Merge branch 'staging' into renovate/major-ruby-on-rails-packages

Author: lodewiges

.github/workflows/continuous-delivery.yml

@@ -135,7 +135,6 @@ jobs:
     with:
       sha: ${{ needs.merge.outputs.sha }}
     secrets:
-      rails_master_key: ${{ secrets.RAILS_MASTER_KEY }}
       sentry_auth_token: ${{ secrets.SENTRY_AUTH_TOKEN }}
 
   deploy:
@@ -188,7 +187,7 @@ jobs:
             docker-compose up -d
 
       - name: Finalize Sentry release
-        uses: getsentry/action-release@e769183448303de84c5a06aaaddf9da7be26d6c7 # v1.7.0
+        uses: getsentry/action-release@1841d945bad68068f92f796114d0fa534129764d # v1.8.0
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: ${{ vars.SENTRY_ORG_NAME }}

.github/workflows/continuous-integration.yml

@@ -68,22 +68,28 @@ jobs:
 
       - name: Download actionlint
         run: |
-          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.6.26
+          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.6
 
       - name: Load test image
         uses: guidojw/actions/load-docker-image@3ad963828827110a6b716a011f242bf01fdf1db4 # v1.4.7
         with:
           name: app
 
       - name: Lint
-        env:
-          RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
         run: |
           EXIT_STATUS=0
-          ./actionlint -ignore 'SC2153:'  -ignore 'property "sha" is not defined in object type {}' || \
-            EXIT_STATUS=$?
-          docker run -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres -e POSTGRES_HOST=localhost -e \
-            RAILS_MASTER_KEY --network=host app bin/ci.sh lint || EXIT_STATUS=$?
+          ./actionlint \
+          -ignore 'property "gh_app_private_key" is not defined' \
+          -ignore 'SC2153:' \
+          -ignore 'property "sha" is not defined in object type {}' || \
+          EXIT_STATUS=$?
+          docker run \
+          -e POSTGRES_USER=postgres \
+          -e POSTGRES_PASSWORD=postgres \
+          -e POSTGRES_HOST=localhost \
+          --network=host \
+          app bin/ci.sh lint || \
+          EXIT_STATUS=$?
           exit $EXIT_STATUS
 
   test:
@@ -123,8 +129,15 @@ jobs:
           RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
         run: |
           mkdir coverage
-          docker run -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres -e POSTGRES_HOST=localhost -e \
-            RAILS_MASTER_KEY --network=host -v "$(pwd)"'/coverage:/app/coverage' app bin/ci.sh spec
+          docker run \
+            -e RAILS_MASTER_KEY \
+            -e POSTGRES_USER=postgres \
+            -e POSTGRES_PASSWORD=postgres \
+            -e POSTGRES_HOST=localhost \
+            --network=host \
+            -v "$(pwd)"'/coverage:/app/coverage' \
+             app bin/ci.sh spec
+
 
       - name: Upload coverage report to Codecov
         if: ${{ !cancelled() }}

.github/workflows/publish-image.yml

@@ -10,9 +10,6 @@ on:
         required: false
         type: string
     secrets:
-      rails_master_key:
-        description: The Rails master key
-        required: true
       sentry_auth_token:
         description: The Sentry integration's token
         required: true
@@ -68,13 +65,11 @@ jobs:
 
       - name: Build and push image
         id: build_push_image
-        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
+        uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
         with:
           push: true
           context: .
           build-args: ${{ needs.metadata.outputs.build_args }}
-          secrets: |
-            rails_master_key=${{ secrets.RAILS_MASTER_KEY }}
           cache-from: type=gha,scope=main
           cache-to: type=gha,scope=main
           tags: |
@@ -90,7 +85,7 @@ jobs:
 
       - name: Create Sentry release
         if: ${{ !(github.event_name == 'workflow_dispatch' && github.workflow == 'Publish Image') }}
-        uses: getsentry/action-release@e769183448303de84c5a06aaaddf9da7be26d6c7 # v1.7.0
+        uses: getsentry/action-release@1841d945bad68068f92f796114d0fa534129764d # v1.8.0
         env:
           SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
           SENTRY_ORG: ${{ vars.SENTRY_ORG_NAME }}

.nvmrc

@@ -1 +1 @@
-18.18.1
+18.20.5

.rubocop.yml

@@ -4,7 +4,7 @@ require:
   - rubocop-performance
 
 AllCops:
-  TargetRailsVersion: 7.0
+  TargetRailsVersion: 7.1
   TargetRubyVersion: 3.2
   Exclude:
     - 'bin/**/*'

.ruby-version

@@ -1 +1 @@
-3.2.2
+3.2.6

Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.2.2-slim@sha256:70370316b02901d7db3f6e453d6259ed4d0d52326d6ac57e3a579f7e3b616e41
+FROM ruby:3.2.6-slim@sha256:c582e3505878002d0b6e316d14a4543d276c84ba040afc73fceef25b6321f80f
 
 # Add build-essential tools.
 RUN apt-get update -qq && \
@@ -7,7 +7,7 @@ RUN apt-get update -qq && \
   git \
   libpq-dev \
   curl \
-  netcat \
+  netcat-traditional \
   wkhtmltopdf
 
 # Add Node, required for asset pipeline.
@@ -24,7 +24,6 @@ ARG BUILD_HASH='unknown'
 ENV BUILD_HASH=$BUILD_HASH
 ARG RAILS_ENV='production'
 ARG NODE_ENV='production'
-ARG RAILS_MASTER_KEY
 
 # Pre-install gems, so that they can be cached.
 COPY Gemfile* /app/
@@ -43,10 +42,8 @@ RUN yarn install --immutable
 COPY . /app/
 
 # Precompile assets after copying app because whole Rails pipeline is needed.
-RUN --mount=type=secret,id=rails_master_key \
-  if [ "$RAILS_ENV" = 'production' ] || [ "$RAILS_ENV" = 'staging' ] || [ "$RAILS_ENV" = 'luxproduction' ]; then \
-    # Use secret if RAILS_MASTER_KEY build arg is not set.
-    RAILS_MASTER_KEY="${RAILS_MASTER_KEY:-$(cat /run/secrets/rails_master_key)}" bundle exec rails assets:precompile; \
+RUN if [ "$RAILS_ENV" = 'production' ] || [ "$RAILS_ENV" = 'staging' ] || [ "$RAILS_ENV" = 'luxproduction' ]; then \
+    SECRET_KEY_BASE_DUMMY=1 bundle exec rails assets:precompile; \
   else \
     echo "Skipping assets:precompile"; \
   fi

Gemfile

@@ -12,7 +12,6 @@ gem 'http', '~> 5.2.0'
 gem 'jbuilder', '~> 2.13.0'
 gem 'jquery-rails', '~> 4.6.0'
 gem 'kaminari', '~> 1.2.2'
-gem 'mini_racer', '~> 0.16.0'
 gem 'mollie-api-ruby', '~> 4.15.0'
 gem 'net-imap', require: false
 gem 'net-pop', require: false
@@ -52,7 +51,7 @@ group :development, :test do
   gem 'bullet', '~> 8.0'
   gem 'colorize'
   gem 'consistency_fail'
-  gem 'dotenv-rails', '~> 2.8.1'
+  gem 'dotenv-rails', '~> 3.1.7'
   gem 'guard-livereload', '~> 2.5.2'
   gem 'guard-rspec', require: false
   gem 'pry-byebug'