Skip to content

Commit 805f40c

Browse files
DavidsonGomesDavidsonGomes
committed
feat: add code quality tools and security policy
- Configure Husky with pre-commit and pre-push hooks - Add commitlint for conventional commit validation - Create comprehensive security policy (SECURITY.md) - Add GitHub Actions for security scanning and dependency review - Create PR and issue templates for better collaboration - Add Canny.io references for community feedback - Fix path traversal vulnerability in /assets endpoint - Create MySQL schema sync analysis tools
1 parent 09ee2e6 commit 805f40c

File tree

12 files changed

+2314
-25
lines changed

12 files changed

+2314
-25
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: 🐛 Bug Report
2+
description: Report a bug or unexpected behavior
3+
title: "[BUG] "
4+
labels: ["bug", "needs-triage"]
5+
assignees: []
6+
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thanks for taking the time to fill out this bug report!
12+
Please search existing issues before creating a new one.
13+
14+
- type: textarea
15+
id: description
16+
attributes:
17+
label: 📋 Bug Description
18+
description: A clear and concise description of what the bug is.
19+
placeholder: Describe the bug...
20+
validations:
21+
required: true
22+
23+
- type: textarea
24+
id: reproduction
25+
attributes:
26+
label: 🔄 Steps to Reproduce
27+
description: Steps to reproduce the behavior
28+
placeholder: |
29+
1. Go to '...'
30+
2. Click on '....'
31+
3. Scroll down to '....'
32+
4. See error
33+
validations:
34+
required: true
35+
36+
- type: textarea
37+
id: expected
38+
attributes:
39+
label: ✅ Expected Behavior
40+
description: A clear and concise description of what you expected to happen.
41+
placeholder: What should happen?
42+
validations:
43+
required: true
44+
45+
- type: textarea
46+
id: actual
47+
attributes:
48+
label: ❌ Actual Behavior
49+
description: A clear and concise description of what actually happened.
50+
placeholder: What actually happened?
51+
validations:
52+
required: true
53+
54+
- type: textarea
55+
id: environment
56+
attributes:
57+
label: 🌍 Environment
58+
description: Please provide information about your environment
59+
value: |
60+
- OS: [e.g. Ubuntu 20.04, Windows 10, macOS 12.0]
61+
- Node.js version: [e.g. 18.17.0]
62+
- Evolution API version: [e.g. 2.3.3]
63+
- Database: [e.g. PostgreSQL 14, MySQL 8.0]
64+
- Connection type: [e.g. Baileys, WhatsApp Business API]
65+
validations:
66+
required: true
67+
68+
- type: textarea
69+
id: logs
70+
attributes:
71+
label: 📋 Logs
72+
description: If applicable, add logs to help explain your problem.
73+
placeholder: Paste relevant logs here...
74+
render: shell
75+
76+
- type: textarea
77+
id: additional
78+
attributes:
79+
label: 📝 Additional Context
80+
description: Add any other context about the problem here.
81+
placeholder: Any additional information...

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: ✨ Feature Request
2+
description: Suggest a new feature or enhancement
3+
title: "[FEATURE] "
4+
labels: ["enhancement", "needs-triage"]
5+
assignees: []
6+
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thanks for suggesting a new feature!
12+
Please check our [Feature Requests on Canny](https://evolutionapi.canny.io/feature-requests) first.
13+
14+
- type: textarea
15+
id: problem
16+
attributes:
17+
label: 🎯 Problem Statement
18+
description: Is your feature request related to a problem? Please describe.
19+
placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
20+
validations:
21+
required: true
22+
23+
- type: textarea
24+
id: solution
25+
attributes:
26+
label: 💡 Proposed Solution
27+
description: Describe the solution you'd like
28+
placeholder: A clear and concise description of what you want to happen.
29+
validations:
30+
required: true
31+
32+
- type: textarea
33+
id: alternatives
34+
attributes:
35+
label: 🔄 Alternatives Considered
36+
description: Describe alternatives you've considered
37+
placeholder: A clear and concise description of any alternative solutions or features you've considered.
38+
39+
- type: dropdown
40+
id: priority
41+
attributes:
42+
label: 📊 Priority
43+
description: How important is this feature to you?
44+
options:
45+
- Low - Nice to have
46+
- Medium - Would be helpful
47+
- High - Important for my use case
48+
- Critical - Blocking my work
49+
validations:
50+
required: true
51+
52+
- type: dropdown
53+
id: component
54+
attributes:
55+
label: 🧩 Component
56+
description: Which component does this feature relate to?
57+
options:
58+
- WhatsApp Integration (Baileys)
59+
- WhatsApp Business API
60+
- Chatwoot Integration
61+
- Typebot Integration
62+
- OpenAI Integration
63+
- Dify Integration
64+
- API Endpoints
65+
- Database
66+
- Authentication
67+
- Webhooks
68+
- File Storage
69+
- Other
70+
71+
- type: textarea
72+
id: use_case
73+
attributes:
74+
label: 🎯 Use Case
75+
description: Describe your specific use case for this feature
76+
placeholder: How would you use this feature? What problem does it solve for you?
77+
validations:
78+
required: true
79+
80+
- type: textarea
81+
id: additional
82+
attributes:
83+
label: 📝 Additional Context
84+
description: Add any other context, screenshots, or examples about the feature request here.
85+
placeholder: Any additional information, mockups, or examples...

‎.github/dependabot.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for npm
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 10
11+
commit-message:
12+
prefix: "chore"
13+
prefix-development: "chore"
14+
include: "scope"
15+
16+
# Enable version updates for GitHub Actions
17+
- package-ecosystem: "github-actions"
18+
directory: "/"
19+
schedule:
20+
interval: "weekly"
21+
day: "monday"
22+
time: "09:00"
23+
open-pull-requests-limit: 5
24+
commit-message:
25+
prefix: "ci"
26+
include: "scope"
27+
28+
# Enable version updates for Docker
29+
- package-ecosystem: "docker"
30+
directory: "/"
31+
schedule:
32+
interval: "weekly"
33+
day: "monday"
34+
time: "09:00"
35+
open-pull-requests-limit: 5
36+
commit-message:
37+
prefix: "chore"
38+
include: "scope"

‎.github/pull_request_template.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
## 📋 Description
2+
<!-- Describe your changes in detail -->
3+
4+
## 🔗 Related Issue
5+
<!-- Link to the issue this PR addresses -->
6+
Closes #(issue_number)
7+
8+
## 🧪 Type of Change
9+
<!-- Mark with an `x` all the checkboxes that apply -->
10+
- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
11+
- [ ] ✨ New feature (non-breaking change which adds functionality)
12+
- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
13+
- [ ] 📚 Documentation update
14+
- [ ] 🔧 Refactoring (no functional changes)
15+
- [ ] ⚡ Performance improvement
16+
- [ ] 🧹 Code cleanup
17+
- [ ] 🔒 Security fix
18+
19+
## 🧪 Testing
20+
<!-- Describe the testing you performed to verify your changes -->
21+
- [ ] Manual testing completed
22+
- [ ] Functionality verified in development environment
23+
- [ ] No breaking changes introduced
24+
- [ ] Tested with different connection types (if applicable)
25+
26+
## 📸 Screenshots (if applicable)
27+
<!-- Add screenshots to help explain your changes -->
28+
29+
## ✅ Checklist
30+
<!-- Mark with an `x` all the checkboxes that apply -->
31+
- [ ] My code follows the project's style guidelines
32+
- [ ] I have performed a self-review of my code
33+
- [ ] I have commented my code, particularly in hard-to-understand areas
34+
- [ ] I have made corresponding changes to the documentation
35+
- [ ] My changes generate no new warnings
36+
- [ ] I have manually tested my changes thoroughly
37+
- [ ] I have verified the changes work with different scenarios
38+
- [ ] Any dependent changes have been merged and published
39+
40+
## 📝 Additional Notes
41+
<!-- Any additional information, concerns, or questions -->

‎.github/workflows/check_code_quality.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
name: Check Code Quality
22

3-
on: [pull_request]
3+
on:
4+
pull_request:
5+
branches: [ main, develop ]
6+
push:
7+
branches: [ main, develop ]
48

59
jobs:
610
check-lint-and-build:

‎.github/workflows/security.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Security Scan
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
schedule:
9+
- cron: '0 0 * * 1' # Weekly on Mondays
10+
11+
jobs:
12+
codeql:
13+
name: CodeQL Analysis
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 15
16+
permissions:
17+
actions: read
18+
contents: read
19+
security-events: write
20+
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
language: [ 'javascript' ]
25+
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@v4
29+
30+
- name: Initialize CodeQL
31+
uses: github/codeql-action/init@v3
32+
with:
33+
languages: ${{ matrix.language }}
34+
35+
- name: Autobuild
36+
uses: github/codeql-action/autobuild@v3
37+
38+
- name: Perform CodeQL Analysis
39+
uses: github/codeql-action/analyze@v3
40+
with:
41+
category: "/language:${{matrix.language}}"
42+
43+
dependency-review:
44+
name: Dependency Review
45+
runs-on: ubuntu-latest
46+
if: github.event_name == 'pull_request'
47+
steps:
48+
- name: Checkout Repository
49+
uses: actions/checkout@v4
50+
- name: Dependency Review
51+
uses: actions/dependency-review-action@v4

‎.husky/commit-msg‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
npx --no -- commitlint --edit $1

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ We value community input and feedback to continuously improve Evolution API:
8484
- **[Discord Community](https://evolution-api.com/discord)**: Real-time chat with developers and users
8585
- **[GitHub Issues](https://github.com/EvolutionAPI/evolution-api/issues)**: Report bugs and technical issues
8686

87+
### 🔒 Security
88+
- **[Security Policy](./SECURITY.md)**: Guidelines for reporting security vulnerabilities
89+
- **Security Contact**: contato@evolution-api.com
90+
8791
## Telemetry Notice
8892

8993
To continuously improve our services, we have implemented telemetry that collects data on the routes used, the most accessed routes, and the version of the API in use. We would like to assure you that no sensitive or personal data is collected during this process. The telemetry helps us identify improvements and provide a better experience for users.

0 commit comments

Comments
 (0)