Skip to content

Commit

Permalink
feat(mojaloop/#2092)!: upgrade nodeJS version for core services (#125)
Browse files Browse the repository at this point in the history
feat(mojaloop/#2092): upgrade nodeJS version for core services - mojaloop/project#2092
- Update ci machines/slack announcements/automated releases
- Bumped dependencies
- Major bump since big dep version leap
- Removed eslint rc/ignore since library uses standard and has no ts types and as such does not need these.

Notes:
- npm-audit-resolver v3.0.0-7 is a candidate release to resolve compatibility with npm v7+ as described in naugtur/npm-audit-resolver#34. This will need to be addressed going forward as npm run audit:resolve (i.e. resolve-audit) is currently not functioning. As a work-around, we need to manually run the following command npm audit fix. The npm run audit:check (i.e. check-audit) still works as expected.
- Primarily had to update `node-rdkafka`>=2.11 to support node 16 which one of the 3ppi services depends on.
- Tape dependency has been added to the ncurc config to ignore dep:checks as v5+ will cause tests to fail. To be addressed by a future story.

BREAKING CHANGE: major version bump for node v16 LTS support, and re-structuring of project directories to align to core Mojaloop repositories!
  • Loading branch information
kleyow authored May 19, 2022
1 parent d07dd2e commit 35313c3
Show file tree
Hide file tree
Showing 15 changed files with 15,528 additions and 3,682 deletions.
341 changes: 268 additions & 73 deletions .circleci/config.yml

Large diffs are not rendered by default.

2 changes: 0 additions & 2 deletions .eslintignore

This file was deleted.

31 changes: 0 additions & 31 deletions .eslintrc

This file was deleted.

6 changes: 6 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,9 @@ typings/

# VSCode directory
.vscode

# General files to ignore
*IGNORE*

# Ignore test results
**/test/results/*
6 changes: 6 additions & 0 deletions .ncurc.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
module.exports = {
reject: [
// TODO: Upgrading tape to v5+ causes tests to fail due to assert.end() being called multiple times. Will need to address this! Perhaps even move to Jest?
"tape"
]
}
5 changes: 0 additions & 5 deletions .ncurc.json

This file was deleted.

2 changes: 1 addition & 1 deletion .nvmrc
Original file line number Diff line number Diff line change
@@ -1 +1 @@
10.15.1
16.15.0
48 changes: 48 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,51 @@ Streaming library for central services

### Kafka
Refer to documentation in [src/kafka/readme.md](./src/kafka/readme.md)

## Auditing Dependencies

We use `npm-audit-resolver` along with `npm audit` to check dependencies for node vulnerabilities, and keep track of resolved dependencies with an `audit-resolve.json` file.

To start a new resolution process, run:

```bash
npm run audit:resolve
```

You can then check to see if the CI will pass based on the current dependencies with:

```bash
npm run audit:check
```

And commit the changed `audit-resolve.json` to ensure that CircleCI will build correctly.

## Automated Releases

As part of our CI/CD process, we use a combination of CircleCI, standard-version
npm package and github-release CircleCI orb to automatically trigger our releases
and image builds. This process essentially mimics a manual tag and release.

On a merge to master, CircleCI is configured to use the mojaloopci github account
to push the latest generated CHANGELOG and package version number.

Once those changes are pushed, CircleCI will pull the updated master, tag and
push a release triggering another subsequent build that also publishes a docker image.

### Potential problems

* There is a case where the merge to master workflow will resolve successfully, triggering
a release. Then that tagged release workflow subsequently failing due to the image scan,
audit check, vulnerability check or other "live" checks.

This will leave master without an associated published build. Fixes that require
a new merge will essentially cause a skip in version number or require a clean up
of the master branch to the commit before the CHANGELOG and bump.

This may be resolved by relying solely on the previous checks of the
merge to master workflow to assume that our tagged release is of sound quality.
We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier
is a boon.

* It is unknown if a race condition might occur with multiple merges with master in
quick succession, but this is a suspected edge case.
Loading

0 comments on commit 35313c3

Please sign in to comment.