reactive resume - Moses Yebei

Abstract

A one-of-a-kind resume builder that keeps your privacy in mind. Completely secure, customizable, portable, open-source and free forever. Try it out today!

The Problem

Many developers need a self‑hosted resume builder that stores user data locally, offers real‑time editing, and can export to PDF/Docx without third‑party tracking. Existing SaaS tools either lock data behind a service or require heavyweight infrastructure to run a full‑stack app.

What This Does

reactive-resume is a monorepo of five loosely coupled projects that together deliver a privacy‑first resume service.

Front‑end – apps/web contains a React UI built with Vite (apps/web/vite.config.ts). The main entry point is apps/web/src/dialogs/resume/index.tsx, which renders the editor and talks to the back‑end via REST.
Back‑end – apps/server runs an Express API (apps/server/src/http/app.ts) started from apps/server/src/index.ts. It loads feature modules from packages/api (e.g., packages/api/src/features/resume/service.ts) and PDF generation from packages/pdf.
PDF generation – packages/pdf/src/document.tsx composes the final PDF using the semantic model (packages/pdf/src/semantic/*). This module is the most connected hub (32 inbound imports).
AI helpers – packages/ai wraps OpenAI/Claude/Gemini calls used by the UI for content suggestions.
Schema & migrations – packages/schema defines the resume data model; migrations holds SQL scripts for the optional Postgres store.

All projects share a single pnpm workspace, Docker support (Dockerfile, Dockerfile.dev), and CI via GitHub Actions.

How It Is Wired

Execution begins with the server entry point apps/server/src/index.ts, which creates an Express app (apps/server/src/http/app.ts). The app registers routes from packages/api – for example, the resume CRUD routes are defined in packages/api/src/features/resume/. Those handlers invoke the schema layer (packages/schema/src/resume/data.ts) and, when a PDF export is requested, call packages/pdf/src/document.tsx.

packages/pdf/src/document.tsx imports the template system (packages/pdf/src/templates/*) and the semantic graph (packages/pdf/src/semantic/*). The import graph shows it as a hub module (32 dependents, 9 imports) and participates in a circular dependency with packages/pdf/src/semantic/template-manifest.ts and packages/api/src/features/resume/stylesheet-preflight.ts. The cycle inflates build time and makes refactoring risky.

On the client side, Vite serves the React bundle; the UI boots from apps/web/src/dialogs/resume/index.tsx, which contacts the API endpoints defined above. Authentication, passkey, and 2FA logic live under apps/server/src/mcp/ and are consumed by the UI through token‑based calls.

The blast radius of changes is highest in packages/pdf/src/document.tsx (hub) and in oversized files such as packages/pdf/src/templates/shared/sections.tsx (1,373 lines). Deep nesting (max depth 7) appears in the same PDF modules, adding cognitive load for future contributors.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/reactive-resume.git
cd reactive-resume

# Install dependencies with pnpm (workspace root)
pnpm install

# Copy example env and edit as needed
cp .env.example .env   # set DB_URL, JWT secret, OpenAI keys, etc.

# Build and run locally (Docker optional)
pnpm dev               # starts both Vite front‑end and Express server
# or, containerised:
docker compose up -d   # uses Dockerfile.dev for dev image

The server reads configuration from .env. The front‑end expects the API at http://localhost:3000 (default in apps/web/.env if present). The docker-compose.yml (not listed) orchestrates the services; otherwise pnpm dev runs them concurrently via the workspace scripts.

Real‑World Use

A company can deploy the Docker image (docker build -t reactive-resume .) behind its internal reverse proxy. Employees log in with passkeys, edit their resumes via the React UI, and export PDFs that are generated on‑the‑fly by the PDF hub. Because all data lives in the company’s PostgreSQL instance (migrations in migrations/), no external service ever sees personal information.

Code Health & Issues

HIGH – GitHub Actions use mutable tags (@v6, @v2). Pin to commit SHA to avoid supply‑chain risk.
HIGH – CI never runs the test suite (354 test files). Add a test step to existing workflows.
MEDIUM – No Dependabot/Renovate config; add .github/dependabot.yml.
MEDIUM – Docker base image (node:${NODE_VERSION}-slim) is unpinned; use digest.
MEDIUM – No dependency‑vulnerability scan in CI; add dependency-review-action or osv-scanner.
MEDIUM – Checkout step keeps token; set persist-credentials: false.
LOW – No job timeouts; add timeout-minutes.
LOW – Missing editor/formatter conventions (.editorconfig, .gitattributes).

Static analysis also flagged import cycles (5 modules), deep nesting (32 occurrences), oversized files (5 files >1k lines), and a hub module with 32 dependents, all of which increase maintenance cost.

The Bottom Line

reactive-resume provides a complete, self‑hostable resume platform with a modern React front‑end and a TypeScript/Express back‑end, but its PDF subsystem is a maintenance hotspot due to cycles and large files. The repo is CI‑ready but needs hardening (pinned actions, test execution, dependency scanning). It is well suited for teams that require full data control and are comfortable managing a monorepo with Docker and pnpm.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

1,443 files

TypeScript535
TSX443
JSON112
Markdown26
SQL22
YAML15

ReactExpressDocker

Architecture

Top-level areas of the codebase, sized by module count. Arrows show how many imports cross from one area into another.

graph TD g0["packages 485 modules"] g1["apps 419 modules"] g2[".design-sync 40 modules"] g3["tests 18 modules"] g4["(root) 5 modules"] g5["tooling 5 modules"] g0 -->|15| g4 g1 -->|2| g4

Module dependencies

The 10 most depended-upon modules of 972, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_packages_pdf_src_document["document"] n1_s_pdf_src_semantic_node_keys["node-keys"] n2__src_templates_shared_styles["styles"] n3_packages_pdf_src_context["context"] n4_c_semantic_template_manifest["template-manifest"] n5_ges_pdf_src_semantic_context["context"] n6_packages_api_src_context["context"] n7_src_templates_shared_context["context"] n8__templates_shared_primitives["primitives"] n9_c_templates_shared_filtering["filtering"] n0_packages_pdf_src_document --> n3_packages_pdf_src_context n0_packages_pdf_src_document --> n5_ges_pdf_src_semantic_context n5_ges_pdf_src_semantic_context --> n1_s_pdf_src_semantic_node_keys n7_src_templates_shared_context --> n2__src_templates_shared_styles n7_src_templates_shared_context --> n3_packages_pdf_src_context n7_src_templates_shared_context --> n5_ges_pdf_src_semantic_context n8__templates_shared_primitives --> n2__src_templates_shared_styles n8__templates_shared_primitives --> n3_packages_pdf_src_context n8__templates_shared_primitives --> n5_ges_pdf_src_semantic_context n8__templates_shared_primitives --> n1_s_pdf_src_semantic_node_keys n8__templates_shared_primitives --> n7_src_templates_shared_context classDef cyc stroke:#ef4444,stroke-width:2px; class n0_packages_pdf_src_document,n4_c_semantic_template_manifest cyc;

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium4

low2

Pin third-party GitHub Actions to a commit SHAhigh8 occurrences

.github/workflows

pnpm/action-setup@v6, crowdin/github-action@v2, docker/setup-buildx-action@v4, docker/login-action@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Make CI invoke the test suite it hashigh354 occurrences

.github/workflows

354 test files, no test command in any workflow

A green check that never executed an assertion is worse than no check, because reviewers trust it.

Fix: Add a test step to the existing workflow rather than a new workflow.

Enable Dependabot or Renovatemedium

20 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

Dockerfile

node:${NODE_VERSION}-slim, node:${NODE_VERSION}-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/autofix.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/autofix.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.