Openshift updates ; Dependency & Maintenance update

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# With this line @NatLibFi/melinda-js-lead owns review rights of the repository
+* @NatLibFi/melinda-js-lead

.github/dependabot.yml

@@ -0,0 +1,40 @@
+# NatLibFi/Melinda maintenance strategy
+# https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "06:30"
+      timezone: "Europe/Helsinki"
+    target-branch: "dependencies"
+
+  # Minor updates to npm production dependencies daily
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "06:45"
+      timezone: "Europe/Helsinki"
+    versioning-strategy: lockfile-only
+    allow:
+      - dependency-type: "production"
+    target-branch: "dependencies"
+
+  # Major updates to npm dependencies weekly @tuesday
+  # Not possible yet https://github.com/dependabot/dependabot-core/issues/1778
+  # - package-ecosystem: "npm"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #     day: "tuesday"
+  #     time: "07:00"
+  #     timezone: "Europe/Helsinki"
+  #   versioning-strategy: increase-if-necessary
+  #   labels:
+  #     - "npm major dependencies"
+  #   reviewers:
+  #     - "natlibfi/melinda-js-lead"

.github/workflows/melinda-node-tests.yml

@@ -0,0 +1,106 @@
+# Melinda node tests
+
+name: Melinda-node-tests
+
+on: push
+
+jobs:
+  build-node-versions:
+    name: Node version matrix
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [18.x, 20.x, 22.x]
+        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
+
+    steps:
+    - name: Checkout the code
+      uses: actions/checkout@v3
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v3
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'npm'
+      env:
+        NPM_CONFIG_IGNORE_SCRIPTS: true
+    - run: npm audit --package-lock-only --production --audit-level=moderate
+    - run: npm i
+    - run: npm test
+    - run: npm run build --if-present
+
+  njsscan:
+    name: Njsscan-check
+    runs-on: ubuntu-latest
+    container: docker://node:18
+
+    steps:
+    - name: Checkout the code
+      uses: actions/checkout@v3
+    - name: nodejsscan scan
+      id: njsscan
+      uses: ajinabraham/njsscan-action@master
+      with:
+        args: '.'
+
+  license-scan:
+    name: License compliance check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: mikaelvesavuori/[email protected]
+        with:
+          exclude_pattern: /^@natlibfi/
+
+  openshift-webhook:
+    name: OpenShift webhook for image builder
+    needs: [build-node-versions, njsscan]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Test webhook
+        uses: joelwmale/webhook-action@master
+        if: github.ref == 'refs/heads/test'
+        with:
+          url: ${{ secrets.WEBHOOK_URL_TEST }}
+          body: '{}'
+      - name: Prod webhook
+        uses: joelwmale/webhook-action@master
+        if: github.ref == 'refs/heads/master'
+        with:
+          url: ${{ secrets.WEBHOOK_URL_PROD }}
+          body: '{}'
+
+#  quayio:
+#     name: Quay.io image builder & publisher
+#     needs: [build-node-versions, njsscan]
+#     runs-on: ubuntu-latest
+#     if: github.actor!= 'dependabot[bot]'   # ignore the pull request which comes from user dependabot, because it does not access to secrets
+
+#     steps:
+#       - uses: actions/checkout@v3
+#       - name: Docker meta
+#         id: meta
+#         uses: docker/metadata-action@v4
+#         with:
+#            images: quay.io/${{ github.repository }}
+#           tags: |
+#             type=raw,value=latest,enable=${{ endsWith(github.ref, github.event.repository.default_branch) }}
+#             type=ref,event=branch
+#             type=ref,event=pr
+#             type=semver,pattern={{version}}
+#             type=semver,pattern={{major}}.{{minor}}
+#             type=semver,pattern={{major}}
+#       - name: Login to Quay.io
+#         uses: docker/login-action@v2
+#         with:
+#           registry: quay.io
+#           username: ${{ secrets.MELINDA_QUAY_IO_USERNAME }}
+#           password: ${{ secrets.MELINDA_QUAY_IO_PASSWORD }}
+#       - name: Build and publish image to Quay.io
+#         uses: docker/build-push-action@v3
+#         with:
+#           context: .
+#           push: true
+#           tags: ${{ steps.meta.outputs.tags }}

.gitignore

@@ -8,4 +8,8 @@ tnsnames.ora
 sqlnet.ora
 wallet
 instantclient
-sets*
+sets*
+volume/oracle/sqlnet.ora.appt
+volume/oracle/tnsnames.ora.appt
+volume/oracle/tnsnames.ora.tammi
+volume/oracle/tnsnames.ora.kuusi

Dockerfile

@@ -1,44 +1,15 @@
-FROM node:12 as builder
-ENTRYPOINT ["./entrypoint.sh"]
+FROM node:20-alpine
 CMD ["/usr/local/bin/node", "index.js"]
 WORKDIR /home/node
 
-ARG BUILD_SCRIPT=build
-
-ENV LD_LIBRARY_PATH /home/node/instantclient
-
 COPY --chown=node:node . build
 
-RUN apt-get update && apt-get install -y build-essential git sudo \
-  && cd build \
-  && sudo -u node \
-    OCI_LIB_DIR=/home/node/build/instantclient \
-    OCI_INC_DIR=/home/node/build/instantclient/sdk/include \
-    sh -c "npm ci && npm run ${BUILD_SCRIPT}" \
-  && sudo -u node \
-    OCI_LIB_DIR=/home/node/instantclient \
-    OCI_INC_DIR=/home/node/instantclient/sdk/include \
-    npm ci --production
-
-FROM node:12
-WORKDIR /home/node
-
-ENTRYPOINT ["./entrypoint.sh"]
-CMD ["/usr/local/bin/node", "index.js"]
-WORKDIR /home/node
-
-ENV TNS_ADMIN /home/node
-ENV LD_LIBRARY_PATH /home/node/instantclient
-ENV ORACLE_WALLET_DIRECTORY /home/node/wallet
-ENV ORACLE_CONNECT_TIMEOUT 10
-
-COPY --chown=node:node instantclient /home/node/instantclient
-COPY --chown=node:node *.template entrypoint.sh /home/node/
-
-COPY --from=builder --chown=node:node /home/node/build/node_modules/ /home/node/node_modules
-COPY --from=builder --chown=node:node /home/node/build/dist/ /home/node/
-
-RUN apt-get update && apt-get install -y tzdata libaio1 \
-  && apt-get clean all
+RUN apk add -U --no-cache --virtual .build-deps git build-base sudo \
+  && sudo -u node sh -c 'cd build && npm install && npm run build' \
+  && sudo -u node cp -r build/package.json build/dist/* . \
+  && sudo -u node npm install --prod \
+  && sudo -u node npm cache clean -f \
+  && apk del .build-deps \
+  && rm -rf build tmp/* /var/cache/apk/*
 
 USER node

Dockerfile.old

@@ -0,0 +1,25 @@
+FROM node:18-alpine as builder
+WORKDIR /home/node
+COPY . .
+
+RUN sh -c 'npm i --ignore-scripts && npm run build && rm -rf node_modules'
+RUN sh -c 'npm i --ignore-scripts --production'
+
+FROM node:18-alpine
+CMD ["/usr/local/bin/node", "index.js"]
+WORKDIR /home/node
+#USER node
+
+#Update
+RUN apk update && apk upgrade
+
+# Timezone setting
+RUN apk add --no-cache tzdata
+ENV TZ=Europe/Helsinki
+
+COPY --from=builder /home/node/dist/ .
+COPY --from=builder /home/node/node_modules node_modules
+COPY --from=builder /home/node/package.json .
+COPY --from=builder /home/node/package-lock.json .
+
+RUN apk add libaio gcompat

README.md

@@ -15,6 +15,6 @@
 
 ## License and copyright
 
-Copyright (c) 2019-2020 **University Of Helsinki (The National Library Of Finland)**
+Copyright (c) 2019-2020, 2023-2024 **University Of Helsinki (The National Library Of Finland)**
 
 This project's source code is licensed under the terms of **Apache License 2.0** .