Merge branch 'release/24.8.0'

.ahoy.yml

@@ -23,12 +23,13 @@ commands:
   build:
     usage: Build or rebuild the project.
     cmd: |
-      ahoy reset
-      ahoy up --build --force-recreate
-      ahoy composer install --prefer-dist
-      ahoy fei
-      ahoy provision
-      DREVOPS_SHOW_LOGIN=1 ahoy info
+      ahoy reset                          # Reset the project.
+      ahoy up --build --force-recreate    # Start the stack.
+      ahoy composer install               # Install Composer dependencies.
+      ahoy fei                            # Install front-end dependencies.
+      ahoy fe                             # Build front-end assets.
+      ahoy provision                      # Provision the site.
+      DREVOPS_SHOW_LOGIN=1 ahoy info      # Show information and a login link.
 
   info:
     usage: Show information about this project.
@@ -105,7 +106,7 @@ commands:
 
   drush:
     usage: Run Drush commands in the CLI service container.
-    cmd: ahoy cli "drush -l \${DREVOPS_LOCALDEV_URL} $*"
+    cmd: ahoy cli "vendor/bin/drush -l \${DREVOPS_LOCALDEV_URL} $*"
 
   #;< REDIS
   flush-redis:
@@ -190,15 +191,25 @@ commands:
   lint-fe:
     usage: Lint front-end code.
     cmd: |
-      ahoy cli vendor/bin/twig-cs-fixer
+      ahoy cli vendor/bin/twig-cs-fixer lint
       ahoy cli "npm run --prefix \${DREVOPS_WEBROOT}/themes/custom/\${DRUPAL_THEME} lint"
 
   lint-fix:
     usage: Fix lint issues of back-end and front-end code.
+    cmd: ahoy lint-be-fix && ahoy lint-fe-fix
+
+  lint-be-fix:
+    usage: Fix lint issues of back-end code.
     cmd: |
       ahoy cli vendor/bin/rector --clear-cache
       ahoy cli vendor/bin/phpcbf
 
+  lint-fe-fix:
+    usage: Fix lint issues of front-end code.
+    cmd: |
+      ahoy cli vendor/bin/twig-cs-fixer lint --fix
+      ahoy cli "npm run --prefix \${DREVOPS_WEBROOT}/themes/custom/\${DRUPAL_THEME} lint-fix"
+
   test:
     usage: Run all tests.
     cmd: ahoy test-unit && ahoy test-kernel && ahoy test-functional && ahoy test-bdd

.circleci/config.yml

@@ -53,8 +53,8 @@ aliases:
       # Using the 'runner' container where each job will be executed.
       # This container has all the necessary tools to run a dockerized environment.
       # @see https://github.com/drevops/ci-runner
-      # @see https://hub.docker.com/repository/docker/drevops/ci-runner/tags?page=1&ordering=last_updated
-      - image: drevops/ci-runner:24.7.0
+      # @see https://hub.docker.com/repository/docker/drevops/ci-runner/tags
+      - image: drevops/ci-runner:24.8.0
         auth:
           username: ${DREVOPS_CONTAINER_REGISTRY_USER}
           password: ${DREVOPS_CONTAINER_REGISTRY_PASS}
@@ -148,7 +148,7 @@ jobs:
             echo "${DREVOPS_CI_DB_CACHE_FALLBACK/no/${CIRCLE_BUILD_NUM}}" | tee /tmp/db_cache_fallback
             echo "$(date ${DREVOPS_CI_DB_CACHE_TIMESTAMP})" | tee /tmp/db_cache_timestamp
             echo "yes" | tee /tmp/db_cache_fallback_yes
-            echo 'v1.21.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback" }}-{{ checksum "/tmp/db_cache_timestamp" }}'
+            echo 'v24.8.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback" }}-{{ checksum "/tmp/db_cache_timestamp" }}'
 
       - restore_cache:
           keys:
@@ -157,10 +157,10 @@ jobs:
             # Change 'v1' to 'v2', 'v3' etc., commit and push to force cache reset.
             # Lookup cache based on the default branch and a timestamp. Allows
             # to use cache from the very first build on the day (sanitized database dump, for example).
-            - v1.21.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback" }}-{{ checksum "/tmp/db_cache_timestamp" }}
+            - v24.8.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback" }}-{{ checksum "/tmp/db_cache_timestamp" }}
             # Fallback to caching by default branch name only. Allows to use
             # cache from the branch build on the previous day.
-            - v1.21.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback" }}-
+            - v24.8.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback" }}-
 
       - run:
           name: Download DB
@@ -190,7 +190,7 @@ jobs:
           # The cache will not be saved if it already exists.
           # Note that the cache fallback flag is enabled for this case in order
           # to save cache even if the fallback is not used when restoring it.
-          key: v1.21.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback_yes" }}-{{ checksum "/tmp/db_cache_timestamp" }}
+          key: v24.8.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback_yes" }}-{{ checksum "/tmp/db_cache_timestamp" }}
           paths:
             - /root/project/.data
 
@@ -234,14 +234,14 @@ jobs:
           keys:
             # Use cached artifacts from previous builds of this branch.
             # @see https://circleci.com/docs/2.0/caching/#restoring-cache
-            - v1.21.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback_yes" }}-{{ checksum "/tmp/db_cache_timestamp" }}
-            - v1.21.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback_yes" }}-
+            - v24.8.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback_yes" }}-{{ checksum "/tmp/db_cache_timestamp" }}
+            - v24.8.0-db10-{{ checksum "/tmp/db_cache_branch" }}-{{ checksum "/tmp/db_cache_fallback_yes" }}-
       #;> !PROVISION_USE_PROFILE
 
       - run:
           name: Lint Dockerfiles with Hadolint
           command: |
-            for file in $(find . -name 'Dockerfile' -o -name '*.dockerfile'); do
+            for file in $(find .docker -name 'Dockerfile' -o -name '*.dockerfile'); do
               echo "Linting ${file}" && cat "${file}" | docker run --rm -i hadolint/hadolint || [ "${DREVOPS_CI_HADOLINT_IGNORE_FAILURE:-0}" -eq 1 ]
             done
 
@@ -401,7 +401,7 @@ jobs:
   # Add RENOVATE_TOKEN as an environment variable with GitHub access token in UI.
   renovatebot-self-hosted:
     docker:
-      - image: renovate/renovate:37.342.1
+      - image: renovate/renovate:38.55.2
         environment:
           RENOVATE_PLATFORM: 'github'
           RENOVATE_AUTODISCOVER: false
@@ -564,14 +564,16 @@ workflows:
           filters:
             branches:
               # Allowed branches:
-              # - main, master, develop, ci, cisomething
+              # - production, main, master, develop, ci, cisomething
+              # - project/description
               # - deps/*
               # - feature/description, feature/123-description
+              # - bugfix/description, bugfix/123-description
               # - release/123.456.789, release/123.456.789-rc.123 (per https://semver.org/)
               # - release/2023-04-17, release/2023-04-17.123 (date-based)
               # - hotfix/123.456.789, hotfix/123.456.789-rc.1213 (per https://semver.org/)
               # - hotfix/2023-04-17, hotfix/2023-04-17.123 (date-based)
-              only: /^(main|master|develop)$|^feature\/[a-zA-Z0-9\-\.\,_]+$|^ci.*|^deps\/.*|^(release|hotfix)\/[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^(release|hotfix)\/[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/
+              only: /^(production|main|master|develop)$|^project\/[a-zA-z0-9\-\.]+|^(feature|bugfix)\/[a-zA-Z0-9\-\.\,_]+$|^ci.*|^deps\/.*|^(release|hotfix)\/[0-9]+(\.[0-9]+){2}(-rc\.[0-9]+)?$|^(release|hotfix)\/[0-9]{4}-[0-9]{2}-[0-9]{2}(\.[0-9]+)?$/
             tags:
               ignore: /.*/
       - deploy-tags:

.docker/clamav.dockerfile

@@ -0,0 +1,35 @@
+# ClamAV container.
+#
+# @see https://hub.docker.com/r/clamav/clamav/tags
+#
+# Allow running ClamAV in rootless mode.
+# @see https://github.com/Cisco-Talos/clamav/issues/478
+#
+# hadolint global ignore=DL3018
+#
+# @see https://hub.docker.com/r/uselagoon/commons/tags
+# @see https://github.com/uselagoon/lagoon-images/tree/main/images/commons
+FROM uselagoon/commons:24.8.0 as commons
+
+FROM clamav/clamav:1.4.0
+
+COPY --from=commons /lagoon /lagoon
+COPY --from=commons /bin/fix-permissions /bin/ep /bin/docker-sleep /bin/wait-for /bin/
+
+RUN apk add --no-cache tzdata
+
+COPY .docker/config/clamav/clamav.conf /tmp/clamav.conf
+
+RUN cat /tmp/clamav.conf >> /etc/clamav/clamd.conf && rm /tmp/clamav.conf && \
+    sed -i "s/^LogFile /# LogFile /g" /etc/clamav/clamd.conf && \
+    sed -i "s/^#LogSyslog /LogSyslog /g" /etc/clamav/clamd.conf && \
+    sed -i "s/^UpdateLogFile /# UpdateLogFile /g" /etc/clamav/freshclam.conf && \
+    sed -i "s/^#LogSyslog /LogSyslog /g" /etc/clamav/freshclam.conf
+
+USER root
+
+RUN fix-permissions /var/lib/clamav
+
+USER clamav
+
+ENTRYPOINT [ "/init-unprivileged" ]

.docker/cli.dockerfile

@@ -6,7 +6,7 @@
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.3-cli-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-cli-drupal
-FROM uselagoon/php-8.3-cli-drupal:24.7.0
+FROM uselagoon/php-8.3-cli-drupal:24.8.0
 
 # Add missing variables.
 # @todo Remove once https://github.com/uselagoon/lagoon/issues/3121 is resolved.
@@ -73,11 +73,6 @@ COPY composer.json composer.* .env* auth* /app/
 RUN if [ -n "${GITHUB_TOKEN}" ]; then export COMPOSER_AUTH="{\"github-oauth\": {\"github.com\": \"${GITHUB_TOKEN}\"}}"; fi && \
     COMPOSER_MEMORY_LIMIT=-1 composer install -n --no-dev --ansi --prefer-dist --optimize-autoloader
 
-# Remove Drush launcher installed by the base Lagoon PHP image.
-# @see https://github.com/uselagoon/lagoon-images/blob/main/images/php-cli-drupal/8.2.Dockerfile#L19
-RUN rm -rf /usr/local/bin/drush
-ENV PATH="/app/vendor/bin:${PATH}"
-
 # Install NodeJS dependencies.
 # Note that package-lock.json is not explicitly copied, allowing to run the
 # stack without existing lock file (this is not advisable, but allows to build
@@ -98,8 +93,8 @@ RUN npm --prefix /app/${WEBROOT}/themes/custom/your_site_theme ci --no-audit --n
 COPY . /app
 
 # Create files directories and set correct permissions.
-RUN mkdir -p "${DRUPAL_PUBLIC_FILES}" "${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}" "${DRUPAL_CONFIG_PATH}" && \
- chmod 0770 "${DRUPAL_PUBLIC_FILES}" "${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}" "${DRUPAL_CONFIG_PATH}"
+RUN mkdir -p "${DRUPAL_PUBLIC_FILES:-/app/${WEBROOT}/sites/default/files}" "${DRUPAL_PRIVATE_FILES:-/app/${WEBROOT}/sites/default/files/private}" "${DRUPAL_TEMPORARY_FILES:-/tmp}" "${DRUPAL_CONFIG_PATH:-/app/config/default}" && \
+ chmod 0770 "${DRUPAL_PUBLIC_FILES:-/app/${WEBROOT}/sites/default/files}" "${DRUPAL_PRIVATE_FILES:-/app/${WEBROOT}/sites/default/files/private}" "${DRUPAL_TEMPORARY_FILES:-/tmp}" "${DRUPAL_CONFIG_PATH:-/app/config/default}"
 
 # Compile front-end assets. Running this after copying all files as we need
 # sources to compile assets.

.docker/config/clamav/clamav.conf

@@ -0,0 +1,4 @@
+MaxDirectoryRecursion 30
+MaxFileSize 100M
+PCREMaxFileSize 100M
+StreamMaxLength 100M

.docker/mariadb.dockerfile

@@ -1,14 +1,14 @@
 # MariaDB container.
 #
-# @see https://hub.docker.com/r/uselagoon/mariadb-10.11-drupal/tags?page=1
+# @see https://hub.docker.com/r/uselagoon/mariadb-10.11-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/mariadb-drupal
 #
 # Use drevops/drevops-mariadb-drupal-data as a starting container image for your
 # database-in-image database.
 # @see https://github.com/drevops/mariadb-drupal-data
 #
 # The ARG value will be updated with a value passed from docker-compose.yml
-ARG IMAGE=uselagoon/mariadb-10.11-drupal:24.7.0
+ARG IMAGE=uselagoon/mariadb-10.11-drupal:24.8.0
 
 # hadolint ignore=DL3006
 FROM ${IMAGE}

.docker/nginx-drupal.dockerfile

@@ -7,9 +7,9 @@ ARG CLI_IMAGE
 # hadolint ignore=DL3006
 FROM ${CLI_IMAGE:-cli} as cli
 
-# @see https://hub.docker.com/r/uselagoon/nginx-drupal/tags?page=1
+# @see https://hub.docker.com/r/uselagoon/nginx-drupal/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/nginx-drupal
-FROM uselagoon/nginx-drupal:24.7.0
+FROM uselagoon/nginx-drupal:24.8.0
 
 # Webroot is used for Nginx docroot configuration.
 ARG WEBROOT=web

.docker/php.dockerfile

@@ -10,7 +10,7 @@ FROM ${CLI_IMAGE:-cli} as cli
 
 # @see https://hub.docker.com/r/uselagoon/php-8.3-fpm/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/php-fpm
-FROM uselagoon/php-8.3-fpm:24.7.0
+FROM uselagoon/php-8.3-fpm:24.8.0
 
 RUN apk add --no-cache tzdata
 

.docker/solr.dockerfile

@@ -5,11 +5,11 @@ FROM ${CLI_IMAGE} as cli
 
 # @see https://hub.docker.com/r/uselagoon/solr-8/tags
 # @see https://github.com/uselagoon/lagoon-images/blob/main/images/solr/8.Dockerfile
-FROM uselagoon/solr-8:24.7.0
+FROM uselagoon/solr-8:24.8.0
 
 # Solr Jump-start config needs to be manually copied from search_api_solr module
 # /app/docroot/modules/contrib/search_api_solr/jump-start/solr8/config-set.
-COPY .docker/config/solr /solr-conf/conf/
+COPY .docker/config/solr/config-set /solr-conf/conf/
 
 USER root
 

.env

@@ -1,7 +1,7 @@
 ##
 # Project environment variables.
 #
-# This is a single location where defined variables control how Scaffold
+# This is a single location where defined variables control how the stack
 # operates and should be the primary place for modifications. Avoid overriding
 # values in scripts or configuration files to simplify future updates and
 # centralize changes.

.github/workflows/draft-release-notes.yml

@@ -19,7 +19,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Generate CalVer version
+        if: vars.DREVOPS_RELEASE_VERSION_SCHEME == 'calver'
+        id: calver
+        run: |
+          export VERSION="$(date "+%y.%-m").0"
+          echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
+          echo "Version set to ${VERSION}"
+
       - name: Draft release notes
         uses: release-drafter/release-drafter@v6
+        with:
+          tag: ${{ steps.calver.outputs.version }}
+          name: ${{ steps.calver.outputs.version }}
+          version: ${{ steps.calver.outputs.version }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/renovate.yml

@@ -0,0 +1,29 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: '45 11,23 * * *'
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.1.7
+
+      - uses: suzuki-shunsuke/github-action-renovate-config-validator@v1.0.1
+
+      - name: Self-hosted Renovate
+        uses: renovatebot/github-action@v40.2.7
+        env:
+          # Update the value of RENOVATE_GIT_AUTHOR with your own.
+          RENOVATE_GIT_AUTHOR: 'Renovate Self Hosted <renovatebot@your-site-url.example>'
+          RENOVATE_DEPENDENCY_DASHBOARD_TITLE: 'Renovate Dependency Dashboard (self-hosted) by GitHub Actions'
+          RENOVATE_DEPENDENCY_DASHBOARD: false
+          RENOVATE_REPOSITORIES: ${{ github.repository }}
+          RENOVATE_PLATFORM: 'github'
+          RENOVATE_AUTODISCOVER: false
+          RENOVATE_DRY_RUN: false
+        with:
+          configurationFile: renovate.json
+          token: ${{ secrets.RENOVATE_TOKEN }}

.github/workflows/scaffold-test-common.yml

@@ -9,6 +9,7 @@ on:
     branches:
       - develop
       - 'feature/**'
+      - 'bugfix/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -76,8 +77,9 @@ jobs:
         uses: codecov/codecov-action@v4
         with:
           directory: /tmp/.scaffold-coverage-html
-          fail_ci_if_error: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   scaffold-test-workflow:
     runs-on: ubuntu-latest
@@ -127,8 +129,9 @@ jobs:
         uses: codecov/codecov-action@v4
         with:
           directory: /tmp/.scaffold-coverage-html
-          fail_ci_if_error: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   scaffold-test-deployment:
     runs-on: ubuntu-latest
@@ -187,8 +190,9 @@ jobs:
         uses: codecov/codecov-action@v4
         with:
           directory: /tmp/.scaffold-coverage-html
-          fail_ci_if_error: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   scaffold-test-actions:
     runs-on: ubuntu-latest

.lagoon.yml

@@ -92,10 +92,11 @@ tasks:
           DREVOPS_NOTIFY_EVENT=post_deployment \
           DREVOPS_NOTIFY_PROJECT=$LAGOON_PROJECT \
           DREVOPS_NOTIFY_ENVIRONMENT_URL=$LAGOON_ROUTE \
-          ./scripts/drevops/notify.sh
+          ./scripts/drevops/notify.sh || true
         service: cli
         shell: bash
     #;> !NOTIFICATIONS
+
 environments:
   # Branch name that represents production environment.
   main: