Upgrade failed

.github/workflows/uptodate.yaml

@@ -9,13 +9,14 @@ on:
   pull_request:
 
 env:
-  REF_BRANCH: prod-2-8
+  REF_BRANCH: prod-2-9
 
 jobs:
   main:
     runs-on: ubuntu-22.04
     name: Compare simple and advance branch
     timeout-minutes: 10
+    if: github.actor != 'renovate[bot]'
 
     steps:
       - uses: actions/checkout@v4
@@ -29,5 +30,13 @@ jobs:
       - run: ci/cleanup ../ref
       - run: rm ci/cleanup
 
-      - run: diff --recursive --new-file ../ref .
+      - run: cd ..; diff --unified --recursive --new-file demo_geomapfish ref
         if: always()
+      - run: cd ..; diff --unified --recursive --new-file demo_geomapfish ref  > /tmp/base.patch || true
+        if: failure()
+      - uses: actions/upload-artifact@v4
+        with:
+          name: Update from base branch.patch
+          path: /tmp/base.patch
+          retention-days: 1
+        if: failure()

.pre-commit-config.yaml

@@ -1,14 +1,35 @@
 # https://pre-commit.com/hooks.html
 
+ci:
+  autoupdate_schedule: quarterly
+  skip:
+    - ripsecrets
+
 repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+        args:
+          - --markdown-linebreak-ext=.md
+      - id: mixed-line-ending
+        args:
+          - --fix=lf
   - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v2.7.1
+    rev: v3.1.0
     hooks:
       - id: prettier
-        additional_dependencies:
-          - [email protected]
-  - repo: https://github.com/sbrunner/jsonschema-validator
-    rev: 0.1.0
+  - repo: https://github.com/PyCQA/autoflake
+    rev: v2.3.1
+    hooks:
+      - id: autoflake
+  - repo: https://github.com/PyCQA/isort
+    rev: 5.13.2
+    hooks:
+      - id: isort
+  - repo: https://github.com/psf/black
+    rev: 24.4.2
     hooks:
-      - id: jsonschema-validator
-        files: ^ci/config\.yaml$
+      - id: black

CONST_CHANGELOG.txt

@@ -1,14 +1,28 @@
 This file includes migration steps for each release of c2cgeoportal.
 
 =============
-Version 2.8.1
+Version 2.9.0
 =============
 
-1. Update dependencies to use GDAL 3.7
+Information to know before starting the upgrade
+===============================================
+
+1. The build command will use Docker Compose version 2 (with the `docker compose` command).
+
+Information
+===========
+
+1. Hostname check:
+   We add a hostname check on the `came_from` parameter, in the oauth2 login, allowed by
+   `vars.authentication.allowed_hosts` and in the OGC server clear cache, allowed by `vars.allowed_hosts`.
+   The behavior change a little bit in the `shortener.allowed_hosts` and in the `authorized_referers`.
+   Now everywhere:
+   - If the hostname (with port) of the candidate URL equals to the request's header "Host", then it's OK.
+   - If the hostname (with port) of the candidate URL is in the allowed list, then it's OK.
+   And they should be netloc (hostname with port) without schema or path.
 
-   Use MapServer 8.0 with GDAL 3.7 (instead of 3.6)
-   Use QGIS server 3.28 with GDAL 3.7 (instead of 3.6)
-   Use GDAL 3.7 as based image (instead of 3.6)
+2. We replace checks (formatting) done by `c2cciutils` by `pre-commit` hooks.
+   This will me more standard and transparent for the project.
 
 =============
 Version 2.8.0

CONST_create_template/.github/workflows/main.yaml

@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       # To publish the images to be used on Kubernetes
       # - uses: camptocamp/initialise-gopass-summon-action@v2
@@ -33,8 +33,8 @@ jobs:
       # - run: make secrets
       # - run: cat env.secrets |grep '^[# A-Z0-9_]\+='|sed -e 's/^[# A-Z0-9_]\+=\(.*\)/::add-mask::\1/g'
 
-      - name: Checks
-        run: c2cciutils-checks
+      - name: Environment information
+        run: c2cciutils-env
 
       # - name: Initialize the acceptance tests
       #   run: make acceptance-init

CONST_create_template/.github/workflows/rebuild.yaml

@@ -10,7 +10,7 @@ env:
   # Requires CI_GPG_PRIVATE_KEY and GOPASS_CI_GITHUB_TOKEN secrets.
   # OPENSHIFT_PROJECT: gs-gmf-geomapfish
   # The release branches
-  HELM_RELEASE_NAMES: int-2-8,prod-2-8
+  HELM_RELEASE_NAMES: int-2-9,prod-2-9
 
 jobs:
   rebuild:
@@ -22,11 +22,11 @@ jobs:
       fail-fast: false
       matrix:
         branch:
-          - int-2-8
-          - prod-2-8
+          - int-2-9
+          - prod-2-9
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
 

CONST_create_template/.github/workflows/update_l10n.yaml

@@ -15,13 +15,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - branch: int-2-8
+          - branch: int-2-9
             base_url: int.customer.ch
-          - branch: prod-2-8
+          - branch: prod-2-9
             base_url: prod.customer.ch
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
           token: ${{ secrets.GOPASS_CI_GITHUB_TOKEN }}

CONST_create_template/.pre-commit-config.yaml

@@ -0,0 +1,35 @@
+# https://pre-commit.com/hooks.html
+
+ci:
+  autoupdate_schedule: quarterly
+  skip:
+    - ripsecrets
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+        args:
+          - --markdown-linebreak-ext=.md
+      - id: mixed-line-ending
+        args:
+          - --fix=lf
+  - repo: https://github.com/pre-commit/mirrors-prettier
+    rev: v3.1.0
+    hooks:
+      - id: prettier
+  - repo: https://github.com/PyCQA/autoflake
+    rev: v2.3.1
+    hooks:
+      - id: autoflake
+  - repo: https://github.com/PyCQA/isort
+    rev: 5.13.2
+    hooks:
+      - id: isort
+  - repo: https://github.com/psf/black
+    rev: 24.4.2
+    hooks:
+      - id: black

CONST_create_template/Dockerfile

@@ -62,7 +62,6 @@ RUN \
         /usr/local/tomcat/webapps/ROOT/print-apps \
         /etc/haproxy_dev \
         /etc/haproxy \
-    && adduser www-data root \
     && sed 's#bind :80#bind *:443 ssl crt /etc/haproxy_dev/localhost.pem#g' /etc/haproxy/haproxy.cfg.tmpl \
         > /etc/haproxy_dev/haproxy.cfg.tmpl \
     && echo '    http-request set-header X-Forwarded-Proto https' >> /etc/haproxy_dev/haproxy.cfg.tmpl

CONST_create_template/Makefile

@@ -16,30 +16,30 @@ update-po-from-url: ## Update the po files from the URL provide by PROJECT_PUBLI
 	curl --fail --retry 5 --retry-delay 1 \
 		$(PROJECT_PUBLIC_URL)locale.pot > geoportal/${PACKAGE}_geoportal/locale/${PACKAGE}_geoportal-client${SUFFIX}.pot
 	sed -i '/^"POT-Creation-Date: /d' geoportal/${PACKAGE}_geoportal/locale/${PACKAGE}_geoportal-client${SUFFIX}.pot
-	docker-compose run --rm -T tools update-po-only `id --user` `id --group` $(LANGUAGES)
+	docker compose run --rm -T tools update-po-only `id --user` `id --group` $(LANGUAGES)
 
 .PHONY: update-po
 update-po: ## Update the po files from the running composition
-	docker-compose exec -T tools sh -c "USER_ID=`id --user` GROUP_ID=`id --group` make --directory=geoportal update-po"
+	docker compose exec -T tools sh -c "USER_ID=`id --user` GROUP_ID=`id --group` make --directory=geoportal update-po"
 
 .PHONY: checks
 checks: prospector eslint ## Runs the checks
 
 .PHONY: prospector
 prospector: ## Runs the Prospector checks
-	docker-compose run --entrypoint= --no-deps --rm --volume=$(CURDIR)/geoportal:/app geoportal \
+	docker compose run --entrypoint= --no-deps --rm --volume=$(CURDIR)/geoportal:/app geoportal \
 		prospector --output-format=pylint --die-on-tool-error
 
 .PHONY: eslint
 eslint: ## Runs the eslint checks
-	docker-compose run --entrypoint= --no-deps --rm --volume=$(CURDIR)/geoportal:/app geoportal \
+	docker compose run --entrypoint= --no-deps --rm --volume=$(CURDIR)/geoportal:/app geoportal \
 		eslint $(find geomapfish -type f -name '*.js' -print 2> /dev/null)
-	docker-compose run --entrypoint= --no-deps --rm --volume=$(CURDIR)/geoportal:/app geoportal \
+	docker compose run --entrypoint= --no-deps --rm --volume=$(CURDIR)/geoportal:/app geoportal \
 		eslint $(find geomapfish -type f -name '*.ts' -print 2> /dev/null)
 
 .PHONY: qgis
 qgis: ## Run QGIS desktop
-	docker-compose -f docker-compose.yaml -f docker-compose-qgis.yaml run --rm qgis
+	docker compose -f docker-compose.yaml -f docker-compose-qgis.yaml run --rm qgis
 
 secrets.tar.bz2.gpg: env.secrets ## Encrypt the secrets for committing changes
 	tar -jcf secrets.tar.bz2 $^
@@ -57,14 +57,14 @@ secrets: ## Decrypt the secrets.tar.bz2.gpg file
 
 .PHONY: acceptance-init
 acceptance-init: ## Initialize the acceptance tests
-	docker-compose --file=docker-compose.yaml --file=docker-compose-db.yaml up -d db tools
-	docker-compose exec -T tools wait-db
-	docker-compose exec -T tools psql --command="DROP EXTENSION IF EXISTS postgis CASCADE"
+	docker compose --file=docker-compose.yaml --file=docker-compose-db.yaml up -d db tools
+	docker compose exec -T tools wait-db
+	docker compose exec -T tools psql --command="DROP EXTENSION IF EXISTS postgis CASCADE"
 	scripts/db-restore --docker-compose-file=docker-compose.yaml --docker-compose-file=docker-compose-db.yaml \
 		--arg=--clean --arg=--if-exists --arg=--verbose $(DUMP_FILE)
-	docker-compose --file=docker-compose.yaml --file=docker-compose-db.yaml up -d
+	docker compose --file=docker-compose.yaml --file=docker-compose-db.yaml up -d
 
 .PHONY: acceptance
 acceptance: ## Run the acceptance tests
-	docker-compose exec -T tools pytest -vv tests/
+	docker compose exec -T tools pytest -vv tests/
 	ci/docker-compose-check

CONST_create_template/README.rst

@@ -1,7 +1,7 @@
 demo_geomapfish project
 ===================
 
-Read the `Documentation <https://camptocamp.github.io/c2cgeoportal/2.8/>`_
+Read the `Documentation <https://camptocamp.github.io/c2cgeoportal/2.9/>`_
 
 Checkout
 --------
@@ -24,6 +24,6 @@ Run
 
 .. code::
 
-   docker-compose up -d
+   docker compose up -d
 
 .. Feel free to add project-specific things.

CONST_create_template/build

@@ -22,17 +22,13 @@ def run(
     args: argparse.Namespace, command: List[str], exit_on_error: bool = True, **kwargs: Any
 ) -> Optional[CompletedProcess]:
     if args.verbose or args.dry_run:
-        print(" ".join([shlex.quote(c) for c in command]))
+        print(shlex.join(command))
     if not args.dry_run or "stdout" in kwargs:
         if args.stack_trace and exit_on_error and not "checks" in kwargs:
             kwargs["check"] = True
         process = subprocess.run(command, **kwargs)  # nosec
         if exit_on_error and process.returncode != 0:
-            print(
-                "An error occurred during execution of `{}`".format(
-                    " ".join([shlex.quote(c) for c in command])
-                )
-            )
+            print(f"An error occurred during execution of `{shlex.join(command)}`")
             sys.exit(process.returncode)
         return process
     return None
@@ -103,6 +99,7 @@ def main() -> None:
             sys.exit(1)
         sys.exit(0)
 
+    docker_compose_command = ["docker", "compose"]
     with open("project.yaml", encoding="utf-8") as project_file:
         project_env = yaml.load(project_file, Loader=yaml.SafeLoader)["env"]
     if len(args.env_files) != project_env["required_args"]:
@@ -112,7 +109,7 @@ def main() -> None:
     print("Use env files: {}".format(", ".join(env_files)))
     for env_file in env_files:
         if not os.path.exists(env_file):
-            print("Error: the env file '{env_file}' does not exist.".format(env_file=env_file))
+            print(f"Error: the env file '{env_file}' does not exist.")
             sys.exit(1)
 
     with open(".env", "w", encoding="utf-8") as dest:
@@ -128,18 +125,18 @@ def main() -> None:
 
             git_hash = run(args, ["git", "rev-parse", "HEAD"], stdout=subprocess.PIPE).stdout.decode().strip()
 
-            dest.write("SIMPLE={}\n".format(str(simple).upper()))
-            dest.write("GIT_HASH={git_hash}\n".format(git_hash=git_hash))
+            dest.write(f"SIMPLE={str(simple).upper()}\n")
+            dest.write(f"GIT_HASH={git_hash}\n")
 
         dest.write("# Used env files: {}\n".format(", ".join(env_files)))
 
     if not args.env:
-        docker_compose_build_cmd = ["docker-compose", "build"]
+        docker_compose_build_cmd = [*docker_compose_command, "build"]
 
         if not args.no_pull:
             # Pull all the images
             if not args.service:
-                run(args, ["docker-compose", "pull", "--ignore-pull-failures"])  # nosec
+                run(args, [*docker_compose_command, "pull", "--ignore-buildable"])  # nosec
             docker_compose_build_cmd.append("--pull")
 
         if args.service:
@@ -163,7 +160,7 @@ def main() -> None:
             service
             for service in run(
                 args,
-                ["docker-compose", "ps", "--services", "--all"],
+                [*docker_compose_command, "ps", "--services", "--all"],
                 stdout=subprocess.PIPE,
                 exit_on_error=True,
             )
@@ -173,9 +170,9 @@ def main() -> None:
         ]
 
     if args.reload is not None:
-        run(args, ["docker-compose", "rm", "--force", "-v", "config"])
+        run(args, [*docker_compose_command, "rm", "--force", "-v", "config"])
         for service in services:
-            run(args, ["docker-compose", "up", "--detach", "--force-recreate", service])
+            run(args, [*docker_compose_command, "up", "--detach", "--force-recreate", service])
 
 
 if __name__ == "__main__":

CONST_create_template/ci/config.yaml

@@ -1,4 +1,4 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/c2cciutils/1.4/c2cciutils/schema.json
+# yaml-language-server: $schema=https://raw.githubusercontent.com/camptocamp/c2cciutils/master/c2cciutils/schema.json
 
 checks:
   codespell: False

CONST_create_template/ci/docker-compose-check

@@ -11,7 +11,7 @@ def _main() -> None:
 
     services = [
         s.strip()
-        for s in subprocess.run(["docker-compose", "ps"], check=True, stdout=subprocess.PIPE)
+        for s in subprocess.run(["docker", "compose", "ps"], check=True, stdout=subprocess.PIPE)
         .stdout.decode("utf-8")
         .splitlines()
     ]

CONST_create_template/ci/requirements.txt

@@ -1 +1 @@
-c2cciutils[checks,publish]==1.4.16
+c2cciutils[checks,publish]==1.6.21

CONST_create_template/docker-compose-db.yaml

@@ -1,7 +1,5 @@
 # This file is used by the acceptance tests to have a local database.
 
-version: '2.3'
-
 volumes:
   postgresql_data: