chore: sync files with stordco/common-config-elixir

.credo.exs

@@ -23,7 +23,7 @@
         # You can give explicit globs or simply directories.
         # In the latter case `**/*.{ex,exs}` will be used.
         #
-        included: ["lib/", "priv/", "test/"],
+        included: ["config/", "lib/", "priv/", "test/"],
         excluded: [~r"/_build/", ~r"/deps/", ~r"/node_modules/"]
       },
       #
@@ -81,7 +81,7 @@
         # You can customize the priority of any check
         # Priority values are: `low, normal, high, higher`
         #
-        {Credo.Check.Design.AliasUsage, [priority: :low, if_nested_deeper_than: 2, if_called_more_often_than: 2]},
+        {Credo.Check.Design.AliasUsage, [priority: :low, if_nested_deeper_than: 4, if_called_more_often_than: 2]},
         {Credo.Check.Design.DuplicatedCode, false},
         # You can also customize the exit_status of each check.
         # If you don't want TODO comments to cause `mix credo` to fail, just
@@ -119,7 +119,8 @@
          [
            order:
              ~w(moduledoc behaviour use import require alias module_attribute defstruct callback macrocallback optional_callback)a,
-           ignore: [:type]
+           ignore: [:type],
+           ignore_module_attributes: [:contract, :decorate, :operation, :trace]
          ]},
         {Credo.Check.Readability.StringSigils, []},
         {Credo.Check.Readability.TrailingBlankLine, []},

.formatter.exs

@@ -1,6 +1,7 @@
-# Used by "mix format"
+# This file is synced with stordco/common-config-elixir. Any changes will be overwritten.
+
 [
-  import_deps: [:ecto],
+  import_deps: [:ecto, :ecto_sql],
   inputs: ["*.{heex,ex,exs}", "{config,lib,priv,test}/**/*.{heex,ex,exs}"],
   line_length: 120,
   plugins: []

.github/pull_request_template.md

@@ -0,0 +1,25 @@
+## Related Ticket(s)
+
+<!--
+Enter the Jira issue below in the following format: PROJECT-##
+-->
+
+## Checklist
+
+<!--
+For each bullet, ensure your pr meets the criteria and write a note explaining how this PR relates. Mark them as complete as they are done. All top-level checkboxes should be checked regardless of their relevance to the pr with a note explaining whether they are relevant or not.
+-->
+
+- [ ] Code conforms to the [Elixir Styleguide](https://github.com/christopheradams/elixir_style_guide)
+
+## Problem
+
+<!--
+What is the problem you're solving or feature you're implementing? Link to any Jira tickets or previous discussions of the issue.
+-->
+
+## Details
+
+<!--
+Include a brief overview of the technical process you took (or are going to take!) to get from the problem to the solution.
+-->

.release-please-config.json → .github/release-please-config-stable.json

@@ -7,6 +7,11 @@
       "section": "Features",
       "hidden": false
     },
+    {
+      "type": "hotfix",
+      "section": "Hotfixes",
+      "hidden": true
+    },
     {
       "type": "fix",
       "section": "Bug Fixes",
@@ -22,9 +27,7 @@
   "draft-pull-request": false,
   "packages": {
     ".": {
-      "extra-files": [
-        "README.md"
-      ],
+      "extra-files": ["README.md"],
       "release-type": "elixir"
     }
   },

.github/workflows/ci.yaml

@@ -12,6 +12,7 @@ on:
   push:
     branches:
       - main
+      - code-freeze/**
   workflow_call:
     secrets:
       CI_SERVICE_KEY:
@@ -27,7 +28,54 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  Changed:
+    name: Changed Files
+    runs-on: ubuntu-latest
+
+    outputs:
+      database: ${{ steps.changed.outputs.database_any_changed }}
+      docker: ${{ steps.changed.outputs.docker_any_changed }}
+      elixir: ${{ steps.changed.outputs.elixir_any_changed }}
+      helm: ${{ steps.changed.outputs.helm_any_changed }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - id: changed
+        name: Get Changed Files
+        uses: tj-actions/changed-files@v44
+        with:
+          files_yaml: |
+            database:
+              - '.github/workflows/ci.yaml'
+              - 'priv/*repo/**'
+            docker:
+              - '.github/workflows/ci.yaml'
+              - 'Dockerfile'
+            documentation:
+              - 'docs/**'
+              - 'priv/documentation/**'
+              - '**.ex'
+              - '**.md'
+            elixir:
+              - '.github/workflows/ci.yaml'
+              - '.tool-versions'
+              - 'priv/**'
+              - '**.ex'
+              - '**.exs'
+              - '**.heex'
+            helm:
+              - '.github/workflows/ci.yaml'
+              - '.github/workflows/staging.yaml'
+              - '.github/workflows/production.yaml'
+              - 'helm/**'
+
   Credo:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }}
+    needs: [Changed]
     runs-on: ubuntu-latest
 
     steps:
@@ -46,8 +94,13 @@ jobs:
         run: mix credo --strict
 
   Dependencies:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }}
+    needs: [Changed]
     runs-on: ubuntu-latest
 
+    env:
+      MIX_ENV: test
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -64,6 +117,8 @@ jobs:
         run: mix deps.unlock --check-unused
 
   Dialyzer:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }}
+    needs: [Changed]
     runs-on: ubuntu-latest
 
     steps:
@@ -82,6 +137,8 @@ jobs:
         run: mix dialyzer --format github
 
   Documentation:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.documentation == 'true' }}
+    needs: [Changed]
     runs-on: ubuntu-latest
 
     steps:
@@ -100,6 +157,8 @@ jobs:
         run: mix docs
 
   Format:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }}
+    needs: [Changed]
     runs-on: ubuntu-latest
 
     steps:
@@ -117,6 +176,39 @@ jobs:
       - name: Format
         run: mix format --check-formatted
 
+  Seed:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.database == 'true' }}
+    needs: [Changed]
+    runs-on: ubuntu-latest
+
+    env:
+      MIX_ENV: test
+
+    services:
+      postgres:
+        image: postgres:14-alpine
+        ports:
+          - 5432:5432
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_INITDB_ARGS: "--nosync"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Elixir
+        uses: stordco/actions-elixir/setup@v1
+        with:
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          hex-token: ${{ secrets.HEX_API_KEY }}
+          oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }}
+          oban-token: ${{ secrets.OBAN_LICENSE_KEY }}
+
+      - name: Seed
+        run: mix ecto.setup
+
   Test:
     name: Test (Elixir ${{ matrix.versions.elixir }} OTP ${{ matrix.versions.otp }})
 
@@ -167,3 +259,33 @@ jobs:
             otp: 25
           - elixir: 1.15
             otp: 26
+
+  Trivy_Filesystem:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') }}
+    name: Trivy Filesystem Scan
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Elixir
+        uses: stordco/actions-elixir/setup@v1
+        with:
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          hex-token: ${{ secrets.HEX_API_KEY }}
+          oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }}
+          oban-token: ${{ secrets.OBAN_LICENSE_KEY }}
+
+      - name: Trivy Scan
+        uses: stordco/actions-trivy@v1
+        with:
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          scan-type: fs
+          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
+

.github/workflows/common-config-elixir.yaml

@@ -27,16 +27,18 @@ jobs:
           persist-credentials: true
 
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 18
 
       - name: Setup Elixir
         uses: stordco/actions-elixir/setup@v1
         with:
+          elixir-version: "1.15"
           github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
           hex-token: ${{ secrets.HEX_API_KEY }}
-          elixir-version: "1.15"
+          oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }}
+          oban-token: ${{ secrets.OBAN_LICENSE_KEY }}
           otp-version: "26.0"
 
       - name: Sync

.github/workflows/pr.yaml

@@ -19,15 +19,34 @@ jobs:
 
     steps:
       - name: Check
-        uses: stordco/actions[email protected]
+        uses: actions/github-script@v7
         with:
-          regex: '^(feat!|fix!|fix|feat|chore|(fix|feat|chore)\(\w.*\)):\s(\[\w{1,8}-\d{1,8}\]|.*).*'
-          hint: |
-            Your PR title does not match the Stord common convention. Please rename your PR to match one of the following formats:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const title = context.payload?.pull_request?.title;
 
-            chore: a small insignificant change
-            fix: [JIRA-1234] fix an existing feature
-            feat: [JIRA-1234] a new feature to release
-            feat!: a breaking change
+            if (typeof title !== 'string') {
+              core.info("Pull request data not in payload. Skipping PR title check.");
+              return;
+            }
 
-            Note: Adding ! (i.e. `feat!:`) represents a breaking change and will result in a SemVer major release.
+            const REGEX = /^(feat!|fix!|hotfix!|fix|feat|chore|hotfix|(fix|feat|chore|hotfix)\(\w.*\)):\s(\[\w{1,8}-\d{1,8}\]|.*).*/;
+
+            if (!REGEX.test(title)) {
+              core.setFailed("Pull request title does not follow conventional commits");
+              console.log(`
+            Pull Request title "${title}" does not follow our [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) naming scheme.
+
+            Please try renaming the PR to match one of these examples:
+
+                chore: a small insignificant change
+                fix: [JIRA-1234] fix an existing feature
+                feat: [JIRA-1234] a new feature to release
+                feat!: a breaking change
+                hotfix: needed in production immediately
+
+            Adding ! (i.e. \`feat!:\`) represents a breaking change and will result in a SemVer major release.
+
+            Starting a commit with \`hotfix\` will result in a seperate hotfix release PR.
+                `.trim());
+            }

.github/workflows/production.yaml

@@ -35,3 +35,4 @@ jobs:
         run: mix hex.publish --yes
         env:
           HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
+

.github/workflows/release.yaml

@@ -7,17 +7,20 @@ on:
     branches:
       - main
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
-  Please:
+  Stable:
     runs-on: ubuntu-latest
 
     steps:
       - id: release
         name: Release
-        uses: google-github-actions/release-please-action@v3
+        uses: googleapis/release-please-action@v4
         with:
-          command: manifest
-          config-file: .release-please-config.json
-          manifest-file: .release-please-manifest.json
-          release-type: elixir
+          config-file: .github/release-please-config-stable.json
+          manifest-file: .github/release-please-manifest.json
+          target-branch: main
           token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}