Use style-guide to import fonts and favicons

[hursey013]

This uses the identity-style-guide NPM package to import shared assets. This first PR imports relatively low risk assets: font files, and favicons. A follow up PR will address shared stylesheets, images, and possibly some Javascript.

[zachmargolis]

is this rejecting files that contain node_modules in the path? I would be more explicit than using the indexing syntax"

.reject { |f| f.include?('node_modules') }

[hursey013]

Yeah, there are some offenders in the identity-style-guide npm package so this is a temporary measure to exclude those for now. None of the images are being used within the app at this point. I will update to the syntax you provided... I wasn't sure the best way to handle excluding just that one folder.

[zachmargolis]

LGTM

[monfresh]

What about the vulnerabilities reported by Snyk? What are we doing about them? Seems like there isn't a fix for the shelljs vulnerability right now. Can we use something else?

[hursey013]

Yeah I'm not sure what to do about this - there are a number of dependencies that don't seem to currently have a fix. All of these dependencies are brought in because the identity-style-guide npm package contains a static site generator called Fractal thats used to generate a style guide on Federalist.

None of these dependencies are actually used within the identity-idp app, I'm just copying asset files out of the package folder into the app. Since they are not being used is it safe to ignore them, or does their presence in the node_modules folder alone cause a potential risk?

[monfresh]

Hmm. Sounds like the identity-style-guide npm package should perhaps not include all of those dependencies if they're only specific to Fractal?

[monfresh]

I think that's probably the best solution. If the style guide is meant to be used outside of Federalist, and if fractal is specific to Federalist, then I would remove fractal as a dependency, and instruct people who want to use it with Federalist to add fractal to their package.json. What do you think?

[hursey013]

@monfresh I modified the node package to only include the assets and not install any of the dependencies.

[monfresh]

Awesome. Thanks!