ReviqueInc GitHub Repository Analysis

Problem: cloudflare/wrangler-action@v3 and aws-actions/configure-aws-credentials@v4 reference mutable version tags. A compromised publisher account could retag v3/v4 to point to malicious code that exfiltrates your CLOUDFLARE_API_TOKEN and AWS OIDC credentials.

Why dangerous: These actions run in your CI environment with full access to all workflow secrets. This is one of the most common supply-chain attack vectors for GitHub Actions.

# Instead of (mutable — dangerous for third parties):
uses: cloudflare/wrangler-action@v3
uses: aws-actions/configure-aws-credentials@v4

# Pin to a specific commit SHA (verify from the action's GitHub releases):
uses: cloudflare/wrangler-action@392e85aa28f1ef5bbe8bee4cecc4ab4c4f73f66f  # v3.14.1
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502  # v4.0.2

# GitHub-owned actions (actions/checkout, actions/setup-node) are lower risk
# but can also be pinned for full supply-chain control:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0

Problem: ci.yml has no permissions: declaration. GitHub's default grants the GITHUB_TOKEN write access to contents, issues, pull-requests, checks, and more. A compromised action or script injection can write to the repo or approve PRs.

name: CI

on:
  pull_request:
    branches: [develop]
  push:
    branches: [develop]

permissions:
  contents: read      # checkout only — no writes needed

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      # ... existing steps unchanged

Problem: deploy-develop.yml, deploy-uat.yml, and deploy-production.yml embed live infrastructure identifiers as YAML fallbacks: AWS API Gateway endpoints, Cognito Identity Pool IDs, IoT MQTT broker addresses, and reCAPTCHA site keys. These are committed to version control.

Fix: Remove all || 'hardcoded-value' fallbacks. Require values to be present in the GitHub environment. Fail fast with an error message if a required variable is absent.

# Before (exposes infrastructure in YAML):
env:
  VITE_BASE_URL: ${{ vars.VITE_BASE_URL_DEV || vars.VITE_BASE_URL || 'https://atg96ts3g3.execute-api.us-east-2.amazonaws.com/v1' }}
  REACT_APP_IDENTITY_POOL_ID: ${{ vars.REACT_APP_IDENTITY_POOL_ID || 'us-east-2:1b4b834c-d3d6-4ec1-a247-3084a6570e4d' }}

# After (clean — all values in GitHub environment variables):
env:
  VITE_BASE_URL: ${{ vars.VITE_BASE_URL_DEV || vars.VITE_BASE_URL }}
  REACT_APP_IDENTITY_POOL_ID: ${{ vars.REACT_APP_IDENTITY_POOL_ID }}

# Add a validation step right after checkout:
- name: Validate required environment variables
  run: |
    : "${VITE_BASE_URL:?Set VITE_BASE_URL in the GitHub develop environment}"
    : "${REACT_APP_IDENTITY_POOL_ID:?Set REACT_APP_IDENTITY_POOL_ID in the GitHub environment}"
    : "${REACT_APP_IOT_ENDPOINT:?Set REACT_APP_IOT_ENDPOINT in the GitHub environment}"

Problem: No dependency vulnerability scanning in any workflow. Known CVEs ship to production.

# Add after the Install step in every workflow:

# For revique-api (no legacy-peer-deps):
- name: Audit dependencies
  run: npm audit --audit-level=high

# For revique-web (uses --legacy-peer-deps):
- name: Audit dependencies
  run: npm audit --audit-level=high --legacy-peer-deps

Problem: Docker image is built but never scanned. OS package vulnerabilities in the base image reach production undetected.

- name: Build Docker image
  run: docker build --tag revique-api:ci .

- name: Scan container image with Trivy
  uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8  # v0.24.0
  with:
    image-ref: revique-api:ci
    format: table
    exit-code: '1'
    severity: CRITICAL,HIGH
    ignore-unfixed: true

Problem: revique-web deploys to develop, UAT, and production without running any code quality checks. revique-api correctly gates on lint + typecheck + tests before deploying.

# Add between "Install dependencies" and "Build composed app" in all three deploy workflows:
- name: Lint
  run: npm run lint

- name: Typecheck
  run: npm run typecheck

# Uncomment when tests are added:
# - name: Test
#   run: npm test

Problem: All 3 environments share SLACK_WEBHOOK_DEV_GITHUB_ACTIONS. Production deploy failures arrive in the dev channel, not the prod monitoring channel.

# In deploy.yml env block for both Slack notification steps:
env:
  SLACK_WEBHOOK_URL: ${{ inputs.environment == 'prod' && secrets.SLACK_WEBHOOK_PROD_GITHUB_ACTIONS || secrets.SLACK_WEBHOOK_DEV_GITHUB_ACTIONS }}

# Add SLACK_WEBHOOK_PROD_GITHUB_ACTIONS to the prod GitHub environment secrets.

Current state: No job defines a timeout. GitHub's default is 6 hours. A hung Cloudflare deploy or stalled ECS migration blocks the concurrency slot for 6 hours.

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 30     # deploy workflows: 30-45 min is generous

  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 20     # CI: lint+test+docker should finish in 20 min

Current state: Both workflows call actions/setup-node@v4 twice. The second "Setup Node for Wrangler" call switches to Node 22 (overriding .nvmrc) and does not restore npm cache. Wrangler runs fine with the Node version already set from .nvmrc.

# Remove this block from both deploy-production.yml and deploy-uat.yml:
# - name: Setup Node for Wrangler
#   uses: actions/setup-node@v4
#   with:
#     node-version: 22

# The first setup-node with node-version-file: .nvmrc is sufficient.

# For revique-api/ci.yml — cancel superseded runs on same branch:
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# For request-uat-promotion.yml — prevent duplicate promotion PRs:
concurrency:
  group: uat-promotion-${{ inputs.source_branch }}-${{ inputs.target_branch }}
  cancel-in-progress: false   # let the running promotion complete

# Add as first step after checkout in ci.yml and as a pre-deploy step in revique-web:
- name: Scan for secrets
  uses: gitleaks/gitleaks-action@cb7149a9b57195b609c63e8518d2b7e1a8b32c8e  # v2.3.7
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}  # optional for org key

on:
  push:
    branches: [develop]
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - '.github/CODEOWNERS'
      - '.gitignore'
  workflow_dispatch:

Create .github/workflows/_deploy-cloudflare.yml called by all three deploy workflows. Eliminates the 3× maintenance burden:

# .github/workflows/_deploy-cloudflare.yml
on:
  workflow_call:
    inputs:
      environment:  { required: true,  type: string }
      wrangler_env: { required: false, type: string, default: '' }
      deploy_url:   { required: true,  type: string }
    secrets:
      CLOUDFLARE_API_TOKEN:          { required: true }
      CLOUDFLARE_ACCOUNT_ID:         { required: true }
      SLACK_WEBHOOK_URL:             { required: true }

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 30
    permissions:
      contents: read
    concurrency:
      group: deploy-${{ inputs.environment }}
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@SHA   # pinned
      # ... shared steps ...
      - uses: cloudflare/wrangler-action@SHA  # pinned
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: >-
            deploy ${{ inputs.wrangler_env != '' && format('--env {0}', inputs.wrangler_env) || '' }}

Add this free, zero-configuration workflow to both repos. It blocks PRs that introduce known vulnerable dependencies:

# .github/workflows/dependency-review.yml
name: Dependency Review
on:
  pull_request:
    branches: [develop, uat, main]

permissions:
  contents: read
  pull-requests: write

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@SHA  # pinned
      - uses: actions/dependency-review-action@SHA  # pinned
        with:
          fail-on-severity: high
          comment-summary-in-pr: true