Staging -> Prod

.docker-hub/docker-compose.yml

@@ -0,0 +1,28 @@
+services:
+  frontend-image:
+    image: ${REGISTRY:-docker.io}/${REPO_OWNER:-ecamp}/ecamp3-frontend:${VERSION:-latest}
+    build:
+      context: ../
+      dockerfile: .docker-hub/frontend/Dockerfile
+      # they have to be registered in GitHub under exactly this name in secrets or vars
+      args:
+        SENTRY_AUTH_TOKEN: ${SENTRY_AUTH_TOKEN:-}
+        SENTRY_ORG: ${SENTRY_ORG:-}
+        SENTRY_FRONTEND_PROJECT: ${SENTRY_FRONTEND_PROJECT:-}
+        SENTRY_RELEASE_NAME: ${RELEASE_NAME:-}
+  print-image:
+    image: ${REGISTRY:-docker.io}/${REPO_OWNER:-ecamp}/ecamp3-print:${VERSION:-latest}
+    build:
+      context: ../
+      dockerfile: .docker-hub/print/Dockerfile
+      # they have to be registered in GitHub under exactly this name in secrets or vars
+      args:
+        SENTRY_AUTH_TOKEN: ${SENTRY_AUTH_TOKEN:-}
+        SENTRY_ORG: ${SENTRY_ORG:-}
+        SENTRY_PRINT_PROJECT: ${SENTRY_PRINT_PROJECT:-}
+        SENTRY_RELEASE_NAME: ${RELEASE_NAME:-}
+  varnish-image:
+    image: ${REGISTRY:-docker.io}/${REPO_OWNER:-ecamp}/ecamp3-varnish:${VERSION:-latest}
+    build:
+      context: varnish
+      dockerfile: Dockerfile

.docker-hub/print/Dockerfile

@@ -1,6 +1,6 @@
 # build stage
-FROM node:24.7.0 AS build-stage
+FROM node:24.8.0 AS build-stage
 ARG SENTRY_AUTH_TOKEN
 ARG SENTRY_ORG
 ARG SENTRY_PRINT_PROJECT
 ARG SENTRY_RELEASE_NAME
@@ -11,7 +11,7 @@
 
 COPY print/package*.json ./
 
 ENV NUXT_SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN
 ENV NUXT_SENTRY_ORG=$SENTRY_ORG
 ENV NUXT_SENTRY_PROJECT=$SENTRY_PRINT_PROJECT
 ENV NUXT_SENTRY_RELEASE_NAME=$SENTRY_RELEASE_NAME
@@ -22,13 +22,13 @@
 RUN npm run build
 
 # production stage
-FROM node:24.7.0 AS production-stage
+FROM node:24.8.0 AS production-stage
 WORKDIR /app
 
 COPY --from=build-stage /app/.output ./.output
 
 ENV NITRO_HOST 0.0.0.0
 ENV NITRO_PORT 80
 
 EXPOSE 80
 CMD node ./.output/server/index.mjs

.docker-hub/varnish/Dockerfile

@@ -1,4 +1,4 @@
-ARG VERSION=7.7.3
+ARG VERSION=8.0.0
 
 FROM varnish:${VERSION}
 

.github/actions/setup-helmfile/action.yaml

@@ -0,0 +1,13 @@
+name: 'Setup helmfile'
+description: 'Sets up helmfile in /usr/local/bin/helmfile'
+runs:
+  using: "composite"
+  steps:
+    - name: install helmfile
+      run: |
+        curl -L https://github.com/helmfile/helmfile/releases/download/v1.1.3/helmfile_1.1.3_linux_amd64.tar.gz -o helmfile.tar.gz
+        tar -xvf /tmp/helmfile.tar.gz
+        mv helmfile /usr/local/bin
+        chmod +x /usr/local/bin/helmfile
+      working-directory: /tmp
+      shell: bash

.github/workflows/continuous-integration-optional.yml

@@ -45,7 +45,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -75,7 +75,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -123,7 +123,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -136,5 +136,5 @@ jobs:
       - run: php bin/console doctrine:migrations:migrate --no-interaction -e test
         working-directory: api
 
-      - run: php bin/console doctrine:schema:validate --skip-sync -e test && php bin/console doctrine:migrations:up-to-date -e test && ! php bin/console doctrine:migrations:diff -e test --namespace DoctrineMigrations
+      - run: php bin/console doctrine:schema:validate -v -e test
         working-directory: api

.github/workflows/continuous-integration.yml

@@ -100,7 +100,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -124,9 +124,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24.7.0'
+          node-version: '24.8.0'
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -153,9 +153,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24.7.0'
+          node-version: '24.8.0'
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -182,9 +182,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24.7.0'
+          node-version: '24.8.0'
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -214,9 +214,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24.7.0'
+          node-version: '24.8.0'
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -274,7 +274,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -353,9 +353,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24.7.0'
+          node-version: '24.8.0'
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -396,9 +396,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24.7.0'
+          node-version: '24.8.0'
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -435,9 +435,9 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: '24.7.0'
+          node-version: '24.8.0'
 
-      - uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -511,7 +511,7 @@ jobs:
     if: always()
     steps:
       - name: Fail if not all jobs were successful
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const needs = `${{ toJSON(needs) }}`;

.github/workflows/deploy-ecamp3-logging.yml

@@ -4,9 +4,17 @@ on:
   workflow_dispatch:
     inputs:
       environment:
-        description: 'Choose environment'
+        description: "Choose environment"
         type: environment
         required: true
+      action:
+        description: "Choose action"
+        type: choice
+        required: true
+        default: diff
+        options:
+          - diff
+          - deploy
 
 jobs:
   deploy-ecamp3-logging:
@@ -15,7 +23,7 @@ jobs:
     environment: ${{ github.event.inputs.environment }}
     steps:
       - name: Validate environment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             if (!"${{ github.event.inputs.environment }}".startsWith("ecamp3-logging")) {
@@ -25,39 +33,43 @@ jobs:
 
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
 
-      - name: Dump secrets to .env
+      - name: Dump secrets to /tmp/secrets.yaml
         run: |
-          echo '${{ toJSON(secrets) }}' | jq -r 'keys[] as $k | select(.[$k] |contains("\n") | not) | "\($k)=\"\(.[$k])\""' >> .env
-        working-directory: .ops/ecamp3-logging
+          cat << 'EOF' | tee -a /tmp/secrets.yaml
+          ${{ toJSON(secrets) }}
+          EOF
+          jq '.' /tmp/secrets.yaml
 
-      - name: Dump variables to .env
+      - name: Dump variables to /tmp/env.yaml
         run: |
-          echo '${{ toJSON(vars) }}' | jq -r 'keys[] as $k | select(.[$k] |contains("\n") | not) | "\($k)=\"\(.[$k])\""' >> .env
-        working-directory: .ops/ecamp3-logging
+          cat << 'EOF' | tee -a /tmp/env.yaml
+          ${{ toJSON(vars) }}
+          EOF
+          jq '.' /tmp/env.yaml
 
-      - name: Show .env for debugging
-        run: echo "$(cat .env | sort)"
+      - name: Merge secrets and variables
+        run: |
+          jq -s '.[0] + .[1]' /tmp/secrets.yaml /tmp/env.yaml > env.yaml
+          jq '.' env.yaml
         working-directory: .ops/ecamp3-logging
 
       - name: Setup helm
         run: |
           mkdir ~/.kube && echo '${{ secrets.KUBECONFIG }}' > ~/.kube/config && chmod go-r ~/.kube/config
 
-      - name: Add helm repositories
-        run: |
-          helm repo add fluent https://fluent.github.io/helm-charts
-          helm repo update
+      - uses: ./.github/actions/setup-helmfile
 
       - name: Diff deployment
         run: |
           ./deploy.sh diff || true
         working-directory: .ops/ecamp3-logging
 
-      - name: Show values.out.yaml
-        run: cat values.out.yaml
+      - name: Show values.yaml
+        run: cat values.yaml
         working-directory: .ops/ecamp3-logging
 
       - name: Deploy
+        if: ${{ github.event.inputs.action == 'deploy' }}
         run: |
           ./deploy.sh deploy
         working-directory: .ops/ecamp3-logging

.github/workflows/deploy-ops-dashboard.yml

@@ -16,7 +16,7 @@ jobs:
     environment: ${{ github.event.inputs.environment }}
     steps:
       - name: Validate environment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             if (!"${{ github.event.inputs.environment }}".startsWith("ops-dashboard")) {

.github/workflows/e2e-tests.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Create large array
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         id: array
         with:
           script: |

.github/workflows/fast-forward.yml

@@ -29,7 +29,7 @@ jobs:
         if: steps.has_permission.outputs.require-result != 'true'
         run: exit 1
 
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@v8
         id: current_pr
         with:
           github-token: ${{ secrets.FAST_FORWARD_TOKEN }}