Your feature branchIntegrate Firebase CI + Docker Node Setup + Initial Bot Scaffolding #30
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| name: 🔥 Firebase Hosting Deploy | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
|
|
||
| jobs: | ||
| firebase-deploy: | ||
| name: 🚀 Deploy to Firebase Hosting | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: 📦 Checkout repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: 🔐 Authenticate to Google Cloud | ||
| uses: google-github-actions/auth@v1 | ||
| with: | ||
| workload_identity_provider: "projects/491439791457/locations/global/workloadIdentityPools/github-pool/providers/github-provider" | ||
| service_account: "[email protected]" | ||
|
|
||
| - name: 🛠️ Install Firebase CLI | ||
| run: npm install -g firebase-tools | ||
|
|
||
| - name: 🚀 Deploy to Firebase Hosting | ||
| run: firebase deploy --only hosting --project xpert-forex-trade | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,24 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| - name: Setup Node.js environment | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| uses: actions/[email protected] | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Set always-auth in npmrc. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| always-auth: # optional, default is false | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Version Spec of the version to use. Examples: 12.x, 10.15.1, >=10.15.0. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| node-version: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # File containing the version Spec of the version to use. Examples: .nvmrc, .node-version, .tool-versions. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| node-version-file: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Target architecture for Node to use. Examples: x86, x64. Will use system architecture by default. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| architecture: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Set this option if you want the action to check for the latest available version that satisfies the version spec. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| check-latest: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Optional registry to set up for auth. Will set the registry in a project level .npmrc and .yarnrc file, and set up auth to read in from env.NODE_AUTH_TOKEN. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| registry-url: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Optional scope for authenticating against scoped registries. Will fall back to the repository owner when using the GitHub Packages registry (https://npm.pkg.github.com/). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| scope: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Used to pull node distributions from node-versions. Since there's a default, this is typically not supplied by the user. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| token: # optional, default is ${{ github.server_url == 'https://github.com' && github.token || '' }} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Used to specify a package manager for caching in the default directory. Supported values: npm, yarn, pnpm. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| cache: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Used to specify the path to a dependency file: package-lock.json, yarn.lock, etc. Supports wildcards or a list of file names for caching multiple dependencies. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| cache-dependency-path: # optional | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+1
to
+24
There was a problem hiding this comment. This workflow file contains only a single action step without proper YAML structure. It's missing the workflow name, trigger events, and job definition. Consider restructuring as a complete workflow or removing if it's meant to be a template.
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| name: Firebase Deploy | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
|
|
||
| jobs: | ||
| deploy: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: google-github-actions/auth@v1 | ||
| with: | ||
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | ||
| service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} | ||
| - run: npm ci | ||
| - run: npm run build | ||
| - run: npx firebase deploy --only hosting |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,14 @@ | ||
| name: GCP Auth Setup | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| auth: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Authenticate with GCP | ||
| uses: google-github-actions/auth@v1 | ||
| with: | ||
| workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} | ||
| service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| ## Cloudflare Endpoint Schema Upload | ||
|
|
||
| **Location**: `intlhub.org → Security → Web Assets → Endpoint Management → Upload Schema` | ||
|
|
||
| **Accepted Formats**: `.yml`, `.yaml`, `.json` | ||
|
|
||
| **Schema Requirements**: | ||
| - OpenAPI or Swagger spec | ||
| - Define paths, methods, parameters, responses | ||
|
|
||
| **Security Behavior**: | ||
| - Matches traffic to schema | ||
| - Blocks or logs non-compliant requests | ||
|
|
||
| **Recommended**: | ||
| - Include contributor metadata in schema comments | ||
| - Version your schema for audit clarity | ||
| - Validate with PITR enabled for rollback protection | ||
|
Comment on lines
+1
to
+18
There was a problem hiding this comment. This file is named with a |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,29 @@ | ||||||
| <?php include 'header.php'; ?> | ||||||
| <div class="container mt-5"> | ||||||
| <h2 class="mb-4">Welcome, <?= $_SESSION['username']; ?>!</h2> | ||||||
|
There was a problem hiding this comment. The user's name is directly rendered from the session without any output escaping. This is a critical Cross-Site Scripting (XSS) vulnerability. If a username contains malicious HTML or JavaScript, it will be executed in the browser. You should always escape dynamic data rendered in HTML. The PR description mentions this is pending, but it's crucial to address it before merging.1 <h2 class="mb-4">Welcome, <?= htmlspecialchars($_SESSION['username'], ENT_QUOTES, 'UTF-8'); ?>!</h2>Style Guide ReferencesFootnotes
|
||||||
|
|
||||||
| <div class="row"> | ||||||
| <div class="col-md-6"> | ||||||
| <h4>Open Trades</h4> | ||||||
| <ul class="list-group"> | ||||||
| <?php foreach ($openTrades as $trade): ?> | ||||||
| <li class="list-group-item"> | ||||||
| <?= $trade['pair']; ?> - <?= $trade['direction']; ?> - $<?= $trade['amount']; ?> | ||||||
|
There was a problem hiding this comment. The data for open trades is rendered without escaping, which poses a Cross-Site Scripting (XSS) risk. Any data that originates from the database and could have been influenced by user input should be treated as untrusted. Please escape all variables before outputting them to the page.1 <?= htmlspecialchars($trade['pair'], ENT_QUOTES, 'UTF-8'); ?> - <?= htmlspecialchars($trade['direction'], ENT_QUOTES, 'UTF-8'); ?> - $<?= htmlspecialchars($trade['amount'], ENT_QUOTES, 'UTF-8'); ?>Style Guide ReferencesFootnotes
There was a problem hiding this comment. User data is being output without proper escaping, creating potential XSS vulnerabilities. Use htmlspecialchars() to escape output: - - $
Suggested change
|
||||||
| </li> | ||||||
| <?php endforeach; ?> | ||||||
| </ul> | ||||||
| </div> | ||||||
|
|
||||||
| <div class="col-md-6"> | ||||||
| <h4>Trade History</h4> | ||||||
| <ul class="list-group"> | ||||||
| <?php foreach ($tradeHistory as $trade): ?> | ||||||
| <li class="list-group-item"> | ||||||
| <?= $trade['pair']; ?> - <?= $trade['type']; ?> - <?= $trade['created_at']; ?> | ||||||
|
There was a problem hiding this comment. Similar to the open trades list, the trade history data is outputted without escaping. This is also a Cross-Site Scripting (XSS) vulnerability. All dynamic data should be escaped to prevent malicious script execution.1 <?= htmlspecialchars($trade['pair'], ENT_QUOTES, 'UTF-8'); ?> - <?= htmlspecialchars($trade['type'], ENT_QUOTES, 'UTF-8'); ?> - <?= htmlspecialchars($trade['created_at'], ENT_QUOTES, 'UTF-8'); ?>Style Guide ReferencesFootnotes
There was a problem hiding this comment. User data is being output without proper escaping, creating potential XSS vulnerabilities. Use htmlspecialchars() to escape output: - -
Suggested change
|
||||||
| </li> | ||||||
| <?php endforeach; ?> | ||||||
| </ul> | ||||||
| </div> | ||||||
| </div> | ||||||
| </div> | ||||||
| <?php include 'footer.php'; ?> | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| xpert_telegram_bot/ | ||
| ├── bot.py ← Paste this code here | ||
| ├── handlers/ | ||
| ├── config/ | ||
| ├── logs/ | ||
| ├── .env | ||
| ├── requirements.txt | ||
| └── diagnostics.py | ||
|
Comment on lines
+1
to
+8
There was a problem hiding this comment. This file appears to contain a text representation of the directory structure instead of Python code for the bot. The file should contain the actual bot implementation. This seems to be a placeholder that was committed by mistake.
Comment on lines
+1
to
+8
There was a problem hiding this comment. This file contains a directory structure outline instead of actual Python code. The bot.py file should contain the implementation of the Telegram bot, not ASCII art of the folder structure. |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| <!DOCTYPE html> | ||
| <html lang="en"> | ||
| <head> | ||
| <meta charset="UTF-8" /> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1.0" /> | ||
| <title>Xpert-Forex-Tradex</title> | ||
| <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet"> | ||
| </head> | ||
| <body> | ||
| <nav class="navbar navbar-expand-lg navbar-dark bg-dark"> | ||
| <div class="container-fluid"> | ||
| <a class="navbar-brand" href="#">Xpert-Forex-Tradex</a> | ||
| </div> | ||
| </nav> | ||
|
|
||
| <div class="container mt-5 text-center"> | ||
| <h1>Welcome to Xpert-Forex-Tradex</h1> | ||
| <p class="lead">Your gateway to smarter trading insights and transparent onboarding.</p> | ||
| <a href="login.php" class="btn btn-primary">Login</a> | ||
| <a href="register.php" class="btn btn-outline-primary">Register</a> | ||
| </div> | ||
|
|
||
| <footer class="bg-light text-center mt-5 p-3"> | ||
| <small>© <span id="current-year"></span> Xpert-Forex-Tradex. All rights reserved.</small> | ||
| </footer> | ||
| <script> | ||
| document.getElementById('current-year').textContent = new Date().getFullYear(); | ||
| </script> | ||
| </body> | ||
| </html> |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hardcoded GCP project details should be moved to GitHub secrets for security. Use ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} and ${{ secrets.GCP_SERVICE_ACCOUNT }} instead of hardcoded values.