Skip to content

v1.0.1

Choose a tag to compare

View all tags
@rolivencia rolivencia released this 19 Jun 19:51
· 369 commits to main since this release
v1.0.1
565add0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Version 1.0.1 prepares the starter for going public: it adopts the Apache-2.0 license, adds community-health files, removes hard-coded credentials, and cleans up the environment configuration and the integration-test teardown (#488). Several of these changes ask something of every fork, so read Fork migration below before merging. The v1.0.1 tag and GitHub Release were published before the package.json version bump and this section; the section was written afterwards.

The first area is public readiness. The starter is now licensed under Apache-2.0, with LICENSE.md, NOTICE.md and a license field in every package.json (#490). CONTRIBUTING.md, SECURITY.md and CODE_OF_CONDUCT.md state the contribution policy: issues are welcome from anyone, pull requests come from ResetShop members, and vulnerabilities are reported privately. A workflow that runs only on the upstream repository closes pull requests from outside the organization (#493). A CODEOWNERS file routes reviews to the maintainers (#488). A personal email and a stray log file are removed from the tree, and the root package.json gains project metadata (#494). The README's setup guide is corrected and now points to files and symbols instead of line numbers, so it no longer goes stale with each edit (#492).

The second is credentials and setup. The database seed no longer creates an administrator from a password hash committed to the repository. It reads SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD, prompts for them in a terminal, or stops with a clear error. npm install no longer runs migrations and the seed, so an install no longer fails on a machine without a database (#491). CI reads the integration-test admin password from a masked Secret instead of a Variable that public workflow logs could show (#508).

The third is backend configuration. The authentication environment schema is split into token, password and security schemas, and CRON_SECRET moves to the cron schema. A process that needs only the password cost or the lockout settings no longer exits when the PASETO keys are unset, and the variable names do not change (#497). The seed and permission-sync scripts use the same database connector as the API, so a dropped idle connection no longer crashes them (#502).

The fourth is integration testing. The suite now closes its database pool, always stops the embedded Postgres and removes its temporary directories, so it no longer leaves orphaned node processes holding memory, and CI's peak memory is bounded (#517).

Fork migration

Every fork:

  • #491 - After npm install, run npm run drizzle:push-migrations and then npm run drizzle:seed yourself (with PG_CONNECTION_STRING set), and add both steps to any CI, Docker or deployment pipeline that relied on npm install to migrate and seed. postinstall now runs only node scripts/setup-skills.mjs.
  • #491 - Wherever npm run drizzle:seed runs without a terminal (CI, Docker, deployment), set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD (12–128 characters); SEED_ADMIN_FIRST_NAME and SEED_ADMIN_LAST_NAME are optional and default to Admin and User. With neither the variables nor a terminal, the seed exits with an error; in a terminal it prompts for them, with the password masked.
  • #508 - In your repository's Settings → Secrets and variables → Actions, create INTEGRATION_TEST_ADMIN_PASSWORD as a Secret and delete the Variable of the same name. The test-integration and e2e jobs in ci.yml now read secrets.INTEGRATION_TEST_ADMIN_PASSWORD and fail without it. PG_TEST_CONNECTION_STRING stays a Variable.
  • #488, #493 - Replace the owners in .github/CODEOWNERS (@juanblas09 @rolivencia) with your own maintainers, or delete the file. Repoint or delete the two links in .github/ISSUE_TEMPLATE/config.yml: they lead to the upstream repository's security advisories and CONTRIBUTING.md.
  • #493, #494 - If your repository is public, replace or delete CONTRIBUTING.md, SECURITY.md and CODE_OF_CONDUCT.md, and replace the description, author, repository, homepage and bugs fields of the root package.json: they describe ResetShop and the upstream repository, and arrive on merge.
  • #517 - Copy the integration-test teardown into apps/<your-app>: src/api/integration/setup/integration-setup.ts, global-setup.ts and embedded-pg-test-db.ts; the new DependencyContainer.teardownDb() in src/api/container/container.ts, which integration-setup.ts calls; teardownTimeout: 30_000 in vitest.integration.config.ts; and pool: 'forks' with maxWorkers: Number(process.env['VITEST_MAX_WORKERS']) || 2 in vitest.config.ts. Without them, integration workers can linger as orphaned node processes, and on Windows the embedded-Postgres temporary directories leak.

If your fork changed or reuses any of the following:

  • #497 - @config/auth.env (authEnv, parseAuthEnv, seedAuthEnv, resetAuthEnv, AuthEnv) is removed. Import PASETO_* and COOKIE_SECURE from @config/token.env (tokenEnv, TokenEnv, seedTokenEnv), BCRYPT_COST from @config/password.env (passwordEnv), AUTH_MAX_FAILED_ATTEMPTS, AUTH_LOCKOUT_DURATION and AUTH_CHANGE_PASSWORD_RATE_LIMIT_* from @config/security.env (securityEnv), and CRON_SECRET from @config/cron.env (cronEnv). createAuthConfig now takes (tokenSource, securitySource, cronSource), and createPasetoConfig takes a TokenEnv.
  • #502 - Standalone database scripts that build new Pool() and drizzle(pool) by hand: use createDrizzlePgConnector() and the DrizzleTransaction type from src/api/helpers/drizzle-postgres-connector.ts. Create the connector inside the entry function, and close it with db.$client.end() in a finally that runs before process.exit.
  • #491 - Your own copy of the seed script: copy src/db/seed.ts, the new src/db/seed-admin-credentials.ts and the four SEED_ADMIN_* fields of src/api/config/app.env.ts into apps/<your-app>, so it stops creating an administrator from a password hash committed to the repository.

Behaviour that changes with no action needed:

  • #497 - Environment variable names and defaults are unchanged. A process that reads only BCRYPT_COST, the lockout settings or CRON_SECRET no longer exits when PASETO_SECRET_KEY or PASETO_ISSUER is unset.
  • #490 - The root package.json license is now "Apache-2.0", and LICENSE.md and NOTICE.md arrive on merge. They cover the starter code; the license of your own code is yours to set.
  • #491 - The seed stays idempotent by email and never overwrites existing rows. On a database seeded before 1.0.1, running it with a different SEED_ADMIN_EMAIL creates a second administrator and keeps admin@sistema.com.
  • #491 - The process.env lint allowlist now also covers apps/**/src/db/**/*.ts.
  • #517 - npm run ci and npm run ci:verify run the test and build batch with --maxParallel=3, and the reference app's unit tests use at most 2 workers. Set VITEST_MAX_WORKERS to raise the limit.

Full changes

See every merged pull request in v1.0.1.

Changes

Public readiness

  • #490 - Adopts the Apache-2.0 license with LICENSE.md, NOTICE.md and a license field in every package.json.
  • #493 - Adds the contribution, security and conduct policies, and closes pull requests from outside the ResetShop organization.
  • #488 - Adds a CODEOWNERS file that routes reviews to the maintainers.
  • #494 - Removes a personal email and a committed log file, and adds project metadata to the root package.json.
  • #492 - Corrects the README setup guide and replaces its line-number citations with durable file and symbol references.

Credentials and setup

  • #491 - Takes the seed administrator's credentials from environment variables or a prompt, and stops running migrations and the seed on npm install.
  • #508 - Reads the integration-test admin password in CI from a masked Secret.

Backend configuration

  • #497 - Splits the authentication environment schema into token, password and security schemas, and moves CRON_SECRET to the cron schema.
  • #502 - Moves the seed and permission-sync scripts onto the shared database connector.

Integration testing

  • #517 - Closes the database pool, stops the embedded Postgres and removes its temporary directories at the end of the integration suite, and bounds CI memory.

What's Changed

  • #490 - Adopt Apache-2.0: LICENSE, NOTICE, and package.json license fields by @rolivencia in #495
  • Require issue-workflow PRs to link their originating issue by @rolivencia in #496
  • #497 - Decompose authEnv into token/password/security sub-schemas; fold CRON_SECRET into cron by @rolivencia in #498
  • #491 - Configurable admin seed + decouple seed/migrations from postinstall by @rolivencia in #500
  • #492 - Full README/docs accuracy pass with durable references by @rolivencia in #503
  • #493 - Public-but-org-only-PRs contributions policy + community-health files by @rolivencia in #505
  • #494 - Pre-public hygiene: remove personal email, error.log, add package metadata by @rolivencia in #506
  • #488 - Add CODEOWNERS review routing (epic in-repo closure) by @rolivencia in #507
  • #502 - Consolidate standalone DB scripts onto createDrizzlePgConnector + DrizzleTransaction by @rolivencia in #509
  • #508 - Source INTEGRATION_TEST_ADMIN_PASSWORD from a Secret in CI by @rolivencia in #510
  • #517 - Fix integration test teardown: orphaned processes, memory not freed, and embedded-pg temp-dir cleanup by @rolivencia in #518

Full Changelog: v1.0.0...v1.0.1

Contributors

rolivencia
Assets 2
Loading