Initial commit

scripts/build.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+export REACT_APP_GIT_SHA=$(git rev-parse --short HEAD)
+export BUILD_DOMAIN=$(test -e .domains && cat .domains)
+[ -n "$BUILD_EXPIRE" ] && export REACT_APP_BUILD_EXPIRE=$(date -d "+${BUILD_EXPIRE}" +%s000)
+
+yarn build

scripts/validate_commit.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const chalk = require('chalk');
+const validate = require('@openware/coding-standards/dist').isCommitMsgValid;
+
+const main = argv => {
+    const msgFile = process.env.HUSKY_GIT_PARAMS || argv[2];
+    if (!msgFile) {
+        return 0;
+    }
+
+    const lines = fs.readFileSync(msgFile).toString()
+        .split('\n')
+        .map(x => x.trim())
+        .filter(x => x.length !== 0 && !x.startsWith('#') && !x.startsWith('Co-authored-by:'));
+
+    for (line of lines) {
+        const { right } = validate(line);
+        if (right) {
+            console.error(`
+${chalk.red(right)}: ${line}
+
+Please read the commit message guidelines: ${chalk.blue.bold('http://chris.beams.io/posts/git-commit/')}
+`);
+            return 1;
+        }
+    }
+    return 0;
+};
+
+process.exit(main(process.argv));

scripts/verify-security-pins.ps1

@@ -0,0 +1,47 @@
+# Verify phase-1/2 minimum package versions in yarn.lock (Windows-native).
+param(
+    [string]$LockFile = "yarn.lock"
+)
+
+$ErrorActionPreference = "Stop"
+
+function Test-SemverGe([string]$Actual, [string]$Minimum) {
+    $a = $Actual -split '\.'
+    $m = $Minimum -split '\.'
+    for ($i = 0; $i -lt [Math]::Max($a.Length, $m.Length); $i++) {
+        $av = if ($i -lt $a.Length) { [int]$a[$i] } else { 0 }
+        $mv = if ($i -lt $m.Length) { [int]$m[$i] } else { 0 }
+        if ($av -gt $mv) { return $true }
+        if ($av -lt $mv) { return $false }
+    }
+    return $true
+}
+
+function Get-YarnVersion([string]$Content, [string]$PackagePattern) {
+    if ($Content -match "(?ms)^${PackagePattern}:\r?\n  version `"([^`"]+)`"") {
+        return $Matches[1]
+    }
+    return $null
+}
+
+if (-not (Test-Path $LockFile)) {
+    Write-Error "Lock file not found: $LockFile"
+}
+
+Write-Host "Checking $LockFile..."
+$content = Get-Content -Raw -Path $LockFile
+
+$axios = Get-YarnVersion $content 'axios@\^0\.32\.0'
+if (-not $axios -or -not (Test-SemverGe $axios "0.32.0")) {
+    $label = if ($axios) { $axios } else { "missing" }
+    Write-Error "FAIL: axios $label < 0.32.0"
+}
+Write-Host "  OK axios $axios (>= 0.32.0)"
+
+$ws = Get-YarnVersion $content 'ws@\^7\.5\.10'
+if (-not $ws -or -not (Test-SemverGe $ws "7.5.10")) {
+    $label = if ($ws) { $ws } else { "missing" }
+    Write-Error "FAIL: ws $label < 7.5.10"
+}
+Write-Host "  OK ws $ws (>= 7.5.10)"
+Write-Host "Security pin verification passed."

scripts/verify-security-pins.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Verify phase-1/2 minimum security gem/package versions in lockfiles.
+set -euo pipefail
+
+semver_ge() {
+  printf '%s\n%s\n' "$2" "$1" | sort -V | head -1 | grep -qx "$2"
+}
+
+check_gemfile_lock() {
+  local file=$1 name min
+  echo "Checking ${file}..."
+  while read -r name min; do
+    [[ -z "$name" ]] && continue
+    local ver
+    ver=$(grep -E "^    ${name} \(" "$file" | head -1 | sed -E 's/.*\(([0-9][0-9.a-z-]*).*/\1/' || true)
+    if [[ -z "$ver" ]]; then
+      echo "FAIL: ${name} not found in ${file}"
+      exit 1
+    fi
+    if ! semver_ge "$ver" "$min"; then
+      echo "FAIL: ${name} ${ver} < required ${min} in ${file}"
+      exit 1
+    fi
+    echo "  OK ${name} ${ver} (>= ${min})"
+  done <<'GEMS'
+rack 2.2.13
+nokogiri 1.13.10
+rexml 3.3.9
+tzinfo 1.2.10
+rails-html-sanitizer 1.4.4
+GEMS
+  if grep -qE '^    sidekiq \(' "$file"; then
+    local sidekiq_ver
+    sidekiq_ver=$(grep -E '^    sidekiq \(' "$file" | head -1 | sed -E 's/.*\(([0-9][0-9.a-z-]*).*/\1/')
+    if ! semver_ge "$sidekiq_ver" "6.4.0"; then
+      echo "FAIL: sidekiq ${sidekiq_ver} < required 6.4.0 in ${file}"
+      exit 1
+    fi
+    echo "  OK sidekiq ${sidekiq_ver} (>= 6.4.0)"
+  fi
+}
+
+check_yarn_lock() {
+  local file=$1
+  echo "Checking ${file}..."
+  local axios ws
+  axios=$(grep -A1 '^axios@\^0\.32' "$file" | grep 'version "' | head -1 | sed -E 's/.*version "([^"]+)".*/\1/')
+  ws=$(grep -A1 '^ws@\^7\.5' "$file" | grep 'version "' | head -1 | sed -E 's/.*version "([^"]+)".*/\1/')
+  if [[ -z "$axios" ]] || ! semver_ge "$axios" "0.32.0"; then
+    echo "FAIL: axios ${axios:-missing} < 0.32.0"
+    exit 1
+  fi
+  echo "  OK axios ${axios} (>= 0.32.0)"
+  if [[ -z "$ws" ]] || ! semver_ge "$ws" "7.5.10"; then
+    echo "FAIL: ws ${ws:-missing} < 7.5.10"
+    exit 1
+  fi
+  echo "  OK ws ${ws} (>= 7.5.10)"
+}
+
+case "${1:-}" in
+  ruby)
+    check_gemfile_lock "${2:-Gemfile.lock}"
+    ;;
+  yarn)
+    check_yarn_lock "${2:-yarn.lock}"
+    ;;
+  *)
+    echo "Usage: $0 ruby [Gemfile.lock] | yarn [yarn.lock]"
+    exit 1
+    ;;
+esac
+
+echo "Security pin verification passed."