Skip to content

Commit 314158c

Browse files
turegjorupturegjorup
authored
Merge pull request #99 from itk-dev/release/1.12.0
release/1.12.0
2 parents f1a5568 + f5ca31b commit 314158c

124 files changed

Lines changed: 5595 additions & 1240 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ MESSENGER_TRANSPORT_DSN_FAILED='doctrine://default?queue_name=failed'
5050
AZURE_AZ_OIDC_METADATA_URL=AZURE_AZ_APP_METADATA_URL
5151
AZURE_AZ_OIDC_CLIENT_ID=AZURE_AZ_APP_CLIENT_ID
5252
AZURE_AZ_OIDC_CLIENT_SECRET=AZURE_AZ_APP_CLIENT_SECRET
53+
# Date the Azure client secret expires (any strtotime-parseable value)
54+
AZURE_AZ_OIDC_CLIENT_SECRET_EXPIRES_AT=2027-01-31
5355
AZURE_AZ_OIDC_REDIRECT_URI=AZURE_AZ_APP_REDIRECT_URI
5456
AZURE_AZ_OIDC_ALLOW_HTTP=false
5557
AZURE_AZ_OIDC_LEEWAY=10
@@ -63,3 +65,22 @@ VAULT_SECRET_ID="CHANGE_ME_IN_LOCAL_ENV"
6365

6466
# The number of old results for each server/result-type combination
6567
APP_KEEP_RESULTS=5
68+
69+
###> economics ###
70+
APP_ECONOMICS_URI=https://economics.itkdev.dk
71+
APP_ECONOMICS_API_KEY=changeme
72+
###< economics ###
73+
74+
###> app/leantime ###
75+
APP_LEANTIME_URI=http://leantime.invalid
76+
APP_LEANTIME_API_KEY=
77+
###< app/leantime ###
78+
79+
###> health ###
80+
# Seconds to cache the health check results, so that monitoring polling
81+
# /health/ready cannot amplify into load on the database and the broker.
82+
HEALTH_CACHE_TTL=15
83+
# Seconds since the last detection result before ingest is reported degraded.
84+
# The harvester currently reports several hundred times an hour.
85+
HEALTH_INGEST_MAX_AGE=1800
86+
###< health ###

‎.env.dev‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Committed defaults for the dev environment.
2+
#
3+
# Local development runs against the mock identity provider defined in
4+
# docker-compose.override.yml, because the real one has no redirect URI
5+
# registered for a developer machine. See README.md, "OpenID Connect".
6+
#
7+
# Override any of these in .env.local to point at a different provider.
8+
9+
###> itk-dev/openid-connect-bundle ###
10+
AZURE_AZ_OIDC_METADATA_URL=http://idp.itksites.local.itkdev.dk/.well-known/openid-configuration
11+
# The mock accepts any client id and secret.
12+
AZURE_AZ_OIDC_CLIENT_ID=client-id
13+
AZURE_AZ_OIDC_CLIENT_SECRET=client-secret
14+
AZURE_AZ_OIDC_REDIRECT_URI=https://itksites.local.itkdev.dk/openid-connect/generic
15+
# The application reaches the mock over http inside the docker network. Never
16+
# true anywhere else: since itk-dev/openid-connect 5.1 this governs every
17+
# endpoint the discovery document announces, not only the metadata URL.
18+
AZURE_AZ_OIDC_ALLOW_HTTP=true
19+
###< itk-dev/openid-connect-bundle ###

‎.env.test‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,8 @@ APP_SECRET='$ecretf0rt3st'
44
SYMFONY_DEPRECATIONS_HELPER=999999
55
PANTHER_APP_ENV=panther
66
PANTHER_ERROR_SCREENSHOT_DIR=./var/error-screenshots
7+
8+
# The path of this URI is the only path the OIDC authenticator treats as a
9+
# callback (openid-connect-bundle 6.0), so it has to be the app's own callback
10+
# route for a callback to reach the authenticator at all.
11+
AZURE_AZ_OIDC_REDIRECT_URI=https://itksites.example.org/openid-connect/generic

‎.github/workflows/doctrine.yaml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
name: Doctrine
2+
3+
env:
4+
COMPOSE_USER: root
5+
6+
on:
7+
pull_request:
8+
push:
9+
branches:
10+
- main
11+
- develop
12+
13+
jobs:
14+
validate-doctrine-schema:
15+
name: Validate Doctrine Schema
16+
runs-on: ubuntu-latest
17+
env:
18+
APP_ENV: prod
19+
20+
steps:
21+
- uses: actions/checkout@v6
22+
23+
- name: Create docker network
24+
run: |
25+
docker network create frontend
26+
27+
- name: Run Composer Install
28+
run: |
29+
docker compose run --rm phpfpm composer install
30+
31+
- name: Run Doctrine Migrations
32+
run: |
33+
docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
34+
35+
- name: Setup messenger "failed" doctrine transport to ensure db schema is updated
36+
run: |
37+
docker compose run --rm phpfpm bin/console messenger:setup-transports failed
38+
39+
- name: Validate Doctrine schema
40+
run: |
41+
docker compose run --rm phpfpm bin/console doctrine:schema:validate
42+
43+
load-fixtures:
44+
name: Load Doctrine fixtures
45+
runs-on: ubuntu-latest
46+
47+
steps:
48+
- uses: actions/checkout@v6
49+
50+
- name: Create docker network
51+
run: |
52+
docker network create frontend
53+
54+
- name: Run Composer Install
55+
run: |
56+
docker compose run --rm phpfpm composer install --no-interaction
57+
58+
- name: Run Doctrine Migrations
59+
run: |
60+
docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
61+
62+
- name: Load fixtures
63+
run: |
64+
docker compose run --rm phpfpm composer fixtures
65+
66+
# The jobs above migrate an empty database. A deployment migrates a database
67+
# that already holds rows, so a migration that cannot cope with existing
68+
# data passes those jobs unnoticed. This job builds the database as it looks
69+
# before the pull request, fixtures included, and then applies the pull
70+
# request's migrations on top of it.
71+
migrate-populated-database:
72+
name: Run migrations on a populated database
73+
runs-on: ubuntu-latest
74+
# This workflow also runs on pushes to main and develop, where there is
75+
# no pull request to read a base branch from: the checkout steps below
76+
# would get an empty revision and fail. A push has no base to compare
77+
# against, so skip the job rather than guess one.
78+
if: github.event_name == 'pull_request'
79+
80+
steps:
81+
- uses: actions/checkout@v6
82+
with:
83+
fetch-depth: 0
84+
85+
- name: Create docker network
86+
run: |
87+
docker network create frontend
88+
89+
- name: Check out the base branch
90+
run: |
91+
git checkout ${{ github.event.pull_request.base.sha }}
92+
93+
- name: Run Composer Install
94+
run: |
95+
docker compose run --rm phpfpm composer install --no-interaction
96+
97+
- name: Run Doctrine Migrations
98+
run: |
99+
docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
100+
101+
- name: Load fixtures
102+
run: |
103+
docker compose run --rm phpfpm composer fixtures
104+
105+
- name: Check out the pull request
106+
run: |
107+
git checkout ${{ github.event.pull_request.head.sha }}
108+
109+
- name: Run Composer Install
110+
run: |
111+
docker compose run --rm phpfpm composer install --no-interaction
112+
113+
- name: Run Doctrine Migrations on the populated database
114+
run: |
115+
docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction

‎.github/workflows/pr.yaml‎

Lines changed: 1 addition & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,6 @@ name: Review
33
env:
44
COMPOSE_USER: runner
55
jobs:
6-
validate-doctrine-schema:
7-
runs-on: ubuntu-latest
8-
name: Validate Doctrine Schema
9-
steps:
10-
- name: Checkout
11-
uses: actions/checkout@v6
12-
13-
- name: Create docker network
14-
run: docker network create frontend
15-
16-
- name: Install and validate
17-
run: |
18-
docker compose up --detach
19-
docker compose exec phpfpm composer install --no-interaction
20-
docker compose exec phpfpm bin/console doctrine:migrations:migrate --no-interaction
21-
docker compose exec phpfpm bin/console messenger:setup-transports failed
22-
docker compose exec phpfpm bin/console doctrine:schema:validate
23-
246
phpstan:
257
runs-on: ubuntu-latest
268
name: PHPStan
@@ -56,30 +38,13 @@ jobs:
5638
docker compose exec -e XDEBUG_MODE=coverage phpfpm vendor/bin/phpunit --coverage-clover=coverage/unit.xml
5739
5840
- name: Upload coverage to Codecov
59-
uses: codecov/codecov-action@v5
41+
uses: codecov/codecov-action@v7
6042
with:
6143
token: ${{ secrets.CODECOV_TOKEN }}
6244
files: ./coverage/unit.xml
6345
fail_ci_if_error: true
6446
flags: unittests
6547

66-
fixtures:
67-
runs-on: ubuntu-latest
68-
name: Load fixtures
69-
steps:
70-
- name: Checkout
71-
uses: actions/checkout@v6
72-
73-
- name: Create docker network
74-
run: docker network create frontend
75-
76-
- name: Load fixtures
77-
run: |
78-
docker compose up --detach
79-
docker compose exec phpfpm composer install --no-interaction
80-
docker compose exec phpfpm bin/console doctrine:migrations:migrate --no-interaction
81-
docker compose exec phpfpm composer fixtures
82-
8348
build-assets:
8449
runs-on: ubuntu-latest
8550
name: Build assets

‎.gitignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,14 @@ yarn-error.log
3030
phpstan.neon
3131
###< phpstan/phpstan ###
3232
.phpunit.cache
33+
34+
###> symfony/asset-mapper ###
35+
/public/assets/
36+
/assets/vendor/
37+
###< symfony/asset-mapper ###
38+
3339
.twig-cs-fixer.cache
3440
.playwright-mcp
41+
42+
# Working docs not meant to ship
43+
RENOVATE_PLAN.md

‎.woodpecker/prod.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ steps:
2424
keep: 4
2525
playbook: "release"
2626
pre_up:
27-
- itkdev-docker-compose-server run phpfpm bin/console doctrine:migrations:migrate --no-interaction
28-
- itkdev-docker-compose-server run phpfpm bin/console messenger:setup-transports
27+
- itkdev-docker-compose-server run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
28+
- itkdev-docker-compose-server run --rm phpfpm bin/console messenger:setup-transports
2929

3030
- name: Run post deploy
3131
image: itkdev/ansible-plugin:1

‎.woodpecker/stg.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ steps:
3131
- git checkout ${CI_COMMIT_BRANCH}
3232
- git pull
3333
- itkdev-docker-compose-server up -d --force-recreate --remove-orphans
34-
- itkdev-docker-compose-server exec phpfpm composer install -no-dev -o --classmap-authoritative
34+
- itkdev-docker-compose-server exec phpfpm composer install --no-dev -o --classmap-authoritative
3535
- itkdev-docker-compose-server exec phpfpm bin/console doctrine:migrations:migrate --no-interaction
3636
- itkdev-docker-compose-server exec phpfpm bin/console messenger:setup-transports
3737
- itkdev-docker-compose-server exec phpfpm bin/console cache:clear

‎CHANGELOG.md‎

Lines changed: 74 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,78 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [1.12.0] - 2026-09-04
11+
12+
- [#99](https://github.com/itk-dev/devops_itksites/pull/99)
13+
Fix the staging deploy: `composer install` was passed `-no-dev`
14+
- [#98](https://github.com/itk-dev/devops_itksites/pull/98)
15+
Deprecate OIDC and Service certificates, keeping their data
16+
- [#96](https://github.com/itk-dev/devops_itksites/pull/96)
17+
Show the Service Agreements monthly price as Danish kroner,
18+
`12.500,50 kr.`, on index and detail
19+
- [#95](https://github.com/itk-dev/devops_itksites/pull/95)
20+
Update `vincentlanglet/twig-cs-fixer` to 4.0. Every other dependency is
21+
already at its latest minor; the remaining majors are held back by their
22+
dependents
23+
- [#94](https://github.com/itk-dev/devops_itksites/pull/94)
24+
Use EasyAdmin's own components in the admin templates
25+
- Replace hand-rolled badge and icon markup with `<twig:ea:Badge>` and
26+
`<twig:ea:Icon>`, so the admin follows EasyAdmin's theming
27+
- Drop the unused `AutoBadgeMenuItem`/`AutoBadgeCrudMenuItem` pair: EasyAdmin
28+
hides a badge whose content is null
29+
- Set the ITK blue with the theme API instead of overriding EasyAdmin's
30+
colour variables one by one
31+
- Load the admin stylesheet again: it was added as `css/admin.css`, a file
32+
deleted in #81, so every admin page carried a 404 and no ITK styling
33+
- [#93](https://github.com/itk-dev/devops_itksites/pull/93)
34+
Update composer dependencies, clearing 15 security advisories
35+
- `api-platform/core` 4.3.7 → 4.3.17, `easycorp/easyadmin-bundle` 5.0.11 → 5.5.1,
36+
`guzzlehttp/guzzle` 7.10.6 → 7.15.5, `guzzlehttp/psr7` 2.10.4 → 2.13.1
37+
- Regenerated the API spec: `symfony/yaml` now writes sequence items on their
38+
own line. No API changes
39+
- [#92](https://github.com/itk-dev/devops_itksites/pull/92) Update openid-connect-bundle to 6.0
40+
- Bump `itk-dev/openid-connect-bundle` to `^6.0`
41+
- A failed OIDC callback now raises an error instead of redirecting to the
42+
identity provider again, so an expired client secret can no longer put the
43+
site in a login loop
44+
- Only the provider's callback path is treated as a callback; the configured
45+
`redirect_uri` covers this, no `callback_path` needed
46+
- Set `client_secret_expires_at` for the `azure_az` provider from the new
47+
`AZURE_AZ_OIDC_CLIENT_SECRET_EXPIRES_AT` variable, so the bundle warns
48+
before the secret expires
49+
- Render a failed login as a page saying so, instead of an unhandled
50+
exception, in `OpenIdConnectFailureListener`
51+
- Add an `oidc_client_secret` health check, so a client secret nearing its
52+
expiry shows up in `/health/detail` instead of in a login loop
53+
- [#83](https://github.com/itk-dev/devops_itksites/pull/83) 7523: Service agreements
54+
- Add Project entity top-level Economics project.
55+
- Add CodeOwner entity
56+
- Add Leantime integration
57+
- [#91](https://github.com/itk-dev/devops_itksites/pull/91) Health endpoints
58+
- Add `/health/live`, `/health/ready` and `/health/detail` endpoints
59+
- Add health checks for database, RabbitMQ transport and detection result freshness
60+
- Cache check results in a dedicated `cache.health` pool
61+
- Exclude `^/health` from the firewalls and protect `/health/detail` with `ITKBasicAuth`
62+
- [#90](https://github.com/itk-dev/devops_itksites/pull/90)
63+
- Fixed user API key migration failing on databases with more than one user
64+
- Generated an API key for existing users, as users created since already get
65+
- Added users to the fixtures and a CI job running migrations on a populated
66+
database
67+
- [#89](https://github.com/itk-dev/devops_itksites/pull/89)
68+
Added `--rm` to `docker compose run` in prod deployment
69+
- [#88](https://github.com/itk-dev/devops_itksites/pull/88)
70+
- Let users use the API
71+
- Add security to detection results API endpoint
72+
- Add server and site collections API endpoints
73+
- [#80](https://github.com/itk-dev/devops_itksites/pull/80) 5566: Service agreements
74+
- Add security contract entity with crud controller
75+
- Add Abstract full crud controller and extend on it in some cases
76+
- Add economics service and sync action/command for service agreement synchronization
77+
- [#81](https://github.com/itk-dev/devops_itksites/pull/81) 5564: Asset Mapper migration
78+
- Add Symfony Asset Mapper bundle and importmap
79+
- Add Renovate auto-patch + auto-release pipeline (Phase 1 fork validation)
80+
- [#87](https://github.com/itk-dev/devops_itksites/pull/87) Update `codecov/codecov-action` to v7
81+
1082
## [1.11.2] - 2026-06-02
1183

1284
- [#85](https://github.com/itk-dev/devops_itksites/pull/85)
@@ -191,7 +263,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
191263

192264
## [1.0.0] - 2022-09-15
193265

194-
[Unreleased]: https://github.com/itk-dev/devops_itksites/compare/1.11.2...HEAD
266+
[Unreleased]: https://github.com/itk-dev/devops_itksites/compare/1.12.0...HEAD
267+
[1.12.0]: https://github.com/itk-dev/devops_itksites/compare/1.11.2...1.12.0
195268
[1.11.2]: https://github.com/itk-dev/devops_itksites/compare/1.11.1...1.11.2
196269
[1.11.1]: https://github.com/itk-dev/devops_itksites/compare/1.11.0...1.11.1
197270
[1.11.0]: https://github.com/itk-dev/devops_itksites/compare/1.10.1...1.11.0

0 commit comments

Comments
 (0)