chore(mojaloop/#3443): nodejs upgrade (#54)

chore(mojaloop/#3443): nodejs upgrade - mojaloop/project#3443
- Upgraded NodeJS from v16 to v18 LTS
- Updated CI config to use NodeJS latest LTS version
- Updated CI config to display runtime versions for each job
- Upgraded NPM dependencies
- Fixed CI bugs caused by the NodeJS upgrade
- Updated CI pipeline use NVM to select node version from` .nvmrc` file
- Upgraded circleci orbs
- Migrated `master` branch to `main`
- Added `.versionrc`

.ncurc.yaml

@@ -1,5 +1,3 @@
 ## Add a TODO comment indicating the reason for each rejected dependency upgrade added to this list, and what should be done to resolve it (i.e. handle it through a story, etc).
 reject: [
-  # TODO: v6+ (ref: https://github.com/sindresorhus/get-port/releases/tag/v6.0.0) is an ESM library and thus not compatible with CommonJS. Future story needed to resolve.
-  "get-port"
 ]

.nvmrc

@@ -1 +1 @@
-16.15.0
+18.17.1

.versionrc

@@ -0,0 +1,16 @@
+{
+  "types": [
+    {"type": "feat", "section": "Features"},
+    {"type": "fix", "section": "Bug Fixes"},
+    {"type": "docs", "section": "Documentation"},
+    {"type": "style", "section": "Styling"},
+    {"type": "refactor", "section": "Refactors"},
+    {"type": "perf", "section": "Performance"},
+    {"type": "test", "section": "Tests"},
+    {"type": "build", "section": "Build System"},
+    {"type": "ci", "section": "CI"},
+    {"type": "chore", "section": "Chore"},
+    {"type": "revert", "section": "Reverts"}
+  ]
+}
+

Dockerfile

@@ -1,17 +1,29 @@
-FROM node:16.15.0-alpine as builder
+# Arguments
+ARG NODE_VERSION=lts-alpine
+
+# NOTE: Ensure you set NODE_VERSION Build Argument as follows...
+#
+#  export NODE_VERSION="$(cat .nvmrc)-alpine" \
+#  docker build \
+#    --build-arg NODE_VERSION=$NODE_VERSION \
+#    -t mojaloop/event-sidecar:local \
+#    . \
+#
+
+# Build Image
+FROM node:${NODE_VERSION} as builder
+
 WORKDIR /opt/app
 
 RUN apk --no-cache add git
-RUN apk add --no-cache -t build-dependencies make gcc g++ python3 libtool libressl-dev openssl-dev autoconf automake \
-    && cd $(npm root -g)/npm \
-    && npm config set unsafe-perm true \
-    && npm install -g node-gyp
+RUN apk add --no-cache -t build-dependencies make gcc g++ python3 libtool openssl-dev autoconf automake bash \
+    && cd $(npm root -g)/npm
 
 COPY package.json package-lock.json* /opt/app/
 
-RUN npm ci --production
+RUN npm ci --omit=dev
 
-FROM node:16.15.0-alpine
+FROM node:${NODE_VERSION}
 WORKDIR /opt/app
 
 # Create empty log file & link stdout to the application log file

README.md

@@ -1,6 +1,6 @@
 # Event-Sidecar
 
-[![Git Commit](https://img.shields.io/github/last-commit/mojaloop/event-sidecar.svg?style=flat)](https://github.com/mojaloop/event-sidecar/commits/master)
+[![Git Commit](https://img.shields.io/github/last-commit/mojaloop/event-sidecar.svg?style=flat)](https://github.com/mojaloop/event-sidecar/commits/main)
 [![Git Releases](https://img.shields.io/github/release/mojaloop/event-sidecar.svg?style=flat)](https://github.com/mojaloop/event-sidecar/releases)
 [![Docker pulls](https://img.shields.io/docker/pulls/mojaloop/event-sidecar.svg?style=flat)](https://hub.docker.com/r/mojaloop/event-sidecar)
 [![CircleCI](https://circleci.com/gh/mojaloop/event-sidecar.svg?style=svg)](https://circleci.com/gh/mojaloop/event-sidecar)
@@ -46,26 +46,26 @@ As part of our CI/CD process, we use a combination of CircleCI, standard-version
 npm package and github-release CircleCI orb to automatically trigger our releases
 and image builds. This process essentially mimics a manual tag and release.
 
-On a merge to master, CircleCI is configured to use the mojaloopci github account
+On a merge to main, CircleCI is configured to use the mojaloopci github account
 to push the latest generated CHANGELOG and package version number.
 
-Once those changes are pushed, CircleCI will pull the updated master, tag and
+Once those changes are pushed, CircleCI will pull the updated main, tag and
 push a release triggering another subsequent build that also publishes a docker image.
 
 ### Potential problems
 
-- There is a case where the merge to master workflow will resolve successfully, triggering
+- There is a case where the merge to main workflow will resolve successfully, triggering
   a release. Then that tagged release workflow subsequently failing due to the image scan,
   audit check, vulnerability check or other "live" checks.
 
-  This will leave master without an associated published build. Fixes that require
+  This will leave main without an associated published build. Fixes that require
   a new merge will essentially cause a skip in version number or require a clean up
-  of the master branch to the commit before the CHANGELOG and bump.
+  of the main branch to the commit before the CHANGELOG and bump.
 
   This may be resolved by relying solely on the previous checks of the
-  merge to master workflow to assume that our tagged release is of sound quality.
+  merge to main workflow to assume that our tagged release is of sound quality.
   We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier
   is a boon.
 
-- It is unknown if a race condition might occur with multiple merges with master in
+- It is unknown if a race condition might occur with multiple merges with main in
   quick succession, but this is a suspected edge case.

audit-ci.jsonc

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+  // audit-ci supports reading JSON, JSONC, and JSON5 config files.
+  // Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
+  "moderate": true,
+  "allowlist": [
+    "GHSA-w5p7-h5w8-2hfq",
+    "GHSA-qgmg-gppg-76g5"
+  ]
+}