diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..c00e4bc19d --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,74 @@ +# See for details: +# - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates +# - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file +version: 2 +updates: + + - package-ecosystem: "maven" + directory: "/" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#allow + allow: + - dependency-name: "com.h2database:h2" + - dependency-name: "net.coobird:thumbnailator" + - dependency-name: "org.apache.commons:commons-lang3" + - dependency-name: "org.apache.commons:commons-text" + - dependency-name: "org.apache.maven.plugins:maven-compiler-plugin" + - dependency-name: "org.jsoup:jsoup" + - dependency-name: "org.liquibase:liquibase-core" + - dependency-name: "org.projectlombok:lombok" + - dependency-name: "org.hibernate.validator:hibernate-validator" + - dependency-name: "org.webjars.npm:htmx.org" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#ignore + ignore: + - dependency-name: "org.hibernate.validator:hibernate-validator" + update-types: [ "version-update:semver-major", "version-update:semver-minor" ] + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleinterval + schedule: + interval: "daily" + time: "08:00" + timezone: "Asia/Novosibirsk" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#commit-message + commit-message: + prefix: "chore" + assignees: [ "php-coder" ] + labels: [ "kind/dependency-update" ] + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#rebase-strategy + rebase-strategy: "disabled" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit + open-pull-requests-limit: 3 + + - package-ecosystem: "github-actions" + directory: "/" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleinterval + schedule: + interval: "daily" + time: "08:00" + timezone: "Asia/Novosibirsk" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#commit-message + commit-message: + prefix: "ci" + assignees: [ "php-coder" ] + labels: [ "kind/dependency-update", "area/ci" ] + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#rebase-strategy + rebase-strategy: "disabled" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit + open-pull-requests-limit: 1 + + # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem- + # NOTE: only terraform >= 0.13 and <= 1.8.x is supported + - package-ecosystem: "terraform" + directory: "infra/terraform" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#scheduleinterval + schedule: + interval: "daily" + time: "08:00" + timezone: "Asia/Novosibirsk" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#commit-message + commit-message: + prefix: "chore" + assignees: [ "php-coder" ] + labels: [ "kind/dependency-update" ] + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#rebase-strategy + rebase-strategy: "disabled" + # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#open-pull-requests-limit + open-pull-requests-limit: 1 diff --git a/.github/workflows/dependencies-diff.yml b/.github/workflows/dependencies-diff.yml index 431646fb4c..8be8308d8b 100644 --- a/.github/workflows/dependencies-diff.yml +++ b/.github/workflows/dependencies-diff.yml @@ -26,10 +26,10 @@ jobs: show-spring-boot-version-diff: name: Run show-spring-boot-version-diff.sh # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: false diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 6b38acf67e..7ff9524584 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -22,21 +22,28 @@ jobs: deploy: name: Deploy # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: false - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java + uses: actions/setup-java@v4.7.1 # https://github.com/actions/setup-java with: distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies + + - name: Restore existing cache + uses: actions/cache@v4.2.3 # https://github.com/actions/cache + with: + # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action + key: maven-repository-${{ hashFiles('pom.xml') }} + path: ~/.m2/repository + restore-keys: maven-repository- - name: Build WAR file # NOTE: we use -Dmaven.test.skip=true instead of -DskipUnitTests=true @@ -48,19 +55,28 @@ jobs: -Dmaven.test.skip=true \ package - - name: Install ansible - # The command pip3 install --user ansible==2.10.17 doesn't work as we have an old version - # See https://docs.ansible.com/ansible/2.10/installation_guide/intro_installation.html#installing-devel-from-github-with-pip - run: python3 -m pip install --user https://github.com/ansible/ansible/archive/refs/tags/v2.10.17.tar.gz + - name: Install mise to set up Ansible + uses: jdx/mise-action@v2.2.3 # https://github.com/jdx/mise-action + with: + version: 2025.5.14 # [default: latest] mise version to install + install: true # [default: true] run `mise install` + cache: true # [default: true] cache mise using GitHub's cache + log_level: info # [default: info] log level + working_directory: infra/ansible # [default: .] directory to run mise in + env: + # Workaround: don't install some dependencies that we don't use (java, maven) or don't want (python) + # See: https://github.com/jdx/mise-action/issues/183 + # https://mise.jdx.dev/configuration/settings.html#disable_tools + MISE_DISABLE_TOOLS: java,maven,python - # https://docs.ansible.com/ansible/2.10/collections/community/general/uptimerobot_module.html + # https://docs.ansible.com/ansible/3/collections/community/general/uptimerobot_module.html # https://docs.ansible.com/ansible/latest/collections_guide/collections_installing.html#installing-an-older-version-of-a-collection - name: Install community.general collection for UptimeRobot - run: ansible-galaxy collection install community.general:==1.3.6 + run: ansible-galaxy collection install community.general:==2.5.2 - # https://docs.ansible.com/ansible/2.10/collections/ansible/posix/debug_callback.html + # https://docs.ansible.com/ansible/3/collections/ansible/posix/debug_callback.html - name: Install ansible.posix.debug for debug callback - run: ansible-galaxy collection install ansible.posix:==1.1.1 + run: ansible-galaxy collection install ansible.posix:==1.2.0 - name: Run deploy.sh env: diff --git a/.github/workflows/integration-tests-h2.yml b/.github/workflows/integration-tests-h2.yml index 2c5a37fbdc..9b5b481ae3 100644 --- a/.github/workflows/integration-tests-h2.yml +++ b/.github/workflows/integration-tests-h2.yml @@ -2,7 +2,17 @@ name: Integration Tests (H2) on: push: - pull_request: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore + paths-ignore: + - 'mise.toml' + - '.gitignore' + - '.github/**' + - '!.github/workflows/integration-tests-h2.yml' + - 'docs/**' + - 'infra/**' + - 'src/main/config/*' + - 'src/main/scripts/**' + - '!src/main/scripts/execute-command.sh' # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions permissions: @@ -21,24 +31,43 @@ jobs: run-integration-tests: name: Integration Tests # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 + # https://docs.github.com/en/actions/using-jobs/using-a-matrix-for-your-jobs + strategy: + matrix: + # https://docs.github.com/en/actions/using-jobs/using-a-matrix-for-your-jobs#example-adding-configurations + include: + - java-version: '8' + allow-failure: false + - java-version: '11' + allow-failure: true + - java-version: '17' + allow-failure: true + # https://docs.github.com/en/actions/using-jobs/using-a-matrix-for-your-jobs#handling-failures + continue-on-error: ${{ matrix.allow-failure }} steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: false - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java + uses: actions/setup-java@v4.7.1 # https://github.com/actions/setup-java with: - distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions - java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies + distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions + java-version: ${{ matrix.java-version }} # https://github.com/actions/setup-java#supported-version-syntax + - name: Restore existing cache + uses: actions/cache@v4.2.3 # https://github.com/actions/cache + with: + # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action + key: maven-repository-${{ hashFiles('pom.xml') }} + path: ~/.m2/repository + restore-keys: maven-repository- - name: Run integration tests run: ./src/main/scripts/execute-command.sh integration-tests - name: Save RobotFramework reports if: ${{ failure() }} - uses: actions/upload-artifact@v3.1.1 # https://github.com/actions/upload-artifact + uses: actions/upload-artifact@v4.6.2 # https://github.com/actions/upload-artifact with: name: robotframework-reports path: target/robotframework-reports/ diff --git a/.github/workflows/integration-tests-mysql.yml b/.github/workflows/integration-tests-mysql.yml index 6f288e1904..2979111c3b 100644 --- a/.github/workflows/integration-tests-mysql.yml +++ b/.github/workflows/integration-tests-mysql.yml @@ -2,7 +2,17 @@ name: Integration Tests (MySQL) on: push: - pull_request: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore + paths-ignore: + - 'mise.toml' + - '.gitignore' + - '.github/**' + - '!.github/workflows/integration-tests-mysql.yml' + - 'docs/**' + - 'infra/**' + - 'src/main/config/*' + - 'src/main/scripts/**' + - '!src/main/scripts/execute-command.sh' # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions permissions: @@ -21,7 +31,7 @@ jobs: run-integration-tests: name: Integration Tests # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idservices services: db: @@ -49,16 +59,22 @@ jobs: - '3306:3306' steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: false - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java + uses: actions/setup-java@v4.7.1 # https://github.com/actions/setup-java with: distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies + - name: Restore existing cache + uses: actions/cache@v4.2.3 # https://github.com/actions/cache + with: + # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action + key: maven-repository-${{ hashFiles('pom.xml') }} + path: ~/.m2/repository + restore-keys: maven-repository- # This is a workaround for github action limitation: we can't specify command for the service (--character-set-server=utf8) # and have to modify database manually. See also: # https://github.com/actions/runner/discussions/1872 and https://github.com/orgs/community/discussions/26688 @@ -79,7 +95,7 @@ jobs: ./src/main/scripts/execute-command.sh integration-tests - name: Save RobotFramework reports if: ${{ failure() }} - uses: actions/upload-artifact@v3.1.1 # https://github.com/actions/upload-artifact + uses: actions/upload-artifact@v4.6.2 # https://github.com/actions/upload-artifact with: name: robotframework-reports path: target/robotframework-reports/ diff --git a/.github/workflows/integration-tests-postgres.yml b/.github/workflows/integration-tests-postgres.yml index 47d5bf69fe..a3a3b26fc2 100644 --- a/.github/workflows/integration-tests-postgres.yml +++ b/.github/workflows/integration-tests-postgres.yml @@ -2,7 +2,17 @@ name: Integration Tests (PostgreSQL) on: push: - pull_request: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore + paths-ignore: + - 'mise.toml' + - '.gitignore' + - '.github/**' + - '!.github/workflows/integration-tests-postgres.yml' + - 'docs/**' + - 'infra/**' + - 'src/main/config/*' + - 'src/main/scripts/**' + - '!src/main/scripts/execute-command.sh' # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions permissions: @@ -21,7 +31,7 @@ jobs: run-integration-tests: name: Integration Tests # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idservices services: db: @@ -40,23 +50,29 @@ jobs: - '5432:5432' steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: false - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java + uses: actions/setup-java@v4.7.1 # https://github.com/actions/setup-java with: distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies + - name: Restore existing cache + uses: actions/cache@v4.2.3 # https://github.com/actions/cache + with: + # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action + key: maven-repository-${{ hashFiles('pom.xml') }} + path: ~/.m2/repository + restore-keys: maven-repository- - name: Run integration tests env: SPRING_PROFILES_ACTIVE: postgres run: ./src/main/scripts/execute-command.sh integration-tests - name: Save RobotFramework reports if: ${{ failure() }} - uses: actions/upload-artifact@v3.1.1 # https://github.com/actions/upload-artifact + uses: actions/upload-artifact@v4.6.2 # https://github.com/actions/upload-artifact with: name: robotframework-reports path: target/robotframework-reports/ diff --git a/.github/workflows/populate-maven-cache.yml b/.github/workflows/populate-maven-cache.yml new file mode 100644 index 0000000000..ff8fb858e0 --- /dev/null +++ b/.github/workflows/populate-maven-cache.yml @@ -0,0 +1,60 @@ +name: Populates a cache for Maven + +on: + push: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpull_requestpull_request_targetbranchesbranches-ignore + branches: + - master + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore + paths: + - pom.xml + - .github/workflows/populate-maven-cache.yml + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_dispatch + workflow_dispatch: + +# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +permissions: + contents: read # for "git clone" + +defaults: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun + run: + # Enable fail-fast behavior using set -eo pipefail + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference + shell: bash + +jobs: + populate-maven-cache: + name: Populate Maven cache + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on + runs-on: ubuntu-22.04 + steps: + + - name: Clone source code + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout + with: + # Whether to configure the token or SSH key with the local git config. Default: true + persist-credentials: false + + - name: Install JDK + uses: actions/setup-java@v4.7.1 # https://github.com/actions/setup-java + with: + distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions + java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax + + - name: Restore existing cache + uses: actions/cache@v4.2.3 # https://github.com/actions/cache + with: + # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action + key: maven-repository-${{ hashFiles('pom.xml') }} + path: ~/.m2/repository + restore-keys: maven-repository- + + - name: Download all dependencies + run: mvn dependency:go-offline + + - name: Install NodeJS and npm + run: mvn frontend:install-node-and-npm --activate-profiles frontend + + - name: List downloaded artifacts + run: find ~/.m2/repository -type f -name '*.jar' diff --git a/.github/workflows/provision-by-ansible.yml b/.github/workflows/provision-by-ansible.yml new file mode 100644 index 0000000000..2850967d0c --- /dev/null +++ b/.github/workflows/provision-by-ansible.yml @@ -0,0 +1,88 @@ +name: Provision a server by Ansible + +on: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_dispatch + workflow_dispatch: + +# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +permissions: + contents: read # for "git clone" + +defaults: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun + run: + # Enable fail-fast behavior using set -eo pipefail + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference + shell: bash + +jobs: + setup-server: + name: Provision a server + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on + runs-on: ubuntu-22.04 + steps: + + - name: Clone source code + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout + with: + # Whether to configure the token or SSH key with the local git config. Default: true + persist-credentials: false + + - name: Install mise to set up Ansible + uses: jdx/mise-action@v2.2.3 # https://github.com/jdx/mise-action + with: + version: 2025.5.14 # [default: latest] mise version to install + install: true # [default: true] run `mise install` + cache: true # [default: true] cache mise using GitHub's cache + log_level: info # [default: info] log level + working_directory: infra/ansible # [default: .] directory to run mise in + env: + # Workaround: don't install some dependencies that we don't use (java, maven) or don't want (python) + # See: https://github.com/jdx/mise-action/issues/183 + # https://mise.jdx.dev/configuration/settings.html#disable_tools + MISE_DISABLE_TOOLS: java,maven,python + + - name: Show ansible version + run: ansible --version + + - name: Decrypt ansible files + working-directory: infra/ansible + env: + # https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow + VAULT_PASSWORD: ${{ secrets.VAULT_PASSWORD }} + run: | + printf '%s' "$VAULT_PASSWORD" >vault-pass.txt + + for FILENAME in vars/prod.yml coder_rsa; do + echo "Decrypting ${FILENAME}.enc to $FILENAME" + ansible-vault decrypt \ + --vault-password-file vault-pass.txt \ + --output "$FILENAME" \ + "${FILENAME}.enc" + done + + - name: Install required collections + working-directory: infra/ansible + run: ansible-galaxy role install --role-file requirements.galaxy.yml --roles-path roles + + - name: Run ansible in syntax check mode + working-directory: infra/ansible + run: ansible-playbook prod.yml -i prod.inventory --syntax-check + + - name: Run ansible + working-directory: infra/ansible + env: + # Disable host key checking to suppress interactive prompt. + # See: https://docs.ansible.com/ansible/3/user_guide/connection_details.html#managing-host-key-checking + ANSIBLE_HOST_KEY_CHECKING: 'False' + # See: https://docs.ansible.com/ansible/3/reference_appendices/config.html#envvar-ANSIBLE_PRIVATE_KEY_FILE + ANSIBLE_PRIVATE_KEY_FILE: 'coder_rsa' + run: ansible-playbook prod.yml -i prod.inventory + + - name: Cleanup + if: always() + working-directory: infra/ansible + run: | + for FILE in vault-pass.txt vars/prod.yml coder_rsa; do + [ ! -f "$FILE" ] || rm -fv "$FILE" + done diff --git a/.github/workflows/provision-by-terraform.yml b/.github/workflows/provision-by-terraform.yml new file mode 100644 index 0000000000..1b9a270717 --- /dev/null +++ b/.github/workflows/provision-by-terraform.yml @@ -0,0 +1,137 @@ +name: Setup a server by Terraform + +on: + push: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpull_requestpull_request_targetbranchesbranches-ignore + branches: + - master + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore + paths: + - .github/workflows/provision-by-terraform.yml + - 'infra/terraform/**' + - '!infra/terraform/*.example' + - '!infra/terraform/*.md' + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_dispatch + workflow_dispatch: + +# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +permissions: + contents: read # for "git clone" + +defaults: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun + run: + # Enable fail-fast behavior using set -eo pipefail + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference + shell: bash + +jobs: + setup-server: + name: Setup a server + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on + runs-on: ubuntu-22.04 + steps: + + - name: Clone source code + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout + with: + # Whether to configure the token or SSH key with the local git config. Default: true + persist-credentials: false + + - name: Checkout terraform data to a subdirectory + working-directory: infra/terraform + run: | + git fetch --depth=1 origin generated-terraform + git worktree add terraform-data generated-terraform + + - name: Install mise to set up Terraform + uses: jdx/mise-action@v2.2.3 # https://github.com/jdx/mise-action + with: + version: 2025.5.14 # [default: latest] mise version to install + install: true # [default: true] run `mise install` + cache: true # [default: true] cache mise using GitHub's cache + log_level: info # [default: info] log level + working_directory: infra/terraform # [default: .] directory to run mise in + env: + # Workaround: don't install parent's dependencies as we don't use them + # See: https://github.com/jdx/mise-action/issues/183 + # https://mise.jdx.dev/configuration/settings.html#disable_tools + MISE_DISABLE_TOOLS: java,maven + + - name: Install ansible-vault + working-directory: infra/ansible + env: + # Don't install some dependencies that we don't use (java, maven) or don't want (python) + # https://mise.jdx.dev/configuration/settings.html#disable_tools + MISE_DISABLE_TOOLS: java,maven,python + run: mise install + + - name: Show Terraform version + # NOTE: a working directory is important here and must be set to the dir where mise is configured + working-directory: infra/terraform + env: + # https://developer.hashicorp.com/terraform/cli/commands#upgrade-and-security-bulletin-checks + CHECKPOINT_DISABLE: true + run: terraform -version + + - name: Show Ansible version + # NOTE: a working directory is important here and must be set to the dir where mise is configured + working-directory: infra/ansible + run: ansible-vault --version + + - name: Decrypt terraform files + working-directory: infra/terraform + env: + # https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow + VAULT_PASSWORD: ${{ secrets.VAULT_PASSWORD }} + run: | + printf '%s' "$VAULT_PASSWORD" >vault-pass.txt + + for FILENAME in terraform.tfstate terraform.tfvars; do + echo "Decrypting ${FILENAME}.enc to $FILENAME" + ansible-vault decrypt \ + --vault-password-file vault-pass.txt \ + --output "$FILENAME" \ + "terraform-data/${FILENAME}.enc" + done + + - name: Run terraform init + working-directory: infra/terraform + env: + # https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_in_automation + TF_IN_AUTOMATION: true + # https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_input + # https://developer.hashicorp.com/terraform/tutorials/automation/automate-terraform#automated-terraform-cli-workflow + TF_INPUT: false + run: terraform init + + - name: Check whether there are no modified files + run: >- + MODIFIED_FILES="$(git status --short)"; + if [ -n "$MODIFIED_FILES" ]; then + echo >&2 "ERROR: the following files have been modified:"; + echo >&2 "$MODIFIED_FILES"; + exit 1; + fi + + - name: Run terraform plan + working-directory: infra/terraform + env: + # https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_in_automation + TF_IN_AUTOMATION: true + # https://developer.hashicorp.com/terraform/cli/config/environment-variables#tf_input + # https://developer.hashicorp.com/terraform/tutorials/automation/automate-terraform#automated-terraform-cli-workflow + TF_INPUT: false + run: >- + terraform plan \ + -detailed-exitcode \ + -out terraform.tfplan + + - name: Cleanup + if: always() + working-directory: infra/terraform + run: | + for FILE in vault-pass.txt terraform.tfplan terraform.tfstate terraform.tfstate.backup terraform.tfvars; do + [ ! -f "$FILE" ] || rm -fv "$FILE" + done + [ ! -d terraform-data ] || git worktree remove terraform-data diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 9e95957dc2..cd10dc8f5e 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -2,7 +2,17 @@ name: Static Analysis on: push: - pull_request: + # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpushpull_requestpull_request_targetpathspaths-ignore + paths-ignore: + - 'mise.toml' + - '.gitignore' + - '.github/**' + - '!.github/workflows/static-analysis.yml' + - 'docs/**' + - 'infra/**' + - 'src/main/config/nginx/*' + - 'src/main/scripts/**' + - '!src/main/scripts/execute-command.sh' # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions permissions: @@ -16,234 +26,53 @@ defaults: shell: bash jobs: - run-checkstyle: - name: Run CheckStyle - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java - with: - distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions - java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies - - name: Run CheckStyle - run: ./src/main/scripts/execute-command.sh checkstyle - - run-pmd: - name: Run PMD - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java - with: - distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions - java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies - - name: Run PMD - run: ./src/main/scripts/execute-command.sh pmd check-license: name: Check license in file headers # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: false - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java + uses: actions/setup-java@v4.7.1 # https://github.com/actions/setup-java with: distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies + - name: Restore existing cache + uses: actions/cache@v4.2.3 # https://github.com/actions/cache + with: + # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action + key: maven-repository-${{ hashFiles('pom.xml') }} + path: ~/.m2/repository + restore-keys: maven-repository- - name: Check license header run: ./src/main/scripts/execute-command.sh check-license - check-pom: - name: Check pom.xml - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java - with: - distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions - java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies - - name: Check pom.xml - run: ./src/main/scripts/execute-command.sh check-pom - - run-bootlint: - name: Run Bootstrap linter - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install bootlint - # https://docs.npmjs.com/cli/v8/commands/npm-install - run: >- - npm install \ - --no-audit \ - --no-fund \ - --global \ - bootlint@1.1.0 - - name: Run bootlint - run: ./src/main/scripts/execute-command.sh bootlint - - run-rflint: - name: Run RobotFramework linter - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install rflint - run: >- - pip3 install \ - --user \ - robotframework==3.2.2 \ - robotframework-lint==1.1 - - name: Run rflint - run: ./src/main/scripts/execute-command.sh rflint - - run-shellcheck: - name: Run ShellCheck - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Show shellcheck version - run: shellcheck --version - - name: Run shellcheck - run: ./src/main/scripts/execute-command.sh shellcheck - - run-html5validator: - name: Run html5validator - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install html5validator - run: pip3 install --user html5validator==0.4.2 - - name: Run html5validator - run: ./src/main/scripts/execute-command.sh html5validator - - run-ansible-lint: - name: Run ansible-lint - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install ansible-lint - run: pip3 install --user ansible-lint==4.2.0 - - name: Run ansible-lint - run: ./src/main/scripts/execute-command.sh ansible-lint - run-enforcer: name: Run maven-enforcer-plugin # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: false - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java + uses: actions/setup-java@v4.7.1 # https://github.com/actions/setup-java with: distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies + - name: Restore existing cache + uses: actions/cache@v4.2.3 # https://github.com/actions/cache + with: + # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action + key: maven-repository-${{ hashFiles('pom.xml') }} + path: ~/.m2/repository + restore-keys: maven-repository- - name: Run maven-enforcer-plugin run: ./src/main/scripts/execute-command.sh enforcer - - run-codenarc: - name: Run CodeNarc - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java - with: - distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions - java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies - - name: Compile sources - run: >- - mvn \ - --batch-mode \ - -Denforcer.skip=true \ - -DskipMinify \ - compile - - name: Run CodeNarc - run: ./src/main/scripts/execute-command.sh codenarc - - run-spotbugs: - name: Run SpotBugs - # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 - steps: - - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout - with: - # Whether to configure the token or SSH key with the local git config. Default: true - persist-credentials: false - - name: Install JDK - uses: actions/setup-java@v3.12.0 # https://github.com/actions/setup-java - with: - distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions - java-version: '8' # https://github.com/actions/setup-java#supported-version-syntax - cache: 'maven' # https://github.com/actions/setup-java#caching-packages-dependencies - - name: Compile sources - run: >- - mvn \ - --batch-mode \ - -Denforcer.skip=true \ - -DskipMinify \ - compile - - name: Run SpotBugs - run: ./src/main/scripts/execute-command.sh spotbugs diff --git a/.github/workflows/todos-extract-from-code.yml b/.github/workflows/todos-extract-from-code.yml index a384039224..31af456075 100644 --- a/.github/workflows/todos-extract-from-code.yml +++ b/.github/workflows/todos-extract-from-code.yml @@ -11,7 +11,6 @@ on: - '**.jpg' - '**.png' - '**.ico' - - '**.md' # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions permissions: @@ -29,16 +28,16 @@ jobs: extract-pdd-puzzles: name: Extract todos from code # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Clone source code - uses: actions/checkout@v3.5.2 # https://github.com/actions/checkout + uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout with: # Whether to configure the token or SSH key with the local git config. Default: true persist-credentials: true - name: Install pdd - run: sudo gem install pdd:0.23.1 --no-document + run: sudo gem install pdd:0.24.0 --no-document - name: Checkout existing todos to another directory run: | @@ -53,18 +52,18 @@ jobs: --exclude '**/*.jpg' \ --exclude '**/*.png' \ --exclude '**/*.ico' \ - --exclude '**/*.md' \ --exclude '**/*.enc' \ --exclude 'src/test/wiremock/**/*' \ --exclude 'generated-todos/**' \ --verbose \ - --file pdd.xml + --format json \ + --file pdd.json - - name: Remove the current date from pdd.xml - run: sed -i -E '/