Update event security logs documentation regarding logging charm operations

.github/pull_request_template.md

@@ -0,0 +1,7 @@
+## Issue
+
+## Solution
+
+## Checklist
+- [ ] I have added or updated any relevant documentation.
+- [ ] I have cleaned any remaining cloud resources from my accounts.

.github/renovate.json5

@@ -4,41 +4,16 @@
     'github>canonical/data-platform//renovate_presets/charm.json5',
   ],
   reviewers: [
-    'team:data-platform-postgresql',
+    'team:data-postgresql',
   ],
+  "baseBranches": ["main", "/^*\\/edge$/"],
   packageRules: [
     {
       matchPackageNames: [
         'pydantic',
       ],
       allowedVersions: '<2.0.0',
     },
-    {
-      matchManagers: [
-        'custom.regex',
-      ],
-      matchDepNames: [
-        'juju',
-      ],
-      matchDatasources: [
-        'pypi',
-      ],
-      allowedVersions: '<3',
-      groupName: 'Juju agents',
-    },
-  ],
-  customManagers: [
-    {
-      customType: 'regex',
-      fileMatch: [
-        '^\\.github/workflows/[^/]+\\.ya?ml$',
-      ],
-      matchStrings: [
-        '(libjuju: )==(?<currentValue>.*?) +# renovate: latest libjuju 2',
-      ],
-      depNameTemplate: 'juju',
-      datasourceTemplate: 'pypi',
-      versioningTemplate: 'loose',
-    },
   ],
+  customManagers: [],
 }

.github/workflows/approve_renovate_pr.yaml

@@ -10,6 +10,6 @@ on:
 jobs:
   approve-pr:
     name: Approve Renovate pull request
-    uses: canonical/data-platform-workflows/.github/workflows/approve_renovate_pr.yaml@v31.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/approve_renovate_pr.yaml@v35.0.2
     permissions:
       pull-requests: write  # Needed to approve PR

.github/workflows/automatic-doc-checks.yml

@@ -0,0 +1,24 @@
+#
+name: Automatic doc checks
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    paths:
+      - 'docs/**'   # Only run on changes to the docs directory
+
+  workflow_dispatch:
+    # Manual trigger
+
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  documentation-checks:
+    uses: canonical/documentation-workflows/.github/workflows/documentation-checks.yaml@main
+    with:
+      working-directory: "docs"
+      fetch-depth: 0

.github/workflows/check_pr.yaml

@@ -11,8 +11,9 @@ on:
       - edited
     branches:
       - main
+      - '*/edge'
 
 jobs:
   check-pr:
     name: Check pull request
-    uses: canonical/data-platform-workflows/.github/workflows/check_charm_pr.yaml@v31.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/check_charm_pr.yaml@v35.0.2

.github/workflows/ci.yaml

@@ -14,7 +14,8 @@ on:
       - 'LICENSE'
       - '**.md'
       - .github/renovate.json5
-      - '.github/workflows/sync_docs.yaml'
+      - 'docs/**'
+      - 'terraform/**'
   schedule:
     - cron: '53 0 * * *'  # Daily at 00:53 UTC
   # Triggered on push to branch "main" by .github/workflows/release.yaml
@@ -27,15 +28,15 @@ on:
 jobs:
   lint:
     name: Lint
-    uses: canonical/data-platform-workflows/.github/workflows/lint.yaml@v31.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/lint.yaml@v35.0.2
 
   unit-test:
     name: Unit test charm
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Install tox & poetry
         run: |
           pipx install tox
@@ -49,7 +50,7 @@ jobs:
 
   build:
     name: Build charm
-    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v31.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/build_charm.yaml@v35.0.2
 
   integration-test:
     name: Integration test charm

.github/workflows/integration_test.yaml

@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Set up environment
         run: |
           sudo snap install charmcraft --classic
@@ -84,20 +84,11 @@ jobs:
     needs:
       - collect-integration-tests
     runs-on: ${{ matrix.job.runner }}
-    timeout-minutes: 217  # Sum of steps `timeout-minutes` + 5
+    timeout-minutes: 216  # Sum of steps `timeout-minutes` + 5
     steps:
-      - name: Free up disk space
-        timeout-minutes: 1
-        run: |
-          printf '\nDisk usage before cleanup\n'
-          df --human-readable
-          # Based on https://github.com/actions/runner-images/issues/2840#issuecomment-790492173
-          rm -r /opt/hostedtoolcache/
-          printf '\nDisk usage after cleanup\n'
-          df --human-readable
       - name: Checkout
         timeout-minutes: 3
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - name: Set up environment
         timeout-minutes: 5
         run: sudo snap install charmcraft --classic
@@ -108,7 +99,7 @@ jobs:
           go install github.com/snapcore/spread/cmd/spread@latest
       - name: Download packed charm(s)
         timeout-minutes: 5
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           pattern: ${{ inputs.artifact-prefix }}-*
           merge-multiple: true
@@ -141,6 +132,11 @@ jobs:
       - timeout-minutes: 1
         if: ${{ success() || (failure() && steps.spread.outcome == 'failure') }}
         run: snap list
+      - name: lxc image list
+        timeout-minutes: 1
+        if: ${{ success() || (failure() && steps.spread.outcome == 'failure') }}
+        # sudo needed since spread runs scripts as root
+        run: sudo lxc image list
       - name: Select model
         timeout-minutes: 1
         # `!contains(matrix.job.spread_job, 'juju29')` workaround for juju 2 error:
@@ -157,7 +153,7 @@ jobs:
       - name: juju status
         timeout-minutes: 1
         if: ${{ !contains(matrix.job.spread_job, 'juju29') && (success() || (failure() && steps.spread.outcome == 'failure')) }}
-        run: sudo juju status --color --relations | tee ~/logs/juju-status.txt
+        run: sudo juju status --color --relations --storage | tee ~/logs/juju-status.txt
       - name: juju debug-log
         timeout-minutes: 3
         if: ${{ !contains(matrix.job.spread_job, 'juju29') && (success() || (failure() && steps.spread.outcome == 'failure')) }}
@@ -207,19 +203,19 @@ jobs:
       # git push origin gh-pages-beta
       # )
       - name: Checkout GitHub pages branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           ref: gh-pages-beta
           path: repo/
       - name: Download default test results
         # Default test results in case the integration tests time out or runner set up fails
         # (So that Allure report will show "unknown"/"failed" test result, instead of omitting the test)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           path: allure-default-results/
           name: allure-default-results-integration-test
       - name: Download test results
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v5
         with:
           path: allure-results/
           pattern: allure-results-integration-test-*

.github/workflows/lib-check.yaml

@@ -14,6 +14,7 @@ on:
       - 'LICENSE'
       - '**.md'
       - 'renovate.json'
+      - 'docs/**'
 
 jobs:
   lib-check:
@@ -23,7 +24,7 @@ jobs:
     if: ${{ github.event.pull_request.head.repo.full_name == 'canonical/postgresql-operator' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
       - name: Check libs

.github/workflows/promote.yaml

@@ -25,9 +25,9 @@ on:
 jobs:
   promote:
     name: Promote charm
-    uses: canonical/data-platform-workflows/.github/workflows/_promote_charm.yaml@v31.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/_promote_charm.yaml@v35.0.2
     with:
-      track: '14'
+      track: '16'
       from-risk: ${{ inputs.from-risk }}
       to-risk: ${{ inputs.to-risk }}
     secrets:

.github/workflows/release.yaml

@@ -1,11 +1,11 @@
 # Copyright 2023 Canonical Ltd.
 # See LICENSE file for licensing details.
-name: Release to Charmhub
+name: Release to Charmhub edge
 
 on:
   push:
     branches:
-      - main
+      - '*/edge'
     paths-ignore:
       - 'tests/**'
       - 'docs/**'
@@ -16,8 +16,18 @@ on:
       - '.github/workflows/sync_docs.yaml'
 
 jobs:
+  tag:
+    name: Create charm refresh compatibility version git tag
+    uses: canonical/data-platform-workflows/.github/workflows/tag_charm_edge.yaml@v35.0.2
+    with:
+      track: '16'
+    permissions:
+      contents: write  # Needed to create git tag
+
   ci-tests:
     name: Tests
+    needs:
+      - tag
     uses: ./.github/workflows/ci.yaml
     secrets: inherit
     permissions:
@@ -26,10 +36,11 @@ jobs:
   release:
     name: Release charm
     needs:
+      - tag
       - ci-tests
-    uses: canonical/data-platform-workflows/.github/workflows/release_charm.yaml@v31.0.0
+    uses: canonical/data-platform-workflows/.github/workflows/release_charm_edge.yaml@v35.0.2
     with:
-      channel: 14/edge
+      track: 16
       artifact-prefix: ${{ needs.ci-tests.outputs.artifact-prefix }}
     secrets:
       charmhub-token: ${{ secrets.CHARMHUB_TOKEN }}

.github/workflows/tiobe_scan.yaml

@@ -0,0 +1,44 @@
+# Copyright 2025 Canonical Ltd.
+# See LICENSE file for licensing details.
+
+name: Weekly TICS scan
+
+on:
+  schedule:
+    - cron: "0 2 * * 6" # Every Saturday 2:00 AM UTC
+  workflow_dispatch:
+
+jobs:
+  TICS:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Create and activate virtual environment
+        run: |
+          python3 -m venv .venv
+          . .venv/bin/activate
+          pip install flake8 poetry pylint pytest tox
+          poetry install --all-groups
+          echo PATH="$PATH" >> "$GITHUB_ENV"
+
+      - name: Run coverage tests
+        run: |
+          tox -e unit
+
+      - name: Move results to the necessary folder for TICS
+        run: |
+          mkdir -p .cover
+          mv coverage.xml .cover/cobertura.xml
+
+      - name: TICS GitHub Action
+        uses: tiobe/tics-github-action@v3
+        with:
+          mode: qserver
+          project: postgresql-operator
+          viewerUrl: https://canonical.tiobe.com/tiobeweb/TICS/api/cfg?name=default
+          branchdir: ${{ env.GITHUB_WORKSPACE }}
+          ticsAuthToken: ${{ secrets.TICSAUTHTOKEN }}
+          installTics: true
+          calc: ALL

.gitignore

@@ -6,11 +6,18 @@ build/
 __pycache__/
 *.py[cod]
 coverage.xml
-requirements.txt
+/requirements.txt
 requirements-last-build.txt
+.last_refresh_unit_status.json
 
 # PyCharm project folder.
 .idea/
 
 # LXD profile used for deployment on local development environment.
 lxd-profile.yaml
+
+# Terraform runtime
+terraform/.terraform.lock.hcl
+terraform/.terraform/
+terraform/terraform.tfstate
+terraform/terraform.tfstate.backup