Release 2022-11-23 (#304)

.github/auto_assign.yml

@@ -2,11 +2,12 @@
 addReviewers: true
 
 # A list of reviewers to be added to pull requests (GitHub user name)
-reviewers: 
+reviewers:
   - trigal2012
   - Alfredo-Moreira
+  - JoeKarow
 
-# A list of keywords to be skipped the process that add reviewers if pull requests include it 
+# A list of keywords to be skipped the process that add reviewers if pull requests include it
 skipKeywords:
   - wip
 

.github/workflows/codeql-analysis.yml

@@ -9,14 +9,14 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
-name: "CodeQL"
+name: 'CodeQL'
 
 on:
   push:
-    branches: [ master, dev ]
+    branches: [main, dev]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master, dev ]
+    branches: [main, dev]
   schedule:
     - cron: '25 9 * * 6'
 
@@ -28,40 +28,40 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript' ]
+        language: ['javascript']
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
         # Learn more:
         # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
+      - name: Checkout repository
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@678fc3afe258fb2e0cdc165ccf77b85719de7b3c # v2
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@678fc3afe258fb2e0cdc165ccf77b85719de7b3c # v2
 
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
 
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
 
-    #- run: |
-    #   make bootstrap
-    #   make release
+      #- run: |
+      #   make bootstrap
+      #   make release
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@678fc3afe258fb2e0cdc165ccf77b85719de7b3c # v2

.github/workflows/codesee-arch-diagram.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: checkout
         id: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
@@ -29,7 +29,7 @@ jobs:
         uses: Codesee-io/codesee-detect-languages-action@latest
 
       - name: Configure JDK 16
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@de1bb2b0c5634f0fc4438d7aa9944e68f9bf86cc # v3
         if: ${{ fromJSON(steps.detect-languages.outputs.languages).java }}
         with:
           java-version: '16'
@@ -38,27 +38,27 @@ jobs:
       # CodeSee Maps Go support uses a static binary so there's no setup step required.
 
       - name: Configure Node.js 14
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # v3
         if: ${{ fromJSON(steps.detect-languages.outputs.languages).javascript }}
         with:
           node-version: '14'
 
       - name: Configure Python 3.x
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # v4
         if: ${{ fromJSON(steps.detect-languages.outputs.languages).python }}
         with:
           python-version: '3.10'
           architecture: 'x64'
 
       - name: Configure Ruby '3.x'
-        uses: ruby/setup-ruby@v1.120.0
+        uses: ruby/setup-ruby@4887fd8753fb3cf1a1e466e0e6d8bc08ca91b0bf # v1.124.0
         if: ${{ fromJSON(steps.detect-languages.outputs.languages).ruby }}
         with:
           ruby-version: '3.0'
 
       # We need the rust toolchain because it uses rustc and cargo to inspect the package
       - name: Configure Rust 1.x stable
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
         if: ${{ fromJSON(steps.detect-languages.outputs.languages).rust }}
         with:
           toolchain: stable

.github/workflows/sync_main_to_dev.yaml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
       - uses: connor-baer/action-sync-branch@main
         with:
           branch: dev

.github/workflows/zap_scan.yaml

@@ -1,102 +1,101 @@
 on:
   pull_request:
-    types: [opened,reopened]
+    types: [opened, reopened]
   # push:
   #   branches:
   #     - main
 
 env:
   PR_NUMBER: ${{ github.event.number }}
   BASE_BRANCH: ${{ github.base_ref }}
-    
+
 jobs:
   zap_scan_staging_baseline:
     runs-on: ubuntu-latest
     name: Scan ZAP website Baseline Staging
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
         with:
           ref: code-security
       - name: ZAP Scan
-        uses: zaproxy/[email protected]
+        uses: zaproxy/action-baseline@7cea08522cd386f6c675776d5e4296aecf61f33b # v0.7.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target: 'https://inreach-api-staging.herokuapp.com/'
+          target: 'https://inreach-api-v1-git-dev-weareinreach.vercel.app/'
           cmd_options: '-a'
 
   zap_scan_production_baseline:
     runs-on: ubuntu-latest
     name: Scan ZAP website Baseline Production
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
         with:
           ref: main
       - name: ZAP Scan
-        uses: zaproxy/[email protected]
+        uses: zaproxy/action-baseline@7cea08522cd386f6c675776d5e4296aecf61f33b # v0.7.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target: 'https://inreach-api.herokuapp.com'
+          target: 'https://api.inreach.org'
           cmd_options: '-a'
 
   zap_scan_staging_full:
     runs-on: ubuntu-latest
     name: Scan ZAP website Full Staging
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
         with:
           ref: code-security
       - name: ZAP Scan
-        uses: zaproxy/[email protected]
+        uses: zaproxy/action-full-scan@6eade0f93b10fad8cfb4e63b979703a2cbd0cc98 # v0.4.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target: 'https://inreach-api-staging.herokuapp.com/'
+          target: 'https://inreach-api-v1-git-dev-weareinreach.vercel.app/'
           cmd_options: '-a'
 
   zap_scan_production_full:
     runs-on: ubuntu-latest
     name: Scan ZAP website Full Production
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
         with:
           ref: main
       - name: ZAP Scan
-        uses: zaproxy/[email protected]
+        uses: zaproxy/action-full-scan@6eade0f93b10fad8cfb4e63b979703a2cbd0cc98 # v0.4.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target: 'https://inreach-api.herokuapp.com'
+          target: 'https://api.inreach.org'
           cmd_options: '-a'
 
   zap_scan_staging_api:
     runs-on: ubuntu-latest
     name: Scan ZAP website API Staging
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
         with:
           ref: code-security
       - name: ZAP Scan
-        uses: zaproxy/[email protected]
+        uses: zaproxy/action-api-scan@6c29b04d78969bf586f2d4ea15c613d2dfb49d07 # v0.2.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target: 'https://inreach-api-staging.herokuapp.com/'
+          target: 'https://inreach-api-v1-git-dev-weareinreach.vercel.app/'
           cmd_options: '-a'
 
   zap_scan_production_api:
     runs-on: ubuntu-latest
     name: Scan ZAP website API Production
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
         with:
           ref: main
       - name: ZAP Scan
-        uses: zaproxy/[email protected]
+        uses: zaproxy/action-api-scan@6c29b04d78969bf586f2d4ea15c613d2dfb49d07 # v0.2.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          target: 'https://inreach-api.herokuapp.com'
+          target: 'https://api.inreach.org'
           cmd_options: '-a'
-

src/mongoose.js

@@ -173,6 +173,7 @@ const CommentSchema = new Schema(
 				source: String,
 				userId: String,
 				userLocation: String,
+				rating: Number,
 				isUserApproved: {type: Boolean, default: false},
 				isDeleted: {type: Boolean, default: false}
 			}
@@ -273,6 +274,7 @@ const UserSchema = new Schema(
 		orgType: String,
 		reasonForJoining: String,
 		reviewerQuestions: {
+			reviewerInterested: {type: Boolean, default: false},
 			verifyAnswer: {type: Boolean, default: false},
 			timeCommitAnswer: {type: Boolean, default: false},
 			specifiedTimeCommit: String,