Merge remote-tracking branch 'origin/prod-2-8' into prod-2-9

.github/ci-upgrade.yaml

@@ -0,0 +1,7 @@
+disabled:
+  - update-audit-workflow
+  - update-changelog-workflow
+  - update-clean-workflow
+  - update-pull-request-checks-workflow
+  - update-delete-old-workflow-run-workflow
+  - update-config

.github/renovate.json5

@@ -1,5 +1,5 @@
 {
-  extends: ['config:base'],
+  'extends': ['config:base'],
   timezone: 'Europe/Zurich',
   schedule: 'after 5pm on the first day of the month',
   labels: ['dependencies'],
@@ -17,15 +17,9 @@
     'prod-2-9-advance',
   ],
   ignorePaths: ['CONST_create_template/**', 'docker-compose-lib.yaml', 'ci/**'],
-  regexManagers: [
-    {
-      'fileMatch': ['^ci/config\\\\.yaml$'],
-      'matchStrings': [
-        '.*https://raw\\\\.githubusercontent\\\\.com/(?<depName>[^\\\\s]+)/(?<currentValue>[0-9\\\\.]+)/.*',
-      ],
-      'datasourceTemplate': 'github-tags',
-    },
-  ],
+  html: {
+    fileMatch: ['\\.html?$', '\\.html?.mako$'],
+  },
   packageRules: [
     /** Docker images versioning */
     {
@@ -34,32 +28,36 @@
     },
     {
       matchDatasources: ['docker'],
-      matchPackageNames: ['node'],
       versioning: 'regex:^(?<major>\\d+)(\\.(?<minor>\\d+)(\\.(?<patch>\\d+))?)?-(?<compatibility>.*)$',
+      matchDepNames: ['node'],
     },
     {
       matchDatasources: ['docker'],
-      matchPackageNames: ['ghcr.io/osgeo/gdal'],
       versioning: 'regex:^(?<compatibility>.*)-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)?$',
+      matchDepNames: ['ghcr.io/osgeo/gdal'],
     },
     /** Automerge the patch, the minor and the dev dependency */
     {
       matchBaseBranches: ['prod-2-8', 'prod-2-8-advance'],
       matchUpdateTypes: ['minor', 'patch'],
       automerge: true,
     },
+    /** Auto merge the dev dependency update */
     {
       matchDepTypes: ['devDependencies'],
       automerge: true,
     },
-    /** Group the patch and the minor */
+    /** Group and auto merge the patch updates */
     {
       matchUpdateTypes: ['patch'],
       groupName: 'all patch versions',
+      automerge: true,
     },
+    /** Group and auto merge the minor updates */
     {
       matchUpdateTypes: ['minor'],
       groupName: 'all minor versions',
+      automerge: true,
     },
     /** Accept only the patch on the stabilization branches */
     {
@@ -74,12 +72,50 @@
     },
     /** Group Poetry packages */
     {
-      matchPackageNames: ['poetry', 'pip'],
       matchPackagePrefixes: ['poetry-'],
       groupName: 'Poetry',
       automerge: true,
       separateMajorMinor: false,
       separateMinorPatch: false,
+      matchDepNames: ['poetry', 'pip'],
+    },
+    /** Disable upgrading the supported Python version */
+    {
+      matchFileNames: ['custom/pyproject.toml'],
+      enabled: false,
+      matchDepNames: ['python'],
+    },
+    /** Support the 4 parts of shellcheck-py version with a v prefix */
+    {
+      versioning: 'regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)$',
+      matchDepNames: ['shellcheck-py/shellcheck-py'],
+    },
+    /** Accept only the patch on stabilization branches */
+    {
+      matchBaseBranches: ['/^[0-9]+\\.[0-9]+$/'],
+      matchUpdateTypes: ['major', 'minor', 'pin', 'digest', 'lockFileMaintenance', 'rollback', 'bump'],
+      enabled: false,
+    },
+    /** Group and auto merge the CI dependencies */
+    {
+      matchFileNames: ['.github/**', '.pre-commit-config.yaml', 'ci/**'],
+      groupName: 'CI dependencies',
+      automerge: true,
+    },
+  ],
+  regexManagers: [
+    /** Do updates on pre-commit additional dependencies */
+    {
+      fileMatch: ['^\\.pre\\-commit\\-config\\.yaml$'],
+      matchStrings: [" +- '?(?<depName>[^' @=]+)(@|==)(?<currentValue>[^' @=]+)'? # (?<datasource>.+)"],
+    },
+    /** Do update on the schema present in the ci/config.yaml */
+    {
+      fileMatch: ['^ci/config\\.yaml$'],
+      matchStrings: [
+        '.*https://raw\\.githubusercontent\\.com/(?<depName>[^\\s]+)/(?<currentValue>[0-9\\.]+)/.*',
+      ],
+      datasourceTemplate: 'github-tags',
     },
     {
       'matchPackageNames': ['shellcheck-py/shellcheck-py'],

.github/workflows/backport.yaml

@@ -1,4 +1,3 @@
----
 name: Backport
 
 on:
@@ -12,8 +11,8 @@ env:
 
 jobs:
   backport:
-    runs-on: ubuntu-22.04
     name: Backport
+    runs-on: ubuntu-22.04
     timeout-minutes: 5
 
     steps:

.github/workflows/main.yaml

@@ -13,13 +13,13 @@ env:
 
 jobs:
   main:
-    runs-on: ubuntu-22.04
     name: Continuous integration
+    runs-on: ubuntu-22.04
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
         with:
           repository: camptocamp/demo_geomapfish_data
           ref: master
@@ -35,8 +35,7 @@ jobs:
       - run: echo "${HOME}/.local/bin" >> ${GITHUB_PATH}
       - run: python3 -m pip install --user --requirement=ci/requirements.txt
 
-      - run: cp env.acceptance-test env.secrets
-      - run: sed -i '/^DOCKER_TAG=/d' env.project
+      - run: touch env.secrets
 
       - name: Checks
         run: c2cciutils-checks
@@ -62,7 +61,7 @@ jobs:
         if: always()
 
       - run:
-          docker-compose --file=docker-compose.yaml --file=docker-compose-db.yaml --file=docker-compose.override.sample.yaml
+          docker compose --file=docker-compose.yaml --file=docker-compose-db.yaml --file=docker-compose.override.sample.yaml
           up -d
       - name: Run the acceptance tests on dev
         run: make acceptance
@@ -78,12 +77,20 @@ jobs:
       - name: Publish
         run: c2cciutils-publish
 
-        # - name: Create Sentry release
-        #   uses: getsentry/action-release@v1
-        #   env:
-        #     SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-        #     SENTRY_ORG: camptocamp
-        #     SENTRY_PROJECT: ${{ env.SENTRY_PROJECT }}
-        #   with:
-        #     environment: ${{ env.SENTRY_ENVIRONMENT }}
-        #   if: github.ref == 'refs/heads/prod-2-8'
+      # - name: Create Sentry release
+      #   uses: getsentry/action-release@v1
+      #   env:
+      #     SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+      #     SENTRY_ORG: camptocamp
+      #     SENTRY_PROJECT: ${{ env.SENTRY_PROJECT }}
+      #   with:
+      #     environment: ${{ env.SENTRY_ENVIRONMENT }}
+      #   if: github.ref == 'refs/heads/prod-2-8'
+      - run: git diff --exit-code --patch > /tmp/dpkg-versions.patch || true
+        if: failure()
+      - uses: actions/upload-artifact@v4
+        with:
+          name: Update dpkg versions list.patch
+          path: /tmp/dpkg-versions.patch
+          retention-days: 1
+        if: failure()

.github/workflows/pull-request-automation.yaml

@@ -0,0 +1,51 @@
+name: Auto reviews, merge and close pull requests
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+
+jobs:
+  auto-merge:
+    name: Auto reviews pull requests from bots
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Print event
+        run: echo "${GITHUB}" | jq
+        env:
+          GITHUB: ${{ toJson(github) }}
+      - name: Print context
+        uses: actions/github-script@v7
+        with:
+          script: |-
+            console.log(context);
+      - name: Auto reviews GHCI updates
+        uses: actions/github-script@v7
+        with:
+          script: |-
+            github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+              event: 'APPROVE',
+            })
+        if: |-
+          startsWith(github.head_ref, 'ghci/audit/')
+          && (github.event.pull_request.user.login == 'geo-ghci-test[bot]'
+            || github.event.pull_request.user.login == 'geo-ghci-int[bot]'
+            || github.event.pull_request.user.login == 'geo-ghci[bot]')
+      - name: Auto reviews Renovate updates
+        uses: actions/github-script@v7
+        with:
+          script: |-
+            github.rest.pulls.createReview({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+              event: 'APPROVE',
+            })
+        if: |-
+          github.event.pull_request.user.login == 'renovate[bot]'

.github/workflows/rebuild-2-6.yaml

@@ -25,7 +25,7 @@ jobs:
           - prod-2-6-simple
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
 
@@ -60,7 +60,7 @@ jobs:
           - prod-2-6
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
 

.github/workflows/rebuild.yaml

@@ -1,4 +1,3 @@
----
 name: Rebuild
 
 on:
@@ -15,8 +14,8 @@ env:
 
 jobs:
   rebuild:
-    runs-on: ubuntu-22.04
     name: Rebuild
+    runs-on: ubuntu-22.04
     timeout-minutes: 10
 
     strategy:
@@ -28,7 +27,7 @@ jobs:
           - prod-2-9
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
 

.github/workflows/update_l10n.yaml

@@ -1,4 +1,3 @@
----
 name: Update l10n cron job
 
 on:
@@ -23,7 +22,7 @@ jobs:
             base_url: https://geomapfish-demo-2-8.camptocamp.com/
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
           token: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}

.github/workflows/upgrade-2-5.yaml

@@ -12,7 +12,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: 'prod-2-5'
           token: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}

.github/workflows/upgrade-2-6.yaml

@@ -19,7 +19,7 @@ jobs:
           - prod-2-6-simple
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
           token: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}

.github/workflows/upgrade-2-7.yaml

@@ -19,7 +19,7 @@ jobs:
           - prod-2-7-advance
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
           token: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}

.github/workflows/upgrade-2-8.yaml

@@ -19,7 +19,7 @@ jobs:
           - prod-2-8-advance
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
           token: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}