Skip to content

Fix/pipeline ci cd#1

Merged
mawed44 merged 5 commits into
mainfrom
fix/pipeline_ci_cd
May 17, 2026
Merged

Fix/pipeline ci cd#1
mawed44 merged 5 commits into
mainfrom
fix/pipeline_ci_cd

Conversation

@mawed44

@mawed44 mawed44 commented May 17, 2026

Copy link
Copy Markdown
Owner

No description provided.

@mawed44 mawed44 requested a review from Copilot May 17, 2026 20:52
@mawed44 mawed44 added the wontfix This will not be worked on label May 17, 2026
@vercel

vercel Bot commented May 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
portfolio-devsecops Ready Ready Preview, Comment May 17, 2026 8:52pm

@mawed44 mawed44 merged commit 2326b2f into main May 17, 2026
14 checks passed

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds CI/CD and quality tooling for the React/Vite portfolio, while adjusting static asset references and removing unused icon imports.

Changes:

  • Adds GitHub Actions CI/CD jobs for linting, audit, secret scanning, SonarQube, and build artifacts.
  • Adds ESLint flat config and related dev dependencies.
  • Moves image/icon usage toward public/ assets and adds Docker Compose support for SonarQube/PostgreSQL.

Reviewed changes

Copilot reviewed 9 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
.github/workflows/ci-cd.yml Adds CI/CD workflow stages for lint, security checks, SAST, and build.
.env.example Adds environment placeholders for PostgreSQL and SonarQube image versions.
docker-compose.yml Adds local SonarQube and PostgreSQL services.
eslint.config.js Adds ESLint flat config for React source files.
index.html Updates favicon and Apple touch icon paths to public assets.
package.json Adds lint script and ESLint-related dev dependencies.
package-lock.json Locks newly added linting dependencies.
public/logo.png Adds the logo used by HTML icon links.
src/components/About.jsx Updates image path and removes an unused icon import.
src/components/Contact.jsx Removes an unused icon import.
src/components/Hero.jsx Removes an unused icon import.
Comments suppressed due to low confidence (2)

.github/workflows/ci-cd.yml:57

  • Using the mutable main branch for this security action makes the workflow non-reproducible and allows upstream changes to alter the scanner code without review. Pin this action to a released version or, preferably for supply-chain hardening, a commit SHA.
        uses: trufflesecurity/trufflehog@main

.github/workflows/ci-cd.yml:68

  • This allows the SAST job to fail without failing the workflow, and the build job does not depend on sonarqube, so SonarQube findings or scanner failures cannot gate the pipeline. If this stage is intended as a CI security control, remove continue-on-error and include it in the required job chain.
    continue-on-error: true

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json
"build": "vite build",
"preview": "vite preview"
"preview": "vite preview",
"lint": "eslint src"
Comment thread eslint.config.js
'react-hooks': reactHooks,
'react-refresh': reactRefresh,
},
rules: {
Comment thread .env.example
Comment on lines +7 to +8
POSTGRES_VERSION=
SONARQUBE_VERSION= No newline at end of file
jobs:
# ── STAGE: TEST ─────────────────────────────────────────────────────────────
lint:
name: Lint & Format
Comment thread index.html
<link rel="icon" type="image/png" href="/src/images/logo.png" />
<link rel="apple-touch-icon" href="/src/images/logo.png" />
<link rel="icon" type="image/png" href="/logo.png" />
<link rel="apple-touch-icon" href="/logo.png" />
Comment thread package.json
Comment on lines +25 to +28
"eslint": "^8.57.0",
"eslint-plugin-react": "^7.34.1",
"eslint-plugin-react-hooks": "^4.6.2",
"eslint-plugin-react-refresh": "^0.4.6",
@mawed44 mawed44 deleted the fix/pipeline_ci_cd branch May 23, 2026 23:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

wontfix This will not be worked on

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants