Registry Service v2 (ongoing): Laravel service replacing the Verdaccio-based registry

.dockerignore

@@ -0,0 +1,16 @@
+.git
+.github
+.claude
+legacy
+node_modules
+vendor
+storage/logs/*
+storage/framework/cache/*
+storage/framework/sessions/*
+storage/framework/views/*
+database/*.sqlite*
+.env
+.env.*
+!.env.example
+tests
+*.md

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[compose.yaml]
+indent_size = 4

.env.docker

@@ -0,0 +1,12 @@
+# Values shared by the app and queue containers in docker-compose.yml.
+# Service-specific values (DB, mail, S3) are set in the compose file itself.
+APP_NAME=Registry
+APP_ENV=local
+APP_KEY=base64:mOXOfgDmHCBgK9Dh04IkWop7kCUkE8yo+79PR3JVvxE=
+APP_DEBUG=true
+APP_TIMEZONE=UTC
+LOG_CHANNEL=stderr
+LOG_LEVEL=debug
+BCRYPT_ROUNDS=12
+REGISTRY_VERSION=2.0.0-dev
+REGISTRY_CATALOG_CACHE_SECONDS=60

.env.example

@@ -0,0 +1,91 @@
+APP_NAME=Registry
+APP_ENV=local
+APP_KEY=
+APP_DEBUG=true
+APP_URL=http://localhost:8000
+APP_TIMEZONE=UTC
+
+APP_LOCALE=en
+APP_FALLBACK_LOCALE=en
+APP_FAKER_LOCALE=en_US
+
+APP_MAINTENANCE_DRIVER=file
+
+BCRYPT_ROUNDS=12
+
+LOG_CHANNEL=stack
+LOG_STACK=single
+LOG_DEPRECATIONS_CHANNEL=null
+LOG_LEVEL=debug
+
+# sqlite for a zero-dependency local run; docker-compose overrides this with mysql.
+DB_CONNECTION=sqlite
+# DB_HOST=127.0.0.1
+# DB_PORT=3306
+# DB_DATABASE=registry
+# DB_USERNAME=registry
+# DB_PASSWORD=registry
+
+SESSION_DRIVER=database
+SESSION_LIFETIME=120
+SESSION_ENCRYPT=false
+SESSION_PATH=/
+SESSION_DOMAIN=null
+
+BROADCAST_CONNECTION=log
+QUEUE_CONNECTION=database
+CACHE_STORE=database
+# CACHE_PREFIX=
+
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+# Verification codes go out by mail. Mailpit (docker compose) listens on 1025 / UI on 8025.
+MAIL_MAILER=log
+MAIL_HOST=127.0.0.1
+MAIL_PORT=1025
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_FROM_ADDRESS="registry@fleetbase.local"
+MAIL_FROM_NAME="${APP_NAME}"
+
+# Package store. Local disk by default; S3 / MinIO in docker and production.
+FILESYSTEM_DISK=local
+REGISTRY_STORAGE_DISK=local
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_DEFAULT_REGION=us-east-1
+AWS_BUCKET=fleetbase-registry
+AWS_ENDPOINT=
+AWS_URL=
+AWS_USE_PATH_STYLE_ENDPOINT=false
+
+# registry:import reads cloud bundle and icon objects from this disk (an s3 disk by default).
+REGISTRY_IMPORT_SOURCE_DISK=import_source
+IMPORT_SOURCE_AWS_BUCKET=
+# IMPORT_SOURCE_AWS_ACCESS_KEY_ID=
+# IMPORT_SOURCE_AWS_SECRET_ACCESS_KEY=
+# IMPORT_SOURCE_AWS_DEFAULT_REGION=
+
+# Registry
+REGISTRY_VERSION=2.0.0-dev
+REGISTRY_CATALOG_CACHE_SECONDS=60
+# Base URL written into npm/Composer metadata; empty = the request's scheme and host.
+REGISTRY_PUBLIC_URL=
+REGISTRY_PACKAGE_METADATA_CACHE_SECONDS=60
+HASH_VERIFY=true
+
+# Release pipeline limits and the secrets scanner (auto | builtin | off).
+# REGISTRY_MAX_BUNDLE_BYTES=52428800
+# REGISTRY_MAX_DIST_BYTES=104857600
+# REGISTRY_MAX_UNPACKED_BYTES=314572800
+# REGISTRY_MAX_FILE_BYTES=26214400
+# REGISTRY_MAX_ARCHIVE_ENTRIES=20000
+REGISTRY_SECRETS_SCANNER=auto
+# REGISTRY_GITLEAKS_BINARY=gitleaks
+# REGISTRY_CHECKS_QUEUE=
+
+# Sentry (optional)
+SENTRY_LARAVEL_DSN=

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore

.github/workflows/cd.yml

@@ -52,6 +52,7 @@ jobs:
           VERSION: ${{ env.VERSION }}
           CACHE: type=gha
         with:
+          workdir: ./legacy
           push: true
           files: |
             ./docker-bake.hcl

.github/workflows/ci.yml

@@ -0,0 +1,130 @@
+name: Registry Service CI
+
+on:
+  push:
+    branches: ["main", "v2", "dev-*"]
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  tests:
+    name: Pest (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ["8.3", "8.4"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: mbstring, intl, bcmath, gd, zip, pdo_sqlite, sqlite3
+          coverage: none
+          tools: composer:v2
+
+      - name: Cache Composer packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ runner.os }}-${{ matrix.php }}-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-${{ runner.os }}-${{ matrix.php }}-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist --no-progress
+
+      - name: Prepare environment
+        run: |
+          cp .env.example .env
+          php artisan key:generate --ansi
+
+      - name: Lint (Pint)
+        run: vendor/bin/pint --test
+
+      - name: Run tests
+        run: vendor/bin/pest --ci --colors=always
+
+  package-conformance:
+    name: npm and Composer conformance
+    runs-on: ubuntu-latest
+    needs: tests
+    # .env.example already runs on SQLite (database/database.sqlite) with the local disk;
+    # `artisan serve` reads .env rather than the job environment.
+    env:
+      PHP_CLI_SERVER_WORKERS: 4
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.3"
+          extensions: mbstring, intl, bcmath, zip, pdo_sqlite, sqlite3, phar, zlib
+          coverage: none
+          tools: composer:v2
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Cache Composer packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ runner.os }}-8.3-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-${{ runner.os }}-8.3-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist --no-progress
+
+      - name: Prepare the service
+        run: |
+          cp .env.example .env
+          php artisan key:generate --ansi
+          touch database/database.sqlite
+          php artisan migrate --force
+
+      - name: Start the service
+        run: |
+          php artisan serve --host=127.0.0.1 --port=8000 > storage/logs/serve.log 2>&1 &
+          for i in $(seq 1 30); do curl -sf http://127.0.0.1:8000/up > /dev/null && exit 0; sleep 1; done
+          cat storage/logs/serve.log; exit 1
+
+      - name: Run npm and Composer against seeded releases
+        run: tests/Conformance/packages.sh http://127.0.0.1:8000
+
+      - name: Service logs
+        if: failure()
+        run: |
+          cat storage/logs/serve.log || true
+          cat storage/logs/laravel.log || true
+
+  docker:
+    name: Docker image builds
+    runs-on: ubuntu-latest
+    needs: tests
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build app target
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: app
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -1,11 +1,25 @@
-.npmrc
-.pnpm-store
-docker-compose.override.yml
-npm-debug.log
-yarn-error.log
+*.log
+.DS_Store
 .env
-*/.npmrc
-storage/*
-config/htpasswd
-plugins/*/node_modules
-minio/
+.env.backup
+.env.production
+.phpactor.json
+.phpunit.result.cache
+/.fleet
+/.idea
+/.nova
+/.phpunit.cache
+/.vscode
+/.zed
+/auth.json
+/node_modules
+/public/build
+/public/hot
+/public/storage
+/storage/*.key
+/storage/pail
+/vendor
+Homestead.json
+Homestead.yaml
+Thumbs.db
+/database/*.sqlite*

.gitmodules

@@ -1,12 +1,12 @@
 [submodule "plugins/verdaccio-composer-middleware"]
-	path = plugins/verdaccio-composer-middleware
+	path = legacy/plugins/verdaccio-composer-middleware
 	url = git@github.com:fleetbase/verdaccio-composer-middleware.git
 [submodule "plugins/verdaccio-fleetbase-extensions-middleware"]
-	path = plugins/verdaccio-fleetbase-extensions-middleware
+	path = legacy/plugins/verdaccio-fleetbase-extensions-middleware
 	url = git@github.com:fleetbase/verdaccio-fleetbase-extensions-middleware.git
 [submodule "plugins/verdaccio-fleetbase-s3-storage"]
-	path = plugins/verdaccio-fleetbase-s3-storage
+	path = legacy/plugins/verdaccio-fleetbase-s3-storage
 	url = git@github.com:fleetbase/verdaccio-fleetbase-s3-storage.git
 [submodule "plugins/verdaccio-fleetbase-auth"]
-	path = plugins/verdaccio-fleetbase-auth
+	path = legacy/plugins/verdaccio-fleetbase-auth
 	url = git@github.com:fleetbase/verdaccio-fleetbase-auth.git