Add deployment pipeline and production assets#41
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's GuideAdds a full CI/CD pipeline with Docker-based local dev and staging/production deployments, introduces production-ready public/SEO assets, and enhances the in-app processing UX with status banners and clearer item states. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 4 issues, and left some high level feedback:
- The
dev.shscript’sexport $(grep -v '^#' .env | xargs)parsing will break on values containing spaces or#; consider switching to a more robust loader (e.g.,set -a; . ./.env; set +aor a small parser) to avoid subtle env bugs. - In
docker-compose.yml,appboth mounts./srcandserver.jsas read-only volumes and usesdevelop.watchon the same paths; simplifying to a single mechanism (either bind mounts ordevelop.watch) would reduce duplication and potential confusion about which source is authoritative. - The CI pipeline runs
npx tsc --noEmitin both thebackendandfrontendjobs; if they share the same tsconfig, consider running the type-check once or splitting configs so each job only checks what it needs to cut CI time and redundant work.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `dev.sh` script’s `export $(grep -v '^#' .env | xargs)` parsing will break on values containing spaces or `#`; consider switching to a more robust loader (e.g., `set -a; . ./.env; set +a` or a small parser) to avoid subtle env bugs.
- In `docker-compose.yml`, `app` both mounts `./src` and `server.js` as read-only volumes and uses `develop.watch` on the same paths; simplifying to a single mechanism (either bind mounts or `develop.watch`) would reduce duplication and potential confusion about which source is authoritative.
- The CI pipeline runs `npx tsc --noEmit` in both the `backend` and `frontend` jobs; if they share the same tsconfig, consider running the type-check once or splitting configs so each job only checks what it needs to cut CI time and redundant work.
## Individual Comments
### Comment 1
<location path="public/sitemap.xml" line_range="3-8" />
<code_context>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+ <url>
+ <loc>https://spectracleanse.com/</loc>
+ <lastmod>2026-05-24</lastmod>
+ <changefreq>weekly</changefreq>
+ <priority>1.0</priority>
</code_context>
<issue_to_address>
**suggestion:** Avoid hard-coding a fixed lastmod date in the sitemap.
Using a fixed `<lastmod>` date will quickly become inaccurate and can mislead crawlers. Prefer either omitting `lastmod` or generating it dynamically during build/deploy so it reflects the real content update time.
```suggestion
<url>
<loc>https://spectracleanse.com/</loc>
<changefreq>weekly</changefreq>
<priority>1.0</priority>
</url>
```
</issue_to_address>
### Comment 2
<location path=".github/workflows/ci-cd.yml" line_range="38-44" />
<code_context>
+ - name: Run npm audit (info level allowed)
+ run: npm audit --audit-level=moderate || true
+
+ - name: Scan for secrets with TruffleHog
+ uses: trufflesecurity/trufflehog@main
+ with:
+ path: ./
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Pin the TruffleHog action to a version or commit instead of using @main.
Referencing `trufflesecurity/trufflehog@main` means the workflow may change or break as the main branch evolves. For stability and supply-chain security, pin this action to a specific version tag or commit SHA (e.g. `@v3` or `@<sha>`).
```suggestion
- name: Scan for secrets with TruffleHog
uses: trufflesecurity/trufflehog@v3
with:
path: ./
base: ${{ github.event.repository.default_branch }}
head: HEAD
extra_args: --debug
```
</issue_to_address>
### Comment 3
<location path=".github/workflows/staging.yml" line_range="35-36" />
<code_context>
+ with:
+ images: |
+ ${{ env.REGISTRY }}/${{ secrets.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}
+ tags: |
+ type=ref,event=branch
+ type=sha,prefix={{branch}}-
</code_context>
<issue_to_address>
**issue (bug_risk):** Use `workflow_run.head_sha` instead of `head_commit.sha` for more robust tagging.
`github.event.workflow_run.head_commit` can be `null` (e.g., for some `workflow_run` events or deleted branches), so `head_commit.sha` isn’t always available. Using `github.event.workflow_run.head_sha` gives a reliable commit reference; please use that for both the image tag and the deployment payload.
</issue_to_address>
### Comment 4
<location path="dev.sh" line_range="8-12" />
<code_context>
+echo "🚀 Starting SpectraCleanse AI in development mode..."
+
+# Load .env if it exists, otherwise use defaults
+if [ -f .env ]; then
+ echo "📝 Loading .env"
+ export $(grep -v '^#' .env | xargs)
+else
+ echo "⚠️ .env not found. Using defaults. Copy .env.example to .env for custom settings."
</code_context>
<issue_to_address>
**suggestion (bug_risk):** The .env loader can break with values containing spaces or special characters.
This pattern will mis-parse values containing spaces, `#`, or extra `=` and can introduce malformed environment variables. Prefer a safer shell approach like `set -a; . ./.env; set +a` / `set +a`, or rely on Docker/Compose `env_file` support instead.
```suggestion
# Load .env if it exists, otherwise use defaults
if [ -f .env ]; then
echo "📝 Loading .env"
set -a
# shellcheck disable=SC1091
. ./.env
set +a
else
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+3
to
+8
| <url> | ||
| <loc>https://spectracleanse.com/</loc> | ||
| <lastmod>2026-05-24</lastmod> | ||
| <changefreq>weekly</changefreq> | ||
| <priority>1.0</priority> | ||
| </url> |
There was a problem hiding this comment.
suggestion: Avoid hard-coding a fixed lastmod date in the sitemap.
Using a fixed <lastmod> date will quickly become inaccurate and can mislead crawlers. Prefer either omitting lastmod or generating it dynamically during build/deploy so it reflects the real content update time.
Suggested change
| <url> | |
| <loc>https://spectracleanse.com/</loc> | |
| <lastmod>2026-05-24</lastmod> | |
| <changefreq>weekly</changefreq> | |
| <priority>1.0</priority> | |
| </url> | |
| <url> | |
| <loc>https://spectracleanse.com/</loc> | |
| <changefreq>weekly</changefreq> | |
| <priority>1.0</priority> | |
| </url> |
Comment on lines
+38
to
+44
| - name: Scan for secrets with TruffleHog | ||
| uses: trufflesecurity/trufflehog@main | ||
| with: | ||
| path: ./ | ||
| base: ${{ github.event.repository.default_branch }} | ||
| head: HEAD | ||
| extra_args: --debug |
There was a problem hiding this comment.
🚨 suggestion (security): Pin the TruffleHog action to a version or commit instead of using @main.
Referencing trufflesecurity/trufflehog@main means the workflow may change or break as the main branch evolves. For stability and supply-chain security, pin this action to a specific version tag or commit SHA (e.g. @v3 or @<sha>).
Suggested change
| - name: Scan for secrets with TruffleHog | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| base: ${{ github.event.repository.default_branch }} | |
| head: HEAD | |
| extra_args: --debug | |
| - name: Scan for secrets with TruffleHog | |
| uses: trufflesecurity/trufflehog@v3 | |
| with: | |
| path: ./ | |
| base: ${{ github.event.repository.default_branch }} | |
| head: HEAD | |
| extra_args: --debug |
Comment on lines
+35
to
+36
| tags: | | ||
| ${{ secrets.DOCKERHUB_USERNAME }}/spectracleanse-api:staging-${{ github.event.workflow_run.head_commit.sha }} |
There was a problem hiding this comment.
issue (bug_risk): Use workflow_run.head_sha instead of head_commit.sha for more robust tagging.
github.event.workflow_run.head_commit can be null (e.g., for some workflow_run events or deleted branches), so head_commit.sha isn’t always available. Using github.event.workflow_run.head_sha gives a reliable commit reference; please use that for both the image tag and the deployment payload.
Comment on lines
+8
to
+12
| # Load .env if it exists, otherwise use defaults | ||
| if [ -f .env ]; then | ||
| echo "📝 Loading .env" | ||
| export $(grep -v '^#' .env | xargs) | ||
| else |
There was a problem hiding this comment.
suggestion (bug_risk): The .env loader can break with values containing spaces or special characters.
This pattern will mis-parse values containing spaces, #, or extra = and can introduce malformed environment variables. Prefer a safer shell approach like set -a; . ./.env; set +a / set +a, or rely on Docker/Compose env_file support instead.
Suggested change
| # Load .env if it exists, otherwise use defaults | |
| if [ -f .env ]; then | |
| echo "📝 Loading .env" | |
| export $(grep -v '^#' .env | xargs) | |
| else | |
| # Load .env if it exists, otherwise use defaults | |
| if [ -f .env ]; then | |
| echo "📝 Loading .env" | |
| set -a | |
| # shellcheck disable=SC1091 | |
| . ./.env | |
| set +a | |
| else |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds CI/CD and staging workflows, Docker/dev scripts, pipeline docs, production public assets, smoke test files, and updates the app shell/docs.
Summary by Sourcery
Introduce an automated Docker-based CI/CD pipeline with staging and production deployments, along with UX and SEO improvements for the web app.
New Features:
Enhancements:
Build:
Deployment:
Documentation:
Tests:
Chores: