Setup NPM Audits as part of CI on React projects

[tloubrieu-jpl]

💡 Description

For the doi-ui components

This is required to remove the vulnerabilities raised during the build (npm audit). The upgrades are breaking the application as-is.

Sub-tasks:

• https://github.com/NASA-PDS/doi-search-js/issues/1
• https://github.com/NASA-PDS/wds-react/issues/100
• https://github.com/NASA-PDS/roundup-action/issues/115

[eddiesarevalo]

@tloubrieu-jpl This project is becoming too broad to handle easily. This project builds two products. One is a javascript file that can be used to embed our apps into a website that doesn’t use react. We use this for apps that will go in the current PDS site. The other is a react npm library. In order to support both ways it uses a custom build dependency setup instead of using create-react-app.

To get our project to be much more manageable we should switch to using create-react-app which uses the latest dependencies including web pack 5. https://create-react-app.dev

The problem is we have the DOI search deployed to the operational PDS website on https://pds.nasa.gov/tools/doi/#/search this is the only project that uses the embeddable js method.

Lets separate the DOI search and the npm react library projects.

While we work towards the modernization effort we can keep the DOI search on its own repository and leave it on web pack 4 and older dependencies. Then we can take that same code and include it in our npm library that will include all the new pds-wds components that have been created for the search prototype. This would continue our npm package for react at https://www.npmjs.com/package/@nasapds/pds-wds-react.

Once we roll out the new PDS site we can stop using the webpack 4 version of the DOI search and use the new one instead since it will all be in react.

[tloubrieu-jpl]

Thanks @eddiesarevalo , I was thinking of splitting the repository also in the perspective of implementing more broadly the npmjs components to be deployed on the PDS web sites. We might have multiple repository of sub-projects although the would be part of the whole PDS WDS: e.g. search for DOIs or search for products.

There is no hurry anyway but we need to prepare that.

[tloubrieu-jpl]

We want move out of the current repository the embeded javascript component.

We will create a new repository legacy-doi-search containing doi-search used on for pds.nasa.gov (ticket https://github.com/NASA-PDS/doi-search-js/issues/1).

We are keeping this repository for

• doi search for doi-ui and new web site
• other react components (web search...)

Only the later will be upgraded to webpack5

[jordanpadams]

Per email from @eddiesarevalo, initial breakup is here: https://github.com/NASA-PDS/wds-react/tree/search-prototype-components

With some issues that still need to be resolved:

[jordanpadams]

📆 September status: Initial breakup activities completed for B14.0. Will continue work in next phase in B14.1