feat!: upgrade ci, image, packages, audit

.ncurc.yaml

@@ -0,0 +1,2 @@
+## Add a TODO comment indicating the reason for each rejected dependency upgrade added to this list, and what should be done to resolve it (i.e. handle it through a story, etc).
+reject: []

.nvmrc

@@ -0,0 +1 @@
+16.15.0

CODEOWNERS

@@ -0,0 +1,5 @@
+# These owners will be the default owners for everything in
+# the repo. Unless a later match takes precedence,
+# The below users will be requested for
+# review when someone opens a pull request.
+*       @mdebarros @elnyry-sam-k @vijayg10

Dockerfile

@@ -1,36 +1,33 @@
-FROM node:12.16.1-alpine as builder
-USER root
-
-WORKDIR /opt/email-notifier
+FROM node:16.15.0-alpine as builder
+WORKDIR /opt/app
 
 RUN apk --no-cache add git
-RUN apk add --no-cache -t build-dependencies make gcc g++ python libtool autoconf automake \
+RUN apk add --no-cache -t build-dependencies make gcc g++ python3 libtool libressl-dev openssl-dev autoconf automake \
     && cd $(npm root -g)/npm \
     && npm config set unsafe-perm true \
     && npm install -g node-gyp
 
-COPY package.json package-lock.json* /opt/email-notifier/
-RUN npm install
-
-COPY src /opt/email-notifier/src
-COPY config /opt/email-notifier/config
-COPY app.js /opt/email-notifier/
-COPY templates /opt/email-notifier/templates
+COPY package.json package-lock.json* /opt/app/
+RUN npm ci
 
-FROM node:12.16.1-alpine
+COPY src /opt/app/src
+COPY config /opt/app/config
+COPY app.js /opt/app/
+COPY templates /opt/app/templates
 
-WORKDIR /opt/email-notifier
+FROM node:16.15.0-alpine
+WORKDIR /opt/app
 
 # Create empty log file & link stdout to the application log file
 RUN mkdir ./logs && touch ./logs/combined.log
 RUN ln -sf /dev/stdout ./logs/combined.log
 
 # Create a non-root user: ml-user
-RUN adduser -D ml-user 
+RUN adduser -D ml-user
 USER ml-user
 
-COPY --chown=ml-user --from=builder /opt/email-notifier .
+COPY --chown=ml-user --from=builder /opt/app .
 RUN npm prune --production
 
 EXPOSE 3081
-CMD node app.js
+CMD node app.js

README.md

@@ -4,9 +4,9 @@
 [![Docker pulls](https://img.shields.io/docker/pulls/mojaloop/email-notifier.svg?style=flat)](https://hub.docker.com/r/mojaloop/email-notifier)
 [![CircleCI](https://circleci.com/gh/mojaloop/email-notifier.svg?style=svg)](https://app.circleci.com/pipelines/github/mojaloop/email-notifier)
 
-Email Notifier is a stand-alone email service that consumes messages from kafka topic, produced by the central-event-processor service.  
-The central-event-processor repo is available [here](https://github.com/mojaloop/central-event-processor/tree/master)  
-The email-notifier flow is available [here](https://github.com/mojaloop/central-event-processor/tree/master#Notifierflowseparateservice)  
+Email Notifier is a stand-alone email service that consumes messages from kafka topic, produced by the central-event-processor service.
+The central-event-processor repo is available [here](https://github.com/mojaloop/central-event-processor/tree/master)
+The email-notifier flow is available [here](https://github.com/mojaloop/central-event-processor/tree/master#Notifierflowseparateservice)
 
 ## Contents
 
@@ -45,7 +45,7 @@ For configuring email:
   }
 ```
 
-Those can be passed as the following environment variables: 
+Those can be passed as the following environment variables:
 
 ```json
 {
@@ -63,7 +63,7 @@ Those can be passed as the following environment variables:
       }
     }
   }
-}  
+}
 ```
 
 ## Troubleshooting `npm install` on MacOS
@@ -76,36 +76,59 @@ npm install
 clang: error: linker command failed with exit code 1
 ```
 
-add the following environment variables: 
+add the following environment variables:
 ```bash
 export CPPFLAGS=-I/usr/local/opt/openssl/include
 export LDFLAGS=-L/usr/local/opt/openssl/lib
 ```
 
-
 ## Auditing Dependencies
 
 We use `npm-audit-resolver` along with `npm audit` to check dependencies for node vulnerabilities, and keep track of resolved dependencies with an `audit-resolve.json` file.
 
 To start a new resolution process, run:
+
 ```bash
 npm run audit:resolve
 ```
 
 You can then check to see if the CI will pass based on the current dependencies with:
+
 ```bash
 npm run audit:check
 ```
 
-And commit the changed `audit-resolv.json` to ensure that CircleCI will build correctly.
-
+And commit the changed `audit-resolve.json` to ensure that CircleCI will build correctly.
 ## Container Scans
 
 As part of our CI/CD process, we use anchore-cli to scan our built docker container for vulnerabilities upon release.
 
 If you find your release builds are failing, refer to the [container scanning](https://github.com/mojaloop/ci-config#container-scanning) in our shared Mojaloop CI config repo. There is a good chance you simply need to update the `mojaloop-policy-generator.js` file and re-run the circleci workflow.
 
 For more information on anchore and anchore-cli, refer to:
+
 - [Anchore CLI](https://github.com/anchore/anchore-cli)
 - [Circle Orb Registry](https://circleci.com/orbs/registry/orb/anchore/anchore-engine)
 
+## Automated Releases
+
+As part of our CI/CD process, we use a combination of CircleCI, standard-version
+npm package and github-release CircleCI orb to automatically trigger our releases
+and image builds. This process essentially mimics a manual tag and release.
+On a merge to master, CircleCI is configured to use the mojaloopci github account
+to push the latest generated CHANGELOG and package version number.
+Once those changes are pushed, CircleCI will pull the updated master, tag and
+push a release triggering another subsequent build that also publishes a docker image.
+### Potential problems
+*   There is a case where the merge to master workflow will resolve successfully, triggering
+    a release. Then that tagged release workflow subsequently failing due to the image scan,
+    audit check, vulnerability check or other "live" checks.
+    This will leave master without an associated published build. Fixes that require
+    a new merge will essentially cause a skip in version number or require a clean up
+    of the master branch to the commit before the CHANGELOG and bump.
+    This may be resolved by relying solely on the previous checks of the
+    merge to master workflow to assume that our tagged release is of sound quality.
+    We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier
+    is a boon.
+*   It is unknown if a race condition might occur with multiple merges with master in
+    quick succession, but this is a suspected edge case.

audit-resolve.json

@@ -103,6 +103,101 @@
     "1771|@mojaloop/event-sdk>grpc>@mapbox/node-pre-gyp>tar": {
       "decision": "fix",
       "madeAt": 1629388377187
+    },
+    "1075703|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs": {
+      "decision": "ignore",
+      "madeAt": 1658272999117,
+      "expiresAt": 1660864995559
+    },
+    "1075703|@mojaloop/event-sdk>grpc>protobufjs": {
+      "decision": "ignore",
+      "madeAt": 1658272999117,
+      "expiresAt": 1660864995559
+    },
+    "1075704|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs": {
+      "decision": "ignore",
+      "madeAt": 1658272999914,
+      "expiresAt": 1660864995559
+    },
+    "1075704|@mojaloop/event-sdk>grpc>protobufjs": {
+      "decision": "ignore",
+      "madeAt": 1658272999914,
+      "expiresAt": 1660864995559
+    },
+    "1081008|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs>moment": {
+      "decision": "ignore",
+      "madeAt": 1658273000619,
+      "expiresAt": 1660864995559
+    },
+    "1081008|@mojaloop/event-sdk>grpc>protobufjs>moment": {
+      "decision": "ignore",
+      "madeAt": 1658273000619,
+      "expiresAt": 1660864995559
+    },
+    "1070030|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs>moment>shins>markdown-it": {
+      "decision": "ignore",
+      "madeAt": 1658273001409,
+      "expiresAt": 1660864995559
+    },
+    "1070030|widdershins>markdown-it": {
+      "decision": "ignore",
+      "madeAt": 1658273001409,
+      "expiresAt": 1660864995559
+    },
+    "1068155|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs>moment>shins>markdown-it>sanitize-html": {
+      "decision": "ignore",
+      "madeAt": 1658273002128,
+      "expiresAt": 1660864995559
+    },
+    "1070260|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs>moment>shins>markdown-it>sanitize-html": {
+      "decision": "ignore",
+      "madeAt": 1658273002891,
+      "expiresAt": 1660864995559
+    },
+    "1070412|ejs": {
+      "decision": "ignore",
+      "madeAt": 1658273003969,
+      "expiresAt": 1660864995559
+    },
+    "1067553|swagger2openapi>better-ajv-errors>jsonpointer": {
+      "decision": "ignore",
+      "madeAt": 1658273005097,
+      "expiresAt": 1660864995559
+    },
+    "1067946|swagger2openapi>better-ajv-errors>jsonpointer>oas-validator>ajv": {
+      "decision": "ignore",
+      "madeAt": 1658273005844,
+      "expiresAt": 1660864995559
+    },
+    "1068310|widdershins>markdown-it>yargs>yargs-parser": {
+      "decision": "ignore",
+      "madeAt": 1658273006615,
+      "expiresAt": 1660864995559
+    },
+    "1070030|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs>moment>widdershins>markdown-it": {
+      "decision": "ignore",
+      "madeAt": 1658274180235,
+      "expiresAt": 1660866172578
+    },
+    "1070030|shins>markdown-it": {
+      "decision": "ignore",
+      "madeAt": 1658274180235,
+      "expiresAt": 1660866172578
+    },
+    "1068310|@mojaloop/central-services-shared>@mojaloop/event-sdk>grpc>protobufjs>moment>widdershins>markdown-it>yargs>yargs-parser": {
+      "decision": "ignore",
+      "madeAt": 1658274181044,
+      "expiresAt": 1660866172578
+    },
+    "1068155|shins>markdown-it>sanitize-html": {
+      "decision": "ignore",
+      "madeAt": 1658274181822,
+      "expiresAt": 1660866172578
+    },
+    "1070260|shins>markdown-it>sanitize-html": {
+      "decision": "ignore",
+      "madeAt": 1658274182566,
+      "expiresAt": 1660866172578
     }
   },
   "rules": {},