Simon-Initiative / oli-torus

Next Generation OLI Authoring and Delivery Platform
https://proton.oli.cmu.edu
MIT License
83 stars 35 forks source link

[ENHANCEMENT] [MER-3391] update codebase and build infrastructure for elixir 1 17 0 and erlang otp 27 #4986

Closed Francisco-Castro closed 1 month ago

Francisco-Castro commented 1 month ago

Ticket MER-3391

This PR upgraded Erlang and Elixir to 27.0.1 and 1.17.2-otp-27, respectively.

When we changed to use an Elixir version >= 1.17.0, many dependencies threw the following warnings:

warning: single-quoted strings represent charlists. Use ~c"" if you indeed want a charlist or use "" instead

Most of the following dependencies that are part of our code haven't handled this issue yet:

libcluster, nodejs, poison, xml_builder, jose, dialyxir, premailex, crontab, base32_crockford, 
bamboo, hound, timex, odgn_json_pointer, tailwind, bcrypt_elixir, earmark, sweet_xml, ex_aws, 
ex_aws_s3, broadway_dashboard, uuid, makeup_eex, phoenix_storybook, mail

The Base32Crockford dependency was replaced with CrockfordBase32 because the former appears to be abandoned; the last commit was 5 years ago. The new dependency was adapted to our current behavior.

The phoenix_storybook dependency was removed because we are not using it.

Dependencies

Benchmarks:

this branch
mix compile  216.12s user 56.98s system 220% cpu 2:03.74 total
mix compile  215.37s user 57.89s system 218% cpu 2:04.96 total

master branch
mix compile  204.78s user 57.35s system 291% cpu 1:29.89 total
mix compile  207.66s user 58.81s system 292% cpu 1:31.16 total
gitguardian[bot] commented 1 month ago

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | | | -------------- | ------------------ | ------------------------------ | ---------------- | --------------- | -------------------- | | [10034199](https://dashboard.gitguardian.com/workspace/76369/incidents/10034199?occurrence=161615545) | Triggered | Generic Password | a0cb6691fbe16c1fcd5b99208ae583a5337da85b | config/hound.exs | [View secret](https://github.com/Simon-Initiative/oli-torus/commit/a0cb6691fbe16c1fcd5b99208ae583a5337da85b#diff-fee31282487e6c0cc91a1b2da8c3110f34fa650a8b8f4d8e8ac2b6e0edb1c15fL74) |
🛠 Guidelines to remediate hardcoded secrets
1. Understand the implications of revoking this secret by investigating where it is used in your code. 2. Replace and store your secret safely. [Learn here](https://blog.gitguardian.com/secrets-api-management?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) the best practices. 3. Revoke and [rotate this secret](https://docs.gitguardian.com/secrets-detection/secrets-detection-engine/detectors/generics/generic_password#revoke-the-secret?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). 4. If possible, [rewrite git history](https://blog.gitguardian.com/rewriting-git-history-cheatsheet?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data. To avoid such incidents in the future consider - following these [best practices](https://blog.gitguardian.com/secrets-api-management/?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) for managing and storing secrets including API keys and other credentials - install [secret detection on pre-commit](https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) to catch secret before it leaves your machine and ease remediation.

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

eliknebel commented 1 month ago

Nice work!