Skip to content

fix(security): DevSecOps comprehensive audit hardening + CI/CD fixes - #2

Closed
ryann-g wants to merge 3 commits into
mainfrom
sec.audit1
Closed

fix(security): DevSecOps comprehensive audit hardening + CI/CD fixes#2
ryann-g wants to merge 3 commits into
mainfrom
sec.audit1

Conversation

@ryann-g

@ryann-g ryann-g commented May 31, 2026

Copy link
Copy Markdown
Owner

Security Audit + CI/CD Fixes

ECC Skills Utilized

  • security-review — security checklist, OWASP Top 10 patterns
  • production-audit — production readiness lens
  • react-patterns — React conventions
  • coding-standards — baseline code quality

Changes Summary

Security Hardening (15 files)

  • — Added 9 security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP)
  • — HTML-escape user data in email templates (stored XSS prevention)
  • — Sanitize error responses (2 endpoints)
  • — Sanitize error responses + add ownership checks (3 endpoints)
  • — Sanitize error response
  • — Block protocol-relative URL open redirect
  • — Sanitize webhook error response
  • — Remove version/environment disclosure
  • — Add user_id ownership check (IDOR defense-in-depth)
  • — Add user_id ownership check
  • — Replace null-as-any with explicit throw
  • — Remove non-null assertions
  • — Clean up console.error
  • — Add error feedback for failed checkout

CI/CD Fixes (2 files)

  • — Skip coverage artifact download when unit-tests fail (prevents 'Artifact not found' error)
  • — Automate release notes from commit bodies using awk-based parsing (fixes static template output)

Verification

  • npm run build — passes
  • npm run lint — clean (0 warnings)
  • npm test — 124/124 tests pass

Remaining (team decision required)

  • Rate limiter: in-memory resets on serverless cold starts (needs Upstash Redis migration)
  • tsconfig.json: noUncheckedIndexedAccess (needs tsc verification pass)
  • Constants extraction: SOURCES/PIPELINE_STAGES duplicated across files

ryann-g added 3 commits May 31, 2026 17:36
@ryann-g
fix(ci): skip coverage download when unit-tests fail
24f71e3 
The pr-comment-summary and coverage-gate jobs tried to download
the coverage-report artifact unconditionally. When unit-tests
failed (or were cancelled), the artifact was never uploaded,
causing 'Artifact not found' errors.

- Add 'if: needs.unit-tests.result == success' to coverage-gate
- Add 'if: needs.unit-tests.result == success' to coverage download step
- Summary generation already handles missing coverage gracefully
@ryann-g
fix(ci): automate release notes from commit bodies
b40584a 
- Use § delimiter to capture full commit body (not just subject line)
- Extract and display bullet points from commit descriptions
- Strip git metadata (Change-Id, Co-authored-by, etc.)
- Fix sed regex for prefix stripping (use [^:]* instead of nested parens)
- Fix OTHER_CHANGEStidy typo
- Add Other Changes section for test/docs/ci/chore commits

Before: release notes showed static 'No improvements in this release'
After: release notes show actual commit details with bullet points
@ryann-g
fix(ci): reliable release notes parsing with awk-based categorization
0816008 
- Replace fragile bash while-loop parsing with single awk script
- Correctly extracts hash, subject, and multi-line body from git log
- Strips conventional commit prefixes (feat, fix, refactor, perf, etc.)
- Indents body bullet points under each commit entry
- Strips git metadata (Change-Id, Co-authored-by, etc.)
- Handles nested parentheses in scopes like fix(security):
- Fixes OTHER_CHANGEStidy typo from original code
@vercel

vercel Bot commented May 31, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
agentflow Ready Ready Preview, Comment May 31, 2026 10:00am

@github-actions

github-actions Bot commented May 31, 2026

Copy link
Copy Markdown

CI/CD Pipeline Results

Check Status
Lint & TypeCheck [FAILED]
Security Audit [FAILED]
Unit Tests [FAILED]
Coverage Gate [FAILED] (N/A)
Preview Deploy [FAILED]
Lighthouse CI [FAILED]

Preview URL:

@ryann-g

ryann-g commented May 31, 2026

Copy link
Copy Markdown
Owner Author

Closing — PR #1 already merged with all these changes. This was created from the same branch after merge.

@ryann-g ryann-g closed this May 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ryann-g