openchurch v2

.env

@@ -0,0 +1,3 @@
+MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
+LOCK_DSN=flock
+CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'

.env.test

@@ -1,32 +1,8 @@
-# This file is a "template" of which env vars need to be defined for your application
-# Copy this file to .env file for development, create environment variables when deploying to production
-# https://symfony.com/doc/current/best_practices/configuration.html#infrastructure-related-configuration
-
-###> symfony/framework-bundle ###
+# define your env variables for the test env here
 APP_ENV=test
-APP_SECRET=A_SECRET_YOU_NEED_TO_CHANGE_TO_MAKE_IT_SECRET
-#TRUSTED_PROXIES=127.0.0.1,127.0.0.2
-#TRUSTED_HOSTS=localhost,example.com
-###< symfony/framework-bundle ###
-
-###> nelmio/cors-bundle ###
-CORS_ALLOW_ORIGIN="^https?://localhost(:[0-9]+)?$"
-###< nelmio/cors-bundle ###
-
-DB_HOST=127.0.0.1
-DB_PORT=3306
-MYSQL_DATABASE=openchurch
-MYSQL_USER=openchurch
-MYSQL_PASSWORD=openchurch
-MYSQL_ALLOW_EMPTY_PASSWORD=true
-
-###> doctrine/doctrine-bundle ###
-# Format described at http://docs.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
-# For an SQLite database, use: "sqlite:///%kernel.project_dir%/var/data.db"
-# Configure your db driver and server_version in config/packages/doctrine.yaml
-DATABASE_URL=mysql://%MYSQL_USER%:%MYSQL_PASSWORD%@%DB_HOST%:%DB_PORT%/%MYSQL_DATABASE%
-###< doctrine/doctrine-bundle ###
-
-ES_HOST=127.0.0.1
-ES_PORT=9200
-ES_ENABLED=false
+APP_SECRET='$ecretf0rt3st'
+DATABASE_URL=mysql://root:symfony@localhost:3306/openchurch_test?serverVersion=11.5.2-MariaDB&charset=utf8mb4
+HOST_API=api.openchurch.local/api
+HOST_ADMIN=admin.openchurch.local
+ELASTIC_PASSWORD=admin
+ELASTICSEARCH_IRI=https://localhost:admin@elasticsearch:9200

.github/workflows/github-actions.yml

@@ -0,0 +1,144 @@
+# https://github.com/shivammathur/setup-php
+name: Tests
+
+on: [push]
+
+permissions:
+  contents: read
+
+jobs:
+  build-docker-image:
+    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/preprod' || github.ref == 'refs/heads/prod' || github.ref == 'refs/heads/feat/v2'
+    runs-on: ubuntu-latest
+    needs: tests
+    env:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: docker.pkg.github.com
+      DOCKER_REPOSITORY: docker.io
+      DOCKER_IMAGE_PHP: hozanaci/openchurch-backend
+      DOCKER_IMAGE_PYTHON: hozanaci/openchurch-sync
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Debug branch info
+        run: |
+          echo "Current branch: $(git rev-parse --abbrev-ref HEAD)"
+          echo "Git ref: ${{ github.ref }}"
+      - name: Create version.json file
+        run: |
+          echo "{ \"version\": \"$(git rev-parse --short HEAD)\", \"build\": \"$(date)\", \"branch\": \"$(git rev-parse --abbrev-ref HEAD)\", \"tag\": \"$(git name-rev --tags --name-only $(git rev-parse HEAD))\" } " > public/version.json
+      - name: Build and push the image to DockerHub
+        run: |
+          echo "$DOCKER_PASSWORD" | docker login $DOCKER_REPOSITORY -u $DOCKER_USERNAME --password-stdin
+          docker build -t $DOCKER_IMAGE_PHP:$(git rev-parse --short HEAD) -f docker/php/Dockerfile .
+          docker push $DOCKER_IMAGE_PHP:$(git rev-parse --short HEAD)
+          docker build -t $DOCKER_IMAGE_PYTHON:$(git rev-parse --short HEAD) -f docker/python/Dockerfile .
+          docker push $DOCKER_IMAGE_PYTHON:$(git rev-parse --short HEAD)
+
+  publish-docker-image:
+    runs-on: ubuntu-latest
+    needs: build-docker-image
+    if: github.ref == 'refs/heads/preprod' || github.ref == 'refs/heads/prod' || github.ref == 'refs/heads/feat/v2'
+    env:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_REGISTRY: docker.pkg.github.com
+      DOCKER_REPOSITORY: docker.io
+      DOCKER_IMAGE_PHP: hozanaci/openchurch-backend
+      DOCKER_IMAGE_PYTHON: hozanaci/openchurch-sync
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Publish latest tag for docker image to DockerHub
+        run: |
+          echo "$DOCKER_PASSWORD" | docker login $DOCKER_REPOSITORY -u $DOCKER_USERNAME --password-stdin
+          docker pull $DOCKER_IMAGE_PHP:$(git rev-parse --short HEAD)
+          docker tag $DOCKER_IMAGE_PHP:$(git rev-parse --short HEAD) $DOCKER_IMAGE_PHP:$(git rev-parse --abbrev-ref HEAD | tr '/' '-')
+          docker push $DOCKER_IMAGE_PHP:$(git rev-parse --abbrev-ref HEAD | tr '/' '-')
+          docker pull $DOCKER_IMAGE_PYTHON:$(git rev-parse --short HEAD)
+          docker tag $DOCKER_IMAGE_PYTHON:$(git rev-parse --short HEAD) $DOCKER_IMAGE_PYTHON:$(git rev-parse --abbrev-ref HEAD | tr '/' '-')
+          docker push $DOCKER_IMAGE_PYTHON:$(git rev-parse --abbrev-ref HEAD | tr '/' '-')
+
+  tests:
+    env:
+      HOST_API: api.openchurch.local/api
+    runs-on: ubuntu-latest
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      mysql:
+        image: mysql:latest
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: false
+          MYSQL_ROOT_PASSWORD: symfony
+          MYSQL_DATABASE: openchurch_test
+        ports:
+          - 3306:3306
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3 --name=mysql
+      elasticsearch:
+        image: elasticsearch:8.16.0
+        ports:
+          - 9200:9200
+        env:
+          ELASTIC_PASSWORD: admin
+          discovery.type: single-node
+          xpack.security.enabled: true
+          bootstrap.memory_lock: true
+          ES_JAVA_OPTS: -Xms512m -Xmx512m
+        options: --health-cmd="curl http://localhost:9200/_cluster/health" --health-interval=10s --health-timeout=5s --health-retries=3
+    steps:
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.3"
+          tools: phpunit-bridge
+          extensions: mbstring, xml, ctype, intl, iconv, json, mysql
+          ini-values: date.timezone=Europe/Paris
+      - uses: actions/checkout@v4
+      - name: Create .env.test.local
+        run: echo -e "DB_NAME_SUFFIX=\\nELASTICSEARCH_IRI=http://elastic:[email protected]:${{ job.services.elasticsearch.ports['9200'] }}" > .env.test.local
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+      - name: Cache composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+      - name: Install Dependencies
+        run: composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist
+      - name: Run migrations
+        run: |
+          php bin/console doctrine:migrations:migrate --no-interaction || echo "No migrations found or migration failed"
+        env:
+          DATABASE_URL: mysql://root:[email protected]:${{ job.services.mysql.ports['3306'] }}/openchurch_test
+      - name: Execute tests (Unit and Feature tests) via PHPUnit
+        run: vendor/bin/phpunit
+        env:
+          DATABASE_URL: mysql://root:[email protected]:${{ job.services.mysql.ports['3306'] }}/openchurch_test
+      - name: phpstan
+        if: always()
+        run: composer phpstan
+      - name: composer validate
+        if: always()
+        run: composer validate --strict
+      - name: lint:container
+        if: always()
+        run: php bin/console lint:container
+      - name: lint:yaml
+        if: always()
+        run: php bin/console lint:yaml config src
+      - name: doctrine:schema:validate
+        if: always()
+        run: php bin/console doctrine:schema:validate -vvv
+        env:
+          DATABASE_URL: mysql://root:[email protected]:${{ job.services.mysql.ports['3306'] }}/openchurch_test
+      - name: Archive logs as artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: logs
+          path: |
+            var/log/test.log
+            .env.test.local

.github/workflows/security.yml

@@ -0,0 +1,16 @@
+name: Security
+
+on:
+    push: ~
+    schedule:
+        - cron: "0 7 * * *"
+
+permissions:
+    contents: read
+
+jobs:
+    security-check:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v4
+            - uses: symfonycorp/security-checker-action@v5