
+  for await (const line of rl) {
+    if (line.startsWith('.icon-'))
+      iconClasses.push(line.split(':')[0].replace('.', ''));
+  }
+
+  fs.writeFile('src/static/icons-' + app + '.json', JSON.stringify(iconClasses), err => {
+    if (err) {
+        console.log('Error writing file', err)
+    } else {
+        console.log('Successfully extracted icon classes')
+    }
+  });
+}
+
+extractIconClasses('cirro');
+