Upgrade Stepup-RA to run on Symfony 6.4 and PHP 8.2 (#313)

* Add docker configs and rebuild the .dist files to reflect the new docker based development environment * Configuring the github actions pipelines for this app * Adding the dev image and fixing up some naming conventions * Default docker config: Add mailcatcher host * Docker config: Make sure all second factors are the same * Docker config: Add correct loa1.5 * Docker: Add monolog configuration when running as a container This will let the logs go to stdout when running as a container, which is the Docker way to send logs * Rename loa's to a more standard name * Add repo name to slack notification * Bump symfony/twig-bridge from 4.4.49 to 4.4.51 Bumps [symfony/twig-bridge](https://github.com/symfony/twig-bridge) from 4.4.49 to 4.4.51. - [Release notes](https://github.com/symfony/twig-bridge/releases) - [Changelog](https://github.com/symfony/twig-bridge/blob/6.3/CHANGELOG.md) - [Commits](symfony/twig-bridge@v4.4.49...v4.4.51) --- updated-dependencies: - dependency-name: symfony/twig-bridge dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * Fix unit tests Tests started failing since yesterday: ``` yarn install v1.22.19 info No lockfile found. [1/4] Resolving packages... warning @symfony/webpack-encore > webpack-dev-server > webpack-dev-middleware > [email protected]: this will be v4 [2/4] Fetching packages... error @symfony/[email protected]: The engine "node" is incompatible with this module. Expected version ">=16.0.0". Got "14.21.2" ``` I was able to trace to issue back to a new release of webpack-encore: https://github.com/symfony/webpack-encore/releases/tag/v4.5.0 * Bump phpseclib/phpseclib from 3.0.19 to 3.0.34 Bumps [phpseclib/phpseclib](https://github.com/phpseclib/phpseclib) from 3.0.19 to 3.0.34. - [Release notes](https://github.com/phpseclib/phpseclib/releases) - [Changelog](https://github.com/phpseclib/phpseclib/blob/master/CHANGELOG.md) - [Commits](phpseclib/phpseclib@3.0.19...3.0.34) --- updated-dependencies: - dependency-name: phpseclib/phpseclib dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * Moving from CMD to ENTRYPOINT * Moving back to CMD * Removing the dev image * Bump phpseclib/phpseclib from 3.0.34 to 3.0.37 Bumps [phpseclib/phpseclib](https://github.com/phpseclib/phpseclib) from 3.0.34 to 3.0.37. - [Release notes](https://github.com/phpseclib/phpseclib/releases) - [Changelog](https://github.com/phpseclib/phpseclib/blob/master/CHANGELOG.md) - [Commits](phpseclib/phpseclib@3.0.34...3.0.37) --- updated-dependencies: - dependency-name: phpseclib/phpseclib dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * Update and install - rector - sf/flex 2+ * Fix deprecations * 1st Rector run LevelSetList::UP_TO_PHP_82, ClassPropertyAssignToConstructorPromotionRector::class, SymfonySetList::SYMFONY_44, * Rector remove Action suffix * Repair controller calls * Update quality tools * Migrate to newer schema * Add types * Remove obsolete var * Replace session with requeststack * Replace legacy with openconext * Move twig files * Fix test with requestStack * Solve PHPStan error * Solve PHPStan error * PHPstan extensions * Remove obsolete phpdoc * Add types * Add types and DI * Replace get with container->get * Add types and DI * Ran phpcbf * DI and removed @template * DI and types * DI and types * DI and types * DI and types * DI and types * DI and types * DI and types * DI and types * DI and types * DI and types * DI and types * Add parent call * Add types * Add types * Add types * Add types * Add types * Add types * Add types * Add types * Add types * Add types * Add types * Add types * Fix deprecations * Fix deprecations * Fix deprecations * Add return types * Add return types * Removed unused imports * Removed unused moment installation * Fix deprecations * Remove deleted service definitions * Add types * Run rector * Add types * Add types * Remove direct dependency * Change security check to composer audit * Change security check to composer audit * 1st Upgrade to 6.x * Update dependencies * Add route attribute * Add route attribute * Change config * Add error bundle * Fix phpcbf * Fix tests and config * Fix tests and config * Fix tests and config * Avoid null return * Rename varname * Replace files according rules * Correct copyright year * Remove more than 1 blank line * Disable dotenv * Use Dependency Injection * Use Dependency Injection * Create MetadataCollection * Use Dependency Injection * Remove obsolete config after renaming the service * Add phpstan rule to detect debug statements * Change early returns * Remove getIdentity call * Add AuthenticatedIdentity * Add roles via contructor * Using ICU format for translations * Remove dead code * Remove deprecated transchoice * Add Loa to Authenticated Identity * Get Loa from Authenticated Identity * Get correct Identity * Get correct Identity Service * Replaced vars * Added helper methods to get internals of Identity * Fix namespace * Fixed on behat runs * Fix flashbag * Fix return redirect * Test double for Yubikey * Test double for Yubikey * Attribute fix and exception controller * Remove obsolete token * Clean up phpcbf * Remove unneeded version * Phpstan settings * Add Logout handling * Add phpstan in check * add phpstan directives * Remove dead code * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Integrate in central config * Remove obsolete code * Use alias * Use alias * Use alias * Remove dead code * Remove dead code * Remove dead code * Github actions update * Github actions update * Add php 8.2 * Set nodejs version * Set nodejs version * Set nodejs version * Set nodejs version * Set nodejs version * Set node version * Add license check * Add license check * Optimize imports * Fix review - Add frontend build in test integration - Fix RAService line length * Move logo * Add correct DOB * Fix Call to an undefined method (phpstan) * Implement method * Fix phpstan errors * Fix phpstan errors * Fix phpstan errors * Fix phpstan errors * Fix phpstan errors * Fixed dist parameter * Configure all build components to use node20 and php82 * GHA: For creating releases the GHA workflow needs more permissions * Docker build: Use the latest actions and upgrade to php8 * Fixed monolog * Removed rubbish in html * Moved services_smoketest.yaml to config * Merge and remove remaining package/{env} config * Ensure MissingRequiredAttributeException end on error page They would not be listened to by the exception handler. As it is derived from an exception that is not handled. * Simplify bundle setup - Resource config has been moved to main /config location - samlstepupproviders.yaml was moved to packages folder * Reorganize less and js files Moved them from the bundle to the globa assets folder Updated the references to these files in the webpack config * Inject the locales instead of leaving them empty This fixed the not present vetting type input fields. Which are added based on the programmed locales. * Remove unused code and cleanup * Remove RecTokenController definition It can be autoconfigured without any issues * Remove unused method * Let PHPMD output in text format That is more in line with the other QA config * Clean up getTranslation method The code style sniffer reported some faulty formatting * Re generate PHPStan baseline Some no longer relevant entries were cleaned up And a couple new ones are added. There is insuficiant time to address them now * Remove security checker from the project Security issues are monitored using dependabot on our VCS. And in addition we scan all projects on a daily scedule with our daily-security-check.yml github action * Remove `app` and `web` folder references * Run scrutinizer on default-jammy * Rename Kernel namepace From `src` to `Surfnet\StepupRa` this sticks to the naming convention we stick to in the other stepup projects * Update Composer dependencies - Remove the repository version of the saml bundle. We can rely on the latest actual release now - Upgrade the monitor bundle - Upgrade any other bundle within the set constraints * Remove unused dotenv component * Update Symfony version constraints Pin them to the 6.4 version we built this app on * Sync lockfile and set a version number * Revert "Simplify bundle setup" This reverts commit 965cf09. * Repair vetting type hints * Upgrade Composer dependencies * Repair vetting type hint controller The locales and hints were not set correctly set when no hints were found for the chosen institution * Remove redundant config option The saml bundle now listens for the authentication_context_class_ref param. Our config chekcs if it is set by verifying the required_loa config option. Having parameters for both options makes no sense. So I merged them * Also the /internal/{info,health} paths must be publically available * GitHub actions workflows: Remove deprecated set-output commands Phase out ancient (4 years!) create release action --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Bart Geesink <[email protected]> Co-authored-by: Dan <[email protected]> Co-authored-by: Peter Havekes <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tim van Dijen <[email protected]> Co-authored-by: Thijs Kinkhorst <[email protected]> Co-authored-by: Michiel Kodde <[email protected]>
OpenConext · May 15, 2024 · 32749c6 · 32749c6
1 parent 2016b93
commit 32749c6
Show file tree

Hide file tree

Showing 635 changed files with 14,231 additions and 129,446 deletions.
diff --git a/.docheader b/.docheader
@@ -0,0 +1,15 @@
+/**
+ * Copyright %regexp:\d{4}% SURFnet %regexp:(B.V.|bv)%
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
diff --git a/.github/workflows/build-push-docker-image.yml b/.github/workflows/build-push-docker-image.yml
@@ -0,0 +1,68 @@
+name: build-push-docker-image
+
+on:
+  push:
+    branches: feature/docker_configs
+  workflow_dispatch:
+
+jobs:
+  build-push-docker-image:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Get the latest release
+        id: release
+        uses: robinraju/[email protected]
+        with:
+          latest: true
+          fileName: "*.tar.bz2"
+
+      - name: Get commit details for the tag from the latest release
+        id: commit_details
+        run: |
+          GIT_SHA=$(git rev-list -n 1 ${{ steps.release.outputs.tag_name }})
+          GIT_COMMIT_TIME=$(git show -s --format=%ci ${{ steps.release.outputs.tag_name }})
+          echo "::set-output name=sha::$GIT_SHA"
+          echo "::set-output name=commit_time::$GIT_COMMIT_TIME"
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set docker labels and tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/openconext/stepup-ra/stepup-ra
+          tags: |
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=sha
+            type=raw,value=prod
+
+      - name: Build and push the Production image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          build-args: |
+            APP_VERSION=${{ steps.release.outputs.tag_name }}
+            GIT_SHA=${{ steps.commit_details.outputs.sha }}
+            GIT_COMMIT_TIME=${{ steps.commit_details.outputs.commit_time }}
+          file: docker/Dockerfile.prod
+          platforms: linux/amd64,linux/arm64
+          push: true          
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/.github/workflows/daily-security-check.yml b/.github/workflows/daily-security-check.yml
@@ -19,9 +19,9 @@ jobs:
         uses: andstor/file-existence-action@v2
         with:
           files: "composer.lock"
-      - name: Run php local security checker
-        if: steps.check_composer.outputs.files_exists == 'true'
-        uses: symfonycorp/security-checker-action@v4
+      -   name: Vulnerability check
+          run: php composer audit
+          if: steps.check_composer.outputs.files_exists == 'true'
 
       # node-yarn checks
       - name: Check for node-yarn project
@@ -97,6 +97,6 @@ jobs:
           SLACK_COLOR: ${{ job.status }}
           SLACK_ICON: https://static.surfconext.nl/logos/idp/surfnet.png
           SLACK_MESSAGE: 'Dependency check failed :crying_cat_face:'
-          SLACK_TITLE: Dependency check wants attention
+          SLACK_TITLE: ${{ github.repository }} wants attention
           SLACK_USERNAME: NightlySecurityCheck
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
@@ -5,60 +5,48 @@ on:
       - "*.*.*"
 jobs:
   build:
+    permissions:
+      contents: write
+
     runs-on: ubuntu-latest
     timeout-minutes: 10
     env:
       COMPONENT_NAME: Stepup-RA
     if: always()
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           repository: OpenConext/Stepup-Build
-          ref: master
+
       - name: Output the semver tag to the tag variable
         id: vars
-        run: echo ::set-output name=tag::${GITHUB_REF#refs/*/}
+        run: echo "tag=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
+
       - name: Run release script
         run: ./stepup-build.sh ${COMPONENT_NAME} --tag ${{ steps.vars.outputs.tag }}
+
       - name: Grab the archive filename
         id: archive
         run: |
-          echo ::set-output name=archive::$(find . -maxdepth 1 -name "$COMPONENT_NAME*.tar.bz2" -printf '%f\n')
-          echo ::set-output name=shasum::$(find . -maxdepth 1 -name "$COMPONENT_NAME*.sha" -printf '%f\n')
-      - name: Create Draft Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ steps.vars.outputs.tag }}
-          release_name: ${{ steps.vars.outputs.tag }}
-          body: Auto generated release. Please update these release notes manually.
-          draft: true
-          prerelease: false
-      - uses: actions/[email protected]
-        name: Upload the release artefact tarbal
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ${{ steps.archive.outputs.archive }}
-          asset_name: ${{ steps.archive.outputs.archive }}
-          asset_content_type: application/gzip
-      - uses: actions/[email protected]
-        name: Upload the release artefact verification shasum
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ${{ steps.archive.outputs.shasum }}
-          asset_name: ${{ steps.archive.outputs.shasum }}
-          asset_content_type: text/plain
-      - uses: eregon/publish-release@v1
-        name: Publish the new release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          echo "archive=$(find . -maxdepth 1 -name "$COMPONENT_NAME*.tar.bz2" -printf '%f\n')" >> $GITHUB_OUTPUT
+          echo "shasum=$(find . -maxdepth 1 -name "$COMPONENT_NAME*.sha" -printf '%f\n')" >> $GITHUB_OUTPUT
+
+      - name: Release
+        uses: softprops/action-gh-release@v2
         with:
-          release_id: ${{ steps.create_release.outputs.id }}
+          files: |
+            ${{ steps.archive.outputs.archive }}
+            ${{ steps.archive.outputs.shasum }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          fail_on_unmatched_files: true
+          generate_release_notes: true
 
+  after_build:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Docker container build
+        uses: benc-uk/workflow-dispatch@v1
+        with:
+          workflow: build-push-docker-image.yml
diff --git a/.github/workflows/test-integration.yml b/.github/workflows/test-integration.yml
@@ -1,48 +1,29 @@
-name: test-integration
-on:
-  pull_request:
-  push:
-    branches: [ master, develop ]
+name: Run QA tests (static analysis, lint and unit tests)
+on: [pull_request]
+
 jobs:
-  build:
+  run-qa-tests:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    defaults:
+      run:
+        working-directory: /var/www/html/
+    container:
+      image:  ghcr.io/openconext/openconext-basecontainers/php82-apache2-node20-composer2:latest
+      volumes:
+        - .:/var/www/html
+
     steps:
       - name: Checkout
-        uses: actions/checkout@v1
-      - name: Get Composer Cache Directory
-        id: composer-cache
-        run: echo "::set-output name=dir::$(composer config cache-files-dir)"
-      - uses: actions/cache@v2
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-      - name: Get yarn cache directory path
-        id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
-      - uses: actions/cache@v2
-        id: yarn-cache
-        with:
-          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
-      - name: Init environment
-        run: |
-          cd ci/docker
-          docker-compose up -d
-      - name: Install dependencies
-        run: |
-          cd ci/docker && docker-compose exec -T stepup-ra bash -lc '
-          composer install
-          yarn
-          ./bin/console assets:install
-          '
-      - name: Build frontend assets
-        run: cd ci/docker && docker-compose exec -T stepup-ra bash -lc 'yarn encore production'
-      - name: Run test scripts
-        run: cd ci/docker && docker-compose exec -T stepup-ra bash -lc ' composer test '
-      - name: Output log files on failure
-        if: failure()
-        run: cd ci/docker && docker-compose exec -T stepup-ra -c 'cat var/log/webtest.log'
+        uses: actions/checkout@v4
+
+      - name: Composer install
+        run: composer install
+
+      - name: Yarn install
+        run: yarn
+
+      - name: build frontend
+        run: yarn encore prod
+
+      - name: Run QA tests
+        run: composer check
diff --git a/.gitignore b/.gitignore
@@ -1,25 +1,12 @@
-/web/bundles/
-/web/app_dev.php
-/web/app_dev.php.dist
-/web/app_test.php
-/app/bootstrap.php.cache
-/web/css/*
-/web/js/*
 /config/*.crt
 /config/*.key
 /config/keys
-/app/cache/*
-/config/legacy/parameters.yaml
-/config/legacy/samlstepupproviders_parameters.yaml
-/config/legacy/global_view_parameters.yaml
-/app/logs/*
-!app/cache/.gitkeep
-!app/logs/.gitkeep
+/config/openconext/parameters.yaml
+/config/openconext/samlstepupproviders_parameters.yaml
+/config/openconext/global_view_parameters.yaml
 /build/
 /composer.phar
 /cache.properties
-/app/SymfonyRequirements.php
-/app/check.php
 /local-php-security-checker
 .idea/
 

diff --git a/.scrutinizer.yml b/.scrutinizer.yml
@@ -1,3 +1,9 @@
+build:
+    image: default-jammy
+    environment:
+        php: 8.2
+        node: v20
+
 filter:
     excluded_paths:
         - "*/Tests/*"

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+## 6.0.0
+- Update php8 and Symfony 6.4
+
 ## 5.0.5
 - Translate remaining [Recovery token] occurrences #303
 - Installed security updates for phpseclib/phpseclib and guzzlehttp/psr7

diff --git a/app/files/sp_gssp.crt b/app/files/sp_gssp.crt
diff --git a/public/fonts/FontAwesome.otf → assets/fonts/FontAwesome.otf b/public/fonts/FontAwesome.otf → assets/fonts/FontAwesome.otf
diff --git a/public/fonts/fontawesome-webfont.eot → assets/fonts/fontawesome-webfont.eot b/public/fonts/fontawesome-webfont.eot → assets/fonts/fontawesome-webfont.eot
diff --git a/public/fonts/fontawesome-webfont.svg → assets/fonts/fontawesome-webfont.svg b/public/fonts/fontawesome-webfont.svg → assets/fonts/fontawesome-webfont.svg
diff --git a/public/fonts/fontawesome-webfont.ttf → assets/fonts/fontawesome-webfont.ttf b/public/fonts/fontawesome-webfont.ttf → assets/fonts/fontawesome-webfont.ttf
diff --git a/public/fonts/fontawesome-webfont.woff → assets/fonts/fontawesome-webfont.woff b/public/fonts/fontawesome-webfont.woff → assets/fonts/fontawesome-webfont.woff
diff --git a/assets/js/app.js b/assets/js/app.js
@@ -4,4 +4,4 @@ import 'bootstrap-less';
 
 
 import '../../vendor/surfnet/stepup-bundle/src/Resources/public/js/stepup.js';
-import '../../src/Surfnet/StepupRa/RaBundle/Resources/public/js/stepup-ra.js';
+import './stepup-ra.js';
diff --git a/...RaBundle/Resources/public/js/stepup-ra.js → assets/js/stepup-ra.js b/...RaBundle/Resources/public/js/stepup-ra.js → assets/js/stepup-ra.js
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+import moment from "moment";
+
 (function ($) {
     'use strict';
 

diff --git a/...RaBundle/Resources/public/less/style.less → assets/less/style.less b/...RaBundle/Resources/public/less/style.less → assets/less/style.less
@@ -1,5 +1,5 @@
-@import "../../../../../../../node_modules/bootstrap-less/bootstrap/index";
-@import "../../../../../../../node_modules/font-awesome/less/font-awesome";
+@import "../../node_modules/bootstrap-less/bootstrap/index";
+@import "../../node_modules/font-awesome/less/font-awesome";
 
 .progress-steps {
     font-size: 110%;

diff --git a/public/images/header-logo.png → assets/openconext/images/header-logo.png b/public/images/header-logo.png → assets/openconext/images/header-logo.png
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4,4 +4,4 @@ import 'bootstrap-less';


		import '../../vendor/surfnet/stepup-bundle/src/Resources/public/js/stepup.js';
		import '../../src/Surfnet/StepupRa/RaBundle/Resources/public/js/stepup-ra.js';
		import './stepup-ra.js';