diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml
new file mode 100644
index 0000000..a4940ad
--- /dev/null
+++ b/.github/workflows/devskim.yml
@@ -0,0 +1,34 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: DevSkim
+
+on:
+ push:
+ branches: [ "main" ]
+ pull_request:
+ branches: [ "main" ]
+ schedule:
+ - cron: '22 2 * * 5'
+
+jobs:
+ lint:
+ name: DevSkim
+ runs-on: ubuntu-20.04
+ permissions:
+ actions: read
+ contents: read
+ security-events: write
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v3
+
+ - name: Run DevSkim scanner
+ uses: microsoft/DevSkim-Action@v1
+
+ - name: Upload DevSkim scan results to GitHub Security tab
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: devskim-results.sarif
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
new file mode 100644
index 0000000..d657a63
--- /dev/null
+++ b/.github/workflows/docker-image.yml
@@ -0,0 +1,18 @@
+name: Docker Image CI
+
+on:
+ push:
+ branches: [ "main" ]
+ pull_request:
+ branches: [ "main" ]
+
+jobs:
+
+ build:
+
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v3
+ - name: Build the Docker image
+ run: docker build . --file Dockerfile --tag my-image-name:$(date +%s)
diff --git a/.github/workflows/njsscan.yml b/.github/workflows/njsscan.yml
new file mode 100644
index 0000000..41fe8e5
--- /dev/null
+++ b/.github/workflows/njsscan.yml
@@ -0,0 +1,42 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow integrates njsscan with GitHub's Code Scanning feature
+# nodejsscan is a static security code scanner that finds insecure code patterns in your Node.js applications
+
+name: njsscan sarif
+
+on:
+ push:
+ branches: [ "main" ]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [ "main" ]
+ schedule:
+ - cron: '16 15 * * 2'
+
+permissions:
+ contents: read
+
+jobs:
+ njsscan:
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+ runs-on: ubuntu-latest
+ name: njsscan code scanning
+ steps:
+ - name: Checkout the code
+ uses: actions/checkout@v3
+ - name: nodejsscan scan
+ id: njsscan
+ uses: ajinabraham/njsscan-action@7237412fdd36af517e2745077cedbf9d6900d711
+ with:
+ args: '. --sarif --output results.sarif || true'
+ - name: Upload njsscan report
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: results.sarif
diff --git a/.github/workflows/ossar.yml b/.github/workflows/ossar.yml
new file mode 100644
index 0000000..667c6d6
--- /dev/null
+++ b/.github/workflows/ossar.yml
@@ -0,0 +1,56 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow integrates a collection of open source static analysis tools
+# with GitHub code scanning. For documentation, or to provide feedback, visit
+# https://github.com/github/ossar-action
+name: OSSAR
+
+on:
+ push:
+ branches: [ "main" ]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [ "main" ]
+ schedule:
+ - cron: '24 18 * * 4'
+
+permissions:
+ contents: read
+
+jobs:
+ OSSAR-Scan:
+ # OSSAR runs on windows-latest.
+ # ubuntu-latest and macos-latest support coming soon
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+ runs-on: windows-latest
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v3
+
+ # Ensure a compatible version of dotnet is installed.
+ # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201.
+ # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action.
+ # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped.
+ # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action:
+ # - name: Install .NET
+ # uses: actions/setup-dotnet@v2
+ # with:
+ # dotnet-version: '3.1.x'
+
+ # Run open source static analysis tools
+ - name: Run OSSAR
+ uses: github/ossar-action@v1
+ id: ossar
+
+ # Upload results to the Security tab
+ - name: Upload OSSAR results
+ uses: github/codeql-action/upload-sarif@v2
+ with:
+ sarif_file: ${{ steps.ossar.outputs.sarifFile }}
diff --git a/Dockerfile b/Dockerfile
index 1068dfb..3d628bf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,11 @@
FROM node:lts
-
ARG NODE_ENV
ENV NODE_ENV $NODE_ENV
-
WORKDIR /usr/src/app
-
COPY . /usr/src/app
RUN rm -rf node_modules
+RUN rm -f .env
RUN npm install
-CMD [ "node", "." ]
+CMD [ "npm", "run", "docker" ]
diff --git a/README.md b/README.md
index d694221..dc69ec6 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,20 @@
# Pw-manager-nodejs
Pw-Manager-Nodejs-opensource
-This is my first project with nodejs! Please keep that in mind.
+
+
+# Install //Fully description will follow soon
+Without Docker
+- Download Zip
+- ....
+With Docker PW Tresor Sven