Files
davila7__claude-code-templates/scripts/predeploy-check.sh
Daniel Avila 0e06493dbe security: Harden CI/CD and repo for open-source safety (#458)
* enhance: Improve prompt-engineer agent (automated review)

- Fix broken reasoning framework: complete Ordering field and Necessity scale
- Remove OpenAI attribution from description; add invocation example block
- Restrict tools to Read only (text-transformation agent needs no writes)
- Add XML Structure and CoT Opportunity dimensions to reasoning template
- Move meta-instruction NOTE out of output template, place as agent directive
- Fix stray markdown bold markers on Reasoning Before Conclusions guideline
- Integrate orphaned examples bullet into the Examples guideline line
- Add concrete worked example section (classify customer feedback)

Automated review cycle | Co-Authored-By: Claude Code <noreply@anthropic.com>

* security: Harden CI/CD and repo for open-source safety

- Add --ignore-scripts to all npm ci/install in CI workflows and predeploy script
- Fix shell injection in discord-release-notification (use env vars + jq for payload)
- Add explicit permissions to all workflows (least privilege principle)
- Add root .npmrc with ignore-scripts=true
- Add .github/dependabot.yml for automated dependency security updates
- Add .github/CODEOWNERS to protect workflows, scripts, and API paths
- Expand .gitignore with *.pem, *.key, credentials.json patterns

* fix: Grant contents:read to deploy workflow so checkout works

Cubic correctly flagged that permissions: {} blocks actions/checkout.
2026-03-26 19:19:39 -04:00

232 lines
5.0 KiB
Bash
Executable File
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
#!/bin/bash
# Pre-Deployment Validation Script
# This script MUST pass before deploying to production
set -e # Exit on any error
echo "🚀 Pre-Deployment Validation Check"
echo "=================================="
echo ""
# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# Counter
TESTS_PASSED=0
TESTS_FAILED=0
# Function to print success
success() {
echo -e "${GREEN}${NC} $1"
((TESTS_PASSED++))
}
# Function to print error
error() {
echo -e "${RED}${NC} $1"
((TESTS_FAILED++))
}
# Function to print warning
warning() {
echo -e "${YELLOW}${NC} $1"
}
# Function to print info
info() {
echo -e "${BLUE}${NC} $1"
}
echo "Step 1: Checking Git Status"
echo "----------------------------"
# Check if we're in a git repository
if ! git rev-parse --git-dir > /dev/null 2>&1; then
error "Not a git repository"
exit 1
else
success "Git repository detected"
fi
# Check for uncommitted changes
if [[ -n $(git status -s) ]]; then
warning "There are uncommitted changes"
git status -s
echo ""
read -p "Continue anyway? (y/N) " -n 1 -r
echo
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
exit 1
fi
else
success "No uncommitted changes"
fi
echo ""
echo "Step 2: Checking Node.js & npm"
echo "-------------------------------"
# Check Node.js version
if command -v node &> /dev/null; then
NODE_VERSION=$(node --version)
success "Node.js ${NODE_VERSION} installed"
else
error "Node.js not found"
exit 1
fi
# Check npm
if command -v npm &> /dev/null; then
NPM_VERSION=$(npm --version)
success "npm ${NPM_VERSION} installed"
else
error "npm not found"
exit 1
fi
echo ""
echo "Step 3: Installing/Updating Dependencies"
echo "-----------------------------------------"
# Install root dependencies
if [ -f "package.json" ]; then
info "Installing root dependencies..."
if npm install --silent --ignore-scripts; then
success "Root dependencies installed"
else
error "Failed to install root dependencies"
exit 1
fi
fi
# Install API dependencies
if [ -f "api/package.json" ]; then
info "Installing API dependencies..."
cd api
if npm install --silent --ignore-scripts; then
success "API dependencies installed"
else
error "Failed to install API dependencies"
exit 1
fi
cd ..
fi
echo ""
echo "Step 4: Running API Tests"
echo "-------------------------"
cd api
# Run critical API tests
info "Running critical endpoint tests..."
if npm run test:api --silent; then
success "All API tests passed"
else
error "API tests failed"
echo ""
echo "Fix the failing tests before deploying!"
exit 1
fi
cd ..
echo ""
echo "Step 5: Checking API File Structure"
echo "------------------------------------"
# Check critical API endpoints exist
CRITICAL_ENDPOINTS=(
"api/track-download-supabase.js"
"api/discord/interactions.js"
"api/claude-code-check.js"
)
for endpoint in "${CRITICAL_ENDPOINTS[@]}"; do
if [ -f "$endpoint" ]; then
success "$(basename $endpoint) exists"
else
error "$(basename $endpoint) NOT FOUND - Critical endpoint missing!"
exit 1
fi
done
echo ""
echo "Step 6: Validating Environment Variables"
echo "-----------------------------------------"
# Check if .env.example exists
if [ -f ".env.example" ]; then
success ".env.example file exists"
# Extract required variables
REQUIRED_VARS=$(grep -E "^[A-Z_]+=" .env.example | cut -d'=' -f1 | sort | uniq)
info "Required environment variables:"
echo "$REQUIRED_VARS" | while read var; do
echo " - $var"
done
echo ""
warning "Make sure these are set in Vercel Dashboard"
else
warning ".env.example not found"
fi
echo ""
echo "Step 7: Vercel Configuration Check"
echo "-----------------------------------"
# Check vercel.json
if [ -f "vercel.json" ]; then
success "vercel.json exists"
# Validate it's valid JSON
if jq empty vercel.json 2>/dev/null; then
success "vercel.json is valid JSON"
else
error "vercel.json is invalid JSON"
exit 1
fi
else
warning "vercel.json not found"
fi
echo ""
echo "Step 8: Final Checks"
echo "--------------------"
# Check if vercel CLI is installed
if command -v vercel &> /dev/null; then
VERCEL_VERSION=$(vercel --version)
success "Vercel CLI ${VERCEL_VERSION} installed"
else
warning "Vercel CLI not installed (install with: npm i -g vercel)"
fi
# Summary
echo ""
echo "=================================="
echo "Pre-Deployment Check Summary"
echo "=================================="
echo -e "${GREEN}Passed: ${TESTS_PASSED}${NC}"
echo -e "${RED}Failed: ${TESTS_FAILED}${NC}"
echo ""
if [ $TESTS_FAILED -eq 0 ]; then
echo -e "${GREEN}✓ All checks passed! Ready to deploy.${NC}"
echo ""
echo "Deploy with:"
echo " vercel --prod"
echo ""
exit 0
else
echo -e "${RED}✗ Some checks failed. Fix issues before deploying.${NC}"
echo ""
exit 1
fi