Move alarms to Terraform #220
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| name: Run Unit Tests | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| env: | ||
| HUSKY: "0" | ||
|
|
||
| - name: Set up Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22.x | ||
| cache: "yarn" | ||
|
|
||
| - name: Setup Terraform | ||
| uses: hashicorp/setup-terraform@v2 | ||
| with: | ||
| terraform_version: 1.12.2 | ||
|
|
||
| - name: Restore Yarn Cache | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: node_modules | ||
| key: yarn-modules-${{ runner.arch }}-${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}-dev | ||
| restore-keys: | | ||
| yarn-modules-${{ runner.arch }}-${{ runner.os }}- | ||
|
|
||
| - name: Run unit testing | ||
| run: make test_unit | ||
|
|
||
| build: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the issue, we will add an explicit permissions block to the test and build jobs. These jobs only require read access to the repository contents, so we will set contents: read as the permission. This ensures that the jobs do not have unnecessary write access, reducing the risk of unintended modifications.
| @@ -8,2 +8,4 @@ | ||
| test: | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
| @@ -39,2 +41,4 @@ | ||
| build: | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-24.04-arm |
| runs-on: ubuntu-24.04-arm | ||
| timeout-minutes: 15 | ||
| name: Build Application | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| env: | ||
| HUSKY: "0" | ||
|
|
||
| - name: Set up Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22.x | ||
| cache: "yarn" | ||
|
|
||
| - name: Restore Yarn Cache | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: node_modules | ||
| key: yarn-modules-${{ runner.arch }}-${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}-prod | ||
| restore-keys: | | ||
| yarn-modules-${{ runner.arch }}-${{ runner.os }}- | ||
|
|
||
| - name: Run build | ||
| run: make build | ||
| env: | ||
| HUSKY: "0" | ||
| VITE_RUN_ENVIRONMENT: prod | ||
| RunEnvironment: prod | ||
| VITE_BUILD_HASH: ${{ github.sha }} | ||
|
|
||
| - name: Upload Build files | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| include-hidden-files: true | ||
| name: build-prod | ||
| path: | | ||
| .aws-sam/ | ||
| dist/ | ||
| dist_ui/ | ||
|
|
||
| deploy-prod: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the issue, we will add a permissions block to the build job. This block will explicitly define the minimal permissions required for the job to function correctly. Based on the steps in the build job, it primarily requires read access to the repository contents and the ability to upload artifacts. Therefore, we will set contents: read and actions: write permissions.
| @@ -42,2 +42,5 @@ | ||
| name: Build Application | ||
| permissions: | ||
| contents: read | ||
| actions: write | ||
| steps: |
Also remove old resources from cloudformation