Skip to content

Commit 01d299f

Browse files
jeffwilcoxjeffwilcox
authored
Merge pull request #1542 from microsoft/260319-updates
Application defaults hardening
2 parents 108628c + 2a055cd commit 01d299f

File tree

197 files changed

+8033
-3200
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

197 files changed

+8033
-3200
lines changed

‎.cspell.json‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@
33
"dictionaries": ["typescript", "softwareTerms"],
44
"ignorePaths": [
55
".environment/**",
6-
".deploy/geneva/**",
76
".config/1espt/**",
87
".config/guardian/**",
8+
".deploy/geneva/**",
9+
".deploy/sitecontainers/**",
910
".npmrc*",
1011
".cspell.json",
1112
".git/",
@@ -374,6 +375,7 @@
374375
"hsts",
375376
"Hsts",
376377
"HSTS",
378+
"httplogging",
377379
"hubber",
378380
"hubbers",
379381
"hubot",
@@ -395,6 +397,7 @@
395397
"insideadmin",
396398
"insideread",
397399
"insidewrite",
400+
"installationid",
398401
"intelli",
399402
"internalcontent",
400403
"internalissuescreated",
@@ -484,6 +487,7 @@
484487
"managerunlink",
485488
"Markdownlint",
486489
"maxif",
490+
"maxpingfailures",
487491
"MCAPS",
488492
"MEMBERTOMAINTAINER",
489493
"memex",
@@ -819,6 +823,7 @@
819823
"signoff",
820824
"signout",
821825
"signup",
826+
"sitecontainer",
822827
"sitecontainers",
823828
"skus",
824829
"smartcard",
@@ -879,6 +884,7 @@
879884
"tolower",
880885
"Toolset",
881886
"toscalar",
887+
"tostring",
882888
"totalcount",
883889
"touchedtime",
884890
"toupper",

‎.github/scripts/appsettings-apply-if-changed.sh‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# @cspell: ignore argjson slurpfile endgroup
5+
6+
APP_NAME=''
7+
RESOURCE_GROUP=''
8+
SLOT=''
9+
SETTINGS_FILE=''
10+
11+
while [[ $# -gt 0 ]]; do
12+
case "$1" in
13+
--name)
14+
APP_NAME="$2"
15+
shift 2
16+
;;
17+
--resource-group)
18+
RESOURCE_GROUP="$2"
19+
shift 2
20+
;;
21+
--slot)
22+
SLOT="$2"
23+
shift 2
24+
;;
25+
--settings-file)
26+
SETTINGS_FILE="$2"
27+
shift 2
28+
;;
29+
*)
30+
echo "Unknown argument: $1"
31+
exit 1
32+
;;
33+
esac
34+
done
35+
36+
if [[ -z "$APP_NAME" || -z "$RESOURCE_GROUP" || -z "$SETTINGS_FILE" ]]; then
37+
echo 'Usage: appsettings-apply-if-changed.sh --name <app> --resource-group <rg> [--slot <slot>] --settings-file <json>'
38+
exit 1
39+
fi
40+
41+
if [[ ! -f "$SETTINGS_FILE" ]]; then
42+
echo "::error::Settings file not found: $SETTINGS_FILE"
43+
exit 1
44+
fi
45+
46+
echo '::group::Diagnostics: desired settings'
47+
echo "Diagnostics: desired settings file path: $SETTINGS_FILE"
48+
echo 'Diagnostics: desired settings payload:'
49+
cat "$SETTINGS_FILE"
50+
echo '::endgroup::'
51+
52+
SLOT_ARGS=()
53+
if [[ -n "$SLOT" ]]; then
54+
SLOT_ARGS+=(--slot "$SLOT")
55+
fi
56+
57+
CURRENT_SETTINGS=$(az webapp config appsettings list \
58+
--name "$APP_NAME" \
59+
--resource-group "$RESOURCE_GROUP" \
60+
"${SLOT_ARGS[@]}" \
61+
--output json)
62+
63+
echo "::group::Diagnostics: current app settings for $APP_NAME${SLOT:+ slot $SLOT}"
64+
echo "Diagnostics: current app settings for $APP_NAME${SLOT:+ slot $SLOT}:"
65+
echo "$CURRENT_SETTINGS"
66+
echo '::endgroup::'
67+
68+
CHANGED_SETTINGS_FILE=$(mktemp)
69+
70+
jq -n \
71+
--slurpfile desired "$SETTINGS_FILE" \
72+
--argjson current "$CURRENT_SETTINGS" \
73+
'
74+
($current
75+
| map(select(type == "object"))
76+
| map(select((.name | type) == "string" and (.name | length) > 0))
77+
| map({key: .name, value: .value})
78+
| from_entries) as $current_map
79+
| ((($desired[0] // [])
80+
| if type == "array" then . else [] end)
81+
| map(select(type == "object"))
82+
| map(select((.name | type) == "string" and (.name | length) > 0)))
83+
| map(select(($current_map[.name] // "__MISSING__") != .value))
84+
' > "$CHANGED_SETTINGS_FILE"
85+
86+
CHANGED_COUNT=$(jq 'length' "$CHANGED_SETTINGS_FILE")
87+
if [[ "$CHANGED_COUNT" -eq 0 ]]; then
88+
echo "No app settings changes detected for $APP_NAME${SLOT:+ slot $SLOT}. Skipping apply."
89+
rm -f "$CHANGED_SETTINGS_FILE"
90+
exit 0
91+
fi
92+
93+
echo "Applying $CHANGED_COUNT changed app setting(s) for $APP_NAME${SLOT:+ slot $SLOT}."
94+
echo "::group::Diagnostics: changed app settings for $APP_NAME${SLOT:+ slot $SLOT}"
95+
echo 'Diagnostics: changed settings payload:'
96+
cat "$CHANGED_SETTINGS_FILE"
97+
echo '::endgroup::'
98+
az webapp config appsettings set \
99+
--name "$APP_NAME" \
100+
--resource-group "$RESOURCE_GROUP" \
101+
"${SLOT_ARGS[@]}" \
102+
--settings @"$CHANGED_SETTINGS_FILE"
103+
104+
rm -f "$CHANGED_SETTINGS_FILE"

‎.github/scripts/sitecontainer-apply-if-changed.sh‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# @cspell: ignore argjson containername
5+
6+
APP_NAME=''
7+
RESOURCE_GROUP=''
8+
SLOT=''
9+
CONTAINER_NAME=''
10+
IS_MAIN=''
11+
IMAGE=''
12+
13+
while [[ $# -gt 0 ]]; do
14+
case "$1" in
15+
--name)
16+
APP_NAME="$2"
17+
shift 2
18+
;;
19+
--resource-group)
20+
RESOURCE_GROUP="$2"
21+
shift 2
22+
;;
23+
--slot)
24+
SLOT="$2"
25+
shift 2
26+
;;
27+
--container-name)
28+
CONTAINER_NAME="$2"
29+
shift 2
30+
;;
31+
--is-main)
32+
IS_MAIN="$2"
33+
shift 2
34+
;;
35+
--image)
36+
IMAGE="$2"
37+
shift 2
38+
;;
39+
*)
40+
echo "Unknown argument: $1"
41+
exit 1
42+
;;
43+
esac
44+
done
45+
46+
if [[ -z "$APP_NAME" || -z "$RESOURCE_GROUP" || -z "$CONTAINER_NAME" || -z "$IS_MAIN" || -z "$IMAGE" ]]; then
47+
echo 'Usage: sitecontainer-apply-if-changed.sh --name <app> --resource-group <rg> [--slot <slot>] --container-name <name> --is-main <true|false> --image <image>'
48+
exit 1
49+
fi
50+
51+
SLOT_ARGS=()
52+
if [[ -n "$SLOT" ]]; then
53+
SLOT_ARGS+=(--slot "$SLOT")
54+
fi
55+
56+
CURRENT_CONTAINERS=$(az webapp sitecontainers list \
57+
--name "$APP_NAME" \
58+
--resource-group "$RESOURCE_GROUP" \
59+
"${SLOT_ARGS[@]}" \
60+
--output json)
61+
62+
CURRENT_IMAGE=$(jq -r \
63+
--arg container_name "$CONTAINER_NAME" \
64+
'
65+
map(select((.name // .containerName // "") == $container_name))
66+
| .[0]
67+
| (.image // .properties.image // "")
68+
' <<< "$CURRENT_CONTAINERS")
69+
70+
if [[ "$CURRENT_IMAGE" == "$IMAGE" ]]; then
71+
echo "No sitecontainer image change for $APP_NAME/$CONTAINER_NAME${SLOT:+ slot $SLOT}. Skipping update."
72+
exit 0
73+
fi
74+
75+
echo "Updating sitecontainer image for $APP_NAME/$CONTAINER_NAME${SLOT:+ slot $SLOT}."
76+
az webapp sitecontainers update \
77+
--name "$APP_NAME" \
78+
--resource-group "$RESOURCE_GROUP" \
79+
"${SLOT_ARGS[@]}" \
80+
--container-name "$CONTAINER_NAME" \
81+
--is-main "$IS_MAIN" \
82+
--image "$IMAGE"

‎.ossdev/environment/index.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ module.exports = function retrieveEnvironment(name, type, options) {
2929
}
3030
}
3131
try {
32+
// eslint-disable-next-line security/detect-non-literal-require
3233
const values = require(environmentPath);
3334
return values;
3435
} catch (requireError) {

‎.prettierignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
# Ignore artifacts
22
dist
33

4+
# Never modify npmrc files (Microsoft Azure Artifacts configuration)
5+
.npmrc
6+
.npmrc.arg
7+
48
# Ignore upstream files
59
.github/dotcom-workflows/
610
.deploy/geneva/

‎.vscode/settings.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"typescript.tsdk": "node_modules/typescript/lib",
33
"chat.tools.terminal.autoApprove": {
44
"npm install": true,
5-
"npx tsc": true
5+
"npx tsc": true,
6+
"npx vitest": true
67
}
78
}

‎Dockerfile‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,15 @@
33
# Licensed under the MIT license. See LICENSE file in the project root for full license information.
44
#
55

6-
ARG IMAGE_NAME=mcr.microsoft.com/azurelinux/base/nodejs:20
6+
ARG IMAGE_NAME=mcr.microsoft.com/azurelinux/base/core:3.0
77

8-
FROM $IMAGE_NAME AS build
8+
FROM $IMAGE_NAME AS node24-base
99

10-
RUN tdnf -y update --quiet
10+
RUN tdnf -y update --quiet && \
11+
tdnf -y install --quiet ca-certificates nodejs24 nodejs24-npm && \
12+
tdnf clean all --quiet
13+
14+
FROM node24-base AS build
1115

1216
WORKDIR /build
1317

@@ -35,7 +39,7 @@ RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm ci
3539
RUN npm run build
3640
RUN rm -f .npmrc
3741

38-
FROM $IMAGE_NAME AS run
42+
FROM node24-base AS run
3943

4044
ENV IS_DOCKER=1 \
4145
NPM_CONFIG_LOGLEVEL=warn \

‎Dockerfile.open‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,15 @@
55

66
# This file simulates running the scripts to convert to open, locally.
77

8-
ARG IMAGE_NAME=mcr.microsoft.com/azurelinux/base/nodejs:20
8+
ARG IMAGE_NAME=mcr.microsoft.com/azurelinux/base/core:3.0
99

10-
FROM $IMAGE_NAME AS build
10+
FROM $IMAGE_NAME AS node24-base
1111

12-
RUN tdnf -y update --quiet
12+
RUN tdnf -y update --quiet && \
13+
tdnf -y install --quiet ca-certificates nodejs24 nodejs24-npm && \
14+
tdnf clean all --quiet
15+
16+
FROM node24-base AS build
1317

1418
WORKDIR /build
1519

@@ -50,7 +54,7 @@ WORKDIR /build/frontend
5054
RUN npm install
5155
RUN npm run build
5256

53-
FROM $IMAGE_NAME AS run
57+
FROM node24-base AS run
5458

5559
ENV IS_DOCKER=1 \
5660
NPM_CONFIG_LOGLEVEL=warn \

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Open Source Management Portal
22

3-
**2025 note: this project does not entirely build today and is a partial reference implementation for example purposes only**
3+
> **Note:** 2025 note: this project does not entirely build today and is a partial reference implementation for example purposes only
44
55
This application represents the home for open source engineering experiences
66
at Microsoft. As a backend application it manages source of truth for many

‎api/client/banner.ts‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@
66
import { NextFunction, Response, Router } from 'express';
77
import { ReposAppRequest } from '../../interfaces/index.js';
88

9-
import { jsonError } from '../../middleware/index.js';
10-
import { getProviders } from '../../lib/transitional.js';
9+
import { CreateError, getProviders } from '../../lib/transitional.js';
1110

1211
const router: Router = Router();
1312

@@ -23,7 +22,7 @@ router.get('/', (req: ReposAppRequest, res: Response, next: NextFunction) => {
2322
});
2423

2524
router.use('/*splat', (req, res: Response, next: NextFunction) => {
26-
return next(jsonError('no API or function available within this banner route', 404));
25+
return next(CreateError.NotFound('no API or function available within this banner route'));
2726
});
2827

2928
export default router;

0 commit comments

Comments
 (0)