Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(mojaloop/#2092)!: upgrade nodeJS version for core services #125

Merged
merged 12 commits into from
May 19, 2022
341 changes: 268 additions & 73 deletions .circleci/config.yml

Large diffs are not rendered by default.

2 changes: 0 additions & 2 deletions .eslintignore

This file was deleted.

31 changes: 0 additions & 31 deletions .eslintrc

This file was deleted.

6 changes: 6 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -65,3 +65,9 @@ typings/

# VSCode directory
.vscode

# General files to ignore
*IGNORE*

# Ignore test results
**/test/results/*
6 changes: 6 additions & 0 deletions .ncurc.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
module.exports = {
reject: [
// TODO: Upgrading tape to v5+ causes tests to fail due to assert.end() being called multiple times. Will need to address this! Perhaps even move to Jest?
"tape"
]
}
5 changes: 0 additions & 5 deletions .ncurc.json

This file was deleted.

2 changes: 1 addition & 1 deletion .nvmrc
Original file line number Diff line number Diff line change
@@ -1 +1 @@
10.15.1
16.15.0
mdebarros marked this conversation as resolved.
Show resolved Hide resolved
48 changes: 48 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -12,3 +12,51 @@ Streaming library for central services

### Kafka
Refer to documentation in [src/kafka/readme.md](./src/kafka/readme.md)

## Auditing Dependencies

We use `npm-audit-resolver` along with `npm audit` to check dependencies for node vulnerabilities, and keep track of resolved dependencies with an `audit-resolve.json` file.

To start a new resolution process, run:

```bash
npm run audit:resolve
```

You can then check to see if the CI will pass based on the current dependencies with:

```bash
npm run audit:check
```

And commit the changed `audit-resolve.json` to ensure that CircleCI will build correctly.

## Automated Releases

As part of our CI/CD process, we use a combination of CircleCI, standard-version
npm package and github-release CircleCI orb to automatically trigger our releases
and image builds. This process essentially mimics a manual tag and release.

On a merge to master, CircleCI is configured to use the mojaloopci github account
to push the latest generated CHANGELOG and package version number.

Once those changes are pushed, CircleCI will pull the updated master, tag and
push a release triggering another subsequent build that also publishes a docker image.

### Potential problems

* There is a case where the merge to master workflow will resolve successfully, triggering
a release. Then that tagged release workflow subsequently failing due to the image scan,
audit check, vulnerability check or other "live" checks.

This will leave master without an associated published build. Fixes that require
a new merge will essentially cause a skip in version number or require a clean up
of the master branch to the commit before the CHANGELOG and bump.

This may be resolved by relying solely on the previous checks of the
merge to master workflow to assume that our tagged release is of sound quality.
We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier
is a boon.

* It is unknown if a race condition might occur with multiple merges with master in
quick succession, but this is a suspected edge case.
Loading