ci: add a working CI gate

.github/workflows/ci.yml

@@ -1,65 +1,136 @@
-# name: CI
+name: CI
 
-# on:
-#   push:
-#     branches:
-#       - deploy-v3
-#   pull_request: ~
-#   workflow_dispatch: ~
+on:
+  push:
+    branches:
+      - main
+  pull_request: ~
+  workflow_dispatch: ~
 
-# concurrency:
-#   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-#   cancel-in-progress: true
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
-# jobs:
-#   tests:
-#     name: Tests
-#     runs-on: ubuntu-latest
-#     permissions:
-#       contents: 'read'
-#       id-token: 'write'
-#     steps:
-#       - name: Checkout
-#         uses: actions/checkout@v3
-#       - name: Pull images
-#         run: docker compose pull --ignore-pull-failures || true
-#       - name: Start services
-#         run: docker compose up --build -d
-#       - name: Wait for services
-#         run: |
-#           while status="$(docker inspect --format="{{if .Config.Healthcheck}}{{print .State.Health.Status}}{{end}}" "$(docker compose ps -q php)")"; do
-#             case $status in
-#               starting) sleep 1;;
-#               healthy) exit 0;;
-#               unhealthy)
-#                 docker compose ps
-#                 docker compose logs
-#                 exit 1
-#               ;;
-#             esac
-#           done
-#           exit 1
-#       - name: Check HTTP reachability
-#         run: curl -v -o /dev/null http://localhost
-#       - name: Check API reachability
-#         run: curl -vk -o /dev/null https://localhost
-#       - name: Check PWA reachability
-#         run: "curl -vk -o /dev/null -H 'Accept: text/html' https://localhost"
-#       - name: Create test database
-#         run: |
-#           docker compose exec -T php bin/console -e test doctrine:database:create
-#           docker compose exec -T php bin/console -e test doctrine:migrations:migrate --no-interaction
-#       - name: PHPUnit
-#         run: docker compose exec -T php bin/phpunit
-#       - name: Doctrine Schema Validator
-#         run: docker compose exec -T php bin/console doctrine:schema:validate
-#       - name: Psalm
-#         run: docker compose exec -T php vendor/bin/psalm
-#       # gcloud does not work with Python 3.10 because collections. Mappings were removed in Python 3.10.
-#       - uses: actions/setup-python@v4
-#         with:
-#           python-version: 3.9.15
-#       - name: Setup gcloud
-#         uses: google-github-actions/setup-gcloud@v1
-#       - name: Lint Helm
-#         run: helm lint ./helm/api-platform/
+permissions:
+  contents: read
+
+jobs:
+  pwa:
+    name: PWA
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: pwa
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # Activated globally: the cache lookup below runs pnpm from the repository
+      # root, where no packageManager field pins the version.
+      - name: Enable corepack
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.1.1 --activate
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: pwa/pnpm-lock.yaml
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: ESLint
+        run: pnpm lint
+
+  api:
+    name: API
+    runs-on: ubuntu-latest
+    env:
+      APP_ENV: test
+    defaults:
+      run:
+        working-directory: api
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: '8.4'
+          coverage: none
+          tools: composer:v2
+      - name: Validate composer.json and composer.lock
+        run: composer validate --strict --no-check-publish
+      - name: Get Composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+      - name: Cache Composer dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('api/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress
+      - name: Lint YAML
+        run: bin/console lint:yaml config --parse-tags
+      - name: Lint Twig
+        run: bin/console lint:twig templates
+      - name: Lint container
+        run: bin/console lint:container
+
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    env:
+      # Falls back to the run token on forks, where the personal token is absent:
+      # the contributors fetch during the PWA build is rate-limited without one.
+      GITHUB_KEY: ${{ secrets.GH_KEY || secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Pull images
+        run: docker compose pull --ignore-pull-failures || true
+      - name: Start services
+        run: docker compose up --build -d
+      - name: Wait for services
+        run: |
+          while status="$(docker inspect --format="{{if .Config.Healthcheck}}{{print .State.Health.Status}}{{end}}" "$(docker compose ps -q php)")"; do
+            case $status in
+              starting) sleep 1;;
+              healthy) exit 0;;
+              unhealthy)
+                docker compose ps
+                docker compose logs
+                exit 1
+              ;;
+            esac
+          done
+          exit 1
+      - name: Check HTTP reachability
+        run: curl -v -o /dev/null http://localhost
+      - name: Check API reachability
+        run: curl -vk -o /dev/null https://localhost
+      - name: Check PWA reachability
+        run: "curl -vk -o /dev/null -H 'Accept: text/html' https://localhost"
+      - name: Create test database
+        run: |
+          docker compose exec -T php bin/console -e test doctrine:database:create
+          docker compose exec -T php bin/console -e test doctrine:migrations:migrate --no-interaction
+      - name: PHPUnit
+        run: docker compose exec -T -e SYMFONY_DEPRECATIONS_HELPER='max[self]=0' php bin/phpunit
+      - name: Doctrine Schema Validator
+        run: docker compose exec -T php bin/console doctrine:schema:validate
+
+  helm:
+    name: Helm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+      - name: Lint Helm
+        run: helm lint ./helm/api-platform/

README.md

@@ -18,11 +18,11 @@ You need to use a valid github token to retrieve the list of contributors.
 2. Select scopes `public_repo`, `read:org` and `read:user`, generate the token and copy it.
 3. If you use "pnpm dev" on the folder pwa to launch the project, add a new `.env.local` file on the root of pwa folder, and set your token as an environment variable named `GITHUB_KEY`. 
 
-If you use docker, create a file "secret_github_key" at the root of the project with your token inside:
+If you use docker, export your token as a `GITHUB_KEY` environment variable, which the compose file reads to build the images:
 
 ```console
-# Create the secret_github_key file
-echo "YOUR_GITHUB_TOKEN" > secret_github_key
+# Export the token for the current shell
+export GITHUB_KEY=YOUR_GITHUB_TOKEN
 ```
 
 > **❗Core team badges restriction**: You need to be a member of API Platform organization to retrieve API Platform teams. You can still locally launch the project, but the badges of the core team members will not appear.
@@ -38,8 +38,8 @@ git clone https://github.com/api-platform/website.git
 # Change directory
 cd website
 
-# Create the github_key file
-echo YOUR_GITHUB_TOKEN > secret_github_key
+# Export the GitHub token
+export GITHUB_KEY=YOUR_GITHUB_TOKEN
 
 # Install and run the project locally
 docker compose up -d

api/config/packages/doctrine.yaml

@@ -6,6 +6,10 @@ doctrine:
         # either here or in the DATABASE_URL env var (see .env file)
         #server_version: '15'
     orm:
+        # The schema was created when SEQUENCE was the PostgreSQL default; IDENTITY
+        # is now, and it expects a column default the migrations never created.
+        identity_generation_preferences:
+            Doctrine\DBAL\Platforms\PostgreSQLPlatform: sequence
         naming_strategy: doctrine.orm.naming_strategy.underscore_number_aware
         auto_mapping: true
         mappings:

api/config/routes/framework.yaml

@@ -1,4 +1,4 @@
 when@dev:
     _errors:
-        resource: '@FrameworkBundle/Resources/config/routing/errors.xml'
+        resource: '@FrameworkBundle/Resources/config/routing/errors.php'
         prefix: /_error

api/config/routes/web_profiler.yaml

@@ -1,8 +1,8 @@
 when@dev:
     web_profiler_wdt:
-        resource: '@WebProfilerBundle/Resources/config/routing/wdt.xml'
+        resource: '@WebProfilerBundle/Resources/config/routing/wdt.php'
         prefix: /_wdt
 
     web_profiler_profiler:
-        resource: '@WebProfilerBundle/Resources/config/routing/profiler.xml'
+        resource: '@WebProfilerBundle/Resources/config/routing/profiler.php'
         prefix: /_profiler

api/src/Entity/Greeting.php

@@ -9,7 +9,7 @@
 /**
  * This is a dummy entity. Remove it!
  */
-#[ApiResource(mercure: true)]
+#[ApiResource]
 #[ORM\Entity]
 class Greeting
 {

docker-compose.yml

@@ -88,4 +88,4 @@ volumes:
 
 secrets:
   GITHUB_KEY:
-    file: ./secret_github_key
+    environment: GITHUB_KEY

pwa/.eslintrc.json

@@ -14,7 +14,18 @@
     "@typescript-eslint/no-explicit-any": "off",
     "prettier/prettier": [
       "warn"
-    ]
+    ],
+    "getter-return": "error",
+    "no-const-assign": "error",
+    "no-dupe-args": "error",
+    "no-dupe-keys": "error",
+    "no-func-assign": "error",
+    "no-import-assign": "error",
+    "no-obj-calls": "error",
+    "no-setter-return": "error",
+    "no-unreachable": "error",
+    "use-isnan": "error",
+    "valid-typeof": "error"
   },
   "settings": {
    "next": {