feat: service layering and platform hardening - #1
Merged
Conversation
Apply type-aware ESLint rules only to TypeScript sources. Scope lint-staged ESLint to TS and wire commitlint through husky.
Centralize compiler options so apps and packages share a strict baseline.
Align root package scripts and dependencies with the layered service layout.
Keep local secrets and generated outputs out of version control.
Automate dependency update PRs for npm and github actions.
Drop type-aware and import plugins from the default lint path. Keep eslint --fix on typescript while tsc remains the type gate.
Introduce shared ecosystem types and tests used across upgrade workflows.
Centralize environment and secret resolution for services with unit coverage.
Provide a reusable http application kernel and security helpers for node services.
Tighten qualify and pipeline workflows for the layered service layout. Keep verify-implementation aligned with current packages and apps.
Refresh codeql path settings for the current monorepo layout.
Split the controller into app, application, infrastructure, and route layers. Add integration and property tests around upgrade orchestration.
Introduce patch application routes backed by a dedicated service and repository. Add integration coverage for patch generation flows.
Capture dependency upgrade domain concepts used by webhook processing.
Handle signed webhook intake through application services and a job queue. Add integration and property tests for webhook domain behavior.
Define environment-specific compose stacks for non-local deployments.
Provide production images for node services and the rust worker.
Expand bootstrap sql for upgrade and patch persistence needs.
Add overview dashboards and provisioning so local observability starts consistently.
Ship namespace, workload, and kind cluster configs for local kubernetes bring-up.
Automate image build/deploy flows and kind-based local cluster setup.
Provide a repeatable local entrypoint for dependency and security checks.
Align the patch helper with the new ai-service interfaces.
Strengthen failure injection coverage for worker resilience validation.
Add a workflow-style chaos experiment for end-to-end worker recovery checks.
Explain how to run and interpret worker chaos scenarios.
Describe staging and production deployment paths for the platform.
Document required environment variables and secret handling expectations.
Capture the layered service architecture and package boundaries.
Record measurable quality and delivery signals for the platform.
Propose the shared http kernel design adopted by node services.
Update validation steps to match the hardened workflows and layout.
Document the current honesty boundary for observability terraform modules.
Remove root-level upgrade tests now owned by service packages. Add a tests readme that points to the new locations.
Avoid rust 2015 parse failures when formatting worker sources outside cargo.
Update the rust worker crate and http entrypoints for the layered platform.
Provide safe example env files for local, staging, and production setup.
Refresh project entry docs for the layered services and contribution workflow.
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 34880974 | Triggered | Generic Password | cfe2108 | docker-compose.staging.yml | View secret |
| 34880974 | Triggered | Generic Password | cfe2108 | docker-compose.prod.yml | View secret |
| 34880974 | Triggered | Generic Password | cfe2108 | docker-compose.staging.yml | View secret |
| 34880974 | Triggered | Generic Password | cfe2108 | docker-compose.prod.yml | View secret |
| 34880974 | Triggered | Generic Password | cfe2108 | docker-compose.prod.yml | View secret |
| 34880974 | Triggered | Generic Password | cfe2108 | docker-compose.staging.yml | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan