feat: upgrade to Ruby 4.0.7 and Rails 8.1.4

.dockerignore

@@ -1,46 +1,71 @@
-# Ignore bundler config.
+# Git
+.git/
+.github/
+.gitignore
+/git-hooks/
+
+# Log- and tempfiles
+/log/*
+!/log/.keep
+/tmp/*
+!/tmp/.keep
+
+# Uploads
+/storage/*
+!/storage/.keep
+public/uploads
+
+# Bundler stuff
 /.bundle
+bin/bundle
 
-# Ignore the default SQLite database.
+# SQLite databases
 /db/*.sqlite3
 /db/*.sqlite3-journal
 
-# Ignore all logfiles and tempfiles.
-/log/*
-/tmp/*
-!/tmp/.keep
-!/log/.keep
+# JS stuff
+/node_modules
+/yarn-error.log
+
+# Docs & .md files
+/doc/
+*.md
+AUTHORS
+LICENSE
+
+# Docker
+Dockerfile*
+docker-compose.yml
 
 # Puma is unhappy without this
 !/tmp/pids
 /tmp/pids/*
 !/tmp/pids/.keep
 
-# Ignore uploaded files in development
-/storage/*
-!/storage/.keep
+# Test files
+/test/
+/spec/
+
+# Lint/tooling config (only used outside Docker)
+.haml-lint.yml
+.overcommit.yml
+.projections.json
+.reek.yml
+.rubocop.yml
+.rubocop_todo.yml
+.tool-versions
+.yamllint.yaml
 
-/node_modules
-/yarn-error.log
 
 /public/assets
 .byebug_history
 
 # Ignore master key for decrypting credentials and more.
 /config/master.key
 
-# Ignore public uploads
-public/uploads
-
-# Ignore changed bundle binstub
-bin/bundle
-
-# Ignore local environment variables file
+# Local environment variables
 .env.local
 .envrc
 
-# Ignore local gems
+# Local gems
 vendor/bundle/**/
-
-.git/
-.github/

.github/workflows/build-manual.yaml

@@ -1,5 +1,5 @@
 ---
-name: "Manual build without tests"
+name: "Manual build"
 
 "on":
   workflow_dispatch:
@@ -24,14 +24,48 @@ name: "Manual build without tests"
           - pude-ptime-int
           - pude-ptime-prod
         default: "pitc-ptime-int"
+      lint:
+        description: "Run lint?"
+        required: true
+        type: boolean
+        default: false
+      test:
+        description: "Run tests?"
+        required: true
+        type: boolean
+        default: false
+      build:
+        description: "Build the image?"
+        required: true
+        type: boolean
+        default: true
       push:
-        description: "Should we push the image to the registry?"
+        description: "Push the image to the registry?"
         required: true
         type: boolean
         default: true
+      sbom:
+        description: "Generate and upload the SBOM?"
+        required: true
+        type: boolean
+        default: false
 
 jobs:
+  lint:
+    if: ${{ inputs.lint }}
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
+    uses: ./.github/workflows/reusable-lint.yaml
+
+  test:
+    if: ${{ inputs.test }}
+    uses: ./.github/workflows/reusable-test.yaml
+
   build-dispatch:
+    needs: [lint, test]
+    if: ${{ inputs.build && !failure() && !cancelled() }}
     uses: ./.github/workflows/reusable-build.yaml
     with:
       environment: ${{ inputs.environment }}
@@ -40,3 +74,14 @@ jobs:
     secrets:
       PUZZLE_REGISTRY_USERNAME: ${{ secrets.PUZZLE_REGISTRY_USERNAME }}
       PUZZLE_REGISTRY_TOKEN: ${{ secrets.PUZZLE_REGISTRY_TOKEN }}
+
+  sbom:
+    needs: build-dispatch
+    if: ${{ inputs.sbom && !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable-sbom.yaml
+    with:
+      project_name: ${{ inputs.project_name }}
+    secrets:
+      dependency_track_url: ${{ secrets.DEPTRACK_URL }}
+      dependency_track_api_key: ${{ secrets.DEPTRACK_API_KEY }}
+...

.github/workflows/build-on-push.yaml

@@ -11,6 +11,10 @@ name: 'Lint, test and image build on push'
 
 jobs:
   lint:
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
     uses: ./.github/workflows/reusable-lint.yaml
 
   test:

.github/workflows/reusable-build.yaml

@@ -63,13 +63,14 @@ jobs:
 
           exit "${exit_code}"
 
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/login-action@v3
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
         with:
           registry: ${{ env.BUILD_REGISTRY }}
           username: ${{ secrets.PUZZLE_REGISTRY_USERNAME }}
           password: ${{ secrets.PUZZLE_REGISTRY_TOKEN }}
-      - uses: docker/build-push-action@v4
+      - uses: docker/build-push-action@v7
+        id: build
         with:
           file: Dockerfile
           build-args: |
@@ -82,5 +83,18 @@ jobs:
             ${{ env.BUILD_REGISTRY_URL }}:latest
             ${{ env.BUILD_REGISTRY_URL }}:git-${{ github.sha }}
           push: ${{ inputs.push }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=registry,ref=${{ env.BUILD_REGISTRY_URL }}:buildcache
+          cache-to: type=registry,ref=${{ env.BUILD_REGISTRY_URL }}:buildcache,mode=max
+
+      - name: 'Report image tags'
+        if: inputs.push
+        run: |
+          echo "::notice title=Image pushed::${BUILD_REGISTRY_URL}:latest, ${BUILD_REGISTRY_URL}:git-${{ github.sha }} (digest ${{ steps.build.outputs.digest }})"
+          {
+            echo '### Image pushed'
+            echo
+            echo '| Tag | Digest |'
+            echo '| --- | --- |'
+            echo "| \`${BUILD_REGISTRY_URL}:latest\` | \`${{ steps.build.outputs.digest }}\` |"
+            echo "| \`${BUILD_REGISTRY_URL}:git-${{ github.sha }}\` | \`${{ steps.build.outputs.digest }}\` |"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/reusable-lint.yaml

@@ -8,12 +8,37 @@ name: 'Code Style Review'
         description: "Ref to checkout"
         type: string
 
+permissions:
+  contents: read
+  checks: write
+  pull-requests: write
+
+# The linters live in the optional :overcommit group (see .overcommit.yml). Set
+# here so every job shares one setup-ruby bundler cache (BUNDLE_WITH is part of
+# its cache key).
+env:
+  BUNDLE_WITH: 'overcommit'
+
 jobs:
-  lint:
+  # Warms the bundler cache once; the linter jobs below only restore it.
+  prepare:
+    runs-on: 'ubuntu-latest'
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+
+  rubocop:
     runs-on: 'ubuntu-latest'
+    needs: prepare
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ inputs.ref }}
 
@@ -28,19 +53,80 @@ jobs:
           # reporter: github-pr-review
           level: error
 
-      - run: 'gem install haml-lint'
+  brakeman:
+    runs-on: 'ubuntu-latest'
+    needs: prepare
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+
+      - uses: reviewdog/action-brakeman@v2
+        with:
+          brakeman_version: gemfile
+          level: error
+
+  actionlint:
+    runs-on: 'ubuntu-latest'
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: reviewdog/action-actionlint@v1
+        with:
+          level: error
+
+  ruby-lint:
+    runs-on: 'ubuntu-latest'
+    needs: prepare
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: 'HAML-Lint'
+            command: 'bundle exec haml-lint --reporter checkstyle'
+            format: '-f=checkstyle'
+          - name: 'Reek'
+            command: 'bundle exec reek --single-line --no-progress app lib'
+            # reek indents every smell by two spaces under its file heading
+            format: '-efm=  %f:%l: %m'
+          - name: 'Rails-Best-Practices'
+            command: 'bundle exec rails_best_practices --without-color'
+            format: '-efm=%f:%l - %m'
+          - name: 'ERB-Lint'
+            command: 'bundle exec erb_lint --lint-all --format compact'
+            format: '-efm=%f:%l:%c: %m'
+          - name: 'Fasterer'
+            command: 'bundle exec fasterer'
+            format: '-efm=%f:%l %m'
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
 
       - uses: reviewdog/action-setup@v1
 
-      - name: 'Run Reviewdog HAML-Lint'
+      - name: ${{ matrix.name }}
         env:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ github.token }}
         run: |
-          haml-lint |
+          ${{ matrix.command }} |
+          sed -E 's/\x1B\[[0-9;]*m//g' |
           reviewdog \
-          -efm="%f:%l %m" \
-          -name="HAML-Lint" \
-          -reporter=github-pr-review \
-          -level=error \
-          -diff="git diff $DIFF_BRANCH"
+          "${{ matrix.format }}" \
+          -name="${{ matrix.name }}" \
+          -reporter=github-pr-review
 ...

.github/workflows/reusable-sbom.yaml

@@ -49,7 +49,7 @@ jobs:
     #     ports: [ '11211:11211' ]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: 'Generate SBOM for ruby and npm dependencies'
         run: |
           npm install -g @cyclonedx/cdxgen
@@ -60,7 +60,7 @@ jobs:
         run: |
           docker run \
                  --rm \
-                 -v $(pwd):/data \
+                 -v "$(pwd):/data" \
                  cyclonedx/cyclonedx-cli \
                  merge \
                  --input-files data/sbom-ruby.json data/sbom-npm.json \
@@ -79,7 +79,7 @@ jobs:
                --form "projectVersion=latest" \
                --form "bom=@sbom.xml"
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: ${{ inputs.artifact-prefix }}sboms