update infrastructure for 3.0

.dockerignore

@@ -0,0 +1,68 @@
+/.git
+!/.git/config
+
+# Unneeded application files
+/.docker/data/README.md
+/.github
+/docs
+/fixtures
+/infrastructure
+/public/build
+/public/fixtures
+public/build
+public/fixtures
+public/media/*
+!public/media/thumbnail_other.png
+!public/media/thumbnail_video.png
+/scripts
+/tests
+
+###> symfony/framework-bundle ###
+/.env.local
+/.env.local.php
+/.env.*.local
+/config/secrets/prod/prod.decrypt.private.php
+/var/
+/vendor/
+###< symfony/framework-bundle ###
+
+###> friendsofphp/php-cs-fixer ###
+/.php-cs-fixer.php
+/.php-cs-fixer.cache
+###< friendsofphp/php-cs-fixer ###
+
+###> phpunit/phpunit ###
+/phpunit.xml
+.phpunit.result.cache
+###< phpunit/phpunit ###
+
+###> lexik/jwt-authentication-bundle ###
+/config/jwt/*.pem
+###< lexik/jwt-authentication-bundle ###
+
+xdebug.ini
+launch.json
+
+###> liip/imagine-bundle ###
+/public/media/cache/
+###< liip/imagine-bundle ###
+
+###> phpstan/phpstan ###
+phpstan.neon
+###< phpstan/phpstan ###
+
+###> pentatrion/vite-bundle ###
+/node_modules/
+/public/build/
+###< pentatrion/vite-bundle ###
+
+#> Playwright
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
+#< Playwright
+
+###> vincentlanglet/twig-cs-fixer ###
+/.twig-cs-fixer.cache
+###< vincentlanglet/twig-cs-fixer ###

.github/Taskfile.yml

@@ -0,0 +1,46 @@
+# Task file for GitHub Actions, https://taskfile.dev/
+
+version: "3"
+
+# https://taskfile.dev/usage/#env-files
+dotenv: [".env.local", ".env"]
+
+tasks:
+  default:
+    desc: "List all tasks"
+    cmds:
+      - task --list-all
+    silent: true
+
+  build-prod:
+    desc: "Build application for production"
+    cmds:
+      - task setup-network
+      - task composer-install
+      - task npm-install
+      - task install-cleanup
+
+  setup-network:
+    desc: "Setup docker frontend network"
+    cmds:
+      - docker network create frontend
+
+  composer-install:
+    desc: "Install dependencies with composer."
+    cmds:
+      - docker compose run --rm --env APP_ENV=prod phpfpm composer install --no-dev -o --classmap-authoritative
+      - docker compose run --rm --env APP_ENV=prod phpfpm composer clear-cache
+
+  npm-install:
+    desc: "Installs node dependencies with npm."
+    cmds:
+      - docker compose run --rm node npm install
+      - docker compose run --rm node npm run build
+
+  install-cleanup:
+    desc: "Cleanup after install"
+    cmds:
+      - rm -rf infrastructure
+      - rm -rf fixtures
+      - rm -rf tests
+      - rm -rf node_modules

.github/workflows/os2display_docker_build_develop.yml → .github/workflows/docker_build_images_from_develop.yml

@@ -4,8 +4,8 @@ on:
     branches:
       - "develop"
 
-# This Action builds to os2display/* using ./infrastructure/os2display/*
-name: OS2display - Build docker image (develop)
+# This Action builds to os2display/* using ./infrastructure/*
+name: Build docker image (develop)
 
 jobs:
   docker:
@@ -14,15 +14,18 @@ jobs:
       APP_VERSION: develop
       COMPOSER_ALLOW_SUPERUSER: 1
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
       - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       # Build api
       - name: Docker meta (API)
         id: meta-api
@@ -31,15 +34,18 @@ jobs:
           images: os2display/display-api-service
 
       - name: Build and push (API)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
-          context: ./infrastructure/os2display/display-api-service/
-          file: ./infrastructure/os2display/display-api-service/Dockerfile
+          context: ./infrastructure/display-api-service/
+          file: ./infrastructure/display-api-service/Dockerfile
           build-args: |
             VERSION=${{ env.APP_VERSION }}
           push: true
           tags: ${{ steps.meta-api.outputs.tags }}
           labels: ${{ steps.meta-api.outputs.labels }}
+          provenance: mode=max
+          sbom: true
+          platforms: linux/amd64,linux/arm64
 
       # Build nginx (depends on api build)
       - name: Docker meta (Nginx)
@@ -49,12 +55,15 @@ jobs:
           images: os2display/display-api-service-nginx
 
       - name: Build and push (Nginx)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
-          context: ./infrastructure/os2display/nginx/
-          file: ./infrastructure/os2display/nginx/Dockerfile
+          context: ./infrastructure/nginx/
+          file: ./infrastructure/nginx/Dockerfile
           build-args: |
             APP_VERSION=${{ env.APP_VERSION }}
           push: true
           tags: ${{ steps.meta-nginx.outputs.tags }}
           labels: ${{ steps.meta-nginx.outputs.labels }}
+          provenance: mode=max
+          sbom: true
+          platforms: linux/amd64,linux/arm64

.github/workflows/os2display_docker_build_tag.yml → .github/workflows/docker_build_images_from_tag.yml

@@ -4,24 +4,25 @@ on:
     tags:
       - "*"
 
-# This Action builds to os2display/* using ./infrastructure/os2display/*
-name: OS2display - Build docker image (tag)
+# This Action builds to os2display/* using ./infrastructure/*
+name: Build docker image (tag)
 
 jobs:
   docker:
     runs-on: ubuntu-latest
-    env:
-      COMPOSER_ALLOW_SUPERUSER: 1
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
       - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       # Build api
       - name: Docker meta (API)
         id: meta-api
@@ -30,15 +31,17 @@ jobs:
           images: os2display/display-api-service
 
       - name: Build and push (API)
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
-          context: ./infrastructure/os2display/display-api-service/
-          file: ./infrastructure/os2display/display-api-service/Dockerfile
+          context: ./infrastructure/display-api-service/
+          file: ./infrastructure/display-api-service/Dockerfile
           build-args: |
             APP_VERSION=${{ github.ref }}
           push: true
           tags: ${{ steps.meta-api.outputs.tags }}
           labels: ${{ steps.meta-api.outputs.labels }}
+          provenance: mode=max
+          sbom: true
 
       # Build nginx (depends on api build)
       - name: Docker meta (Nginx)
@@ -54,10 +57,12 @@ jobs:
       - name: Build and push (Nginx)
         uses: docker/build-push-action@v5
         with:
-          context: ./infrastructure/os2display/nginx/
-          file: ./infrastructure/os2display/nginx/Dockerfile
+          context: ./infrastructure/nginx/
+          file: ./infrastructure/nginx/Dockerfile
           build-args: |
             APP_VERSION=${{ steps.get_tag.outputs.git_tag }}
           push: true
           tags: ${{ steps.meta-nginx.outputs.tags }}
           labels: ${{ steps.meta-nginx.outputs.labels }}
+          provenance: mode=max
+          sbom: true

.github/workflows/github_build_release.yml

@@ -8,23 +8,23 @@ name: Create Github Release
 permissions:
   contents: write
 
+env:
+  COMPOSE_USER: runner
+
 jobs:
   create-release:
     runs-on: ubuntu-latest
-    env:
-      COMPOSER_ALLOW_SUPERUSER: 1
-      APP_ENV: prod
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Composer install
-        run: |
-          docker network create frontend
-          docker compose run --rm --user=root --env APP_ENV=prod phpfpm composer install --no-dev -o --classmap-authoritative
-          docker compose run --rm --user=root --env APP_ENV=prod phpfpm composer clear-cache
-          rm -rf infrastructure
+      - name: Install Task task runner
+        uses: go-task/setup-task@v1
 
+      - name: Install, Build, Cleanup
+        run: |
+          task --taskfile=.github/Taskfile.yaml build-prod
+
       - name: Make assets dir
         run: |
           mkdir -p ../assets
@@ -39,7 +39,7 @@ jobs:
 
       - name: Create a release in GitHub and uploads assets
         run: |
-          gh release create ${{ github.ref_name }} --verify-tag --generate-notes ../assets/*.*
+          gh release create ${{ github.ref_name }} --verify-tag --generate-notes ${{ steps.prerelease.outputs.flag }} ../assets/*.*
         env:
           GITHUB_TOKEN: ${{ github.TOKEN }}
         shell: bash