Add php 8.2 and Symfony 6.4 (#282)

* Upgrade SF 4 to latest and webpack * Fix deprecations * Fix deprecations * Fix sptintf warning * Move to openconext folder Add debug bundle * Remove redundant script * Add debug config * Fix CSP for dev * Fix PHP8 compat * Fix php8 deprecation warnings * Fix php config * Delete obsolete test and fix exception expectations * Delete obsolete assertings because of type hinting * Fix empty assertion and exceptions * Fix empty assertion and exceptions * Upgrade mockery, phpunit Fixed tests on php8 * Upgrade SF6 * Remove dotenv * Optimized for phpunit 9 * Eliminated mockery and fixed useless dataprovider loop * Eliminated mockery and fixed useless dataprovider loop * PHPCBF * Add strong(er) typing * Fixed test * Fixed test * Remove mockery * Remove mockery * Remove mockery * Remove mockery * Little simpler * Move expectation to const * Add property promotion * Add VoidReturnTypeWhereNoReturnRector * Re-add getAttributes function * Use getter instead of protected value * Remove double version constraints * Run Rector * Fix vulnerability warnings * Run test-integration on main push * Integration tests * Remove assert because of typing * Rename yml to yaml * Rename yml to yaml * Yarn install * Remove Action suffix * Fix login * Fix deprecations * Fix translations * Fix translations * Fix state * Remove obsolete Guard * Fix phpstan * Fix phpstan * Fix phpstan * Fix phpstan * phpcbf * Remove SamlToken * Remove SamlToken * Type vars * Ran rector and strict types * Phpstan level2 * Phpstan level 3 * Phpstan level 5 * QA tools * Fixes - QA tools - Remove string tests because of strong typing - Remove obsolete docblocks * Fix phpcbf * Add routeing attributes * Remove yaml routes for profile * Remove comments * Move twig to templates * Merge config files * Fix phpcbf * Run composer update * Add phpstan config * Adjust readme based on devconf * Multiline parameters * Sort use statements automatically * Correct copyright year * Correct copyright year * Make php version with more checks * Add file counter * Remove empty line * Remove redundant doc comments * Rename templateEngine to twig * Add typing * Make linkedId nullable * Remove aa/api from aa connection * Remove doctrine/annotations * Fix all nsmaspaces * Remove unused dev dependencies * Amend changelog * label for new attribute surf-autorisaties (#283) * Remove twig Twig is already aavailable via the AbstractController, so we can use that and skip the Environment DI * Remove SamlListener This routing is done by the SamlBundle, and is not needed here anymore * Add component_info * Add archive section to composer.json. This allows building with the stepup build script * Created yarn.lock * Install http client * Change engineblock to httpClient Change to httpClient * Ran QA tools - removed obsolete baselines from phpstan - phpcbf changes method formatting * Replace GuzzleHttp client with Symfony HttpClient in AttributeAggregationApiClientBundle * Refactor unsubscribeAccount method to handle exceptions in AttributeAggregationRepository json_decode returned mixed (true, false or null), but the new implementation throws exceptions. So if no exceptions are catched, it is considered to be successful * Replace GuzzleHttp client with Symfony HttpClient in UserLifecycleApiClientBundle, adjust namespaces, and refactor JsonApiClient for Symfony HttpClient compatibility * Refactor JsonApiClient tests and implementation to use Symfony HttpClient across various ApiClientBundles, removing Guzzle dependencies * Remove GuzzleHttp dependency from composer.json * Add daily security check GitHub Action and update README for yarn usage * Update services.yaml to refine OpenConext resource loading and remove obsolete ApiClientBundle configurations * Update services.yaml to exclude Profile Value objects from Symfony resource loading * Remove obsolete folder * Fix GET request by removing 'exceptions' option * Update UserService dependency injection * Refactor services configuration and centralize email and locale settings in global services.yaml * Update CHANGELOG * De-bundle engineblock API * Remove Bundle from namespace * Remove controller service arguments tag from services.yaml in ProfileBundle * Align the package build process with the rest of OpenConext The workflow to build the package has been rewritten to use Stepup-Build for building the package * Build workflow: Checkout stepup-build * Build workflow: Use the correct project name * Docker: Upgrade the image used for production images to php8.2 * Build action: Add permissions for creating a release * Docker build workflow: Bring in line with the other OpenConext app * Build action: Add more permissions for creating a release * Prod dockerfile: Fix a typo * Docker build: Download tar.bz2 not tar.gz * GitHub actions workflows: Remove deprecated set-output commands * Build workflow: Phase out deprecated create release action * Build workflow: Use auto generated release notes from the new action that is used to create releases. No more need for a seperate action * Fix a small typo in the brand "ORCID iD" * Tighten security headers a bit * Also the /internal/{info,health} paths must be publically available BSR: remove unused stanza * Sync NL / EN menu captions * Use app_secret instead of secret * Add doctrine/annotations (required for JMS) * Override getProjectDir in Kernel for compatibility * Update monolog config to direct logs to stderr * Change PHPMD output format from XML to text in QA script * Update PHPStan baseline and increase analysis level to 9 * Update PHPStan baseline and increase analysis level to 9 * Remove local PHP security checker script This will be done by daily-security-check.yml * Enable UTF-8 support for router and streamline framework config across environments * Refine AttributeAggregationRepository delete operation to handle non-OK statuses with correct body * Upgrade doctrine/annotations to version 2.0.1 explicitly * Enforce secure cookies and disable SameSite attribute in framework configuration * Remove test configuration for SAML service provider and identity provider in surfnet_saml.yaml * Enable caching for Webpack Encore by default and disable in development environments * Remove obsolete configuration * Remove Rector configuration * Update translation overrides path for EN, NL, and PT languages * Remove unnecessary whitespace in Kernel.php * Remove HttpClientConfigurationTest as there's no config left * Update baseline * Refactor AttributeReleasePolicyServiceTest to use PHPUnit mocks and update PHPStan baseline Remove mockery from dependencies * Docker image build: Use the current tag to download the latest release. Before we were using the "latest" tag to download it, which would not work when the "pre-release" tag was set * Add authetication context clkass reference to the required parameters * Add testcase for repository Because the logic is slightly changed, we want to make sure it still works, and for future refactoring * Update translation overrides path to use absolute directory in NL, EN, and PT files * Update README.md to streamline Development instructions. * Fix numbering * Refactor PHP classes to use strict types and improve doc with @throws * phpcbf * Simplify console * Add exception message * Change certificate locations * Omit --prefer-dist * Move to dep dependencies * Delete string test because of strong typing * Update baseline --------- Co-authored-by: Michiel Kodde <[email protected]> Co-authored-by: Thijs Kinkhorst <[email protected]> Co-authored-by: Bart Geesink <[email protected]>
OpenConext · Apr 24, 2024 · a8c89b2 · a8c89b2
1 parent 9e52209
commit a8c89b2
Show file tree

Hide file tree

Showing 324 changed files with 13,985 additions and 25,017 deletions.
diff --git a/.env.dist b/.env.dist
diff --git a/.env.test b/.env.test
diff --git a/.github/workflows/build-push-docker-image.yml b/.github/workflows/build-push-docker-image.yml
@@ -1,8 +1,6 @@
 name: build-push-docker-image
 
 on:
-  push:
-    branches: feature/docker_configs
   workflow_dispatch:
 
 jobs:
@@ -18,8 +16,14 @@ jobs:
         id: release
         uses: robinraju/[email protected]
         with:
-          latest: true
-          fileName: "*.tar.gz"
+          fileName: "*.tar.bz2"
+          tag: "${{ github.ref_name }}" 
+
+      - name: Get commit details for the tag from the latest release
+        id: commit_details
+        run: |
+          echo "sha=$(git rev-list -n 1 ${{ steps.release.outputs.tag_name }})" >> $GITHUB_OUTPUT
+          echo "commit_time=$(git show -s --format=%ci ${{ steps.release.outputs.tag_name }})" >> $GITHUB_OUTPUT
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -33,27 +37,28 @@ jobs:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Set docker metadata for the container
+   
+      - name: Set docker labels and tags
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: |
-            ghcr.io/openconext/openconext-profile/profile
+          images: ghcr.io/openconext/openconext-profile/profile
           tags: |
             type=ref,event=tag
-            type=ref,event=branch
-            type=ref,event=pr
             type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
+            type=sha
+            type=raw,value=prod
 
       - name: Build and push the Production image
         uses: docker/build-push-action@v5
         with:
           context: .
+          build-args: |
+            APP_VERSION=${{ steps.release.outputs.tag_name }}
+            GIT_SHA=${{ steps.commit_details.outputs.sha }}
+            GIT_COMMIT_TIME=${{ steps.commit_details.outputs.commit_time }}
           file: docker/Dockerfile.prod
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/daily-security-check.yml b/.github/workflows/daily-security-check.yml
@@ -0,0 +1,102 @@
+---
+name: Daily security check
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      # PHP checks
+      - name: Check for php composer project
+        id: check_composer
+        uses: andstor/file-existence-action@v2
+        with:
+          files: "composer.lock"
+      -   name: Vulnerability check
+          run: php composer audit
+          if: steps.check_composer.outputs.files_exists == 'true'
+
+      # node-yarn checks
+      - name: Check for node-yarn project
+        id: check_node_yarn
+        uses: andstor/file-existence-action@v2
+        with:
+          files: "yarn.lock"
+      - name: Setup node
+        if: steps.check_node_yarn.outputs.files_exists == 'true'
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20
+      - name: Yarn Audit
+        if: steps.check_node_yarn.outputs.files_exists == 'true'
+        run: yarn audit --level high --groups dependencies optionalDependencies
+
+      # node-npm checks
+      - name: Check for node-npm project
+        id: check_node_npm
+        uses: andstor/file-existence-action@v2
+        with:
+          files: "package.lock"
+      - name: Setup node
+        if: steps.check_node_npm.outputs.files_exists == 'true'
+        uses: actions/setup-node@v3
+        with:
+          node-version: 20
+      - name: npm audit
+        if: steps.check_node_npm.outputs.files_exists == 'true'
+        run: npm audit --audit-level=high
+
+      # python checks
+      - name: Check for python project
+        id: check_python
+        uses: andstor/file-existence-action@v2
+        with:
+          files: "requirements.txt"
+      - name: Safety checks Python dependencies
+        if: steps.check_python.outputs.files_exists == 'true'
+        uses: pyupio/[email protected]
+
+      # java checks
+      - name: Check for java maven project
+        id: check_maven
+        uses: andstor/file-existence-action@v2
+        with:
+          files: "pom.xml"
+      - name: Setup java if needed
+        if: steps.check_maven.outputs.files_exists == 'true'
+        uses: actions/setup-java@v3
+        with:
+          java-version: 11
+          distribution: 'temurin'
+          cache: 'maven'
+      - name: Set up maven cache if needed
+        if: steps.check_maven.outputs.files_exists == 'true'
+        uses: actions/cache@v1
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-
+      - name: Check java
+        if: steps.check_maven.outputs.files_exists == 'true'
+        run: mvn org.owasp:dependency-check-maven:check
+
+      # Send results
+      - name: Send to Slack if something failed
+        if: failure()
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_CHANNEL: surfconext-nightly-check
+          SLACK_COLOR: ${{ job.status }}
+          SLACK_ICON: https://static.surfconext.nl/logos/idp/surfnet.png
+          SLACK_MESSAGE: 'Dependency check failed :crying_cat_face:'
+          SLACK_TITLE: ${{ github.repository }} wants attention
+          SLACK_USERNAME: NightlySecurityCheck
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
@@ -5,54 +5,39 @@ on:
       - "*.*.*"
 jobs:
   build:
+    permissions:
+      contents: write
+
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      COMPONENT_NAME: OpenConext-profile
     if: always()
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v4
+        with:
+          repository: OpenConext/Stepup-Build
       - name: Output the semver tag to the tag variable
         id: vars
-        run: echo ::set-output name=tag::${GITHUB_REF#refs/*/}
-      - name: Pull OpenConext build container
-        run: docker-compose -f ./docker-compose-tag-release.yml up -d
-      - name: Make the release files
-        run: docker-compose exec -T openconext sh -c 'HOME=/var/www/html ./bin/makeRelease.sh ${{ steps.vars.outputs.tag }}'
-      - name: Create Draft Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ steps.vars.outputs.tag }}
-          release_name: ${{ steps.vars.outputs.tag }}
-          body: Auto generated release. Please update these release notes manually.
-          draft: true
-          prerelease: false
-      - uses: actions/[email protected]
-        name: Upload the release artefact tarbal
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./Releases/OpenConext-profile-${{ steps.vars.outputs.tag }}.tar.gz
-          asset_name: OpenConext-profile-${{ steps.vars.outputs.tag }}.tar.gz
-          asset_content_type: application/gzip
-      - uses: actions/[email protected]
-        name: Upload the release artefact verification hash
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./Releases/OpenConext-profile-${{ steps.vars.outputs.tag }}.sha
-          asset_name: OpenConext-profile-${{ steps.vars.outputs.tag }}.sha
-          asset_content_type: text/plain
-      - uses: eregon/publish-release@v1
-        name: Publish the new release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
+      - name: Run release script
+        run: ./stepup-build.sh ${COMPONENT_NAME} --tag ${{ steps.vars.outputs.tag }}
+      - name: Grab the archive filename
+        id: archive
+        run: |
+          echo "archive=$(find . -maxdepth 1 -name "$COMPONENT_NAME*.tar.bz2" -printf '%f\n')" >> $GITHUB_OUTPUT
+          echo "shasum=$(find . -maxdepth 1 -name "$COMPONENT_NAME*.sha" -printf '%f\n')" >> $GITHUB_OUTPUT
+
+      - name: Release
+        uses: softprops/action-gh-release@v2
         with:
-          release_id: ${{ steps.create_release.outputs.id }}
+          files: |
+            ${{ steps.archive.outputs.archive }}
+            ${{ steps.archive.outputs.shasum }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fail_on_unmatched_files: true
+          generate_release_notes: true
 
   after_build:
     needs: build

diff --git a/.github/workflows/test-integration.yml b/.github/workflows/test-integration.yml
@@ -1,89 +1,26 @@
-name: test-integration
-on:
-  push:
-    branches: [ main ]
-  pull_request:
+name: Run QA tests (static analysis, lint and unit tests)
+on: [pull_request]
 
 jobs:
-  build:
+  run-qa-tests:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    if: always()
+    defaults:
+      run:
+        working-directory: /var/www/html/
+    container:
+      image:  ghcr.io/openconext/openconext-basecontainers/php82-apache2-node20-composer2:latest
+      volumes:
+        - .:/var/www/html
+
     steps:
       - name: Checkout
-        uses: actions/checkout@master
-      - name: Get Composer cache directory
-        id: composer-cache
-        run: |
-          echo "::set-output name=dir::$(composer config cache-files-dir)"
-      - name: Restore Composer cache
-        uses: actions/cache@v1
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-composer-
-      - name: Init environment
-        run: cd docker && ./init.sh && cat .env
-      - name: Build Docker environmnent
-        if: always()
-        run: |
-          cd docker &&
-          docker-compose -f ../docker-compose.yml up -d --build --force-recreate
-      - name: Install Composer dependencies
-        if: always()
-        run: |
-          docker-compose exec -T php-fpm sh -c '
-              SYMFONY_ENV=test COMPOSER_MEMORY_LIMIT=-1 composer install --prefer-dist -n -o
-          '
-      - name: Clear Symfony caches
-        if: always()
-        run: |
-          docker-compose exec -T php-fpm sh -c '
-              ./bin/console cache:clear --env=test
-          '
-      - name: Build frontend dependencies
-        if: always()
-        run: |
-          docker-compose exec -T php-fpm sh -c '
-              CYPRESS_INSTALL_BINARY=0 npm i && \
-              npm run encore production
-          '
-      - name: Run code quality tests
-        if: always()
-        run: |
-          docker-compose exec -T php-fpm sh -c '
-              echo -e "\nPHP Mess Detector\n" && \
-              ./ci/phpmd.sh && \
-              echo -e "\nPHP CodeSniffer\n" && \
-              ./ci/phpcs.sh && \
-              echo -e "\nPHP Lint\n" && \
-              ./ci/phplint.sh && \
-              echo -e "\nDocheader checker\n" && \
-              ./ci/docheader.sh && \
-              echo -e "\nPHP Copy Paste Detector\n" && \
-              ./ci/phpmd.sh
-          '
-        env:
-          SYMFONY_ENV: test
-      - name: Run unit tests
-        if: always()
-        run: |
-          APP_ENV=test docker-compose exec -T php-fpm sh -c '
-              echo -e "\nPHPUnit unit tests\n" && \
-              ./ci/phpunit.sh
-          '
-        env:
-          SYMFONY_ENV: test
-      - name: Run Cypress a11y tests
-        if: always()
-        continue-on-error: true
-        run: |
-          APP_ENV=test docker-compose exec -T cypress sh -c '
-              echo -e "\nCypress a11y tests\n" && \
-              cypress run --spec "./tests/cypress/integration/a11y/*.spec.js" --browser=electron --headless'        env:
-          SYMFONY_ENV: test
-      - name: Show log on failure
-        if: failure()
-        run:  |
-          cd docker && docker-compose exec -T php-fpm cat var/logs/test/test.log
+        uses: actions/checkout@v4
+
+      - name: Composer install
+        run: composer install
+
+      - name: Yarn install
+        run: yarn
+
+      - name: Run QA tests
+        run: composer check