[rel-DB] Merge main

.github/workflows/commands.yml

@@ -22,7 +22,7 @@ jobs:
           app_id: ${{ secrets.AUTOMATION_APP_ID }}
           private_key: ${{ secrets.AUTOMATION_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           submodules: recursive
@@ -61,7 +61,7 @@ jobs:
 
       - name: Write failure comment
         if: steps.merge.outputs.result != '' && steps.conflicts.outputs.result != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             github.rest.issues.createComment({

.github/workflows/continuous_integration.yml

@@ -22,7 +22,7 @@ jobs:
         working-directory: .github/docker-compose
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: Create secrets for datastore
       run: mkdir secrets && echo -n "openslides" > secrets/postgres_password
@@ -50,9 +50,9 @@ jobs:
     name: Build and test development docker image with Docker Compose
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
-          submodules: true
+          submodules: recursive
 
       - name: Run tests
         run: dev/run-tests.sh
@@ -61,7 +61,7 @@ jobs:
     name: Build and test local dev setup
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         path: openslides-backend
 
@@ -72,14 +72,14 @@ jobs:
         echo "AUTH_COMMIT_HASH=$(echo $AUTH_COMMIT_HASH)" >> $GITHUB_ENV
 
     - name: Clone auth service
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         repository: OpenSlides/openslides-auth-service
         ref: ${{ env.AUTH_COMMIT_HASH }}
         path: openslides-auth-service
 
     - name: Clone vote service
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6
       with:
         repository: OpenSlides/openslides-vote-service
         ref: main
@@ -93,12 +93,12 @@ jobs:
     name: Check coding style
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         submodules: true
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 
@@ -132,12 +132,12 @@ jobs:
       PYTHONPATH: .
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         submodules: true
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ env.PYTHON_VERSION }}
 

.github/workflows/pick-to-staging.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout main
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: main
           fetch-depth: 2

Dockerfile

@@ -1,6 +1,6 @@
 ARG CONTEXT=prod
 
-FROM python:3.12.9-slim-bookworm as base
+FROM python:3.12.9-slim-bookworm AS base
 
 ## Setup
 ARG CONTEXT
@@ -35,7 +35,7 @@ RUN REQUIREMENTS_FILE=$(case "$APP_CONTEXT" in \
     REQUIREMENTS_FILE=${REQUIEREMENTS_FILE_OVERWRITE:-$REQUIREMENTS_FILE} && \
     . requirements/export_service_commits.sh && pip install --no-cache-dir --requirement requirements/${REQUIREMENTS_FILE}
 
-ENV PYTHONPATH /app
+ENV PYTHONPATH=/app
 
 ENV EMAIL_HOST=postfix
 ENV EMAIL_PORT=25
@@ -58,18 +58,19 @@ COPY ./dev/command.sh ./
 RUN chmod +x command.sh
 CMD ["./command.sh"]
 
-HEALTHCHECK CMD curl --fail http://localhost:9002/system/action/health/ && curl --fail http://localhost:9003/system/presenter/health/ || exit 1
+HEALTHCHECK CMD curl --fail http://localhost:9002/system/action/health/ || curl --fail http://localhost:9003/system/presenter/health/ || exit 1
 
 #HEALTHCHECK --interval=5m --timeout=2m --start-period=45s \
 #   CMD (curl -f --retry 6 --max-time 5 --retry-delay 10 --retry-max-time 60 "http://localhost:9002/system/action/health/xxx" && curl -f --retry 6 --max-time 5 --retry-delay 10 --retry-max-time 60 "http://localhost:9003/system/presenter/health/") || bash -c 'kill -s 15 -1 && (sleep 10; kill -s 9 -1)'
 
 ENTRYPOINT ["./entrypoint.sh"]
 
 # Development Image
-FROM base as dev
+FROM base AS dev
 
 COPY dev/.bashrc .
 COPY dev/cleanup.sh .
+COPY dev/run-lint.sh ./dev/
 
 # Copy files which are mounted to make the full stack work
 COPY scripts scripts
@@ -89,13 +90,12 @@ EXPOSE 5678
 STOPSIGNAL SIGKILL
 
 # Test Image (same as dev)
-FROM dev as tests
+FROM dev AS tests
 
 # Production Image
-FROM base as prod
+FROM base AS prod
 
-# Große Sicherheitslücke hier umgehen:
-# Das sorgt dafür dass alle Commands innerhalb des Containers als unprivilegierter User durchgeführt werden und nicht als root
+# This disables root access for the enduser, which could pose a security risk
 RUN adduser --system --no-create-home appuser
 
 COPY scripts scripts
@@ -115,4 +115,4 @@ RUN chown appuser ./scripts/ && \
 ARG VERSION=dev
 RUN echo "$VERSION" > openslides_backend/version.txt
 
-USER appuser
+USER appuser