Release OpenProject 12.0.0

Author: oliverguenther

.buildpacks

@@ -0,0 +1,2 @@
+https://github.com/heroku/heroku-buildpack-nodejs.git#v162
+https://github.com/pkgr/heroku-buildpack-ruby.git#v212-1

.dockerignore

@@ -0,0 +1,34 @@
+.github/
+.git
+.dockerignore
+.bundle
+.env*
+.buildpacks
+.*.yml
+*.swp
+.*ignore
+*.md
+*.log
+Vagrantfile
+Dockerfile
+Guardfile
+docker-compose.*
+browserslist
+
+docs
+!docs/api/apiv3/openapi-spec.yml
+!docs/api/apiv3/paths
+!docs/api/apiv3/tags
+!docs/api/apiv3/components
+
+extra
+features
+help
+log/*.log
+spec
+spec_legacy
+tmp
+frontend/node_modules
+node_modules
+# travis
+vendor/bundle

.editorconfig

@@ -0,0 +1,61 @@
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) 2012-2020 the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See COPYRIGHT and LICENSE files for more details.
+#++
+
+# If you place a .env file into the root directory of OpenProject
+# you can override some default settings that foreman will use
+# to start OpenProject
+
+# This is used to prevent people from using the new docker-compose file for automated installs
+LOCAL_DEV_CHECK=1
+
+# Set this to your ckeditor build output directory (which includes ckeditor.js) if you
+# want to develop ckeditor locally.
+CKEDITOR_BUILD_DIR=frontend/src/vendor/ckeditor/
+
+# This is the host from which you will be accessing the development servers locally
+PUBLIC_HOST=localhost
+
+HOST=0.0.0.0
+PORT=1337
+
+DEV_UID=1000
+DEV_GID=1001
+
+DB_HOST=db
+DB_PORT=5432
+DB_USERNAME=openproject
+DB_PASSWORD=openproject
+DB_DATABASE=openproject
+
+CI_JOBS=24
+
+SMTP_ADDRESS=
+SMTP_PORT=
+SMTP_DOMAIN=
+SMTP_USER_NAME=
+SMTP_PASSWORD=

.env.example

@@ -0,0 +1,37 @@
+name: "Core/Ruby-Brakeman"
+
+on:
+  pull_request:
+    branches:
+      - dev
+      - release/*
+    paths:
+      - '**.rb'
+  schedule:
+    - cron: '10 6 * * 1'
+
+jobs:
+  brakeman-scan:
+    if: github.repository == 'opf/openproject'
+    name: Brakeman Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@v1
+
+      - name: Setup Brakeman
+        run: |
+          gem install brakeman
+
+      - name: Scan
+        continue-on-error: true
+        run: |
+          brakeman -i config/brakeman.ignore -f sarif -o output.sarif.json .
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: output.sarif.json

.github/workflows/brakeman-scan-core.yml

@@ -0,0 +1,38 @@
+name: "Core/JS-CodeQL"
+
+on:
+  pull_request:
+    branches:
+      - dev
+      - release/*
+    paths:
+      - '**.js'
+      - '**.ts'
+  schedule:
+    - cron: '55 5 * * 1-5'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1

.github/workflows/codeql-scan-core.yml

@@ -0,0 +1,21 @@
+name: Core/CD
+on:
+  push:
+    branches:
+      - dev
+      - release/*
+jobs:
+  trigger_downstream_workflow:
+    if: github.repository == 'opf/openproject'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger downstream workflow
+        env:
+          TOKEN: ${{ secrets.OPENPROJECT_CI_TOKEN }}
+          SAAS_CD_WORKFLOW_ID: continuous-delivery-saas.yml
+          SAAS_REPOSITORY: opf/saas-openproject
+        run: |
+          curl -i --fail -H"authorization: Bearer $TOKEN" \
+            -XPOST -H"Accept: application/vnd.github.v3+json" \
+            https://api.github.com/repos/$SAAS_REPOSITORY/actions/workflows/$SAAS_CD_WORKFLOW_ID/dispatches \
+            -d '{"ref": "${{ github.ref }}"}'

.github/workflows/continuous-delivery.yml

@@ -0,0 +1,36 @@
+name: Docker
+on:
+  # Scheduled workflows run on the latest commit on the default or base branch
+  schedule:
+    - cron: '20 2 * * *' # Daily at 02:20
+
+  push:
+    tags:
+      - v*
+jobs:
+  publish:
+    # restrict this job to base repo for now
+    if: github.repository == 'opf/openproject'
+    runs-on: ubuntu-latest
+    env:
+      INPUT_BUILDOPTIONS: --pull
+    steps:
+      - uses: actions/checkout@master
+      - name: Prepare docker files
+        run: |
+          cp ./docker/prod/Dockerfile ./Dockerfile
+      - name: Build & Push
+        id: build_and_push
+        uses: elgohr/Publish-Docker-Github-Action@master
+        with:
+          name: openproject/community
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          tag_semver: true
+          cache: ${{ github.event_name != 'schedule' }}
+      - name: Test
+        run: |
+          docker run --name openproject -d -p 8080:80 -e SUPERVISORD_LOG_LEVEL=debug -e SECRET_KEY_BASE=secret ${{ steps.build_and_push.outputs.digest }}
+          sleep 30
+          docker logs openproject --tail 100
+          wget -O- --retry-on-http-error=503,502 --retry-connrefused http://localhost:8080/api/v3

.github/workflows/docker.yml

@@ -0,0 +1,21 @@
+name: "Core/Frontend-Linting"
+on:
+  pull_request:
+    branches:
+      - dev
+      - release/*
+    paths:
+      - '**.js'
+      - '**.ts'
+
+jobs:
+  eslint:
+    name: eslint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - uses: opf/action-eslint@v2
+        with:
+          reporter: github-pr-check

.github/workflows/eslint-core.yml

@@ -0,0 +1,37 @@
+name: pullpreview
+
+on:
+  pull_request:
+    types: [labeled, unlabeled, synchronize, closed, reopened]
+
+jobs:
+  deploy:
+    if: github.repository == 'opf/openproject' && ( github.event_name == 'push' || github.event.label.name == 'pullpreview' || contains(github.event.pull_request.labels.*.name, 'pullpreview') )
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+    - uses: actions/checkout@v2
+    - name: Generate .env.pullpreview file
+      run: |
+        echo "OP_ADMIN_USER_SEEDER_FORCE_PASSWORD_CHANGE=off" >> .env.pullpreview
+        echo "OPENPROJECT_SHOW__SETTING__MISMATCH__WARNING=false" >> .env.pullpreview
+    - name: Boot as BIM edition
+      if: contains(github.ref, 'bim/') || contains(github.head_ref, 'bim/')
+      run: |
+        echo "OPENPROJECT_EDITION=bim" >> .env.pullpreview
+    - name: Prepare docker-compose files
+      run: |
+        cp ./docker/pullpreview/docker-compose.yml ./docker-compose.pullpreview.yml
+        cp ./docker/prod/Dockerfile ./Dockerfile
+    - uses: pullpreview/action@v5
+      with:
+        admins: crohr,HDinger,machisuji,oliverguenther,ulferts,wielinde,b12f
+        always_on: dev
+        compose_files: docker-compose.pullpreview.yml
+        instance_type: medium_2_0
+        ports: 80,443
+        default_port: 443
+      env:
+        AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
+        AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
+        AWS_REGION: eu-central-1

.github/workflows/pullpreview.yml

@@ -0,0 +1,25 @@
+name: "Core/Backend-Linting"
+
+on:
+  pull_request:
+    branches:
+      - dev
+      - release/*
+    paths:
+      - '**.rb'
+
+jobs:
+  rubocop:
+    name: rubocop
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - uses: ruby/setup-ruby@v1
+      - uses: opf/action-rubocop@v2
+        with:
+          github_token: ${{ secrets.github_token }}
+          rubocop_version: gemfile
+          rubocop_extensions: rubocop-rails:gemfile rubocop-rspec:gemfile
+          reporter: github-pr-check