Ruby & Rails Updates

.erb_lint.yml

@@ -0,0 +1,29 @@
+---
+EnableDefaultLinters: true
+glob: "**/*.{html,text,js}{+*,}.erb"
+exclude:
+  - '**/vendor/**/*'
+  - '**/node_modules/**/*'
+  - 'app/views/*_mailer/*.text.erb'
+linters:
+  ErbSafety:
+    enabled: true
+  ParserErrors:
+    enabled: false
+  Rubocop:
+    enabled: true
+    rubocop_config:
+      inherit_from:
+        - .rubocop.yml
+      Layout/InitialIndentation:
+        Enabled: false
+      Layout/LineLength:
+        Enabled: false
+      Layout/TrailingEmptyLines:
+        Enabled: false
+      Lint/UselessAssignment:
+        Enabled: false
+      Naming/VariableNumber:
+        Enabled: false
+      Style/FrozenStringLiteralComment:
+        Enabled: false

.github/workflows/brakeman.yml

@@ -0,0 +1,54 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow integrates Brakeman with GitHub's Code Scanning feature
+# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications
+
+name: Brakeman Scan
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+  schedule:
+    - cron: '27 8 * * 5'
+
+permissions:
+  contents: read
+
+env:
+  RAILS_ENV: test
+
+jobs:
+  brakeman-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+    name: Brakeman Scan
+    runs-on: ubuntu-latest
+    steps:
+    # Checkout the repository to the GitHub Actions runner
+    - name: Checkout
+      uses: actions/checkout@v6
+
+    # Customize the ruby version depending on your needs
+    - name: Setup Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+
+    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
+    - name: Scan
+      continue-on-error: true
+      run: |
+        bundle exec brakeman --ignore-config config/brakeman.ignore --format sarif --output tmp/output.sarif.json
+
+    # Upload the SARIF file generated in the previous step
+    - name: Upload SARIF
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: tmp/output.sarif.json

.github/workflows/lint-css.yml

@@ -0,0 +1,18 @@
+name: Stylesheets
+
+on:
+  - workflow_dispatch
+
+permissions:
+  contents: read
+
+jobs:
+  stylelint:
+    name: CSS files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+      - run: bin/stylelint

.github/workflows/lint-erb.yml

@@ -0,0 +1,23 @@
+name: ERB Templates
+
+on:
+  - workflow_dispatch
+
+permissions:
+  contents: read
+
+env:
+  RAILS_ENV: test
+
+jobs:
+  erblint:
+    name: ERB files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+      - name: Run ERB Lint
+        run: bin/erblint

.github/workflows/lint-js.yml

@@ -0,0 +1,27 @@
+name: Javascripts
+
+on:
+  - workflow_dispatch
+
+permissions:
+  contents: read
+
+jobs:
+  eslint:
+    name: Plain JS files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+      - run: bin/eslint
+  coffeelint:
+    name: Coffee JS files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+      - run: bin/coffeelint

.github/workflows/rubocop.yml

@@ -0,0 +1,23 @@
+name: RuboCop
+
+on:
+  - workflow_dispatch
+
+permissions:
+  contents: read
+
+env:
+  RAILS_ENV: test
+
+jobs:
+  rubocop:
+    name: Run
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+      - name: Run RuboCop
+        run: bin/rubocop

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Rails Tests
+
+on:
+  - workflow_dispatch
+
+env:
+  RAILS_ENV: test
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: true
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: '.nvmrc'
+      - run: yarn install
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+      - name: Prepare Assets
+        run: bundle exec rails assets:precompile
+      - name: Run Rails Tests
+        run: bundle exec rails test -b -d
+

.rubocop.yml

@@ -0,0 +1,66 @@
+plugins:
+  - rubocop-capybara
+  - rubocop-minitest
+  - rubocop-performance
+  - rubocop-rails
+
+AllCops:
+  Exclude:
+    - 'bin/*'
+    - 'config/ci.rb'
+    - 'config.ru'
+    - 'db/schema.rb'
+    - 'Rakefile'
+    - 'vendor/**/**'
+  NewCops: enable
+
+Layout/EmptyLineAfterGuardClause:
+  Enabled: false
+
+Layout/SpaceInsideArrayLiteralBrackets:
+  Exclude: ['config/environments/*']
+
+Metrics/BlockLength:
+  Exclude:
+    - 'config/routes.rb'
+
+Metrics/ClassLength:
+  Exclude:
+    - 'test/**/*'
+
+Minitest/EmptyLineBeforeAssertionMethods:
+  Enabled: false
+
+Style/Documentation:
+  Enabled: false
+
+Style/FrozenStringLiteralComment:
+  Exclude:
+    - 'config/application.rb'
+    - 'config/boot.rb'
+    - 'config/environment.rb'
+    - 'config/environments/*'
+    - 'config/initializers/assets.rb'
+    - 'config/initializers/content_security_policy.rb'
+    - 'config/initializers/filter_parameter_logging.rb'
+    - 'config/initializers/inflections.rb'
+    - 'config/initializers/permissions_policy.rb'
+    - 'config/puma.rb'
+    - 'Gemfile'
+
+Style/GlobalStdStream:
+  Exclude:
+    - 'config/environments/*'
+
+Style/StringLiterals:
+  Exclude:
+    - 'config/application.rb'
+    - 'config/boot.rb'
+    - 'config/environment.rb'
+    - 'config/environments/*'
+    - 'config/initializers/assets.rb'
+    - 'config/puma.rb'
+
+Style/SymbolArray:
+  Exclude:
+    - 'config/initializers/filter_parameter_logging.rb'

.ruby-version

@@ -1 +1 @@
-ruby-3.2.2
+ruby-4.0.5

.stylelintignore

@@ -0,0 +1,2 @@
+lib/assets/**/*
+vendor/assets/**/*

.yarnrc.yml

@@ -4,4 +4,6 @@ enableGlobalCache: false
 
 nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-4.7.0.cjs
+npmMinimalAgeGate: 0
+
+yarnPath: .yarn/releases/yarn-4.16.0.cjs

Dockerfile

@@ -1,6 +1,6 @@
 # syntax = docker/dockerfile:1
 
-FROM ruby:3.2-slim AS base
+FROM ruby:4.0-slim-bookworm AS base
 
 LABEL org.opencontainers.image.source="https://github.com/bfpi/klarschiff-client"
 LABEL org.opencontainers.image.authors="BFPI GmbH"
@@ -16,7 +16,7 @@ RUN echo "${GITHUB_BRANCH:-unknown} / ${GITHUB_COMMIT_HASH:-unknown}" > /rails/g
 ENV RAILS_ENV=${RAILS_ENV} \
     BUNDLE_DEPLOYMENT="1" \
     BUNDLE_PATH="/usr/local/bundle" \
-    BUNDLE_WITHOUT="development"
+    BUNDLE_WITHOUT="development test"
 
 # Throw-away build stage to reduce size of final image
 FROM base AS build