Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions .github/workflows/trivy.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
name: Trivy Scanner

permissions:
contents: read
security-events: write
on:
push:
branches:
- main
- dev
pull_request:
jobs:
trivy-scan:
name: Use Trivy
runs-on: ubuntu-24.04

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
Ensure that ubuntu-24.04 is a valid and supported runner version. GitHub Actions currently supports ubuntu-latest, ubuntu-22.04, and ubuntu-20.04. Using an unsupported version may cause the workflow to fail.

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Run Trivy scanner in repo mode
uses: aquasecurity/[email protected]

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
Consider updating to the latest version of aquasecurity/trivy-action to benefit from the latest features and security patches. Verify compatibility with your workflow before updating.

with:
scan-type: "fs"
ignore-unfixed: true
format: "sarif"
output: "trivy-results.sarif"
severity: "CRITICAL,HIGH,UNKNOWN"
scanners: vuln,secret,misconfig,license
github-pat: ${{ secrets.GITHUB_TOKEN }}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ security]
Ensure that the GITHUB_TOKEN has the necessary permissions to perform the scan and upload results. Review the token's permissions to avoid potential security issues.


- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: "trivy-results.sarif"
12 changes: 11 additions & 1 deletion src/api/admin/admin.service.ts
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,16 @@ import {
} from 'src/shared/topcoder/challenges.service';
import { Logger } from 'src/shared/global';

function formatDate(date = new Date()) {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The formatDate function is defined but not used within this diff. Ensure that this function is necessary for the current scope or remove it to maintain clean code.

const pad = (n, z = 2) => String(n).padStart(z, '0');

return (
`${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ` +
`${pad(date.getHours())}:${pad(date.getMinutes())}:${pad(date.getSeconds())}.` +
`${pad(date.getMilliseconds(), 3)}`

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
Consider using a more standard date formatting library, such as date-fns or moment, to handle date formatting. This can improve maintainability and reduce potential errors in date manipulation.

);
}

/**
* The admin winning service.
*/
Expand Down Expand Up @@ -322,7 +332,7 @@ export class AdminService {
userId: +winning.winner_id,
status: body.paymentStatus,
amount: body.paymentAmount,
releaseDate: body.releaseDate,
releaseDate: formatDate(new Date(body.releaseDate)),

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The formatDate function is used to format the releaseDate. Ensure that formatDate handles all possible date formats that body.releaseDate might contain, and consider adding error handling for cases where the date format is invalid or conversion fails.

};

await this.tcChallengesService.updateLegacyPayments(
Expand Down