Merge branch 'develop' into 'main'

feat: Add PHP 8.5 TAG VAR

See merge request ldc-web/shared-ci!29

build/composer-bedrock-8.3.yml

@@ -0,0 +1,28 @@
+composer-build:
+    stage: build
+    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.3:latest
+    before_script:
+        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
+        - composer config http-basic.connect.advancedcustomfields.com $APP_ACF_USER $APP_ACF_PWD
+    cache:
+        paths:
+            - vendor/
+            - public/
+
+
+    script:
+        - composer install --no-dev --optimize-autoloader --classmap-authoritative
+    artifacts:
+      expose_as: 'composer-build'
+      paths:
+          - vendor
+          - public
+    allow_failure: false
+    dependencies:
+        - composer-security
+    needs:
+        - job: composer-security
+          optional: true
+    rules:
+        - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
+        - if: $CI_COMMIT_TAG != null

build/composer-bedrock.yml

@@ -24,6 +24,5 @@ composer-build:
         - job: composer-security
           optional: true
     rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
         - if: $CI_COMMIT_TAG != null

build/composer.yml

@@ -1,24 +1,27 @@
 composer-build:
     stage: build
-    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
+    image: composer:2.10
-    before_script:
-        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
     cache:
+        key:
+            files:
+                - composer.lock
         paths:
             - vendor/
+        policy: pull-push
+    before_script:
+        - composer config gitlab-token.lab.s-web.fr "${CI_DEPLOY_USER}" "${CI_DEPLOY_PASSWORD}"
     script:
-        - composer install --no-dev --optimize-autoloader --classmap-authoritative --no-scripts
+        - composer install --ignore-platform-reqs --no-interaction --no-plugins --no-scripts --no-dev --prefer-dist
     artifacts:
-      expose_as: 'vendor'
+        paths:
-      paths:
+            - vendor/
-          - vendor
+        expire_in: 1h
-    allow_failure: false
     dependencies:
         - composer-security
     needs:
         - job: composer-security
           optional: true
+    allow_failure: false
     rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
-        - if: $CI_COMMIT_TAG != null
+        - if: $CI_COMMIT_TAG != null

build/composer7.3.yml

@@ -1,24 +1,23 @@
 composer-build:
     stage: build
-    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa:php7.3-1.0
+    image: composer:2.9.7
     before_script:
         - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
     cache:
         paths:
             - vendor/
     script:
-        - composer install --no-dev --optimize-autoloader --classmap-authoritative --no-scripts
+        - composer install --no-dev --optimize-autoloader --classmap-authoritative --no-scripts --ignore-platform-reqs
     artifacts:
       expose_as: 'vendor'
       paths:
           - vendor
-    allow_failure: false
+    allow_failure: true
     dependencies:
         - composer-security
     needs:
         - job: composer-security
           optional: true
     rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
-        - if: $CI_COMMIT_TAG != null
+        - if: $CI_COMMIT_TAG != null

build/docker-bedrock-multistage.yml

@@ -0,0 +1,51 @@
+.docker-build:
+    stage: build
+    image:
+        name: gcr.io/kaniko-project/executor:v1.23.2-debug
+        entrypoint: [""]
+    script:
+        - /kaniko/executor
+            --context "${CI_PROJECT_DIR}"
+            --build-arg "GITLAB_USER=${CI_DEPLOY_USER}"
+            --build-arg "GITLAB_PASSWORD=${CI_DEPLOY_PASSWORD}"
+            --build-arg "APP_ACF_USER=${APP_ACF_USER}"
+            --build-arg "APP_ACF_PWD=${APP_ACF_PWD}"
+            --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
+            --destination "${IMAGE_TAG}"
+            --cache=true
+            --cache-ttl 24h
+    allow_failure: false
+    dependencies:
+        - composer-security
+        - npm-security
+    needs:
+        - job: composer-security
+          optional: true
+        - job: npm-security
+          optional: true
+
+docker-build:staging:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:s-${CI_COMMIT_SHA}"
+    rules:
+        - if: $CI_COMMIT_BRANCH == "trunk"
+          allow_failure: true
+
+
+docker-build:latest:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
+    rules:
+        - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
+          allow_failure: true
+
+
+docker-build:release:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
+    rules:
+        - if: $CI_COMMIT_TAG != null
+          allow_failure: true

build/docker-bedrock.yml

@@ -15,15 +15,6 @@
         - job: composer-build
           optional: true
 
-
-docker-build:review:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
-    rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-
-
 docker-build:staging:
     extends: .docker-build
     variables:

build/docker-multistage.yml

@@ -0,0 +1,50 @@
+.docker-build:
+    stage: build
+    image:
+        name: gcr.io/kaniko-project/executor:v1.23.2-debug
+        entrypoint: [""]
+    script:
+        - /kaniko/executor
+            --context "${CI_PROJECT_DIR}"
+            --build-arg "GITLAB_USER=${CI_DEPLOY_USER}"
+            --build-arg "GITLAB_PASSWORD=${CI_DEPLOY_PASSWORD}"
+            --build-arg "PHP_8_5_TAG=${PHP_8_5_TAG}"
+            --dockerfile "${CI_PROJECT_DIR}/Dockerfile"
+            --destination "${IMAGE_TAG}"
+            --cache=true
+            --cache-ttl 24h
+    allow_failure: false
+    dependencies:
+        - composer-security
+        - npm-security
+    needs:
+        - job: composer-security
+          optional: true
+        - job: npm-security
+          optional: true
+
+docker-build:staging:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:s-${CI_COMMIT_SHA}"
+    rules:
+        - if: $CI_COMMIT_BRANCH == "trunk"
+          allow_failure: true
+
+
+docker-build:latest:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
+    rules:
+        - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
+          allow_failure: true
+
+
+docker-build:release:
+    extends: .docker-build
+    variables:
+        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
+    rules:
+        - if: $CI_COMMIT_TAG != null
+          allow_failure: true

build/docker.yml

@@ -18,21 +18,14 @@
         - job: composer-build
           optional: true
 
-
-docker-build:review:
-    extends: .docker-build
-    variables:
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
-    rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-
-
 docker-build:staging:
     extends: .docker-build
     variables:
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:s-${CI_COMMIT_SHA}"
     rules:
         - if: $CI_COMMIT_BRANCH == "trunk"
+          when: manual
+          allow_failure: true
 
 
 docker-build:latest:
@@ -41,6 +34,8 @@ docker-build:latest:
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
     rules:
         - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
+          when: manual
+          allow_failure: true
 
 
 docker-build:release:
@@ -48,4 +43,6 @@ docker-build:release:
     variables:
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
     rules:
-        - if: $CI_COMMIT_TAG != null
+        - if: $CI_COMMIT_TAG != null
+          when: manual
+          allow_failure: true

build/npm.yml

@@ -1,9 +1,11 @@
 npm-build:
     stage: build
-    image: node:18
+    image: node:24
     before_script:
         - npm config set @ldc-web:registry https://${CI_SERVER_HOST}/api/v4/packages/npm/
         - npm config set -- '//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
+        - npm config set @uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/
+        - npm config set -- '//${CI_SERVER_HOST}/api/v4/groups/ldc-web/-/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
         - npm install
     cache:
         paths:
@@ -21,6 +23,5 @@ npm-build:
         - job: npm-security
           optional: true
     rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
         - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
         - if: $CI_COMMIT_TAG != null

deploy/kubernetes.yml

@@ -1,11 +1,17 @@
+variables:
+    KUBERNETES_CLUSTER_NAME: prod-k8s-ldc-web
+    KUBERNETES_VERSION: 1.29.2
+
 .kubernetes:
     stage: deploy
     image:
-        name: alpine/k8s:1.26.0
+        name: "alpine/k8s:${KUBERNETES_VERSION}"
         entrypoint: ['']
     variables:
-        KUBE_CONTEXT: ldc-web/cluster-k8s:k8s-ldc-web
+        KUBE_CONTEXT: "ldc-web/cluster-k8s:${KUBERNETES_CLUSTER_NAME}"
         KUBE_NAMESPACE: default
+        CRT_TLS_NAME: "wildcard-k8s-ldc"
+        REDIRECT:
     before_script:
         - kubectl config use-context ${KUBE_CONTEXT}
     script:
@@ -20,29 +26,29 @@
         action: stop
 
 
-kubernetes:review:
+# kubernetes:review:
-    extends: .kubernetes
+#    extends: .kubernetes
-    variables:
+#    variables:
-        KUBE_NAMESPACE: review
+#        KUBE_NAMESPACE: review
-        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
+#        IMAGE_TAG: "${CI_REGISTRY_IMAGE}:review-${CI_MERGE_REQUEST_IID}"
-    needs:
+#    needs:
-        - job: docker-build:review
+#        - job: docker-build:review
-    rules:
+#    rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+#        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    when: manual
+#    when: manual
-    environment:
+#    environment:
-        name: review/${CI_MERGE_REQUEST_IID}
+#        name: review/${CI_MERGE_REQUEST_IID}
-        url: https://${DOMAIN}
+#        url: https://${DOMAIN}
-        on_stop: kubernetes_stop:review
+#        on_stop: kubernetes_stop:review
 
-kubernetes_stop:review:
+# kubernetes_stop:review:
-    extends: .kubernetes_stop
+#    extends: .kubernetes_stop
-    variables:
+#    variables:
-        KUBE_NAMESPACE: review
+#        KUBE_NAMESPACE: review
-    rules:
+#    rules:
-        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+#        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    environment:
+#    environment:
-        name: review/${CI_MERGE_REQUEST_IID}
+#        name: review/${CI_MERGE_REQUEST_IID}
 
 
 kubernetes:staging:
@@ -54,6 +60,9 @@ kubernetes:staging:
         - job: docker-build:staging
     rules:
         - if: $CI_COMMIT_BRANCH == "trunk"
+    script:
+        - envsubst < manifest.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
+        - envsubst < staging-resources.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
     when: manual
     environment:
         name: staging
@@ -75,10 +84,15 @@ kubernetes:prod:
     variables:
         KUBE_NAMESPACE: production
         IMAGE_TAG: "${CI_REGISTRY_IMAGE}:p-${CI_COMMIT_SHA}"
+        CRT_TLS_NAME: "${APP_DOMAIN}"
+        REDIRECT: "www."
     needs:
         - job: docker-build:latest
     rules:
         - if: $CI_COMMIT_BRANCH == "main" || $CI_COMMIT_BRANCH == "master"
+    script:
+        - envsubst < manifest.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
+        - envsubst < production-resources.yaml | kubectl apply --namespace ${KUBE_NAMESPACE} -f -
     when: manual
     environment:
         name: production

lint/eslint.yml

@@ -1,9 +1,11 @@
 eslint:
     stage: lint
-    image: node:18
+    image: node:24
     before_script:
         - npm config set @ldc-web:registry https://${CI_SERVER_HOST}/api/v4/packages/npm/
         - npm config set -- '//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
+        - npm config set @uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/
+        - npm config set -- '//${CI_SERVER_HOST}/api/v4/groups/ldc-web/-/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
         - npm install
     cache:
         paths:

lint/lint.yml

@@ -1,3 +1,22 @@
+spec:
+  inputs:
+    larastan_bootstrap:
+      default: false
+      type: boolean
+    db_connection:
+      default: "sqlite"
+    db_database:
+      default: ":memory:"
+    cache_store:
+      default: "array"
+    session_driver:
+      default: "array"
+    enable_rector:
+      default: false
+      type: boolean
+
+---
+
 include:
   - project: 'ldc-web/shared-ci'
     ref: 'main'
@@ -5,6 +24,17 @@ include:
   - project: 'ldc-web/shared-ci'
     ref: 'main'
     file: 'lint/phpstan.yml'
+    inputs:
+      larastan_bootstrap: $[[ inputs.larastan_bootstrap ]]
+      db_connection: $[[ inputs.db_connection ]]
+      db_database: $[[ inputs.db_database ]]
+      cache_store: $[[ inputs.cache_store ]]
+      session_driver: $[[ inputs.session_driver ]]
+  - project: "ldc-web/shared-ci"
+    ref: "main"
+    file: "lint/rector.yml"
+    inputs:
+      enable_rector: $[[ inputs.enable_rector ]]
   - project: 'ldc-web/shared-ci'
     ref: 'main'
     file: 'lint/eslint.yml'

lint/phpcs.yml

@@ -1,6 +1,6 @@
 phpcs:
     stage: lint
-    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
+    image: composer:2.10
     before_script:
         - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
         - composer install --no-scripts

lint/phpstan.yml

@@ -1,9 +1,40 @@
+spec:
+  inputs:
+    larastan_bootstrap:
+      default: false
+      type: boolean
+    db_connection:
+      default: "sqlite"
+    db_database:
+      default: ":memory:"
+    cache_store:
+      default: "array"
+    session_driver:
+      default: "array"
+
+---
+
 phpstan:
     stage: lint
-    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
+    image: composer:2.10
+    cache:
+      key: phpstan-cache-${CI_COMMIT_REF_SLUG}
+      paths:
+          - vendor/
+          - .phpstan-cache/
+    variables:
+        DB_CONNECTION: "$[[ inputs.db_connection ]]"
+        DB_DATABASE: "$[[ inputs.db_database ]]"
+        CACHE_STORE: "$[[ inputs.cache_store ]]"
+        SESSION_DRIVER: "$[[ inputs.session_driver ]]"
     before_script:
         - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
-        - composer install --no-scripts
+        - composer install --no-scripts --no-interaction
+        - |
+          if [ "$[[ inputs.larastan_bootstrap ]]" = "true" ]; then
+            cp .env.example .env
+            php artisan key:generate
+          fi
     script:
         - vendor/bin/phpstan --error-format=junit > phpstan-report.xml
     artifacts:

lint/rector.yml

@@ -0,0 +1,31 @@
+spec:
+  inputs:
+    enable_rector:
+      default: false
+      type: boolean
+
+---
+
+rector:
+    stage: lint
+    image: composer:2.10
+    cache:
+      key: rector-cache-$CI_COMMIT_REF_SLUG
+      paths:
+        - vendor/
+        - .rector-cache/
+    before_script:
+        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
+        - composer install --no-scripts --no-interaction
+    script:
+        - vendor/bin/rector process --dry-run --no-progress-bar --output-format=junit > rector-report.xml
+    artifacts:
+      when: always
+      expose_as: 'rector'
+      paths:
+          - rector-report.xml
+      reports:
+        junit: rector-report.xml
+    allow_failure: true
+    rules:
+        - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && "$[[ inputs.enable_rector ]]" == "true"'

lint/stylelint.yml

@@ -1,9 +1,11 @@
 stylelint:
     stage: lint
-    image: node:18
+    image: node:24
     before_script:
         - npm config set @ldc-web:registry https://${CI_SERVER_HOST}/api/v4/packages/npm/
         - npm config set -- '//${CI_SERVER_HOST}/api/v4/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
+        - npm config set @uwil:registry=https://lab.s-web.fr/api/v4/groups/ldc-web/-/packages/npm/
+        - npm config set -- '//${CI_SERVER_HOST}/api/v4/groups/ldc-web/-/packages/npm/:_authToken' "${CI_DEPLOY_PASSWORD}"
         - npm install
     cache:
         paths:
@@ -18,4 +20,4 @@ stylelint:
     allow_failure: false
     rules:
         - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-        - if: $CI_COMMIT_BRANCH == "develop"
+        - if: $CI_COMMIT_BRANCH == "develop"

security/composer.yml

@@ -1,8 +1,10 @@
 composer-security:
     stage: security
-    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa-8.2:latest
+    image: composer:2.10
+    before_script:
+        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
     script:
-        - local-php-security-checker --format=json --path=./composer.lock > composer-security-checker-report.json
+        - composer audit --locked --format=json > composer-security-checker-report.json || true
     artifacts:
         when: on_failure
         expose_as: 'composer-security-checker'

security/npm.yml

@@ -1,6 +1,6 @@
 npm-security:
     stage: security
-    image: node:17.9.1
+    image: node:24
     before_script: 
         - npm install --location=global audit-ci@^6
     script: