Merge branch 'main' into feature/platform-multi-tenancy

Author: rsmithlal

.env.dev

@@ -9,7 +9,7 @@ APP_DEFAULT_LOCALE='en'
 APP_AVAILABLE_LOCALES='es,en,fr'
 APP_FALLBACK_LOCALES='es,en,fr'
 
-ES_PORT='9201'
+ES_PORT='9200'
 ES_HOST='http://elasticsearch'
 # ELASTICSEARCH_URL='http://elasticsearch:9201'
 

.env.prod.sample

@@ -24,7 +24,7 @@ PORT=5000
 
 RACK_ENV=production
 RAILS_ENV=production
-RAILS_LOG_LEVEL=debug
+RAILS_LOG_LEVEL=info
 RAILS_LOG_TO_STDOUT=true
 RAILS_SERVE_STATIC_FILES=true
 

.github/copilot-instructions.md

@@ -0,0 +1,21 @@
+## Summary
+
+Describe the change and the motivation.
+
+## Checklist
+
+- [ ] Tests added/updated and passing (`bin/ci`).
+- [ ] Lint and security checks (`rubocop`, `brakeman`, `bundler-audit`).
+- [ ] Documentation updated under `docs/` describing new/changed functionality.
+- [ ] Mermaid diagrams (`docs/*.mmd`) updated to reflect changes.
+- [ ] Rendered PNGs regenerated with `bin/render_diagrams` and committed.
+- [ ] For DB changes, included any needed backfills/dedupes and noted risks.
+
+## Screenshots / Diagrams
+
+If applicable, include screenshots or link to updated diagrams.
+
+## Notes
+
+Anything reviewers should be aware of (migration order, flags, feature toggles).
+

.github/pull_request_template.md

@@ -1,18 +1,9 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-# This workflow integrates Brakeman with GitHub's Code Scanning feature
-# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications
-
 name: Brakeman Scan
 
 on:
   push:
     branches: [ "main" ]
   pull_request:
-    # The branches below must be a subset of the branches above
     branches: [ "main" ]
   schedule:
     - cron: '26 3 * * 0'
@@ -22,37 +13,38 @@ permissions:
 
 jobs:
   brakeman-scan:
-    permissions:
-      contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     name: Brakeman Scan
+    # Option A: stay on latest (24.04) – requires up-to-date setup-ruby
     runs-on: ubuntu-latest
+    # Option B (fallback): force older image if you prefer
+    # runs-on: ubuntu-22.04
+
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
     steps:
-    # Checkout the repository to the GitHub Actions runner
-    - name: Checkout
-      uses: actions/checkout@v3
-
-    # Customize the ruby version depending on your needs
-    - name: Setup Ruby
-      uses: ruby/setup-ruby@55283cc23133118229fd3f97f9336ee23a179fcf # v1.146.0
-      with:
-        ruby-version: '3.2'
-
-    - name: Setup Brakeman
-      env:
-        BRAKEMAN_VERSION: '4.10' # SARIF support is provided in Brakeman version 4.10+
-      run: |
-        gem install brakeman --version $BRAKEMAN_VERSION
-
-    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
-    - name: Scan
-      continue-on-error: true
-      run: |
-        brakeman -f sarif -o output.sarif.json .
-
-    # Upload the SARIF file generated in the previous step
-    - name: Upload SARIF
-      uses: github/codeql-action/upload-sarif@v2
-      with:
-        sarif_file: output.sarif.json
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Ruby
+        # Use the rolling v1 tag so you get fixes for new runner images
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.2'   # or your exact patch, e.g. '3.2.2'
+          # bundler-cache not needed since we install brakeman directly
+
+      - name: Setup Brakeman
+        run: |
+          gem install brakeman
+
+      - name: Scan (SARIF)
+        continue-on-error: true
+        run: |
+          brakeman -f sarif -o output.sarif.json .
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: output.sarif.json

.github/workflows/brakeman.yml

@@ -50,7 +50,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -64,7 +64,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -77,6 +77,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: Diagrams Check
+
+on:
+  pull_request:
+    branches: [ "**" ]
+
+jobs:
+  render-and-verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Render Mermaid diagrams
+        run: |
+          chmod +x bin/render_diagrams || true
+          ./bin/render_diagrams || true
+
+      - name: Verify rendered PNGs are up to date
+        run: |
+          CHANGED=$(git status --porcelain -- docs/diagrams/exports/png/*.png docs/diagrams/exports/svg/*.svg | wc -l)
+          if [ "$CHANGED" -gt 0 ]; then
+            echo "Diagram exports are out of date. Please run bin/render_diagrams and commit the updated files." >&2
+            echo "Changed files:" >&2
+            git status --porcelain -- docs/diagrams/exports/png/*.png docs/diagrams/exports/svg/*.svg >&2 || true
+            exit 1
+          fi
+        shell: bash
+

.github/workflows/diagrams.yml

@@ -0,0 +1,48 @@
+name: i18n Translation Health Report
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+  pull_request:
+    branches:
+      - main
+      - dev
+
+jobs:
+  i18n-health:
+    runs-on: ubuntu-latest
+    env:
+      # Ensure dev/test gems (incl. i18n-tasks) are installed
+      BUNDLE_WITHOUT: ""
+      BUNDLE_WITH: "development:test"
+    if: github.event_name == 'push' || github.event_name == 'pull_request'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        env:
+          # Ensure bundler installs dev/test groups during caching step
+          BUNDLE_WITHOUT: ""
+          BUNDLE_WITH: "development:test"
+        with:
+          ruby-version: '3.4.4'
+          bundler-cache: true
+      - name: Verify i18n-tasks
+        run: bundle exec i18n-tasks --version
+      - name: Normalize locale files
+        run: bin/i18n normalize
+      - name: Run i18n checks
+        run: bin/i18n check
+      - name: Upload i18n health report
+        if: always()
+        run: bin/i18n health > i18n-health.txt
+        continue-on-error: true
+      - name: Archive i18n health report
+        uses: actions/upload-artifact@v4
+        with:
+          name: i18n-health-report
+          path: i18n-health.txt
+    continue-on-error: true

.github/workflows/i18n-health.yml

@@ -11,19 +11,20 @@ jobs:
       matrix:
         include:
           - ruby: '3.4.4'
-            rails: '7.1.5.1'
+            rails: '7.1.5.2'
             allowed_failure: false   # ✅ required
-          # - ruby: '3.4.4'
-          #   rails: '7.2'
-          #   allowed_failure: true    # ⚠️ allowed to fail
           - ruby: '3.4.4'
-            rails: '8.0'
+            rails: '7.2.2.1'
+            allowed_failure: false   # ⚠️ allowed to fail
+          - ruby: '3.4.4'
+            rails: '8.0.2'
             allowed_failure: true    # ⚠️ allowed to fail
 
     env:
       RAILS_ENV: test
       DATABASE_URL: "postgis://rails:password@localhost:5432/rails_test"
       ES_HOST:  "http://localhost"
+      ELASTICSEARCH_URL: "http://localhost:9200"
       RAILS_VERSION: ${{ matrix.rails }}
 
     services:
@@ -54,15 +55,15 @@ jobs:
           # Run the automatic bundle-install only on 7.1.
           # For 7.2 / 8.0 it just sets up Ruby *and* restores a cache layer
           # that we’ll reuse in the later manual install.
-          bundler-cache: ${{ matrix.rails == '7.1.5.1' }}
+          bundler-cache: ${{ matrix.rails == '7.1.5.2' }}
 
           # One cache bucket per Rails version so they don’t clobber each other.
           cache-version: rails-${{ matrix.rails }}
 
       # Updating Rails can legitimately blow up on the experimental tracks,
       # so we allow that *step* to error out without failing the job.
       - name: Update Rails & install gems
-        if: matrix.rails != '7.1.5.1'
+        if: matrix.rails != '7.1.5.2'
         id: update
         run: |
           # turn off deployment mode
@@ -74,21 +75,52 @@ jobs:
         continue-on-error: ${{ matrix.allowed_failure }}
 
       - name: Prepare DB schema
-        if: (matrix.rails == '7.1.5.1') || steps.update.outcome == 'success'
+        if: (matrix.rails == '7.1.5.2') || steps.update.outcome == 'success'
         run: |
           rm -f spec/dummy/tmp/pids/server.pid
           bundle exec rake -f spec/dummy/Rakefile db:schema:load
         continue-on-error: ${{ matrix.allowed_failure }}
 
+      - name: Wait for Elasticsearch
+        if: (matrix.rails == '7.1.5.2') || steps.update.outcome == 'success'
+        run: |
+          echo "Waiting for Elasticsearch to be healthy..."
+          curl -s "http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=60s" || (echo "Elasticsearch not healthy" && exit 1)
+
+
       - name: Run RSpec
-        if: (matrix.rails == '7.1.5.1') || steps.update.outcome == 'success'
+        if: (matrix.rails == '7.1.5.2') || steps.update.outcome == 'success'
         env:
           RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
         run: |
           rm -f spec/dummy/tmp/pids/server.pid
           bundle exec rspec
         continue-on-error: ${{ matrix.allowed_failure }}
 
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report-ruby-${{ matrix.ruby }}-rails-${{ matrix.rails }}
+          path: |
+            coverage/
+
+      - name: Generate coverage badge
+        if: ${{ github.ref == 'refs/heads/main' && success() }}
+        continue-on-error: true
+        run: |
+          COVERAGE=$(jq -r '.result.covered_percent' coverage/.last_run.json)
+          COLOR=$(node -e "cov=parseFloat(process.argv[1]);console.log(cov>=90?'green':cov>=75?'orange':'red')" $COVERAGE)
+          npx badgen-cli --subject coverage --status ${COVERAGE}% --color $COLOR > coverage.svg
+
+      - name: Commit badge
+        if: ${{ github.ref == 'refs/heads/main' && success() }}
+        continue-on-error: true
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "chore: update coverage badge"
+          file_pattern: coverage.svg
+
   # ── style & security jobs (unchanged) ───────────────────────────────────────
   rubocop:
     runs-on: ubuntu-latest

.github/workflows/rubyonrails.yml

@@ -3,8 +3,23 @@ AllCops:
     - 'bin/*'
     - 'node_modules/**/*'
     - 'spec/dummy/db/schema.rb'
+    - 'db/schema.rb'
     - 'vendor/**/*'
   NewCops: enable
+  TargetRubyVersion: 3.4
+plugins:
+  - rubocop-rails
+  - rubocop-rspec
+  - rubocop-rspec_rails
+  - rubocop-capybara
+  - rubocop-factory_bot
 Style/StringLiterals:
   Exclude:
     - 'db/migrate/*'
+
+Rails:
+  Enabled: false
+Capybara:
+  Enabled: false
+FactoryBot:
+  Enabled: false