Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
43 commits
Select commit Hold shift + click to select a range
7119f89
Fix the response format for copilot requests to match the previous se…
jmgasper Feb 20, 2026
87bca52
Enable code scanning and reviewer, lots of documentation, fix a permi…
jmgasper Feb 20, 2026
a7d9727
More documentation and fix a path issue that was affecting platform-u…
jmgasper Feb 20, 2026
7e3e378
Completed documentation, dependency updates for security fixes
jmgasper Feb 20, 2026
3c43d6e
Refactoring to reduce redundancies
jmgasper Feb 20, 2026
1919dee
Build fix
jmgasper Feb 20, 2026
df968ec
Lint
jmgasper Feb 20, 2026
b32254f
Build and lint fixes
jmgasper Feb 20, 2026
bdbcb10
PM-2648: send copilot application emails to PM users and creator
jmgasper Feb 22, 2026
a4d61e0
PM-2684: add member-api fallback for invite email resolution
jmgasper Feb 22, 2026
a048818
Potential build fix
jmgasper Feb 22, 2026
f977b4b
Build updates
jmgasper Feb 22, 2026
f3744aa
Build fix
jmgasper Feb 22, 2026
c854018
Build updates
jmgasper Feb 23, 2026
b168d71
Additional debugging information for sending emails failure
jmgasper Feb 23, 2026
334a029
Fix issue with event bus client
jmgasper Feb 23, 2026
34a8664
Further configuration of bus API handling
jmgasper Feb 23, 2026
8d970f7
Fix up known member vs. unknown email when sending project invites
jmgasper Feb 23, 2026
c90c1e2
PM-2684: split invite email template selection for known vs unknown u…
jmgasper Feb 23, 2026
e3f0af2
Better formatting of the email payload for Sendgrid for new project i…
jmgasper Feb 24, 2026
149a31b
Fix up invite acceptance / decline
jmgasper Feb 24, 2026
b56d778
PM-2684: preserve legacy invite payload on legacy template fallback
jmgasper Feb 24, 2026
6acde83
Fix for pulling metadata with auth token (for old work-manager compat…
jmgasper Feb 25, 2026
286ecdf
Better copilot notifications for all of the various emails that need …
jmgasper Feb 27, 2026
da06ac8
Merge branch 'dev' of github.com:topcoder-platform/projects-api-v6 in…
jmgasper Feb 27, 2026
e9b3aab
Allow talent manager access to edit projects
jmgasper Mar 3, 2026
31174c8
Merge branch 'dev' of github.com:topcoder-platform/projects-api-v6 in…
jmgasper Mar 3, 2026
714e636
Allow M2M tokens to check project membership
jmgasper Mar 3, 2026
377b9c2
Fix up issue with notification emails
jmgasper Mar 3, 2026
945e56e
Fixes for email notifications and billing accounts
jmgasper Mar 4, 2026
e15bbb9
QA fixes
jmgasper Mar 4, 2026
a67ce77
Fix for how we get email addresses for copilot notification
jmgasper Mar 4, 2026
812ac82
Allow additional roles for update
jmgasper Mar 4, 2026
40ecc40
Raise billing account change event
jmgasper Mar 4, 2026
e77c2d5
Better user lookup for users page in WM
jmgasper Mar 6, 2026
30ec7f7
Additional template email fixes for invite / decline
jmgasper Mar 6, 2026
bc020f1
QA fixes
jmgasper Mar 9, 2026
4066b1b
QA fixes
jmgasper Mar 9, 2026
b43995e
Better handling of non-numeric project IDs
jmgasper Mar 9, 2026
86c7a31
Fixes from QA
jmgasper Mar 9, 2026
9caf043
QA fixes
jmgasper Mar 9, 2026
b5e2433
QA Fixes
jmgasper Mar 9, 2026
dc1b0a3
Further tweaks for M2M token usage
jmgasper Mar 9, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 0 additions & 56 deletions .circleci/config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,6 @@ defaults: &defaults
docker:
- image: cimg/python:3.13.2-browsers

node_defaults: &node_defaults
docker:
- image: cimg/node:22.13

install_dependency: &install_dependency
name: Installation of build and deployment dependencies.
command: |
Expand Down Expand Up @@ -63,42 +59,6 @@ jobs:
DEPLOYMENT_ENVIRONMENT: "prod"
steps: *builddeploy_steps

deployment-validation-dev:
<<: *node_defaults
environment:
DEPLOYMENT_VALIDATION_ENABLED: "true"
DEPLOYMENT_SMOKE_ENABLED: "false"
V6_BASE_URL: "${DEPLOYMENT_VALIDATION_DEV_BASE_URL}"
steps:
- checkout
- run:
name: Enable pnpm
command: corepack enable
- run:
name: Install dependencies
command: pnpm install --frozen-lockfile
- run:
name: Run deployment validation tests
command: pnpm test:deployment

deployment-validation-prod:
<<: *node_defaults
environment:
DEPLOYMENT_VALIDATION_ENABLED: "true"
DEPLOYMENT_SMOKE_ENABLED: "false"
V6_BASE_URL: "${DEPLOYMENT_VALIDATION_PROD_BASE_URL}"
steps:
- checkout
- run:
name: Enable pnpm
command: corepack enable
- run:
name: Install dependencies
command: pnpm install --frozen-lockfile
- run:
name: Run deployment validation tests
command: pnpm test:deployment

workflows:
version: 2
build-dev:
Expand All @@ -109,14 +69,6 @@ workflows:
branches:
only:
- dev
- deployment-validation-dev:
context: org-global
requires:
- build-dev
filters:
branches:
only:
- dev

build-prod:
jobs:
Expand All @@ -126,11 +78,3 @@ workflows:
branches:
only:
- master
- deployment-validation-prod:
context: org-global
requires:
- build-prod
filters:
branches:
only:
- master
16 changes: 14 additions & 2 deletions .env.example
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,19 @@ AUTH0_PROXY_SERVER_URL="https://auth0proxy.topcoder-dev.com"
AUTH0_CLIENT_ID=""
AUTH0_CLIENT_SECRET=""

# Kafka Event Bus
# Bus API client configuration (via tc-bus-api-wrapper)
# KAFKA_URL is retained only for compatibility with shared env packs;
# current wrapper initialization does not use it.
KAFKA_URL="localhost:9092"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
The comment indicates that KAFKA_URL is retained only for compatibility and is not used by the current wrapper initialization. Consider removing this variable if it's truly unused to avoid confusion and reduce maintenance overhead.

KAFKA_ERROR_TOPIC="common.error.reporting"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
Ensure that KAFKA_ERROR_TOPIC is correctly configured in all environments, as misconfiguration could lead to loss of error reporting.

KAFKA_CLIENT_CERT=""
KAFKA_CLIENT_CERT_KEY=""
BUSAPI_URL="https://api.topcoder-dev.com/v5"

# Project event topics (only active topics)
# Project event topics
KAFKA_PROJECT_CREATED_TOPIC="project.created"
KAFKA_PROJECT_UPDATED_TOPIC="project.updated"
KAFKA_PROJECT_BILLING_ACCOUNT_UPDATED_TOPIC="project.action.billingAccount.update"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The topic KAFKA_PROJECT_BILLING_ACCOUNT_UPDATED_TOPIC is newly added. Verify that this topic is correctly set up and consumed by the relevant services to ensure the billing account updates are processed as expected.

KAFKA_PROJECT_DELETED_TOPIC="project.deleted"
KAFKA_PROJECT_MEMBER_ADDED_TOPIC="project.member.added"
KAFKA_PROJECT_MEMBER_REMOVED_TOPIC="project.member.removed"
Expand Down Expand Up @@ -55,9 +59,17 @@ INVITE_EMAIL_SECTION_TITLE=""
COPILOT_PORTAL_URL=""
WORK_MANAGER_URL=""
ACCOUNTS_APP_URL=""
# Dedicated project-invite templates:
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[❗❗ correctness]
The addition of dedicated project-invite templates is a good practice for clarity. Ensure that the IDs for SENDGRID_PROJECT_INVITATION_KNOWN_USER_TEMPLATE_ID and SENDGRID_PROJECT_INVITATION_UNKNOWN_USER_TEMPLATE_ID are correctly configured in all environments to avoid sending incorrect email templates.

# - known user (Join/Decline flow): SENDGRID_PROJECT_INVITATION_KNOWN_USER_TEMPLATE_ID
# - unknown email (Register flow): SENDGRID_PROJECT_INVITATION_UNKNOWN_USER_TEMPLATE_ID
# Legacy fallback for both invite types:
SENDGRID_TEMPLATE_PROJECT_MEMBER_INVITED=""
SENDGRID_PROJECT_INVITATION_KNOWN_USER_TEMPLATE_ID=""
SENDGRID_PROJECT_INVITATION_UNKNOWN_USER_TEMPLATE_ID=""
SENDGRID_TEMPLATE_COPILOT_ALREADY_PART_OF_PROJECT=""
SENDGRID_TEMPLATE_INFORM_PM_COPILOT_APPLICATION_ACCEPTED=""
SENDGRID_TEMPLATE_COPILOT_REQUEST_CREATED=""
COPILOTS_SLACK_EMAIL=""
UNIQUE_GMAIL_VALIDATION=false

# API Configuration
Expand Down
22 changes: 22 additions & 0 deletions .github/workflows/code_reviewer.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: AI PR Reviewer

on:
pull_request:
types:
- opened
- synchronize
permissions:
pull-requests: write
jobs:
tc-ai-pr-review:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@v3

- name: TC AI PR Reviewer
uses: topcoder-platform/tc-ai-pr-reviewer@master
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # The GITHUB_TOKEN is there by default so you just need to keep it like it is and not necessarily need to add it as secret as it will throw an error. [More Details](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret)
LAB45_API_KEY: ${{ secrets.LAB45_API_KEY }}
exclude: '**/*.json, **/*.md, **/*.jpg, **/*.png, **/*.jpeg, **/*.bmp, **/*.webp' # Optional: exclude patterns separated by commas
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[💡 style]
Consider adding a newline at the end of the file to adhere to POSIX standards, which can improve compatibility with various tools and systems.

35 changes: 35 additions & 0 deletions .github/workflows/trivy.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
name: Trivy Scanner

permissions:
contents: read
security-events: write

on:
push:
branches:
- dev
pull_request:

jobs:
trivy-scan:
name: Use Trivy
runs-on: ubuntu-24.04
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ maintainability]
Consider using a stable version of the runner, such as ubuntu-latest, instead of a specific version like ubuntu-24.04. This ensures that the workflow benefits from the latest security updates and bug fixes automatically.

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Run Trivy scanner in repo mode
uses: aquasecurity/trivy-action@0.34.0
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ security]
Ensure that the version 0.34.0 of aquasecurity/trivy-action is the intended version to use. Consider using a more recent version if available, as it might contain important updates or security patches.

with:
scan-type: fs
ignore-unfixed: true
format: sarif
output: trivy-results.sarif
severity: CRITICAL,HIGH,UNKNOWN
scanners: vuln,secret,misconfig,license
github-pat: ${{ secrets.GITHUB_TOKEN }}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ security]
Using secrets.GITHUB_TOKEN is generally safe for most operations, but ensure that it has the necessary permissions for the actions being performed, especially when writing security events.


- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy-results.sarif
4 changes: 2 additions & 2 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

FROM node:22.13.1-alpine

RUN apk add --no-cache bash
RUN apk add --no-cache bash git
RUN apk update
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[⚠️ correctness]
The apk update command should be placed before apk add to ensure that the package index is up-to-date before installing packages. This can prevent potential issues with outdated package indexes.


ARG RESET_DB_ARG=false
Expand All @@ -17,4 +17,4 @@ RUN npm install pnpm -g
RUN pnpm install
RUN pnpm run build
RUN chmod +x appStartUp.sh
CMD ./appStartUp.sh
CMD ./appStartUp.sh
4 changes: 3 additions & 1 deletion LISTENERS.md
Original file line number Diff line number Diff line change
@@ -1,13 +1,14 @@
# Kafka Listener Audit for `projects-api-v6` Topics

Date: 2026-02-08
Date: 2026-03-04
Scope: all top-level services/apps in this monorepo.
Excluded per request: `projects-api-v6`, `tc-project-service`.

## Active topics in `projects-api-v6/.env.example`

- `project.created`
- `project.updated`
- `project.action.billingAccount.update`
- `project.deleted`
- `project.member.added`
- `project.member.removed`
Expand All @@ -22,6 +23,7 @@ No non-excluded service in this monorepo statically subscribes to these topics.
|---|---|---|---|
| `KAFKA_PROJECT_CREATED_TOPIC` | `project.created` | None found | N/A |
| `KAFKA_PROJECT_UPDATED_TOPIC` | `project.updated` | None found | N/A |
| `KAFKA_PROJECT_BILLING_ACCOUNT_UPDATED_TOPIC` | `project.action.billingAccount.update` | None found | N/A |
| `KAFKA_PROJECT_DELETED_TOPIC` | `project.deleted` | None found | N/A |
| `KAFKA_PROJECT_MEMBER_ADDED_TOPIC` | `project.member.added` | None found | N/A |
| `KAFKA_PROJECT_MEMBER_REMOVED_TOPIC` | `project.member.removed` | None found | N/A |
Expand Down
Loading
Loading