Fix/bugs #13
+802
−72
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| --- | ||
| name: Bug Report | ||
| about: Report a bug to help us improve Dequel | ||
| title: "[Bug]: " | ||
| labels: bug, triage | ||
| assignees: "" | ||
| --- | ||
|
|
||
| ## Description | ||
|
|
||
| A clear and concise description of what the bug is. | ||
|
|
||
| ## Steps to Reproduce | ||
|
|
||
| 1. Go to '...' | ||
| 2. Click on '...' | ||
| 3. Scroll down to '...' | ||
| 4. See error | ||
|
|
||
| ## Expected Behavior | ||
|
|
||
| What did you expect to happen? | ||
|
|
||
| ## Actual Behavior | ||
|
|
||
| What actually happened? | ||
|
|
||
| ## Screenshots / Logs | ||
|
|
||
| If applicable, add screenshots or relevant logs. | ||
|
|
||
| ## Environment | ||
|
|
||
| - **Dequel Version**: (check `VERSION` or `scripts/dequel status`) | ||
| - **OS**: | ||
| - **Docker version**: | ||
| - **Bun version** (if relevant): | ||
| - **Browser** (if relevant): | ||
|
|
||
| ## Affected Component | ||
|
|
||
| - [ ] API (Backend) | ||
| - [ ] Web Dashboard (Frontend) | ||
| - [ ] Docs | ||
| - [ ] CLI / Install Script | ||
| - [ ] Docker / Deployment | ||
| - [ ] Build System (Railpack / BuildKit) | ||
| - [ ] Caddy / Ingress | ||
| - [ ] Monitoring (Prometheus / Grafana / Loki) | ||
|
|
||
| ## Additional Context | ||
|
|
||
| Add any other context, workarounds, or related issues. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| --- | ||
| name: Feature Request | ||
| about: Suggest an idea for Dequel | ||
| title: "[Feature]: " | ||
| labels: enhancement | ||
| assignees: "" | ||
| --- | ||
|
|
||
| ## Problem Statement | ||
|
|
||
| Is your feature request related to a problem? Please describe what you're trying to solve. | ||
|
|
||
| ## Proposed Solution | ||
|
|
||
| A clear and concise description of what you want to happen. | ||
|
|
||
| ## Alternative Solutions | ||
|
|
||
| Any alternative solutions or features you've considered. | ||
|
|
||
| ## Affected Component | ||
|
|
||
| - [ ] API (Backend) | ||
| - [ ] Web Dashboard (Frontend) | ||
| - [ ] Docs | ||
| - [ ] CLI / Install Script | ||
| - [ ] Build System (Railpack / BuildKit) | ||
| - [ ] Caddy / Ingress | ||
| - [ ] Monitoring (Prometheus / Grafana / Loki) | ||
|
|
||
| ## Mockups / Examples | ||
|
|
||
| If applicable, add mockups, diagrams, or examples from other projects. | ||
|
|
||
| ## Additional Context | ||
|
|
||
| Add any other context or screenshots. | ||
|
|
||
| ## Would you like to implement this? | ||
|
|
||
| - [ ] Yes, I'd be happy to submit a PR |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| ## Description | ||
|
|
||
| Please provide a summary of the changes and the motivation behind them. What problem does this PR solve? | ||
|
|
||
| Fixes #(issue) | ||
|
|
||
| ## Type of Change | ||
|
|
||
| - [ ] Bug fix (non-breaking change that fixes an issue) | ||
| - [ ] New feature (non-breaking change that adds functionality) | ||
| - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) | ||
| - [ ] Documentation update | ||
| - [ ] Refactor (no functional changes) | ||
| - [ ] CI / Build / Tooling | ||
| - [ ] Other (please describe): | ||
|
|
||
| ## How Has This Been Tested? | ||
|
|
||
| Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. | ||
|
|
||
| - [ ] Existing tests pass (`bun test` in `apps/api/`) | ||
| - [ ] New tests added (if applicable) | ||
| - [ ] Manual testing performed (describe steps) | ||
|
|
||
| ## Checklist | ||
|
|
||
| - [ ] My code follows the project's code style (no comments, named exports, functional components, etc.) | ||
| - [ ] I have read the [contributing guidelines](../CONTRIBUTING.md) | ||
| - [ ] I have added tests that prove my fix is effective or that my feature works | ||
| - [ ] I have updated the documentation (if applicable) | ||
| - [ ] My changes generate no new warnings or lint errors | ||
| - [ ] I have run `bun test` in `apps/api/` and all tests pass | ||
| - [ ] I have synced the VERSION file if needed (`bun run sync-versions`) | ||
|
|
||
| ## Screenshots (if applicable) | ||
|
|
||
| | Before | After | | ||
| |--------|-------| | ||
| | (insert here) | (insert here) | | ||
|
|
||
| ## Additional Context | ||
|
|
||
| Add any other context about the PR here (e.g., migration notes, deployment considerations, rollback strategy). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| name: Security Scans | ||
|
|
||
| on: | ||
| push: | ||
| pull_request: | ||
| workflow_dispatch: | ||
|
|
||
| concurrency: | ||
| group: security-scans-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| forbidden-pattern-scan: | ||
| name: Forbidden Pattern Scan | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Run forbidden pattern scan | ||
| run: bash scripts/workflow/forbidden-pattern-scan.sh "${{ github.workspace }}" | ||
|
|
||
| lazarus-scanner: | ||
| name: Lazarus Scanner | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Python | ||
| uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.12" | ||
|
|
||
| - name: Download lazarus_scanner.py | ||
| run: | | ||
| curl -fsSL -o lazarus_scanner.py \ | ||
| https://raw.githubusercontent.com/hngprojects/lazarus-scanner/main/lazarus_scanner.py | ||
| [ -s lazarus_scanner.py ] || { echo "FAIL: lazarus_scanner.py is empty or missing"; exit 1; } | ||
|
|
||
| - name: Run Lazarus scanner | ||
| run: python3 lazarus_scanner.py | ||
|
Comment on lines
+35
to
+42
There was a problem hiding this comment. Remote code execution without integrity verification is a supply-chain risk. The workflow downloads and executes a Python script from an external repository with no checksum validation. If that repository is compromised, malicious code runs with full repository access. For a security-focused workflow, this is particularly concerning. Consider pinning to a specific commit and verifying a SHA256 checksum: 🛡️ Proposed fix with checksum verification - name: Download lazarus_scanner.py
run: |
- curl -fsSL -o lazarus_scanner.py \
- https://raw.githubusercontent.com/hngprojects/lazarus-scanner/main/lazarus_scanner.py
- [ -s lazarus_scanner.py ] || { echo "FAIL: lazarus_scanner.py is empty or missing"; exit 1; }
+ SCANNER_SHA256="<expected-sha256-hash>" # Pin to known-good hash
+ curl -fsSL -o lazarus_scanner.py \
+ https://raw.githubusercontent.com/hngprojects/lazarus-scanner/<commit-sha>/lazarus_scanner.py
+ echo "${SCANNER_SHA256} lazarus_scanner.py" | sha256sum -c - || {
+ echo "FAIL: checksum mismatch for lazarus_scanner.py"; exit 1;
+ }🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| # Contributing to Dequel | ||
|
|
||
| Thank you for your interest in contributing! Here's how to get started. | ||
|
|
||
| ## Getting Started | ||
|
|
||
| 1. Fork and clone the repo | ||
| 2. Install dependencies: `bun install` | ||
| 3. Read [`AGENTS.md`](./AGENTS.md) for the full architecture and conventions | ||
|
|
||
| ## Reporting Bugs | ||
|
|
||
| Open a [Bug Report](https://github.com/Lftobs/dequel/issues/new?template=bug_report.yml). Include: | ||
|
|
||
| - Steps to reproduce | ||
| - Expected vs actual behavior | ||
| - Dequel version (`VERSION` file or `scripts/dequel status`) | ||
| - Environment details (OS, Docker version, browser if relevant) | ||
|
|
||
| ## Suggesting Features | ||
|
|
||
| Open a [Feature Request](https://github.com/Lftobs/dequel/issues/new?template=feature_request.yml). Describe: | ||
|
|
||
| - The problem you're solving | ||
| - Your proposed solution | ||
| - Any alternatives considered | ||
| - Whether you'd like to implement it yourself | ||
|
|
||
| ## Development | ||
|
|
||
| ### Running Locally | ||
|
|
||
| ```bash | ||
| # API (port 3001) | ||
| bun apps/api/src/index.ts | ||
|
|
||
| # Web dashboard (port 3000) | ||
| bun apps/web/src/main.tsx | ||
|
|
||
| # Docs (port 4321) | ||
| bun apps/docs/src/main.tsx | ||
|
Comment on lines
+34
to
+41
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Search for port configurations in API, web, and docs apps
echo "=== Checking API entry point for port configuration ==="
fd -e 'index.ts|main.ts|config.ts' apps/api/src --max-depth 3 -x grep -l '3001\|17474\|PORT' {} \;
echo -e "\n=== Checking Web entry point ==="
fd -e 'main.tsx' apps/web/src --max-depth 2 -x grep -l '3000\|PORT' {} \;
echo -e "\n=== Checking Docs entry point and port ==="
fd -e 'main.tsx' apps/docs/src --max-depth 2 | head -5
fd -e 'main.tsx|index.ts' apps/docs/src --max-depth 2 -x grep -l '4321\|PORT' {} \;Repository: Lftobs/dequel Length of output: 1633 🏁 Script executed: #!/bin/bash
# List directory structure first
echo "=== Repository structure ==="
ls -la apps/ 2>/dev/null | head -20
echo -e "\n=== API src files ==="
find apps/api/src -type f -name "*.ts" -o -name "*.js" 2>/dev/null | head -10
echo -e "\n=== Web src files ==="
find apps/web/src -type f -name "*.tsx" -o -name "*.ts" 2>/dev/null | head -10
echo -e "\n=== Docs src files ==="
find apps/docs/src -type f -name "*.tsx" -o -name "*.ts" -o -name "*.jsx" -o -name "*.js" 2>/dev/null | head -10
echo -e "\n=== Searching for port 3001 references ==="
rg '3001' apps/ -t ts -t tsx -t js -t json 2>/dev/null | head -20
echo -e "\n=== Searching for port 3000 references ==="
rg '3000' apps/ -t ts -t tsx -t js -t json 2>/dev/null | head -20
echo -e "\n=== Searching for port 4321 references ==="
rg '4321' apps/ -t ts -t tsx -t js -t json 2>/dev/null | head -20
echo -e "\n=== Checking API index.ts content ==="
cat apps/api/src/index.ts 2>/dev/null | head -50
echo -e "\n=== Checking Web main.tsx content ==="
cat apps/web/src/main.tsx 2>/dev/null | head -50
echo -e "\n=== Checking Docs main.tsx content ==="
cat apps/docs/src/main.tsx 2>/dev/null | head -50Repository: Lftobs/dequel Length of output: 3954 🏁 Script executed: #!/bin/bash
# Find config files in docs
echo "=== All files in apps/docs ==="
find apps/docs -type f 2>/dev/null
echo -e "\n=== Check for astro.config or package.json ==="
find apps/docs -name "*.config.*" -o -name "package.json" 2>/dev/null
echo -e "\n=== Full API index.ts ==="
wc -l apps/api/src/index.ts
cat apps/api/src/index.ts
echo -e "\n=== Search for listen/port binding in API ==="
rg 'listen|port|\.listen\|3001' apps/api/ -i 2>/dev/null | head -30Repository: Lftobs/dequel Length of output: 6180 🏁 Script executed: #!/bin/bash
echo "=== API config.ts to find port defaults ==="
cat apps/api/src/utils/config.ts | head -100
echo -e "\n=== Docs astro.config.mjs ==="
cat apps/docs/astro.config.mjs
echo -e "\n=== API package.json scripts ==="
cat apps/api/package.json | grep -A 10 '"scripts"'
echo -e "\n=== Web package.json scripts ==="
cat apps/web/package.json | grep -A 10 '"scripts"'
echo -e "\n=== Docs package.json scripts ==="
cat apps/docs/package.json | grep -A 10 '"scripts"'
echo -e "\n=== CONTRIBUTING.md content around lines 34-41 ==="
cat CONTRIBUTING.md | sed -n '30,45p'Repository: Lftobs/dequel Length of output: 3494 Fix incorrect ports and entry point commands in local development guide. The specified ports and entry point commands are incorrect. API defaults to port 17474 (configured via PORT env var, not 3001), Web dev runs on Vite's default 5173 (preview uses 3000), and Docs is an Astro project running on port 3000—not 4321. More critically, the entry point commands are wrong: Or run from the workspace root with workspace filters if configured. 🤖 Prompt for AI Agents |
||
| ``` | ||
|
|
||
| ### Code Conventions | ||
|
|
||
| - **No comments** in source code unless absolutely necessary | ||
| - **Named exports** over default exports | ||
| - **Functional components + hooks** in React | ||
| - **Tailwind CSS** for styling (web and docs) | ||
| - Max ~500 lines per file — split into feature-grouped directories | ||
| - `set -euo pipefail` in all bash scripts | ||
|
|
||
| ### Database Migrations | ||
|
|
||
| ```bash | ||
| # Generate migration from schema changes | ||
| bunx drizzle-kit generate | ||
|
|
||
| # Push schema directly (dev only) | ||
| bunx drizzle-kit push | ||
| ``` | ||
|
|
||
| ### Testing | ||
|
|
||
| ```bash | ||
| # API tests | ||
| bun test | ||
| ``` | ||
|
|
||
| Always run `bun test` in `apps/api/` before committing API changes. | ||
|
|
||
| ### Versioning | ||
|
|
||
| ```bash | ||
| # Bump version across the codebase | ||
| ./bump.sh v0.2.0 | ||
| ``` | ||
|
|
||
| This updates `VERSION`, all `package.json` files, and optionally adds a changelog entry. | ||
|
|
||
| ## Pull Requests | ||
|
|
||
| 1. Create a PR from your fork using the [PR template](./.github/PULL_REQUEST_TEMPLATE.md) | ||
| 2. Ensure all tests pass (`bun test`) | ||
| 3. Keep changes focused — one feature/fix per PR | ||
| 4. Update documentation if your change affects user-facing behavior | ||
| 5. If changing API behavior, update the docs site content | ||
|
|
||
| ### PR Checklist | ||
|
|
||
| - [ ] Tests pass (`bun test` in `apps/api/`) | ||
| - [ ] No new warnings or lint errors | ||
| - [ ] Documentation updated (if applicable) | ||
| - [ ] Version synced (`bun run sync-versions`) if `VERSION` changed | ||
| - [ ] Follows code conventions (no comments, named exports, etc.) | ||
|
|
||
| ## Release Process | ||
|
|
||
| Maintainers cut releases by tagging: | ||
|
|
||
| ```bash | ||
| git tag vX.Y.Z | ||
| git push origin vX.Y.Z | ||
| ``` | ||
|
|
||
| CI builds Docker images to `ghcr.io/lftobs/dequel/{api,web}:X.Y.Z` and creates a GitHub Release. | ||
|
|
||
| ## Questions? | ||
|
|
||
| Open a [Discussion](https://github.com/Lftobs/dequel/discussions) for questions and community support. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| MIT License | ||
|
|
||
| Copyright (c) 2024 Lftobs | ||
|
|
||
| Permission is hereby granted, free of charge, to any person obtaining a copy | ||
| of this software and associated documentation files (the "Software"), to deal | ||
| in the Software without restriction, including without limitation the rights | ||
| to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | ||
| copies of the Software, and to permit persons to whom the Software is | ||
| furnished to do so, subject to the following conditions: | ||
|
|
||
| The above copyright notice and this permission notice shall be included in all | ||
| copies or substantial portions of the Software. | ||
|
|
||
| THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | ||
| IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | ||
| FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | ||
| AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
| LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | ||
| OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
| SOFTWARE. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add explicit minimal permissions for least-privilege security.
The workflow runs with default write-all permissions, but a read-only scan only requires
contents: read. Explicit permissions also protect against future credential leakage if steps are added.🛡️ Proposed fix to add permissions block
name: Security Scans on: push: pull_request: workflow_dispatch: +permissions: + contents: read + concurrency: group: security-scans-${{ github.ref }} cancel-in-progress: true📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 1-43: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Source: Linters/SAST tools