[pull] master from mozilla:master

.circleci/config.yml

@@ -14,13 +14,13 @@ references:
     working_directory: ~/addons-frontend
     docker:
       # This is the NodeJS version we run in production.
-      - image: cimg/node:18.20
+      - image: cimg/node:20.19
 
   defaults-next: &defaults-next
     working_directory: ~/addons-frontend
     docker:
       # This is the next NodeJS version we will support.
-      - image: cimg/node:20.12
+      - image: cimg/node:22.14
 
   defaults-release: &defaults-release
     machine:
@@ -211,9 +211,15 @@ jobs:
     <<: *defaults-release
     steps:
       - better_checkout
-      - run: pip install tox
-      - run: TOXENV=dennis-lint tox
-
+      - run:
+          name: Install Dennis
+          command: pip install dennis==1.1.0
+      - run:
+          name: Lint locales
+          command: |
+            bash -c 'dennis-cmd lint locale/*/LC_MESSAGES/*.po --rules W202'
+            bash -c 'dennis-cmd lint --errorsonly locale/*/LC_MESSAGES/*.po'
+            bash -c 'dennis-cmd lint --errorsonly locale/templates/LC_MESSAGES/*.pot'
 
   release-blog-utils:
     <<: *defaults
@@ -235,9 +241,6 @@ jobs:
       - run:
           name: Install dependencies
           command: sudo apt-get update; sudo apt-get install pigz
-      - run:
-          name: "Install Tox"
-          command: pip install tox
       - run: docker info
         # Build the container, using Circle's Docker cache. Only use 1 image per
         # day to keep the cache size down.
@@ -271,6 +274,12 @@ jobs:
           command: |
             IMG="image-$(date +%j).gz"; docker save addons-frontend | pigz --fast -c > ~/addons-frontend/docker/$IMG; ls -l ~/addons-frontend/docker
             ls -l ~/addons-frontend/docker
+      - run:
+          name: Check image works
+          command: |
+            docker run --rm -p 4000:4000 -d -e NODE_ENV=production -e NODE_CONFIG_ENV=prod  addons-frontend sh -c "yarn build && yarn start"
+            sleep 60
+            curl --retry 3 --retry-delay 2 http://127.0.0.1:4000/__frontend_lbheartbeat__
       - run:
           name: Push to repo
           command: |
@@ -279,17 +288,6 @@ jobs:
             docker tag addons-frontend $DOCKERHUB_REPO:$CIRCLE_TAG
             docker images
             docker push $DOCKERHUB_REPO:$CIRCLE_TAG
-      - run:
-          name: Set hosts
-          command: |
-            echo 127.0.0.1 olympia.test | sudo tee -a /etc/hosts
-            cat /etc/hosts
-      - run:
-          name: Test Image
-          command: |
-            sudo sysctl -w vm.max_map_count=262144
-            ./tests/smoke/setup_docker.sh
-            tox -e smoke-tests
 
   release-master: # build for the master branch
     <<: *defaults-release
@@ -298,9 +296,6 @@ jobs:
       - run:
           name: Install dependencies
           command: sudo apt-get update; sudo apt-get install pigz
-      - run:
-          name: "Install Tox"
-          command: pip install tox
       - run: docker info
         # Build the container, using Circle's Docker cache. Only use 1 image per
         # day to keep the cache size down.
@@ -334,23 +329,18 @@ jobs:
           command: |
             IMG="image-$(date +%j).gz"; docker save addons-frontend | pigz --fast -c > ~/addons-frontend/docker/$IMG; ls -l ~/addons-frontend/docker
             ls -l ~/addons-frontend/docker
+      - run:
+          name: Check image works
+          command: |
+            docker run --rm -p 4000:4000 -d -e NODE_ENV=production -e NODE_CONFIG_ENV=prod  addons-frontend sh -c "yarn build && yarn start"
+            sleep 60
+            curl --retry 3 --retry-delay 2 http://127.0.0.1:4000/__frontend_lbheartbeat__
       - run:
           name: Push to repo
           command: |
             [ ! -z $DOCKERHUB_REPO ]
             docker tag addons-frontend $DOCKERHUB_REPO:latest
             docker push $DOCKERHUB_REPO:latest
-      - run:
-          name: Set hosts
-          command: |
-            echo 127.0.0.1 olympia.test | sudo tee -a /etc/hosts
-            cat /etc/hosts
-      - run:
-          name: Test Image
-          command: |
-            sudo sysctl -w vm.max_map_count=262144
-            ./tests/smoke/setup_docker.sh
-            tox -e smoke-tests
 
 workflows:
   version: 2

.eslintrc

@@ -88,6 +88,9 @@
     }]
   },
   "settings": {
+    "react": {
+      "version": "detect"
+    },
     "import/core-modules": [
       // This is a workaround for: https://github.com/benmosher/eslint-plugin-import/issues/793
       "redux-saga/effects",

.flowconfig

@@ -9,6 +9,8 @@
 .*/node_modules/stylelint
 .*/node_modules/@snyk/composer-lockfile-parser/.*
 .*/node_modules/resolve
+.*/node_modules/hermes-estree/.*
+.*/node_modules/hermes-parser/.*
 
 [include]
 

.github/actions/context/action.yml

@@ -0,0 +1,111 @@
+name: 'Dump Context'
+description: 'Display context for action run'
+
+outputs:
+  # All github action outputs are strings, even if set to "true"
+  # so when using these values always assert against strings or convert from json
+  # \$\{{ needs.context.outputs.is_fork == 'true' }} // true
+  # \$\{{ fromJson(needs.context.outputs.is_fork) == false }} // true
+  # \$\{{ needs.context.outputs.is_fork == true }} // false
+  # \$\{{ needs.context.outputs.is_fork }} // false
+  is_fork:
+    description: ""
+    value: ${{ steps.context.outputs.is_fork }}
+  is_default_branch:
+    description: ""
+    value: ${{ steps.context.outputs.is_default_branch }}
+  is_release_master:
+    description: ""
+    value: ${{ steps.context.outputs.is_release_master }}
+  is_release_tag:
+    description: ""
+    value: ${{ steps.context.outputs.is_release_tag }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Dump GitHub context
+      shell: bash
+      env:
+        GITHUB_CONTEXT: ${{ toJson(github) }}
+      run: echo "$GITHUB_CONTEXT"
+    - name: Dump job context
+      shell: bash
+      env:
+        JOB_CONTEXT: ${{ toJson(job) }}
+      run: echo "$JOB_CONTEXT"
+    - name: Dump steps context
+      shell: bash
+      env:
+        STEPS_CONTEXT: ${{ toJson(steps) }}
+      run: echo "$STEPS_CONTEXT"
+    - name: Dump runner context
+      shell: bash
+      env:
+        RUNNER_CONTEXT: ${{ toJson(runner) }}
+      run: echo "$RUNNER_CONTEXT"
+    - name: Dump env context
+      shell: bash
+      env:
+        ENV_CONTEXT: ${{ toJson(env) }}
+      run: |
+        echo "$ENV_CONTEXT"
+    - name: Dump inputs context
+      shell: bash
+      env:
+        INPUTS_CONTEXT: ${{ toJson(inputs) }}
+      run: |
+        echo "$INPUTS_CONTEXT"
+
+    - name: Set context
+      id: context
+      env:
+        # The default branch of the repository, in this case "master"
+        default_branch: ${{ github.event.repository.default_branch }}
+        event_name: ${{ github.event_name }}
+        event_action: ${{ github.event.action }}
+        # Stable check for if the workflow is running on the default branch
+        # https://stackoverflow.com/questions/64781462/github-actions-default-branch-variable
+        is_default_branch: ${{ format('refs/heads/{0}', env.default_branch) == github.ref }}
+        # In most events, the repository refers to the head which would be the fork
+        # This is different in a pull_request where we need to check the head explicitly
+        is_fork: ${{ github.event.repository.fork }}
+        # repository on a pull request refers to the base which is always mozilla/addons-server
+        is_head_fork: ${{ github.event.pull_request.head.repo.fork }}
+        # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
+        is_dependabot: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+      shell: bash
+      run: |
+
+        if [[ "$event_name" == 'pull_request' ]]; then
+          # If the head repository is a fork or if the PR is opened by dependabot
+          # we consider the run to be a fork. Dependabot and proper forks are treated
+          # the same in terms of limited read only github token scope
+          if [[ "$is_head_fork" == 'true' || "$is_dependabot" == 'true' ]]; then
+            is_fork="true"
+          fi
+        fi
+
+        is_release_master="false"
+        is_release_tag="false"
+
+        # Releases can only happen if we are NOT on a fork
+        if [[ "$is_fork" == 'false' ]]; then
+          # A master release occurs on a push to the default branch of the origin repository
+          if [[ "$event_name" == 'push' && "$is_default_branch" == 'true' ]]; then
+            is_release_master="true"
+          fi
+
+          # A tag release occurs when a release is published
+          if [[ "$event_name" == 'release' && "$event_action" == 'publish' ]]; then
+            is_release_tag="true"
+          fi
+        fi
+
+        echo "is_default_branch=$is_default_branch" >> $GITHUB_OUTPUT
+        echo "is_fork=$is_fork" >> $GITHUB_OUTPUT
+        echo "is_release_master=$is_release_master" >> $GITHUB_OUTPUT
+        echo "is_release_tag=$is_release_tag" >> $GITHUB_OUTPUT
+
+        echo "event_name: $event_name"
+        cat $GITHUB_OUTPUT

.github/dependabot.yml

@@ -8,4 +8,13 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 99
+    ignore:
+      - dependency-name: "ua-parser-js"
+        versions: ["2.x"]
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: daily

.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+jobs:
+  context:
+    runs-on: ubuntu-latest
+
+    outputs:
+      is_fork: ${{ steps.context.outputs.is_fork }}
+      is_default_branch: ${{ steps.context.outputs.is_default_branch }}
+
+    steps:
+      - uses: actions/checkout@v6
+      - id: context
+        uses: ./.github/actions/context
+
+  locales:
+    needs: context
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: ${{ needs.context.outputs.is_default_branch }}
+
+      - uses: actions/setup-node@v6
+        with:
+            node-version: 20
+            package-manager-cache: false
+
+      - name: Install gettext
+        run: sudo apt-get install gettext
+
+      - name: Yarn install
+        run: yarn install --frozen-lockfile --prefer-offline
+
+      - name: Extract locales
+        run: yarn extract-locales
+
+      - name: Push Locales
+        env:
+          is_fork: ${{ needs.context.outputs.is_fork }}
+          event_name: ${{ github.event_name }}
+          is_default_branch: ${{ needs.context.outputs.is_default_branch }}
+          is_push: ${{ github.event_name == 'push' }}
+        run: |
+
+          # Keep this logic in sync with addons-server
+
+          if [[ "$is_fork" == 'true' ]]; then
+            cat <<'EOF'
+              Github actions are not authorized to push from workflows triggered by forks.
+              We cannot verify if the l10n extraction push will work or not.
+              Please submit a PR from the base repository if you are modifying l10n extraction scripts.
+          EOF
+            exit 0
+          fi
+
+          if [[ "$is_default_branch" == 'true' && "$is_push" == 'true' ]]; then
+            args=""
+          else
+            args="--dry-run"
+          fi
+
+          ./bin/push-locales $args

.prettierignore

@@ -2,6 +2,7 @@
 *.*
 # exclude these files
 Dockerfile
+src/fonts/LICENSE
 # exclude these directories
 /assets/
 /bin/

.stylelintrc

@@ -30,15 +30,6 @@
         ],
       }
     ],
-    "block-closing-brace-newline-after": [
-      "always",
-      {
-        "ignoreAtRules": [
-          "if",
-          "else"
-        ],
-      }
-    ],
     "color-function-notation": null,
     "declaration-colon-newline-after": null,
     "function-disallowed-list": [
@@ -68,6 +59,7 @@
         ]
       }
     ],
+    "scss/dollar-variable-colon-space-after": "always-single-line",
     "scss/dollar-variable-pattern": null,
     "scss/no-global-function-names": null,
     "selector-class-pattern": "^([a-zA-Z][a-zA-Z0-9]*)([-[a-zA-Z0-9]+|--[a-zA-Z0-9]+])*$",
@@ -77,4 +69,4 @@
     "value-list-comma-newline-after": null,
     "selector-not-notation": "simple"
   }
-}
+}

Dockerfile

@@ -1,7 +1,7 @@
 #
 # Build
 #
-FROM node:18.20-slim AS builder
+FROM node:20.19-slim AS builder
 
 WORKDIR /srv/node
 COPY package.json yarn.lock /srv/node/
@@ -12,7 +12,7 @@ RUN yarn install --pure-lockfile
 #
 # Install
 #
-FROM node:18.20-slim
+FROM node:20.19-slim
 
 ARG app_uid=9500
 ARG app_dir=/app