Merge pull request #659 from itk-dev/feature/cleanup-yml-linting

Feature/cleanup yml linting

Author: martinyde

.docker/data/.gitignore

@@ -1,5 +1,5 @@
 # Ignore everything in this directory
 *
-# Except this file
+# Except
 !.gitignore
-!Readme.md
+!README.md

.docker/data/README.md

@@ -0,0 +1,29 @@
+# .docker/data
+
+Please map persistent volumes to this directory on the servers.
+
+If a container needs to persist data between restarts you can map the relevant files in the container to
+`.docker/data/<container-name>`.
+
+## RabbitMQ example
+
+If you are using RabbitMQ running in a container as a message broker you need to configure a persistent volume for
+RabbitMQs data directory to avoid losing message on container restarts.
+x
+```yaml
+# docker-compose.server.override.yml
+
+services:
+  rabbit:
+    image: rabbitmq:3.9-management-alpine
+    hostname: "${COMPOSE_PROJECT_NAME}"
+    networks:
+      - app
+      - frontend
+    environment:
+      - "RABBITMQ_DEFAULT_USER=${RABBITMQ_USER}"
+      - "RABBITMQ_DEFAULT_PASS=${RABBITMQ_PASSWORD}"
+      - "RABBITMQ_ERLANG_COOKIE=${RABBITMQ_ERLANG_COOKIE}"
+    volumes:
+      - ".docker/data/rabbitmq:/var/lib/rabbitmq/mnesia/"
+```

.docker/nginx.conf

@@ -17,9 +17,7 @@ http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
-    set_real_ip_from 172.16.0.0/16;
-    real_ip_recursive on;
-    real_ip_header X-Forwarded-For;
+    # Note: set_real_ip_from is set in the server block
 
     log_format  main  '$http_x_real_ip - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
@@ -34,4 +32,3 @@ http {
 
     include /etc/nginx/conf.d/*.conf;
 }
-

.docker/templates/default.conf.template

@@ -6,11 +6,30 @@ server {
 
     client_max_body_size ${NGINX_MAX_BODY_SIZE};
 
-    # This also needs to be set in the single server tag and not only in http.
     set_real_ip_from 172.16.0.0/16;
+    set_real_ip_from 192.168.39.0/24;
     real_ip_recursive on;
     real_ip_header X-Forwarded-For;
 
+    location = /cron-metrics {
+        # Proxy to supercronic metrics
+        proxy_pass http://${NGINX_CRON_METRICS}/metrics;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # Define which paths to protect
+    location ~ ^/(flag/flag|admin|user/login) {
+        # Block bots on these paths only
+        if ($http_user_agent ~* (bot|crawl|crawler|spider|scraper)) {
+            return 403;
+        }
+
+        try_files $uri /index.php?$query_string;
+    }
+
     location = /favicon.ico {
         log_not_found off;
         access_log off;
@@ -86,16 +105,6 @@ server {
         fastcgi_pass ${NGINX_FPM_SERVICE};
     }
 
-    # Define which paths to protect
-    location ~ ^/(flag/flag|admin|user/login) {
-        # Block bots on these paths only
-        if ($http_user_agent ~* (bot|crawl|crawler|spider|scraper)) {
-            return 403;
-        }
-
-        try_files $uri /index.php?$query_string;
-    }
-
     # Enforce clean URLs
     #
     # Removes index.php from urls like www.example.com/index.php/my-page --> www.example.com/my-page

.github/workflows/changelog.yaml

@@ -14,11 +14,9 @@ on:
 jobs:
   changelog:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 2
 

.github/workflows/composer.yaml

@@ -26,47 +26,54 @@
 name: Composer
 
 env:
-  COMPOSE_USER: root
+  COMPOSE_USER: runner
 
 on:
   pull_request:
+    paths: &paths
+      - "composer.json"
+      - "composer.lock"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   composer-validate:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-      - run: |
+      - uses: actions/checkout@v6
+
+      - name: Create docker network
+        run: |
           docker network create frontend
+
       - run: |
-          docker compose run --rm phpfpm composer validate
+          docker compose run --rm phpfpm composer validate --strict
 
   composer-normalized:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
-      - uses: actions/checkout@v4
-      - run: |
+      - uses: actions/checkout@v6
+
+      - name: Create docker network
+        run: |
           docker network create frontend
+
       - run: |
           docker compose run --rm phpfpm composer install
           docker compose run --rm phpfpm composer normalize --dry-run
 
   composer-audit:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-    # Ignore abandoned packages until https://www.drupal.org/project/drupal/issues/3550917
     steps:
-      - uses: actions/checkout@v4
-      - run: |
+      - uses: actions/checkout@v6
+
+      - name: Create docker network
+        run: |
           docker network create frontend
+
       - run: |
-          docker compose run --rm phpfpm composer audit --locked --abandoned=ignore
+          docker compose run --rm phpfpm composer audit

.github/workflows/javascript.yaml

@@ -15,21 +15,24 @@ name: JavaScript
 
 on:
   pull_request:
+    paths: &paths
+      - "web/themes/custom/**/js/**/*.js"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   javascript-lint:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - run: |
+      - name: Create docker network
+        run: |
           docker network create frontend
 
       - run: |

.github/workflows/markdown.yaml

@@ -22,21 +22,23 @@ name: Markdown
 
 on:
   pull_request:
+    paths: &paths
+      - "**/*.md"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   markdown-lint:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - run: |
+      - name: Create docker network
+        run: |
           docker network create frontend
 
       - run: |

.github/workflows/php.yaml

@@ -34,22 +34,32 @@
 name: PHP
 
 env:
-  COMPOSE_USER: root
+  COMPOSE_USER: runner
 
 on:
   pull_request:
+    paths: &paths
+      - "**/*.php"
+      - "composer.json"
+      - "composer.lock"
+      - "docker-compose.yml"
   push:
     branches:
       - main
       - develop
+    paths: *paths
 
 jobs:
   coding-standards:
     name: PHP - Check Coding Standards
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - run: |
+      - uses: actions/checkout@v6
+
+      - name: Create docker network
+        run: |
           docker network create frontend
+
+      - run: |
           docker compose run --rm phpfpm composer install
           docker compose run --rm phpfpm vendor/bin/phpcs

.github/workflows/site.yaml

@@ -19,7 +19,7 @@
 name: Drupal
 
 env:
-  COMPOSE_USER: root
+  COMPOSE_USER: runner
 
 on:
   pull_request:
@@ -33,11 +33,14 @@ jobs:
     name: Check that site can be installed
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - name: Start docker and install dependencies
+      - name: Create docker network
         run: |
           docker network create frontend
+
+      - name: Start docker and install dependencies
+        run: |
           docker compose pull
           docker compose up --detach
 
@@ -64,21 +67,41 @@ jobs:
     # Check updating site only on pull request.
     if: github.event_name == 'pull_request'
     name: Check that site can be updated
+
+    # This job checks that the Drupal site can be upgraded without issues.
+    #
+    # We do this by
+    #
+    # 1. Checking out the base branch ("github.base_ref") and installing the
+    #    site from scratch (using the exact same steps as the "install-site"
+    #    job)
+    # 2. Checking out the updated code and updating the site from the previous
+    #    installation
+    #
+    # Notice that step 2 is NOT run with the code in our new branch, but with
+    # the updated code merged on top of the target branch
+    # (cf.https://github.com/actions/checkout/issues/881). This makes sure that
+    # we can actually update the site after merging with the base branch.
+    #
+    # In some cases we run into a situation where the base site (step 1) cannot
+    # be installed, e.g. if this is a new project or we're making changes that
+    # require manual steps on the upgrade path, and then this jobs will fail. In
+    # that case we should note this in the pull request description and document
+    # the steps needed to complete the upgrade path.
+
     runs-on: ubuntu-latest
-    env:
-      # Force docker compose to run with the new project name
-      # @todo Remove in the future when base branch uses the new project name
-      COMPOSE_PROJECT_NAME: deltag
-      COMPOSE_DOMAIN: deltag.local.itkdev.dk
     steps:
       # Install site from our base ref
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.base_ref }}
 
-      - name: Start docker and install dependencies
+      - name: Create docker network
         run: |
           docker network create frontend
+
+      - name: Start docker and install dependencies
+        run: |
           docker compose pull
           docker compose up --detach
 
@@ -106,17 +129,15 @@ jobs:
           sudo chown -Rv $USER:$USER vendor/ web/ private-files/ || true
           sudo chmod -Rv a+w web/sites/default || true
 
-      # Install site with our current ref
-      - uses: actions/checkout@v4
+      # Update site using our updated code.
+      - uses: actions/checkout@v6
         with:
-          ref: ${{ github.head_ref }}
           # Keep our local settings (cf.
           # https://github.com/actions/checkout?tab=readme-ov-file#usage)
           clean: false
 
       - name: Start docker and install dependencies
         run: |
-          docker network create frontend || true
           docker compose pull
           docker compose up --detach