Deploy to production

.github/dependabot.yml

@@ -5,6 +5,13 @@ updates:
     schedule:
       interval: "monthly"
     groups:
-      all:
+      react:
+        patterns:
+          - "react"
+          - "react-*"
+      everything-else:
         patterns:
           - "*"
+        exclude-patterns:
+          - "react"
+          - "react-*"

.github/workflows/action-lint.yml

@@ -0,0 +1,31 @@
+name: GitHub Actions linting
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - '.github/workflows/*.ya?ml'
+  pull_request:
+    paths:
+      - '.github/workflows/*.ya?ml'
+
+concurrency:
+  group: "action-lint-${{ github.ref }}"
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  workflow_syntax:
+    permissions:
+      contents: read
+    name: Lint actions
+    uses: move-agency/actions-templates/.github/workflows/actionlint.yml@main
+  workflow_security:
+    permissions:
+      # required for workflows in private repositories
+      contents: read
+      actions: read
+    name: Check action security
+    uses: move-agency/actions-templates/.github/workflows/zizmor.yml@main

.github/workflows/build-docker-image.yml

@@ -1,4 +1,6 @@
 name: Build Docker Image
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   pull_request:
@@ -14,5 +16,7 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Build Docker Image
         run: docker build .

.github/workflows/build.yml

@@ -1,4 +1,6 @@
 name: Build
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   pull_request:
@@ -14,6 +16,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/check-changes-to-env.yml

@@ -1,4 +1,8 @@
 name: Check Changes to Env
+permissions:
+  contents: read
+  pull-requests: read
+  issues: write
 on:
   pull_request:
     types: [opened, synchronize]
@@ -12,16 +16,19 @@ jobs:
     - name: Get PR Number
       id: get-pr-number
       run: |
-        PR_NUMBER=$(echo "${{ github.ref }}" | awk 'BEGIN { FS = "/" } ; { print $3 }')
-        echo "pr-number=${PR_NUMBER}" >> $GITHUB_OUTPUT
+        PR_NUMBER=$(echo "${GITHUB_REF}" | awk 'BEGIN { FS = "/" } ; { print $3 }')
+        echo "pr-number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
     - name: Comment when dummy.txt changes
       uses: actions/github-script@v7
+      env:
+        PR_NUMBER: ${{ steps.get-pr-number.outputs.pr-number }}
+        REPO: ${{ github.repository }}
       with:
         script: |
           const filename = ".env.example"
           const filenameSha256 = await sha256(filename)
-          const diffURL = "https://github.com/${{ github.repository }}/pull/${{ steps.get-pr-number.outputs.pr-number }}/files#diff-" + filenameSha256
-          const docsURL = "https://github.com/${{ github.repository }}/wiki/Setting-Environment-Variables"
+          const diffURL = `https://github.com/${process.env.REPO}/pull/${process.env.PR_NUMBER}/files#diff-${filenameSha256}`
+          const docsURL = `https://github.com/${process.env.REPO}/wiki/Setting-Environment-Variables`
           const commentBody = `⚠️ It looks like [${filename}](${diffURL}) has changed. Remember to update the [Setting Environment Variables](${docsURL}) article accordingly.`
           const listComments = await github.rest.issues.listComments({
             ...context.repo,

.github/workflows/lint.yml

@@ -1,4 +1,6 @@
 name: Lint
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   pull_request:
@@ -12,7 +14,10 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install modules
         run: npm install
       - name: Run ESLint

.github/workflows/run-unit-tests.yml

@@ -1,4 +1,6 @@
 name: Run Unit Tests
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   pull_request:
@@ -14,6 +16,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:

.github/workflows/test-sql-queries.yml

@@ -1,4 +1,6 @@
 name: Test SQL Queries
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   pull_request:
@@ -11,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres:latest
+        image: postgres:17.5
         ports:
           - 5432:5432
         options: >-
@@ -26,6 +28,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Wait for PostgreSQL to be ready
         run: |
           until pg_isready -h localhost -p 5432; do

README.md

@@ -82,8 +82,8 @@ Two following long-lived branches exist:
 
 ## ❤️ The Product of a Shape Weekend
 
-Every year we go on Shape Weekend, three days where all employees in Shape get together for a hackathon to build amazing products. In 2023, a team of Shape developers with a passion for documentation and spec-driven development built Framna Docs and we've used it daily ever since!
+Before we became Framna, our company was known as Shape. Every year, we held "Shape Weekend", a three-day hackathon where all employees came together to build exciting new products. In 2023, one of those teams, passionate about documentation and spec-driven development, built Framna Docs. We have used it daily ever since.
 
 ---
 
-Framna Docs is built with ❤️ by [Shape](https://shape.dk) in Denmark. Oh, and [we are hiring](https://careers.shape.dk) 🤗
+Framna Docs is built with ❤️ by [Framna](https://framna.com/) in Denmark. Oh, and [we are hiring](https://framna.com/careers) 🤗

docker-compose.yaml

@@ -1,4 +1,3 @@
-version: '3.8'
 services:
   cache:
     image: redis:6.2-alpine
@@ -8,6 +7,26 @@ services:
     command: redis-server --save 20 1 --loglevel warning
     volumes: 
       - cache:/data
+
+  postgres:
+    image: postgres:16.8
+    restart: always
+    ports:
+    - '5432:5432'
+    environment:
+      - POSTGRES_USER=oscar
+      - POSTGRES_PASSWORD=passw0rd
+      - POSTGRES_DB=shape-docs
+
+  app:
+    build: .
+    ports:
+      - '3000:3000'
+    env_file:
+      - .env
+    depends_on:
+      - cache
+
 volumes:
   cache:
-    driver: local
+    driver: local