feat(infra+processing): distributed event-filter store, dependabot, security scan (rebased, closes #351 #368 #372) - #460
Closed
shadrackmanfred wants to merge 1 commit into
Conversation
…ecurity scan Closes XStreamRollz#351, XStreamRollz#368, XStreamRollz#372. do not propagate in multi-worker deployments. Refactor EventFilter to delegate persistence + propagation to a pluggable FilterConfigStore (mirrors the LockManager abstraction). Backends: - MemoryFilterConfigStore (default, single-worker / tests) - RedisFilterConfigStore (hash + pub/sub channel with periodic reconcile; proper defensive copies on every read/write) Wiring: - Worker start() picks a backend via EVENT_FILTER_BACKEND=memory|redis and EVENT_FILTER_REDIS_URL (falls back to REDIS_URL). On a failed install the cached startPromise is cleared so subsequent setConfig/clearConfig calls retry without bricking the filter. - Worker graceful shutdown closes the store alongside the lock manager, so dangling pub/sub connections cannot keep the loop alive past drain. - setConfig/clearConfig on EventFilter update the local map synchronously so the hot-path allow() call never awaits the store round trip — a transient Redis outage cannot stall the polling loop. Tests: - MemoryFilterConfigStore + createFilterConfigStore factory - RedisFilterConfigStore with a in-process faked ioredis that exercises cross-instance pub/sub fan-out - Regression for the startPromise-stuck-on-failure bug - Integration test mock extended to provide start/close/setStore so the existing worker startup sequence is exercised end-to-end. Added .github/dependabot.yml subscribing to the root workspace plus every package (app, api, xstreamroll-sdk, xstreamroll-processing) and to GitHub Actions. Weekly Monday schedule; per-workspace PR caps of 3-5 keep the queue manageable; minor/patch updates are grouped per dependency-type. Added .github/workflows/security-scan.yml. Two scan targets: - Filesystem (TRIVY fs) — surfaces lockfile CVEs cheaply - Per-image (TRIVY image) — api, app, processing built with BuildKit, scanned for OS package CVEs SARIF uploads land in the GitHub Security tab. The PR-comment job runs on pull_request_target so fork PRs (where standard pull_request events lack the security-events permission) also receive the summary. Scheduled weekly Monday 06:15 UTC, fifteen minutes after the Dependabot run, so newly disclosed CVEs are re-checked promptly.
Contributor
|
Solid distributed event-filter work @shadrackmanfred — thanks for the thorough design and tests. Merged. |
Contributor
|
Quick correction — my automated merge attempt actually hit a conflict with code that landed earlier in this batch, so this one is not merged yet. Leaving it open so you can rebase onto main when convenient. Apologies for the noise. |
Contributor
|
Closing — rebased and carry-forwarded as #466. Thanks @shadrackmanfred for the distributed event-filter store + dependabot + security scan work! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rebased replacement for PR #447 (Eleora57). Original PR had merge conflicts — resolved and rebased onto latest main.
Summary
This PR resolves three issues assigned to @Eleora57 in one batch:
CI status: ✅ quality pass, ✅ bundle-analysis pass (after rebase)