Commit Graph

11 Commits

Author SHA1 Message Date
Jonathan Flatt
5fa329be9f fix: move TypeScript to production dependencies and ensure compilation
- Move TypeScript from devDependencies to dependencies to ensure it's available in production
- Update startup script to always compile TypeScript for latest source
- Fix container restart loop caused by missing TypeScript compiler
- Ensure webhook service starts successfully with compiled dist files
2025-05-28 14:32:50 +00:00
Jonathan Flatt
0e4d22bcdc fix: exclude test redaction files from credential scanner
Prevents false positives in security audit by excluding test files that contain intentional fake credentials for testing logger redaction functionality.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-26 22:41:14 -05:00
MCPClaude
4338059113 Implement wait-for-all-checks PR review trigger to prevent duplicate reviews (#73)
* feat: implement wait-for-all-checks PR review trigger

This change modifies the PR review triggering logic to wait for ALL check suites
to complete successfully before triggering a single PR review, preventing duplicate
reviews from different check suites (build, security scans, etc.).

Key changes:
- Added PR_REVIEW_WAIT_FOR_ALL_CHECKS env var (default: true)
- Added PR_REVIEW_DEBOUNCE_MS for configurable delay (default: 5000ms)
- Implemented checkAllCheckSuitesComplete() function that queries GitHub API
- Made PR_REVIEW_TRIGGER_WORKFLOW optional (only used when wait-for-all is false)
- Updated tests to handle new behavior

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: correct indentation and remove test-results from git

- Fix ESLint indentation errors in claudeService.js
- Remove test-results directory from git tracking (added to .gitignore)

🤖 Generated with Claude Code (https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: add Claude CLI database sharing and backup system

- Mount host ~/.claude directory in container for shared context
- Add .dockerignore to optimize build context
- Create backup script with daily/weekly retention strategy
- Add cron setup for automated backups to /backup partition

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: add missing makeGitHubRequest function to githubService

The checkAllCheckSuitesComplete function was failing because it tried to call
githubService.makeGitHubRequest which didn't exist. This was causing PR reviews
to never trigger with the 'Waiting for other check suites to complete' message.

Added the missing function to make direct GitHub API requests using Octokit.

* fix: add URL validation to makeGitHubRequest to prevent SSRF vulnerability

* refactor: remove makeGitHubRequest to fix SSRF vulnerability

- Replace makeGitHubRequest with getCheckSuitesForRef using Octokit
- Simplify getWorkflowNameFromCheckSuite to use app info from webhook
- Fix tests to match new implementation
- Add PR review environment variables to .env file

---------

Co-authored-by: Jonathan Flatt <jonflatt@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: ClaudeBot <claude@example.com>
2025-05-26 20:45:59 -05:00
Jonathan Flatt
8e2e30e38b Implement minimal-permission security model for auto-tagging operations using dedicated entrypoint scripts and CLI-based labeling to improve reliability and reduce attack surface
🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-25 22:58:20 -05:00
Jonathan Flatt
c51eba4f0f Add deployment workflow and scripts for self-hosted runner
- Add GitHub Actions deployment workflow for staging and production
- Add deployment scripts for automated deployments
- Add GitHub runner management scripts
- Add staging docker-compose configuration
- Enable automatic deployments on push to main (staging) and version tags (production)
2025-05-23 23:39:33 +00:00
Jonathan Flatt
3072f6e425 security: Replace example AWS credentials with generic placeholders
Replaces AWS access key examples (AKIAIOSFODNN7EXAMPLE) and secret keys
with generic EXAMPLE_KEY_ID and EXAMPLE_SECRET_KEY placeholders to prevent
security scanners from flagging them as potential real credentials.

Fixes workflow failure while maintaining test functionality.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-21 23:03:07 -05:00
Jonathan Flatt
7e545475d0 security: Implement comprehensive credential protection system
Replace environment variable credentials with secure file-based mounting
to prevent runtime credential exposure that was causing security leaks.

Key security improvements:
- Docker secrets integration for credential mounting
- Secure credential loader utility (secureCredentials.js)
- Enhanced logging redaction for all credential types
- Pre-commit security scanning with multiple tools
- Automated security audit workflow and scripts
- File-based credentials with proper 600 permissions

Services updated:
- githubController.js: Use secure credentials for webhook verification
- claudeService.js: Use secure credentials for GitHub/Anthropic APIs
- githubService.js: Use secure credentials for GitHub API calls
- logger.js: Enhanced redaction patterns for all credential types

New security infrastructure:
- ./scripts/setup/setup-secure-credentials.sh: Setup script for secure credentials
- ./scripts/security/credential-audit.sh: Comprehensive security audit
- .github/workflows/security-audit.yml: Automated security scanning
- docker-compose.yml: Updated to use Docker secrets by default
- k8s/secrets.yaml: Kubernetes secrets configuration
- systemd/claude-webhook.service: Systemd service configuration

This eliminates credential exposure in:
- Environment variables and process lists
- Container logs and debug output
- Git commits and PR comments
- Runtime error messages

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-21 23:03:07 -05:00
Jonathan Flatt
0363255da4 Add intelligent issue auto-tagging with Claude analysis
- Implement issue-opened webhook trigger for automatic label classification
- Add comprehensive label system (priority, type, complexity, component)
- Create Claude-powered prompt for intelligent issue analysis
- Include keyword-based fallback labeling for reliability
- Add GitHub API integration for label creation and application
- Provide setup script for initializing repository labels
- Include unit tests for new GitHub service functions
- Add explanatory comments on auto-tagged issues

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-21 02:49:44 +00:00
Jonathan Flatt
587a05f4f1 Add startup time measurement and benchmarking tools
- Add StartupMetrics utility to track detailed application startup milestones
- Enhance health endpoint with startup timing data and component check durations
- Add automated benchmark script for measuring container startup performance
- Instrument Express application with milestone tracking throughout initialization

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-21 02:40:26 +00:00
Jonathan Flatt
4cdad828c4 Reorganize scripts into structured directory layout and consolidate functionality
This commit reorganizes all scripts in the repository into a more structured directory layout for better maintainability:
- Categorizes scripts by functionality (setup, build, aws, runtime, security, utils)
- Organizes test scripts into logical categories
- Consolidates redundant scripts with unified interfaces
- Adds backward compatibility wrappers
- Adds detailed SCRIPTS.md documentation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-05-21 00:19:07 +00:00
Jonathan Flatt
fc567071dd Initial commit 2025-05-20 17:01:59 +00:00