updated security.md to latest version as per HHS

.devcontainer/nih/Dockerfile

@@ -0,0 +1,14 @@
+# [Choice] Node.js version (use -bullseye variants on local arm64/Apple Silicon): 18, 16, 14, 18-bullseye, 16-bullseye, 14-bullseye, 18-buster, 16-buster, 14-buster
+ARG VARIANT=16-bullseye
+FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}
+
+# [Optional] Uncomment this section to install additional OS packages.
+# RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
+#     && apt-get -y install --no-install-recommends <your-package-list-here>
+
+# [Optional] Uncomment if you want to install an additional version of node using nvm
+# ARG EXTRA_NODE_VERSION=10
+# RUN su node -c "source /usr/local/share/nvm/nvm.sh && nvm install ${EXTRA_NODE_VERSION}"
+
+# [Optional] Uncomment if you want to install more global node packages
+# RUN su node -c "npm install -g <your-package-list -here>"

.devcontainer/nih/README.md

@@ -0,0 +1,13 @@
+# NIH Devcontainer
+
+## Steps for running from GitHub Codespaces
+
+1. [Set Environment Secrets](#secrets)
+1. Launch your Codespace using [these settings](https://github.com/codespaces/new?hide_repo_select=true&ref=GH-170-devcontainer&repo=348553095&skip_quickstart=true&machine=standardLinux32gb&devcontainer_path=.devcontainer%2Fnih%2Fdevcontainer.json&geo=UsEast).
+1. Run the "Launch site 3000"configuration from the `Run and Debug` panel in VS Code.
+
+### Secrets
+
+Use Codespace secrets to inject sensitive configuration variables into GitHub Codespaces. This can either be done [manually](https://github.com/settings/codespaces), or with the [gh-codespace-secret.sh](gh-codespace-secret.sh) shell script which automatically loads/updates portal-specific variables that are set in the current environment. Note: before running `gh-codespace-secret.sh` you will need to have a `GITHUB_TOKEN` environment variable set with a PAT that has the `codespace:secrets` scope.
+
+If you create the secrets manually, be sure to make the secrets visible to the repsoitory from which you are launching the codespace (eg github.com/NIHGov/github-portal).

.devcontainer/nih/devcontainer.json

@@ -0,0 +1,120 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
+// https://github.com/microsoft/vscode-dev-containers/tree/v0.245.2/containers/typescript-node
+{
+  "name": "NIH GitHub Portal",
+  "dockerComposeFile": "docker-compose.yml",
+  "service": "web",
+  "workspaceFolder": "/workspace",
+  "postCreateCommand": "./.devcontainer/nih/setup.sh",
+  // If you change any local env vars be sure to close ALL VSCODE windows
+  // before rebuilding so vars are updated in the container
+  "remoteEnv": {
+    "AAD_CLIENT_ID": "${localEnv:AAD_CLIENT_ID}",
+    "AAD_CLIENT_SECRET": "${localEnv:AAD_CLIENT_SECRET}",
+    "AAD_ISSUER": "${localEnv:AAD_ISSUER}",
+    "AAD_REDIRECT_URL": "${localEnv:AAD_REDIRECT_URL}",
+    "AAD_TENANT_ID": "${localEnv:AAD_TENANT_ID}",
+    "APPINSIGHTS_INSTRUMENTATION_CS": "${localEnv:APPINSIGHTS_INSTRUMENTATION_CS}",
+    "APPINSIGHTS_INSTRUMENTATION_KEY": "${localEnv:APPINSIGHTS_INSTRUMENTATION_KEY}",
+    "AUTHORIZED_CORPORATE_ADMINISTRATOR_USERNAMES": "${localEnv:AUTHORIZED_CORPORATE_ADMINISTRATOR_USERNAMES}",
+    "DEBUG": "${localEnv:DEBUG:*}",
+    "DEBUG_ALLOW_HTTP": "${localEnv:DEBUG_ALLOW_HTTP}",
+    "DEBUG_SHOW_FOOTER": "${localEnv:DEBUG_SHOW_FOOTER:1}",
+    "ENVIRONMENT_NAME": "${localEnv:ENVIRONMENT_NAME}",
+    "FEATURE_FLAG_ALLOW_USERS_TO_VIEW_LOCKED_ORG_DETAILS": "1",
+    "GITHUB_APP_ACTIONS_APP_ID": "${localEnv:GH_APP_ACTIONS_APP_ID}",
+    "GITHUB_APP_ACTIONS_KEY": "${localEnv:GH_APP_ACTIONS_KEY}",
+    "GITHUB_APP_ACTIONS_KEY_FILE": "${localEnv:GH_APP_ACTIONS_KEY_FILE}",
+    "GITHUB_APP_ACTIONS_SLUG": "${localEnv:GH_APP_ACTIONS_SLUG}",
+    "GITHUB_APP_DATA_APP_ID": "${localEnv:GH_APP_DATA_APP_ID}",
+    "GITHUB_APP_DATA_KEY": "${localEnv:GH_APP_DATA_KEY}",
+    "GITHUB_APP_DATA_KEY_FILE": "${localEnv:GH_APP_DATA_KEY_FILE}",
+    "GITHUB_APP_DATA_SLUG": "${localEnv:GH_APP_DATA_SLUG}",
+    "GITHUB_APP_JOBS_APP_ID": "${localEnv:GH_APP_JOBS_APP_ID}",
+    "GITHUB_APP_JOBS_KEY": "${localEnv:GH_APP_JOBS_KEY}",
+    "GITHUB_APP_JOBS_KEY_FILE": "${localEnv:GH_APP_JOBS_KEY_FILE}",
+    "GITHUB_APP_JOBS_SLUG": "${localEnv:GH_APP_JOBS_SLUG}",
+    "GITHUB_APP_ONBOARDING_APP_ID": "${localEnv:GH_APP_ONBOARDING_APP_ID}",
+    "GITHUB_APP_ONBOARDING_KEY": "${localEnv:GH_APP_ONBOARDING_KEY}",
+    "GITHUB_APP_ONBOARDING_KEY_FILE": "${localEnv:GH_APP_ONBOARDING_KEY_FILE}",
+    "GITHUB_APP_ONBOARDING_SLUG": "${localEnv:GH_APP_ONBOARDING_SLUG}",
+    "GITHUB_APP_OPERATIONS_APP_ID": "${localEnv:GH_APP_OPERATIONS_APP_ID}",
+    "GITHUB_APP_OPERATIONS_KEY": "${localEnv:GH_APP_OPERATIONS_KEY}",
+    "GITHUB_APP_OPERATIONS_KEY_FILE": "${localEnv:GH_APP_OPERATIONS_KEY_FILE}",
+    "GITHUB_APP_OPERATIONS_SLUG": "${localEnv:GH_APP_OPERATIONS_SLUG}",
+    "GITHUB_APP_SECURITY_APP_ID": "${localEnv:GH_APP_SECURITY_APP_ID}",
+    "GITHUB_APP_SECURITY_KEY": "${localEnv:GH_APP_SECURITY_KEY}",
+    "GITHUB_APP_SECURITY_KEY_FILE": "${localEnv:GH_APP_SECURITY_KEY_FILE}",
+    "GITHUB_APP_SECURITY_SLUG": "${localEnv:GH_APP_SECURITY_SLUG}",
+    "GITHUB_APP_UI_APP_ID": "${localEnv:GH_APP_UI_APP_ID}",
+    "GITHUB_APP_UI_KEY": "${localEnv:GH_APP_UI_KEY}",
+    "GITHUB_APP_UI_KEY_FILE": "${localEnv:GH_APP_UI_KEY_FILE}",
+    "GITHUB_APP_UI_OAUTH_CLIENT_ID": "${localEnv:GH_APP_UI_OAUTH_CLIENT_ID}",
+    "GITHUB_APP_UI_OAUTH_CLIENT_SECRET": "${localEnv:GH_APP_UI_OAUTH_CLIENT_SECRET}",
+    "GITHUB_APP_UI_SLUG": "${localEnv:GH_APP_UI_SLUG}",
+    "GITHUB_APP_UPDATES_APP_ID": "${localEnv:GH_APP_UPDATES_APP_ID}",
+    "GITHUB_APP_UPDATES_KEY": "${localEnv:GH_APP_UPDATES_KEY}",
+    "GITHUB_APP_UPDATES_KEY_FILE": "${localEnv:GH_APP_UPDATES_KEY_FILE}",
+    "GITHUB_APP_UPDATES_SLUG": "${localEnv:GH_APP_UPDATES_SLUG}",
+    "GITHUB_CALLBACK_URL": "${localEnv:GH_CALLBACK_URL}",
+    "GITHUB_CLIENT_ID": "${localEnv:GH_CLIENT_ID}",
+    "GITHUB_CLIENT_SECRET": "${localEnv:GH_CLIENT_SECRET}",
+    "GITHUB_ORGANIZATIONS_FILE": "${localEnv:GH_ORGANIZATIONS_FILE}",
+    "GITHUB_PRIMARY_ORGANIZATION_ID": "${localEnv:GH_PRIMARY_ORGANIZATION_ID}",
+    "GITHUB_WEBHOOKS_SERVICEBUS_CONNECTIONSTRING": "${localEnv:GH_WEBHOOKS_SERVICEBUS_CONNECTIONSTRING}",
+    "GOOGLE_ANALYTICS_KEY": "${localEnv:GOOGLE_ANALYTICS_KEY}",
+    "MAIL_AZURESERVICEBUS_CONNECTIONSTRING": "${localEnv:MAIL_AZURESERVICEBUS_CONNECTIONSTRING}",
+    "MAIL_AZURESERVICEBUS_QUEUENAME": "${localEnv:MAIL_AZURESERVICEBUS_QUEUENAME}",
+    "MAIL_FROM": "${localEnv:MAIL_FROM}",
+    "PORTAL_ADMIN_EMAIL": "${localEnv:PORTAL_ADMIN_EMAIL}",
+    "REDIS_HOST": "${localEnv:REDIS_HOST:redis}",
+    "REDIS_TLS_HOST": "${localEnv:REDIS_TLS_HOST}",
+    "REDIS_PORT": "${localEnv:REDIS_PORT}",
+    "REDIS_KEY": "${localEnv:REDIS_KEY:redispw}",
+    "REPOS_LINKS_PROVIDER_NAME": "${localEnv:REPOS_LINKS_PROVIDER_NAME:postgres}",
+    "REPOS_POSTGRES_DATABASE": "${localEnv:REPOS_POSTGRES_DATABASE:postgres}",
+    "REPOS_POSTGRES_HOST": "${localEnv:REPOS_POSTGRES_HOST:localhost}",
+    "REPOS_POSTGRES_PASSWORD": "${localEnv:REPOS_POSTGRES_PASSWORD:postgres}",
+    "REPOS_POSTGRES_PORT": "${localEnv:REPOS_POSTGRES_PORT:5432}",
+    "REPOS_POSTGRES_SSL": "${localEnv:REPOS_POSTGRES_SSL:false}",
+    "REPOS_POSTGRES_USER": "${localEnv:REPOS_POSTGRES_USER:postgres}",
+    "SESSION_PROVIDER": "${localEnv:SESSION_PROVIDER:redis}",
+    "SESSION_COOKIE_DOMAIN": "${localEnv:SESSION_COOKIE_DOMAIN}",
+    "SITE_SERVICE_BANNER": "${localEnv:SITE_SERVICE_BANNER}",
+    "SITE_SERVICE_BANNER_DETAILS": "${localEnv:SITE_SERVICE_BANNER_DETAILS}",
+    "SITE_SERVICE_BANNER_LINK": "${localEnv:SITE_SERVICE_BANNER_LINK}",
+    "TEAM_JOIN_APPROVAL_TYPES": "${localEnv:TEAM_JOIN_APPROVAL_TYPES:mail}"
+  },
+
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "sqltools.connections": [
+          {
+            "name": "Postgres Database",
+            "driver": "PostgreSQL",
+            "previewLimit": 50,
+            "server": "localhost",
+            "port": 5432,
+            "database": "postgres",
+            "username": "postgres",
+            "password": "postgres"
+          }
+        ]
+      },
+      "extensions": ["mtxr.sqltools", "mtxr.sqltools-driver-pg"]
+    }
+  },
+
+  "forwardPorts": [3000, 5432],
+
+  //"remoteUser": "node"
+  "portsAttributes": {
+    "3000": {
+      "label": "NIH Portal"
+    },
+    "5432": {
+      "label": "Postgres Database"
+    }
+  }
+}

.devcontainer/nih/docker-compose.yml

@@ -0,0 +1,23 @@
+version: '3.9'
+services:
+  web:
+    build: .
+    volumes:
+      - ../..:/workspace:cached
+    command: sleep infinity
+    network_mode: service:db
+  redis:
+    image: 'redis:alpine'
+    command: redis-server --requirepass redispw
+  db:
+    image: 'postgres:alpine'
+    restart: unless-stopped
+    volumes:
+      - ../../pg.sql:/docker-entrypoint-initdb.d/pg.sql
+      - postgres-data:/var/lib/postgresql/data
+    environment:
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_USER: postgres
+      POSTGRES_DB: postgres
+volumes:
+  postgres-data:

.devcontainer/nih/gh-codespace-secret.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -e
+WRITE=0
+REPOSITORIES=${REPOS:-"nihgov/github-portal"}
+
+if [[ -z "$GITHUB_TOKEN" ]]; then
+    printf "GITHUB_TOKEN with scope 'codespace:secrets' must be set to create secrets." 1>&2
+    exit 1
+fi
+
+# Fail safe requiring explicit permission to write secrets with the --write flag
+if [[ $1 == "--write" ]]; then
+    WRITE=1
+else
+    printf "Running in dry-run mode. Pass --write flag to create secrets.\n\n"
+fi
+
+# Filter to remove variables that have default values in the devcontainer.json
+# to reduce unneeded secrets from being created.
+FILTER="KEY_FILE\|REPOS_*\|^DEBUG|SESSION_COOKIE_DOMAIN"
+
+# Get list of application environment variables from the devcontainer.json file
+ENV_VARS=($(cat devcontainer.json | sed 's/^ *\/\/.*//' | jq -r ".remoteEnv | keys[]" | grep -v $FILTER))
+
+FLAG="--no-store"
+
+# Remove no store flag if not in dry-run
+if [ "$WRITE" -eq "1" ]; then
+  FLAG=""
+fi
+
+# Loop through each variable and create a secret if the variable is set
+for VAR in "${ENV_VARS[@]}"
+do
+    # Check if the variable is set
+    if [[ -n "${!VAR}" ]]; then
+
+      # Replace GITHUB_ with GH_ since GitHub secrets cannot start with GITHUB
+      CLEANED_VAR="${VAR/GITHUB_/GH_}"
+
+      # If in dry-run mode print the encrypted, base64-encoded value instead of
+      # storing it on Github with the --no-store flag
+      if [ "$WRITE" -eq "0" ]; then
+        printf "\033[0;32m$CLEANED_VAR: \033[0m"
+      fi
+
+      # Create the secret or print the encrpyted secret
+      gh secret set -a codespaces $FLAG -u $CLEANED_VAR -b"${!VAR}" -r $REPOSITORIES
+    fi
+done

.devcontainer/nih/setup.sh

@@ -0,0 +1,4 @@
+git config --global --add safe.directory /workspace
+npm i
+cd default-assets-package
+npm i

.github/dependabot.yml

@@ -1,12 +1,31 @@
 version: 2
 updates:
   - package-ecosystem: npm
-    directory: '/'
+    directory: /
+    target-branch: staging
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'npm - back-end'
+  - package-ecosystem: npm
+    directory: /default-assets-package
+    target-branch: staging
     schedule:
       interval: daily
     open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'npm - front-end'
   - package-ecosystem: github-actions
-    directory: '/'
+    target-branch: staging
+    directory: /
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'actions'
+  - package-ecosystem: 'docker'
+    target-branch: staging
+    directory: '/'
+    schedule:
+      interval: 'weekly'

.github/scripts/Create-EnvOrgs.ps1

@@ -0,0 +1,21 @@
+$output = Get-Content ./raw.json | ConvertFrom-Json
+
+Write-Output $output.data.enterprise.organizations.nodes
+
+
+$orgsArray = @()
+
+foreach ($org in $output.data.enterprise.organizations.nodes) {
+  $envObj = [PSCustomObject]@{
+    name        = "$($org.login)"
+    id          = $($org.databaseId)
+    type        = @("public", "private")
+    description = "$($org.description)"
+    locked      = $True
+  }
+
+  $orgsArray += $envObj
+  Write-Output $orgsArray
+}
+
+$orgsArray | ConvertTo-Json -Depth 10 | Out-File -FilePath "orgs.json"