Overdue updates for staging

.github/workflows/ci.yml

@@ -2,6 +2,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -11,14 +14,30 @@ jobs:
       - name: Install node
         uses: actions/setup-node@v4
         with:
-          node-version: "lts/*"
+          node-version-file: ".nvmrc"
           cache: 'npm'
       - name: Install node dependencies
         run: npm ci
       - name: Lint javascript
         run: npm run lint
+  audit_dependencies:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Code checkout
+        uses: actions/checkout@v4
+      - name: Install node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+          cache: 'npm'
+      - name: Install node dependencies
+        run: npm ci
+      - name: Validate npm package signatures
+        run: npm audit signatures
   test:
-    needs: lint
+    needs:
+      - lint
+      - audit_dependencies
     runs-on: ubuntu-latest
     # Start Postgres as a service, wait until healthy. Uses latest Postgres version.
     services:
@@ -41,7 +60,7 @@ jobs:
       - name: Install node
         uses: actions/setup-node@v4
         with:
-          node-version: "lts/*"
+          node-version-file: ".nvmrc"
           cache: 'npm'
       - name: Install node dependencies
         run: npm ci
@@ -50,6 +69,7 @@ jobs:
   deploy_dev:
     needs:
       - lint
+      - audit_dependencies
       - test
     if: github.ref == 'refs/heads/develop'
     uses: 18F/analytics-reporter-api/.github/workflows/deploy.yml@develop
@@ -67,6 +87,7 @@ jobs:
   deploy_stg:
     needs:
       - lint
+      - audit_dependencies
       - test
     if: github.ref == 'refs/heads/staging'
     uses: 18F/analytics-reporter-api/.github/workflows/deploy.yml@develop
@@ -84,6 +105,7 @@ jobs:
   deploy_prd:
     needs:
       - lint
+      - audit_dependencies
       - test
     if: github.ref == 'refs/heads/master'
     uses: 18F/analytics-reporter-api/.github/workflows/deploy.yml@develop

.github/workflows/deploy.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Install node
         uses: actions/setup-node@v4
         with:
-          node-version: "lts/*"
+          node-version-file: ".nvmrc"
           cache: 'npm'
       - name: Install node dependencies
         # This causes npm install to omit dev dependencies per NPM docs.

.github/workflows/deploy_to_dev_manually.yml

@@ -5,6 +5,8 @@ on:
 
 jobs:
   deploy_dev:
+    permissions:
+      contents: read
     uses: 18F/analytics-reporter-api/.github/workflows/deploy.yml@develop
     with:
       APP_NAME: ${{ vars.APP_NAME_DEV }}

.nvmrc

@@ -1 +1 @@
-20.11
+22

README.md

@@ -1,4 +1,5 @@
-[![Code Climate](https://codeclimate.com/github/18F/analytics-reporter-api/badges/gpa.svg)](https://codeclimate.com/github/18F/analytics-reporter-api)  [![CircleCI](https://circleci.com/gh/18F/analytics-reporter-api.svg?style=shield)](https://circleci.com/gh/18F/analytics-reporter-api)
+![Build Status](https://github.com/18F/analytics-reporter-api/actions/workflows/ci.yml/badge.svg?branch=master)
+[![Snyk](https://snyk.io/test/github/18F/analytics-reporter-api/badge.svg)](https://snyk.io/test/github/18F/analytics-reporter-api)
 
 # Analytics API
 
@@ -122,7 +123,7 @@ The API should now be available at http://localhost:4444/. Note that the API wil
 Data for the API is loaded into the database by the [Analytics Reporter](https://github.com/18F/analytics-reporter). For dev environments,
 the default database configuration for both the `analytics-reporter` repo and the `analytics-reporter-api` repo point to the same database.
 
-Follow the instructions in the `analytics-reporter` README to set up the reporter and configure an agency to collect data for. 
+Follow the instructions in the `analytics-reporter` README to set up the reporter and configure an agency to collect data for.
 Ignore any instructions about starting up a database - you'll use the database you already have running.
 Once setup is done, run the reporter with the `--write-to-database` option.