release/1.12.0

.env

@@ -50,6 +50,8 @@ MESSENGER_TRANSPORT_DSN_FAILED='doctrine://default?queue_name=failed'
 AZURE_AZ_OIDC_METADATA_URL=AZURE_AZ_APP_METADATA_URL
 AZURE_AZ_OIDC_CLIENT_ID=AZURE_AZ_APP_CLIENT_ID
 AZURE_AZ_OIDC_CLIENT_SECRET=AZURE_AZ_APP_CLIENT_SECRET
+# Date the Azure client secret expires (any strtotime-parseable value)
+AZURE_AZ_OIDC_CLIENT_SECRET_EXPIRES_AT=2027-01-31
 AZURE_AZ_OIDC_REDIRECT_URI=AZURE_AZ_APP_REDIRECT_URI
 AZURE_AZ_OIDC_ALLOW_HTTP=false
 AZURE_AZ_OIDC_LEEWAY=10
@@ -63,3 +65,22 @@ VAULT_SECRET_ID="CHANGE_ME_IN_LOCAL_ENV"
 
 # The number of old results for each server/result-type combination
 APP_KEEP_RESULTS=5
+
+###> economics ###
+APP_ECONOMICS_URI=https://economics.itkdev.dk
+APP_ECONOMICS_API_KEY=changeme
+###< economics ###
+
+###> app/leantime ###
+APP_LEANTIME_URI=http://leantime.invalid
+APP_LEANTIME_API_KEY=
+###< app/leantime ###
+
+###> health ###
+# Seconds to cache the health check results, so that monitoring polling
+# /health/ready cannot amplify into load on the database and the broker.
+HEALTH_CACHE_TTL=15
+# Seconds since the last detection result before ingest is reported degraded.
+# The harvester currently reports several hundred times an hour.
+HEALTH_INGEST_MAX_AGE=1800
+###< health ###

.env.dev

@@ -0,0 +1,19 @@
+# Committed defaults for the dev environment.
+#
+# Local development runs against the mock identity provider defined in
+# docker-compose.override.yml, because the real one has no redirect URI
+# registered for a developer machine. See README.md, "OpenID Connect".
+#
+# Override any of these in .env.local to point at a different provider.
+
+###> itk-dev/openid-connect-bundle ###
+AZURE_AZ_OIDC_METADATA_URL=http://idp.itksites.local.itkdev.dk/.well-known/openid-configuration
+# The mock accepts any client id and secret.
+AZURE_AZ_OIDC_CLIENT_ID=client-id
+AZURE_AZ_OIDC_CLIENT_SECRET=client-secret
+AZURE_AZ_OIDC_REDIRECT_URI=https://itksites.local.itkdev.dk/openid-connect/generic
+# The application reaches the mock over http inside the docker network. Never
+# true anywhere else: since itk-dev/openid-connect 5.1 this governs every
+# endpoint the discovery document announces, not only the metadata URL.
+AZURE_AZ_OIDC_ALLOW_HTTP=true
+###< itk-dev/openid-connect-bundle ###

.env.test

@@ -4,3 +4,8 @@ APP_SECRET='$ecretf0rt3st'
 SYMFONY_DEPRECATIONS_HELPER=999999
 PANTHER_APP_ENV=panther
 PANTHER_ERROR_SCREENSHOT_DIR=./var/error-screenshots
+
+# The path of this URI is the only path the OIDC authenticator treats as a
+# callback (openid-connect-bundle 6.0), so it has to be the app's own callback
+# route for a callback to reach the authenticator at all.
+AZURE_AZ_OIDC_REDIRECT_URI=https://itksites.example.org/openid-connect/generic

.github/workflows/doctrine.yaml

@@ -0,0 +1,115 @@
+name: Doctrine
+
+env:
+    COMPOSE_USER: root
+
+on:
+    pull_request:
+    push:
+        branches:
+            - main
+            - develop
+
+jobs:
+    validate-doctrine-schema:
+        name: Validate Doctrine Schema
+        runs-on: ubuntu-latest
+        env:
+            APP_ENV: prod
+
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Create docker network
+              run: |
+                  docker network create frontend
+
+            - name: Run Composer Install
+              run: |
+                  docker compose run --rm phpfpm composer install
+
+            - name: Run Doctrine Migrations
+              run: |
+                  docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
+
+            - name: Setup messenger "failed" doctrine transport to ensure db schema is updated
+              run: |
+                  docker compose run --rm phpfpm bin/console messenger:setup-transports failed
+
+            - name: Validate Doctrine schema
+              run: |
+                  docker compose run --rm phpfpm bin/console doctrine:schema:validate
+
+    load-fixtures:
+        name: Load Doctrine fixtures
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Create docker network
+              run: |
+                  docker network create frontend
+
+            - name: Run Composer Install
+              run: |
+                  docker compose run --rm phpfpm composer install --no-interaction
+
+            - name: Run Doctrine Migrations
+              run: |
+                  docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
+
+            - name: Load fixtures
+              run: |
+                  docker compose run --rm phpfpm composer fixtures
+
+    # The jobs above migrate an empty database. A deployment migrates a database
+    # that already holds rows, so a migration that cannot cope with existing
+    # data passes those jobs unnoticed. This job builds the database as it looks
+    # before the pull request, fixtures included, and then applies the pull
+    # request's migrations on top of it.
+    migrate-populated-database:
+        name: Run migrations on a populated database
+        runs-on: ubuntu-latest
+        # This workflow also runs on pushes to main and develop, where there is
+        # no pull request to read a base branch from: the checkout steps below
+        # would get an empty revision and fail. A push has no base to compare
+        # against, so skip the job rather than guess one.
+        if: github.event_name == 'pull_request'
+
+        steps:
+            - uses: actions/checkout@v6
+              with:
+                  fetch-depth: 0
+
+            - name: Create docker network
+              run: |
+                  docker network create frontend
+
+            - name: Check out the base branch
+              run: |
+                  git checkout ${{ github.event.pull_request.base.sha }}
+
+            - name: Run Composer Install
+              run: |
+                  docker compose run --rm phpfpm composer install --no-interaction
+
+            - name: Run Doctrine Migrations
+              run: |
+                  docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
+
+            - name: Load fixtures
+              run: |
+                  docker compose run --rm phpfpm composer fixtures
+
+            - name: Check out the pull request
+              run: |
+                  git checkout ${{ github.event.pull_request.head.sha }}
+
+            - name: Run Composer Install
+              run: |
+                  docker compose run --rm phpfpm composer install --no-interaction
+
+            - name: Run Doctrine Migrations on the populated database
+              run: |
+                  docker compose run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction

.github/workflows/pr.yaml

@@ -3,24 +3,6 @@ name: Review
 env:
     COMPOSE_USER: runner
 jobs:
-    validate-doctrine-schema:
-        runs-on: ubuntu-latest
-        name: Validate Doctrine Schema
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v6
-
-            - name: Create docker network
-              run: docker network create frontend
-
-            - name: Install and validate
-              run: |
-                  docker compose up --detach
-                  docker compose exec phpfpm composer install --no-interaction
-                  docker compose exec phpfpm bin/console doctrine:migrations:migrate --no-interaction
-                  docker compose exec phpfpm bin/console messenger:setup-transports failed
-                  docker compose exec phpfpm bin/console doctrine:schema:validate
-
     phpstan:
         runs-on: ubuntu-latest
         name: PHPStan
@@ -56,30 +38,13 @@ jobs:
                   docker compose exec -e XDEBUG_MODE=coverage phpfpm vendor/bin/phpunit --coverage-clover=coverage/unit.xml
 
             - name: Upload coverage to Codecov
-              uses: codecov/codecov-action@v5
+              uses: codecov/codecov-action@v7
               with:
                   token: ${{ secrets.CODECOV_TOKEN }}
                   files: ./coverage/unit.xml
                   fail_ci_if_error: true
                   flags: unittests
 
-    fixtures:
-        runs-on: ubuntu-latest
-        name: Load fixtures
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v6
-
-            - name: Create docker network
-              run: docker network create frontend
-
-            - name: Load fixtures
-              run: |
-                  docker compose up --detach
-                  docker compose exec phpfpm composer install --no-interaction
-                  docker compose exec phpfpm bin/console doctrine:migrations:migrate --no-interaction
-                  docker compose exec phpfpm composer fixtures
-
     build-assets:
         runs-on: ubuntu-latest
         name: Build assets

.gitignore

@@ -30,5 +30,14 @@ yarn-error.log
 phpstan.neon
 ###< phpstan/phpstan ###
 .phpunit.cache
+
+###> symfony/asset-mapper ###
+/public/assets/
+/assets/vendor/
+###< symfony/asset-mapper ###
+
 .twig-cs-fixer.cache
 .playwright-mcp
+
+# Working docs not meant to ship
+RENOVATE_PLAN.md

.woodpecker/prod.yml

@@ -24,8 +24,8 @@ steps:
           keep: 4
           playbook: "release"
           pre_up:
-              - itkdev-docker-compose-server run phpfpm bin/console doctrine:migrations:migrate --no-interaction
-              - itkdev-docker-compose-server run phpfpm bin/console messenger:setup-transports
+              - itkdev-docker-compose-server run --rm phpfpm bin/console doctrine:migrations:migrate --no-interaction
+              - itkdev-docker-compose-server run --rm phpfpm bin/console messenger:setup-transports
 
     - name: Run post deploy
       image: itkdev/ansible-plugin:1

.woodpecker/stg.yml

@@ -31,7 +31,7 @@ steps:
               - git checkout ${CI_COMMIT_BRANCH}
               - git pull
               - itkdev-docker-compose-server up -d --force-recreate --remove-orphans
-              - itkdev-docker-compose-server exec phpfpm composer install -no-dev -o --classmap-authoritative
+              - itkdev-docker-compose-server exec phpfpm composer install --no-dev -o --classmap-authoritative
               - itkdev-docker-compose-server exec phpfpm bin/console doctrine:migrations:migrate --no-interaction
               - itkdev-docker-compose-server exec phpfpm bin/console messenger:setup-transports
               - itkdev-docker-compose-server exec phpfpm bin/console cache:clear

CHANGELOG.md

@@ -7,6 +7,78 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.12.0] - 2026-09-04
+
+- [#99](https://github.com/itk-dev/devops_itksites/pull/99)
+  Fix the staging deploy: `composer install` was passed `-no-dev`
+- [#98](https://github.com/itk-dev/devops_itksites/pull/98)
+  Deprecate OIDC and Service certificates, keeping their data
+- [#96](https://github.com/itk-dev/devops_itksites/pull/96)
+  Show the Service Agreements monthly price as Danish kroner,
+  `12.500,50 kr.`, on index and detail
+- [#95](https://github.com/itk-dev/devops_itksites/pull/95)
+  Update `vincentlanglet/twig-cs-fixer` to 4.0. Every other dependency is
+  already at its latest minor; the remaining majors are held back by their
+  dependents
+- [#94](https://github.com/itk-dev/devops_itksites/pull/94)
+  Use EasyAdmin's own components in the admin templates
+  - Replace hand-rolled badge and icon markup with `<twig:ea:Badge>` and
+    `<twig:ea:Icon>`, so the admin follows EasyAdmin's theming
+  - Drop the unused `AutoBadgeMenuItem`/`AutoBadgeCrudMenuItem` pair: EasyAdmin
+    hides a badge whose content is null
+  - Set the ITK blue with the theme API instead of overriding EasyAdmin's
+    colour variables one by one
+  - Load the admin stylesheet again: it was added as `css/admin.css`, a file
+    deleted in #81, so every admin page carried a 404 and no ITK styling
+- [#93](https://github.com/itk-dev/devops_itksites/pull/93)
+  Update composer dependencies, clearing 15 security advisories
+  - `api-platform/core` 4.3.7 → 4.3.17, `easycorp/easyadmin-bundle` 5.0.11 → 5.5.1,
+    `guzzlehttp/guzzle` 7.10.6 → 7.15.5, `guzzlehttp/psr7` 2.10.4 → 2.13.1
+  - Regenerated the API spec: `symfony/yaml` now writes sequence items on their
+    own line. No API changes
+- [#92](https://github.com/itk-dev/devops_itksites/pull/92) Update openid-connect-bundle to 6.0
+  - Bump `itk-dev/openid-connect-bundle` to `^6.0`
+  - A failed OIDC callback now raises an error instead of redirecting to the
+    identity provider again, so an expired client secret can no longer put the
+    site in a login loop
+  - Only the provider's callback path is treated as a callback; the configured
+    `redirect_uri` covers this, no `callback_path` needed
+  - Set `client_secret_expires_at` for the `azure_az` provider from the new
+    `AZURE_AZ_OIDC_CLIENT_SECRET_EXPIRES_AT` variable, so the bundle warns
+    before the secret expires
+  - Render a failed login as a page saying so, instead of an unhandled
+    exception, in `OpenIdConnectFailureListener`
+  - Add an `oidc_client_secret` health check, so a client secret nearing its
+    expiry shows up in `/health/detail` instead of in a login loop
+- [#83](https://github.com/itk-dev/devops_itksites/pull/83) 7523: Service agreements
+  - Add Project entity top-level Economics project.
+  - Add CodeOwner entity
+  - Add Leantime integration
+- [#91](https://github.com/itk-dev/devops_itksites/pull/91) Health endpoints
+  - Add `/health/live`, `/health/ready` and `/health/detail` endpoints
+  - Add health checks for database, RabbitMQ transport and detection result freshness
+  - Cache check results in a dedicated `cache.health` pool
+  - Exclude `^/health` from the firewalls and protect `/health/detail` with `ITKBasicAuth`
+- [#90](https://github.com/itk-dev/devops_itksites/pull/90)
+  - Fixed user API key migration failing on databases with more than one user
+  - Generated an API key for existing users, as users created since already get
+  - Added users to the fixtures and a CI job running migrations on a populated
+    database
+- [#89](https://github.com/itk-dev/devops_itksites/pull/89)
+  Added `--rm` to `docker compose run` in prod deployment
+- [#88](https://github.com/itk-dev/devops_itksites/pull/88)
+  - Let users use the API
+  - Add security to detection results API endpoint
+  - Add server and site collections API endpoints
+- [#80](https://github.com/itk-dev/devops_itksites/pull/80) 5566: Service agreements
+  - Add security contract entity with crud controller
+  - Add Abstract full crud controller and extend on it in some cases
+  - Add economics service and sync action/command for service agreement synchronization
+- [#81](https://github.com/itk-dev/devops_itksites/pull/81) 5564: Asset Mapper migration
+  - Add Symfony Asset Mapper bundle and importmap
+- Add Renovate auto-patch + auto-release pipeline (Phase 1 fork validation)
+- [#87](https://github.com/itk-dev/devops_itksites/pull/87) Update `codecov/codecov-action` to v7
+
 ## [1.11.2] - 2026-06-02
 
 - [#85](https://github.com/itk-dev/devops_itksites/pull/85)
@@ -191,7 +263,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [1.0.0] - 2022-09-15
 
-[Unreleased]: https://github.com/itk-dev/devops_itksites/compare/1.11.2...HEAD
+[Unreleased]: https://github.com/itk-dev/devops_itksites/compare/1.12.0...HEAD
+[1.12.0]: https://github.com/itk-dev/devops_itksites/compare/1.11.2...1.12.0
 [1.11.2]: https://github.com/itk-dev/devops_itksites/compare/1.11.1...1.11.2
 [1.11.1]: https://github.com/itk-dev/devops_itksites/compare/1.11.0...1.11.1
 [1.11.0]: https://github.com/itk-dev/devops_itksites/compare/1.10.1...1.11.0