.github/dependabot.yml

@@ -16,10 +16,6 @@ updates:
       symfony:
         patterns:
           - "symfony/*"
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - "version-update:semver-major"
 
 
   - package-ecosystem: "npm"
@@ -29,10 +25,6 @@ updates:
     schedule:
         interval: "weekly"
     open-pull-requests-limit: 10
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - "version-update:semver-major"
 
 
   - package-ecosystem: "github-actions"
@@ -42,20 +34,3 @@ updates:
     schedule:
         interval: "weekly"
     open-pull-requests-limit: 5
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - "version-update:semver-major"
-
-
-  - package-ecosystem: "docker"
-    directory: "/"
-    commit-message:
-        prefix: "chore"
-    schedule:
-        interval: "weekly"
-    open-pull-requests-limit: 10
-    ignore:
-      - dependency-name: "*"
-        update-types:
-          - "version-update:semver-major"

.github/workflows/build.yml

@@ -5,6 +5,7 @@ on:
 
 jobs:
   build-push-php:
+    environment: PROD
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -18,6 +19,7 @@ jobs:
         IMAGE_REPOSITORY: ${{ vars.IMAGE_REPO }}
          
   build-push-caddy:
+    environment: PROD
     # Same Dockerfile as php, with a build target which is after
     needs: [build-push-php]
     runs-on: ubuntu-latest

.github/workflows/cd.yml

@@ -5,7 +5,8 @@ on:
   push:
     branches:
       - main
-      - staging
+    tags: 
+      - '*'
   pull_request:
     types: [ opened, reopened, synchronize, labeled ]
   workflow_dispatch: ~
@@ -17,23 +18,25 @@ permissions:
   packages: write
 
 jobs:
-  remove-deploy-label:
-    name: Remove deploy label
-    if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'deploy')
-    runs-on: ubuntu-latest
-    steps:
-      - uses: mondeja/remove-labels-gh-action@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          labels: |
-            deploy
+  # remove-deploy-label:
+  #   name: Remove deploy label
+  #   if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'deploy')
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - uses: mondeja/remove-labels-gh-action@v1
+  #       with:
+  #         token: ${{ secrets.GITHUB_TOKEN }}
+  #         labels: |
+  #           deploy
+
   build:
-    if: github.event_name != 'pull_request' || (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'deploy'))
+    # we run the CD only on pull requests from the same repo
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     name: Build
     uses: ./.github/workflows/build.yml
 
   deploy:
-    if: github.event_name != 'pull_request' || (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'deploy'))
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     name: Deploy
     needs: [ build ]
     uses: ./.github/workflows/deploy.yml
@@ -45,6 +48,6 @@ jobs:
       storage-secret-key: ${{ secrets.STORAGE_SECRET_KEY}}
       project-id: ${{ secrets.PROJECT_ID }}
       workload-identity-provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
-      pg-password: ${{ secrets.PG_PASSWORD }}
+      database-url: ${{ secrets.DATABASE_URL }}
       mailer-dsn: ${{ secrets.MAILER_DSN }}
       sms-dsn: ${{ secrets.SMS_DSN }}

.github/workflows/cleanup.yml

@@ -1,75 +0,0 @@
-name: Cleanup
-
-on:
-  pull_request:
-    types: [ closed ]
-
-permissions:
-  id-token: write
-  contents: read
-  pull-requests: write
-  
-jobs:
-  meta:
-    name: Meta
-    runs-on: ubuntu-latest
-    outputs:
-      context: ${{ steps.meta.outputs.context }}
-      environment: ${{ steps.meta.outputs.environment }}
-      namespace: ${{ steps.meta.outputs.namespace }}
-
-    steps:
-    - name: Generate metadata
-      id: meta
-      run: |
-        set -xo pipefail
-        PROJECT=plateforme-ebs
-        CONTEXT=nonprod
-        ENVIRONMENT=nonprod
-
-        echo "context=${CONTEXT}" >> $GITHUB_OUTPUT
-        echo "environment=${ENVIRONMENT}" >> $GITHUB_OUTPUT
-        echo "namespace=${CONTEXT}-${PROJECT}" >> $GITHUB_OUTPUT
-
-
-  cleanup:
-    name: Cleanup
-    runs-on: ubuntu-latest
-    environment:
-      name: ${{ needs.meta.outputs.environment }}
-    needs: ["meta"]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: GKE Auth
-        uses: 'google-github-actions/auth@v2'
-        with:
-          project_id: '${{ secrets.PROJECT_ID }}'
-          workload_identity_provider: '${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}'
-
-      - name: Setup gcloud
-        uses: google-github-actions/setup-gcloud@v1
-        with:
-          project_id: ${{ secrets.PROJECT_ID }}
-
-      - name: Connect cluster
-        run: |
-          gcloud components install gke-gcloud-auth-plugin
-          gcloud auth login --cred-file=$CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE
-          gcloud container clusters get-credentials ${{ vars.CLUSTER_NAME }} --region europe-west1 --project ${{ secrets.PROJECT_ID }}
-          kubectl config view
-
-      - name: Uninstall helm release
-        id: uninstall_helm_release
-        run: |
-          export RELEASE_NAME=pr-$(jq --raw-output .pull_request.number $GITHUB_EVENT_PATH)
-          echo "Uninstalling release $RELEASE_NAME in namespace ${{ needs.meta.outputs.namespace }}..."
-          if ! helm uninstall $RELEASE_NAME --namespace ${{ needs.meta.outputs.namespace }} --wait ; then
-            echo "HELM Uninstall has failed !"
-            echo "Please ask the SRE team to manually clean remaining objects"
-            exit 1
-          fi
-          echo "HELM uninstall successfull"
-          echo "Cleaning remaining PVC..."
-          kubectl delete pvc -l app.kubernetes.io/instance=$RELEASE_NAME --namespace ${{ needs.meta.outputs.namespace }}

.github/workflows/deploy.yml

@@ -23,9 +23,6 @@ on:
         required: true
       database-url:
         description: Database URL
-        required: false
-      pg-password:
-        description: PostgreSQL password for CNPG cluster
         required: true
       mailer-dsn:
         description: Mailer DSN
@@ -58,32 +55,15 @@ jobs:
         run: |
           set -xo pipefail
           PROJECT=${{ vars.PROJECT_NAME }}
-          if [[ "${{ github.ref_name }}" == "main" ]]; then
           # Tags are deployed in prod
           CONTEXT=prod
           ENVIRONMENT=prod
-            IMAGE_TAG=${{ github.ref_name }}
-            RELEASE_NAME=prod
-            TRUSTED_HOST=$(echo ${{ vars.DOMAIN }} | sed 's/\./\\\\\\\\./g')
-            URL=${{ vars.DOMAIN }}
-            STORAGE_NAME=${{ vars.PROD_STORAGE_BUCKET }}
-          else
-            CONTEXT=nonprod
-            ENVIRONMENT=nonprod
-            IMAGE_TAG=sha-${GITHUB_SHA::7}
-            if [ "$GITHUB_EVENT_NAME" == "pull_request" ]; then
-                RELEASE_NAME=pr-$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
-                STORAGE_NAME=${{ vars.STORAGE_BUCKET }}-pr
-            else
-                RELEASE_NAME=${{ github.ref_name }}
-                STORAGE_NAME=${{ vars.NONPROD_STORAGE_BUCKET }}-main
-            fi
-            URL=${RELEASE_NAME}.${{ vars.NONPROD_DOMAIN }}
-            TRUSTED_HOST=$(echo ${URL} | sed 's/\./\\\\\\\\./g')
-          fi
           PHP_IMAGE_REPO=${{ vars.IMAGE_REPO }}/${{ vars.IMAGE_NAME_PHP }}
           CADDY_IMAGE_REPO=${{ vars.IMAGE_REPO }}/${{ vars.IMAGE_NAME_CADDY }}
-          echo "url=${URL}" >> $GITHUB_OUTPUT
+          IMAGE_TAG=sha-${GITHUB_SHA::7}
+          RELEASE_NAME=prod
+          TRUSTED_HOST=$(echo ${{ vars.DOMAIN }} | sed 's/\./\\\\\\\\./g')
+
           echo "trusted_host=${TRUSTED_HOST}" >> $GITHUB_OUTPUT
           echo "context=${CONTEXT}" >> $GITHUB_OUTPUT
           echo "environment=${ENVIRONMENT}" >> $GITHUB_OUTPUT
@@ -92,7 +72,6 @@ jobs:
           echo "caddy_image_repo=${CADDY_IMAGE_REPO}" >> $GITHUB_OUTPUT
           echo "release_name=${RELEASE_NAME}" >> $GITHUB_OUTPUT
           echo "namespace=${CONTEXT}-${PROJECT}" >> $GITHUB_OUTPUT
-          echo "storage_name=${STORAGE_NAME}" >> $GITHUB_OUTPUT
 
   deploy:
     name: Deploy
@@ -150,14 +129,15 @@ jobs:
             --set=php.image.tag=${{ needs.meta.outputs.image_tag }} \
             --set=caddy.image.repository=${{ needs.meta.outputs.caddy_image_repo }} \
             --set=caddy.image.tag=${{ needs.meta.outputs.image_tag }} \
-            --set=ingress.hosts[0].host=${{ needs.meta.outputs.url }} \
+            --set=ingress.hosts[0].host=${{ vars.DOMAIN }} \
             --set=ingress.tls[0].secretName=${{ needs.meta.outputs.release_name }}-tls \
-            --set=ingress.tls[0].hosts[0]=${{ needs.meta.outputs.url }} \
+            --set=ingress.tls[0].hosts[0]=${{ vars.DOMAIN }} \
+            --set=postgresql.url="${{ secrets.database-url }}" \
+            --set=postgresql.enabled='${{ github.event_name == 'pull_request' }}' \
             --set=payum.apikey="${{ secrets.payum-apikey }}" \
-            --set=cnpg.credentials.password="${{ secrets.pg-password }}" \
             --set=mailer.dsn="${{ secrets.mailer-dsn }}" \
             --set=sms.dsn="${{ secrets.sms-dsn }}" \
-            --set=php.storage.bucket="${{ needs.meta.outputs.storage_name }}" \
+            --set=php.storage.bucket="${{ vars.STORAGE_BUCKET }}" \
             --set=php.storage.endpoint="https://storage.googleapis.com" \
             --set=php.storage.region="eu-west-1" \
             --set=php.storage.usePathStyleEndpoint=true \

Dockerfile

@@ -11,7 +11,6 @@ ARG CADDY_VERSION=2.11.2
 FROM node AS yarn_build
 WORKDIR /usr/app
 RUN apt-get update && apt-get install tar
-RUN npm install -g yarn
 RUN mkdir -p /usr/app/vendor/symfony
 RUN curl -L https://github.com/symfony/ux-autocomplete/archive/v2.7.1.tar.gz -o ux-autocomplete.tar.gz
 RUN tar -xzvf ux-autocomplete.tar.gz --directory /usr/app/vendor/symfony
@@ -25,7 +24,7 @@ RUN yarn build
 FROM php:${PHP_VERSION}-fpm-alpine AS app_php
 
 # needed for security update until base image is updated
-RUN apk upgrade --no-cache libcurl curl openssl openssl-dev libressl libcrypto3 libssl3 nghttp2-libs
+#RUN apk upgrade libcurl curl openssl openssl-dev libressl libcrypto3 libssl3
 
 # Allow to use development versions of Symfony
 ARG STABILITY="stable"
@@ -197,6 +196,6 @@ COPY --from=app_php /srv/app/public public/
 COPY docker/caddy/Caddyfile /etc/caddy/Caddyfile
 
 # needed for security update until base image is updated
-RUN apk upgrade --no-cache libcurl curl openssl openssl-dev libcrypto3 libssl3 nghttp2-libs
+#RUN apk upgrade libcurl curl openssl openssl-dev libressl libcrypto1.1 libssl1.1 libcrypto3 libssl3
 
 WORKDIR /srv/app

helm/chart/Chart.yaml

@@ -25,6 +25,11 @@ version: 0.0.1
 appVersion: 0.0.1
 
 dependencies:
+  # bitnami chart are using the workaround from https://github.com/bitnami/charts/issues/10539
+  - name: postgresql
+    version: ~11.9.13
+    repository: https://charts.bitnami.com/bitnami/
+    condition: postgresql.enabled
   - name: external-dns
     version: ~5.4.15
     repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami

helm/chart/templates/NOTES.txt

@@ -1,8 +1,3 @@
-{{- if .Values.cnpg.enabled }}
-IMPORTANT: This chart requires the CloudNativePG operator to be installed in your cluster.
-  helm upgrade --install cnpg --namespace cnpg-system --create-namespace cloudnative-pg/cloudnative-pg
-  See: https://cloudnative-pg.io/documentation/current/installation_upgrade/
-{{ end }}
 1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
 {{- range $host := .Values.ingress.hosts }}

helm/chart/templates/_helpers.tpl

@@ -80,13 +80,6 @@ app.kubernetes.io/name: {{ include "plateforme-ebs.name" . }}-pwa
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
-{{/*
-CNPG cluster name
-*/}}
-{{- define "plateforme-ebs.cnpgClusterName" -}}
-{{- printf "%s-postgresql" (include "plateforme-ebs" .) }}
-{{- end }}
-
 {{/*
 Create the name of the service account to use
 */}}

helm/chart/templates/cnpg-cluster.yaml

@@ -1,38 +0,0 @@
-{{- if .Values.cnpg.enabled }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "plateforme-ebs.cnpgClusterName" . }}-credentials
-  labels:
-    {{- include "plateforme-ebs.labels" . | nindent 4 }}
-type: kubernetes.io/basic-auth
-stringData:
-  username: {{ .Values.cnpg.owner | quote }}
-  password: {{ .Values.cnpg.credentials.password | quote }}
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: {{ include "plateforme-ebs.cnpgClusterName" . }}
-  labels:
-    {{- include "plateforme-ebs.labels" . | nindent 4 }}
-spec:
-  instances: {{ .Values.cnpg.instances }}
-  bootstrap:
-    initdb:
-      database: {{ .Values.cnpg.database | quote }}
-      owner: {{ .Values.cnpg.owner | quote }}
-      secret:
-        name: {{ include "plateforme-ebs.cnpgClusterName" . }}-credentials
-      postInitApplicationSQL:
-        - ALTER ROLE {{ .Values.cnpg.owner }} CREATEDB;
-  storage:
-    size: {{ .Values.cnpg.storage.size | quote }}
-    {{- if .Values.cnpg.storage.storageClass }}
-    storageClass: {{ .Values.cnpg.storage.storageClass | quote }}
-    {{- end }}
-  {{- with .Values.cnpg.resources }}
-  resources:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

helm/chart/templates/secrets.yaml

@@ -6,9 +6,8 @@ metadata:
     {{- include "plateforme-ebs.labels" . | nindent 4 }}
 type: Opaque
 data:
-  {{- if .Values.cnpg.enabled }}
-  database-url: {{ printf "postgresql://%s:%s@%s-rw/%s?serverVersion=%s&charset=utf8" .Values.cnpg.owner .Values.cnpg.credentials.password (include "plateforme-ebs.cnpgClusterName" .) .Values.cnpg.database .Values.cnpg.postgresql.version | b64enc | quote }}
-  cnpg-password: {{ .Values.cnpg.credentials.password | b64enc | quote }}
+  {{- if .Values.postgresql.enabled }}
+  database-url: {{ printf "pgsql://%s:%s@%s-postgresql/%s?serverVersion=14&charset=utf8" .Values.postgresql.global.postgresql.auth.username .Values.postgresql.global.postgresql.auth.password .Release.Name .Values.postgresql.global.postgresql.auth.database | b64enc | quote }}
   {{- else }}
   database-url: {{ .Values.postgresql.url | b64enc | quote }}
   {{- end }}
@@ -24,5 +23,5 @@ data:
   {{- end }}
   sms-dsn: {{ .Values.sms.dsn | b64enc | quote }}
   payum-apikey: {{ .Values.payum.apikey | b64enc | quote }}
-  php-storage-key: {{ .Values.php.storage.key | default "" | b64enc | quote }}
-  php-storage-secret: {{ .Values.php.storage.secret | default "" | b64enc | quote }}
+  php-storage-key: {{ .Values.php.storage.key | b64enc | quote }}
+  php-storage-secret: {{ .Values.php.storage.secret | b64enc | quote }}

helm/chart/values-minikube.yml

@@ -14,9 +14,10 @@ payum:
   gateway: 'mollie'
   apikey: 'test'
 
-cnpg:
-  credentials:
-    password: change_me
+postgresql:
+  auth:
+    # PostgreSQL password is set only the first time chart in installed
+    postgresPassword: change_me
 
 maildev:
   enabled: true

helm/chart/values-nonprod.yml

@@ -27,9 +27,8 @@ redis:
     storageClass: "standard"
     size: "1Gi"
 
-cnpg:
-  credentials:
-    password: change_me
+postgresql:
+  url: change_me
 
 php:
   fixtureJob:

helm/chart/values-prod.yml

@@ -27,9 +27,8 @@ redis:
     storageClass: "standard"
     size: "1Gi"
 
-cnpg:
-  credentials:
-    password: change_me
+postgresql:
+  url: change_me
 
 php:
   fixtureJob:

helm/chart/values.yaml

@@ -69,33 +69,34 @@ mercure:
   jwtSecret: "!ChangeThisMercureHubJWTSecretKey!"
   extraDirectives: cors_origins http://ghcr.io https://ghcr.io
 
-# CloudNativePG cluster configuration.
-# The CNPG operator must be pre-installed in the cluster.
-# See: https://cloudnative-pg.io/documentation/current/installation_upgrade/
-cnpg:
+# Full configuration: https://github.com/bitnami/charts/tree/master/bitnami/postgresql
+postgresql:
   enabled: true
-  instances: 1
+  # If bringing your own PostgreSQL, the full uri to use
+  # url: postgresql://plateforme-ebs:!ChangeMe!@database:5432/api?serverVersion=13&charset=utf8
+  global:
     postgresql:
-    version: "16"
-  database: app
-  owner: app
-  credentials:
-    # IMPORTANT: use only alphanumeric characters. Special characters (@, #, %, :)
-    # will break the DATABASE_URL parsing by PHP's parse_url().
-    password: "ChangeMe"
-  storage:
-    size: 1Gi
+      auth:
+        username: "example"
+        password: "!ChangeMe!"
+        database: "api"
+        postgresPassword: "!ChangeMe!"
+  # Persistent Volume Storage configuration.
+  # ref: https://kubernetes.io/docs/user-guide/persistent-volumes
+  pullPolicy: IfNotPresent
+  image:
+    repository: bitnami/postgresql
+    tag: 14
+  primary:
+    persistence:
+      enabled: true
       storageClass: standard
+      size: 1Gi
     resources:
       requests:
         memory: 50Mi
         cpu: 1m
 
-# External PostgreSQL URL, used when cnpg.enabled is false.
-# url: postgresql://app:!ChangeMe!@database:5432/app?serverVersion=16&charset=utf8
-postgresql:
-  url: ""
-
 payum:
   # @see https://my.mollie.com/dashboard/org_XXXXXXXX/developers/api-keys
   # even it's a fake key it must start with 'test_' or 'live_' and must be at least 30 characters long

src/Controller/Product/ProductController.php

@@ -103,7 +103,8 @@ final class ProductController extends AbstractController
             }
 
             return $this->render('pages/product/show.html.twig', compact('slug', 'id', 'product'));
-        }
+        } else {
             throw new GoneHttpException();
         }
+    }
 }

src/Controller/User/Product/ServiceController.php

@@ -69,9 +69,10 @@ final class ServiceController extends AbstractController
             }
 
             return $this->render('pages/product/new_service.html.twig', compact('form', 'product'));
-        }
+        } else {
             throw new GoneHttpException();
         }
+    }
 
     #[Route([
         'en' => MyAccountAction::BASE_URL_EN.'/services/{id}/edit',
@@ -95,7 +96,8 @@ final class ServiceController extends AbstractController
             }
 
             return $this->render('pages/product/edit_service.html.twig', compact('form', 'product'));
-        }
+        } else {
             throw new GoneHttpException();
         }
+    }
 }

src/Controller/User/Product/UserProductsController.php

@@ -94,7 +94,8 @@ final class UserProductsController extends AbstractController
 
         if ($this->configurationRepository->getServicesParameter()) {
             return $this->render('pages/account/product/list.html.twig', compact('pagination', 'form'));
-        }
+        } else {
             throw new GoneHttpException('there is no services');
         }
+    }
 }

src/Payment/PayumManager.php

@@ -80,8 +80,7 @@ final class PayumManager
                     'groupOfferId' => (string) $offer->getId(),
                 ],
             ];
-        }
-
+        } else {
             return [
                 // method must be set as the default value is not retrieved from the gateway configuration
                 'method' => PaymentMethod::CREDITCARD->value,
@@ -91,6 +90,7 @@ final class PayumManager
                 ],
             ];
         }
+    }
 
     /**
      * @param array<string, string> $afterParameters

src/Repository/MenuItemRepository.php

@@ -12,8 +12,6 @@ use Doctrine\ORM\QueryBuilder;
 use Gedmo\Sortable\Entity\Repository\SortableRepository;
 
 /**
- * @extends SortableRepository<MenuItem>
- *
  * @method MenuItem|null find($id, $lockMode = null, $lockVersion = null)
  * @method MenuItem|null findOneBy(array $criteria, array $orderBy = null)
  * @method MenuItem[]    findAll()

src/State/GroupGetStatsProvider.php

@@ -15,7 +15,7 @@ use App\Repository\GroupRepository;
 final class GroupGetStatsProvider implements ProviderInterface
 {
     public function __construct(
-        private readonly GroupRepository $groupRepository,
+        readonly private GroupRepository $groupRepository,
     ) {
     }
 

src/State/GroupsProvider.php

@@ -16,8 +16,8 @@ use App\Repository\UserRepository;
 class GroupsProvider implements ProviderInterface
 {
     public function __construct(
-        private readonly GroupRepository $groupRepository,
-        private readonly UserRepository $userRepository,
+        readonly private GroupRepository $groupRepository,
+        readonly private UserRepository $userRepository,
     ) {
     }
 

tests/Unit/Notifier/SmsNotifierTest.php

@@ -6,14 +6,14 @@ namespace App\Tests\Unit\Notifier;
 
 use App\Entity\User;
 use App\Notifier\SmsNotifier;
-use Monolog\Test\MonologTestCase;
+use Monolog\Test\TestCase;
 use PHPUnit\Framework\MockObject\MockObject;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\HttpClient\Response\MockResponse;
 use Symfony\Component\Notifier\Exception\TransportException;
 use Symfony\Component\Notifier\TexterInterface;
 
-final class SmsNotifierTest extends MonologTestCase
+final class SmsNotifierTest extends TestCase
 {
     public function testNotify(): void
     {