[pull] master from mozilla:master

.dockerignore

@@ -6,3 +6,5 @@ deps/
 node_modules/
 storage/
 logs/*
+
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,15 +1,43 @@
+Fixes: mozilla/addons#ISSUENUM
+
+<!--
 Thanks for opening a Pull Request (PR), here's a few guidelines as to what we need in your PR before we review it.
+-->
+
+### Description
+
+<!--
+Your PR will be squashed when merged so the 1st commit must contain a descriptive and concise summary of the change.
+Additional details should be added in the description. If your change is simple enough to summarize in the commit, or
+if it is not relevant for your PR, remove this section.
+-->
+
+### Context
+
+<!--
+Often a pull request contains changes that are not fully self explanatory. Maybe this PR is a part of a series,
+or maybe it is a partial change now with a more ambitious plan for the future. Add this additional context here.
+If it is not relevant for your PR, remove this section.
+-->
+
+### Testing
+
+<!--
+Your change must be related to an existing, open issue. This issue should contain testing instructions.
+Often, the testing info in the issue is higher level, geared towards a user or QA experience.
+Here you can provide information for a developer verifying this PR. Get technical.
+If it is not relevant to your PR, remove this section.
+-->
+
+### Checklist
 
+<!--
+Here's a few guidelines as to what we need in your PR before we review it.
 Please delete anything that isn't relevant to your patch.
+-->
 
-* [ ] This PR relates to an existing open issue and there are no existing
-      PRs open for the same issue.
-* [ ] Add `Fixes #ISSUENUM` at the top of your PR.
-* [ ] Add a description of the changes introduced in this PR.
-* [ ] The change has been successfully run locally.
-* [ ] Add tests to cover the changes added in this PR.
-* [ ] Add before and after screenshots (Only for changes that impact the UI).
-
-Once you have met the above requirements please replace this section with
-a `Fixes #ISSUENUM` linking to the issue fixed by this PR along with an
-explanation of the changes. Thanks for your contribution!
+- [ ] Add `#ISSUENUM` at the top of your PR to an existing open issue in the mozilla/addons repository.
+- [ ] Successfully verified the change locally.
+- [ ] The change is covered by automated tests, or otherwise indicated why doing so is unnecessary/impossible.
+- [ ] Add before and after screenshots (Only for changes that impact the UI).
+- [ ] Add or update relevant [docs](../docs/) reflecting the changes made.

.github/actions/build-docker/action.yml

@@ -0,0 +1,114 @@
+name: 'Docker Build'
+description: 'Builds `addons-server` docker image'
+inputs:
+  password:
+    required: false
+    description: "Docker registry password"
+    default: "invalid"
+  push:
+    required: false
+    description: "Build and push image to registry (cannot be used together with load)"
+    default: "false"
+  username:
+    required: false
+    description: "Docker registry username"
+    default: "invalid"
+
+outputs:
+  digest:
+    description: "The Docker image digest"
+    value: ${{ steps.digest.outputs.digest }}
+  version:
+    description: "The Docker version for the image"
+    value: ${{ steps.meta.outputs.version }}
+  tags:
+    description: "The Docker tags for the image"
+    value: ${{ steps.meta.outputs.tags }}
+
+runs:
+  using: "composite"
+  steps:
+    # Setup docker to build for multiple architectures
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v1
+      with:
+        version: latest
+        buildkitd-flags: --debug
+
+    # Login to a registry to push the image
+    - name: Login to Container Registry
+      # Only login if we are pushing the image
+      if: ${{ inputs.push == 'true' }}
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}
+
+
+    - name: Suffix for local builds
+      id: suffix
+      shell: bash
+      # The suffix is unique to a branch and commit
+      run: |
+        if [[ "${{ inputs.push }}" == "false" ]]; then
+          echo "suffix=${{ github.ref }}-${{ github.sha }}" >> $GITHUB_OUTPUT
+        else
+          echo "suffix=ci" >> $GITHUB_OUTPUT
+        fi
+
+    # Determine the tags for the image
+    # We need to support custom explicit tags allowing CI to build unique images
+    # that won't be pushed to the registry.
+    - name: Docker meta
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        # Hard coding our dockerhub image name
+        images: mozilla/addons-server
+        flavor: |
+          suffix=-${{ steps.suffix.outputs.suffix }}
+        tags: |
+          type=schedule
+          type=ref,event=tag
+          type=ref,event=branch
+          type=ref,event=pr
+          # set latest tag for default branch
+          # Disabled for now as we do not use this action for
+          # The production build
+          # type=raw,value=latest,enable={{is_default_branch}}
+
+    - name: Create .env and version.json files
+      shell: bash
+      env:
+        DOCKER_VERSION: ${{ steps.meta.outputs.version }}
+        DOCKER_COMMIT: ${{ github.sha }}
+        VERSION_BUILD_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      run: make setup
+
+    - name: Set Docker Variables
+      id: cache
+      shell: bash
+      run: |
+        echo "tag=mozilla/addons-server:${{ steps.meta.outputs.version }}-cache" >> $GITHUB_OUTPUT
+
+    - name: Build Image
+      id: build
+      uses: docker/bake-action@v4
+      with:
+        targets: web
+        push: ${{ inputs.push }}
+        load: ${{ inputs.push == 'false' }}
+        set: |
+          *.cache-from=type=registry,ref=${{ steps.cache.outputs.tag }}
+          *.cache-to=type=registry,ref=${{ steps.cache.outputs.tag }},mode=max,compression-level=9,force-compression=true,ignore-error=true
+
+    - name: Get image digest
+      id: digest
+      shell: bash
+      env:
+        BUILDX_BAKE_METADATA_FILE: metadata.json
+      run: |
+        echo '${{ steps.build.outputs.metadata }}' > metadata.json
+        echo "digest=$(cat metadata.json | jq -r '.web."containerimage.digest"')" >> $GITHUB_OUTPUT

.github/actions/context/action.yml

@@ -0,0 +1,114 @@
+name: 'Dump Context'
+description: 'Display context for action run'
+
+outputs:
+  # All github action outputs are strings, even if set to "true"
+  # so when using these values always assert against strings or convert from json
+  # \$\{{ needs.context.outputs.is_fork == 'true' }} // true
+  # \$\{{ fromJson(needs.context.outputs.is_fork) == false }} // true
+  # \$\{{ needs.context.outputs.is_fork == true }} // false
+  # \$\{{ needs.context.outputs.is_fork }} // false
+  is_fork:
+    description: ""
+    value: ${{ steps.context.outputs.is_fork }}
+  is_default_branch:
+    description: ""
+    value: ${{ steps.context.outputs.is_default_branch }}
+  is_release_master:
+    description: ""
+    value: ${{ steps.context.outputs.is_release_master }}
+  is_release_tag:
+    description: ""
+    value: ${{ steps.context.outputs.is_release_tag }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Dump GitHub context
+      shell: bash
+      env:
+        GITHUB_CONTEXT: ${{ toJson(github) }}
+      run: echo "$GITHUB_CONTEXT"
+    - name: Dump job context
+      shell: bash
+      env:
+        JOB_CONTEXT: ${{ toJson(job) }}
+      run: echo "$JOB_CONTEXT"
+    - name: Dump steps context
+      shell: bash
+      env:
+        STEPS_CONTEXT: ${{ toJson(steps) }}
+      run: echo "$STEPS_CONTEXT"
+    - name: Dump runner context
+      shell: bash
+      env:
+        RUNNER_CONTEXT: ${{ toJson(runner) }}
+      run: echo "$RUNNER_CONTEXT"
+    - name: Dump env context
+      shell: bash
+      env:
+        ENV_CONTEXT: ${{ toJson(env) }}
+      run: |
+        echo "$ENV_CONTEXT"
+    - name: Dump inputs context
+      shell: bash
+      env:
+        INPUTS_CONTEXT: ${{ toJson(inputs) }}
+      run: |
+        echo "$INPUTS_CONTEXT"
+
+    - name: Set context
+      id: context
+      env:
+        # The default branch of the repository, in this case "master"
+        default_branch: ${{ github.event.repository.default_branch }}
+      shell: bash
+      run: |
+        event_name="${{ github.event_name }}"
+        event_action="${{ github.event.action }}"
+
+        # Stable check for if the workflow is running on the default branch
+        # https://stackoverflow.com/questions/64781462/github-actions-default-branch-variable
+        is_default_branch="${{ format('refs/heads/{0}', env.default_branch) == github.ref }}"
+
+        # In most events, the epository refers to the head which would be the fork
+        is_fork="${{ github.event.repository.fork }}"
+
+        # This is different in a pull_request where we need to check the head explicitly
+        if [[ "${{ github.event_name }}" == 'pull_request' ]]; then
+          # repository on a pull request refers to the base which is always mozilla/addons-server
+          is_head_fork="${{ github.event.pull_request.head.repo.fork }}"
+          # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
+          is_dependabot="${{ github.actor == 'dependabot[bot]' }}"
+
+          # If the head repository is a fork or if the PR is opened by dependabot
+          # we consider the run to be a fork. Dependabot and proper forks are treated
+          # the same in terms of limited read only github token scope
+          if [[ "$is_head_fork" == 'true' || "$is_dependabot" == 'true' ]]; then
+            is_fork="true"
+          fi
+        fi
+
+        is_release_master="false"
+        is_release_tag="false"
+
+        # Releases can only happen if we are NOT on a fork
+        if [[ "$is_fork" == 'false' ]]; then
+          # A master release occurs on a push to the default branch of the origin repository
+          if [[ "$event_name" == 'push' && "$is_default_branch" == 'true' ]]; then
+            is_release_master="true"
+          fi
+
+          # A tag release occurs when a release is published
+          if [[ "$event_name" == 'release' && "$event_action" == 'publish' ]]; then
+            is_release_tag="true"
+          fi
+        fi
+
+        echo "is_default_branch=$is_default_branch" >> $GITHUB_OUTPUT
+        echo "is_fork=$is_fork" >> $GITHUB_OUTPUT
+        echo "is_release_master=$is_release_master" >> $GITHUB_OUTPUT
+        echo "is_release_tag=$is_release_tag" >> $GITHUB_OUTPUT
+
+        echo "event_name: $event_name"
+        cat $GITHUB_OUTPUT

.github/actions/run-docker/action.yml

@@ -0,0 +1,52 @@
+name: 'Docker Run Action'
+description: 'Run a command in a new container'
+inputs:
+  version:
+    description: 'The version of the image to run. '
+    required: true
+    default: 'local'
+  digest:
+    description: 'The build digest of the image to run. Overrides version.'
+    required: true
+    default: ''
+  run:
+    description: 'Run command in container'
+    required: true
+  services:
+    description: 'List of services to start'
+    required: false
+    default: 'web'
+  compose_file:
+    description: 'The docker-compose file to use'
+    required: false
+    default: 'docker-compose.yml:docker-compose.ci.yml'
+runs:
+  using: 'composite'
+  steps:
+    - id: id
+      shell: bash
+      run: |
+        echo "id=$(id -u)" >> $GITHUB_OUTPUT
+
+    - name: Run Docker Container
+      shell: bash
+      env:
+        DOCKER_VERSION: ${{ inputs.version }}
+        DOCKER_DIGEST: ${{ inputs.digest }}
+        COMPOSE_FILE: ${{ inputs.compose_file }}
+        DOCKER_SERVICES: ${{ inputs.services }}
+        HOST_UID: ${{ steps.id.outputs.id }}
+      run: |
+        # Start the specified services
+        make up
+
+        # Exec the run command in the container
+        # quoted 'EOF' to prevent variable expansion
+        cat <<'EOF' | docker compose exec --user olympia web sh
+          ${{ inputs.run }}
+        EOF
+
+    - name: Logs
+      shell: bash
+      if: failure()
+      run: docker compose logs

.github/dependabot.yml

@@ -34,7 +34,7 @@ updates:
     - ">= 6"
   - dependency-name: idna
     versions:
-    - ">= 3"
+    - ">= 4"
   - dependency-name: amqp
     versions:
     - ">= 6"