Merge remote-tracking branch 'origin/develop' into feature/replace-swagger

# Conflicts:
#	Common/DataAnnotations/StringCollectionItemMaxLengthAttribute.cs
#	Cron/Program.cs
#	Directory.Packages.props

Author: hhvrc

.dockerignore

@@ -2,6 +2,8 @@
 **/bin/
 **/obj/
 **/out/
+**/node_modules/
+API/SmtpTemplates/dist/
 
 # files
 **/appsettings.Development.json

.env

@@ -1,27 +1,59 @@
-# Required variables (uncomment and set values!)
-#PG_PASS=someSecurePassword
-
-# Compose variables
-OPENSHOCK_DOMAIN=openshock.local # your public base domain
-OPENSHOCK_GATEWAY_SUBDOMAIN=gateway # subdomain for the included gateway
-OPENSHOCK_API_SUBDOMAIN=api # subdomain for the api
-
-#global email config
-OPENSHOCK__MAIL__SENDER__NAME=OpenShock System
-OPENSHOCK__MAIL__SENDER__EMAIL=system@openshock.app
-
-#mail configs. uncomment one of the 2 sections below and make your config changes
-
-#MailJet
-#OPENSHOCK__MAIL__TYPE: MAILJET # MAILJET or SMTP, check Documentation
-#OPENSHOCK__MAIL__MAILJET__KEY: mailjetkey
-#OPENSHOCK__MAIL__MAILJET__SECRET: mailjetsecret
-#OPENSHOCK__MAIL__MAILJET__TEMPLATE__PASSWORDRESET: 9999999
-
-#SMTP
-OPENSHOCK__MAIL__TYPE=SMTP # MAILJET or SMTP, check Documentation
-OPENSHOCK__MAIL__SMTP__HOST=mail.domain.zap
-OPENSHOCK__MAIL__SMTP__USERNAME=open@shock.zap
-OPENSHOCK__MAIL__SMTP__PASSWORD=SMTPPASSWORD
-OPENSHOCK__MAIL__SMTP__ENABLESSL=true
-OPENSHOCK__MAIL__SMTP__VERIFYCERTIFICATE=true
+# OpenShock configuration. These are simple knobs; docker-compose.yml maps them
+# onto the OPENSHOCK__* variables the containers read and shares them across every
+# service. Anything left unset falls back to the defaults defined in the compose file.
+
+# --- Required ---
+# Database password (no default, must be set).
+PG_PASS=someSecurePassword
+
+# --- Images ---
+# Tag for the backend images (api, gateway, cron) — they share the backend repo's
+# versioning. The frontend is a separate repo with its own versions, so it has its
+# own tag. Pin to a release for reproducible deploys; both default to `latest`.
+#OPENSHOCK_TAG=latest
+#OPENSHOCK_FRONTEND_TAG=latest
+
+# --- Host / port / paths ---
+# The whole stack runs on one host and one port; services are told apart by path.
+# The host clients use to reach the stack.
+OPENSHOCK_HOST=openshock.local
+# External port for the stack. Leave blank for 443 (standard https). Set e.g. 8080
+# to serve on https://host:8080. Traefik publishes this onto its https entrypoint.
+#OPENSHOCK_PORT=8080
+# Path prefix per service. Frontend sits at the root; api and gateway on sub-paths.
+# Leave OPENSHOCK_FRONTEND_PATH blank to keep the web UI at the root (recommended).
+#OPENSHOCK_FRONTEND_PATH=
+OPENSHOCK_API_PATH=/api
+OPENSHOCK_GATEWAY_PATH=/gateway
+
+# --- Database (optional, defaults shown) ---
+#PG_USER=openshock
+#PG_DB=openshock
+
+# --- Feature flags (optional, defaults shown) ---
+#OPENSHOCK_TURNSTILE_ENABLE=false
+#OPENSHOCK_REGISTRATION_ENABLED=true
+
+# --- TLS (optional, defaults shown) ---
+# Set this to true to disable TLS certificate verification for the frontend. This is useful
+# for testing with self-signed certs, but should not be used in production.
+#OPENSHOCK_FRONTEND_TLS_INSECURE=false
+
+# --- E-mail ---
+# MAIL_TYPE is required by the app. Leave it as None to run without outbound mail,
+# or set it to Smtp / Mailjet and fill in the matching block below.
+MAIL_TYPE=None
+MAIL_SENDER_NAME=OpenShock System
+MAIL_SENDER_EMAIL=system@openshock.app
+
+# SMTP (used when MAIL_TYPE=Smtp)
+#SMTP_HOST=mail.domain.zap
+#SMTP_PORT=587
+#SMTP_USERNAME=open@shock.zap
+#SMTP_PASSWORD=SMTPPASSWORD
+#SMTP_ENABLESSL=true
+#SMTP_VERIFYCERTIFICATE=true
+
+# Mailjet (used when MAIL_TYPE=Mailjet)
+#MAILJET_KEY=mailjetkey
+#MAILJET_SECRET=mailjetsecret

.github/actions/build-app/action.yml

@@ -23,7 +23,7 @@ runs:
   steps:
     - name: Extract metadata (tags, labels) for Docker
       id: meta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
       with:
         images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ inputs.image }}
         flavor: |
@@ -32,7 +32,7 @@ runs:
           type=raw,value=${{ inputs.tag-prefix }}-${{ github.run_number }}-a${{ github.run_attempt }}
 
     - name: Build and push
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
       with:
         context: .
         file: ${{ inputs.dockerfile }}

.github/actions/promote-image/action.yml

@@ -17,7 +17,7 @@ runs:
 
     - name: Extract metadata (tags, labels) for Promotion
       id: remeta
-      uses: docker/metadata-action@v5
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
       with:
         images: ${{ inputs.image }}
         flavor: |

.github/dependabot.yml

@@ -1,21 +1,43 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
 version: 2
+updates:
 
-multi-ecosystem-groups:
-  maintenance:
+  # Check for Nuget package updates
+  - package-ecosystem: nuget
+    directory: /
     schedule:
       interval: weekly
       day: monday
-      time: '06:00'
-
-updates:
-  - package-ecosystem: nuget
-    directory: /
-    patterns:
-      - '*'
-    multi-ecosystem-group: maintenance
-
+      time: '08:00'
+    groups:
+      nuget:
+        patterns:
+          - '*' # Group all updates together
+  
+  # Check for Github Actions version updates (for CI/CD)
   - package-ecosystem: github-actions
     directory: /
-    patterns:
-      - '*'
-    multi-ecosystem-group: maintenance
+    schedule:
+      interval: weekly
+      day: monday
+      time: '08:00'
+    groups:
+      github-actions:
+        patterns:
+          - '*' # Group all updates together
+
+  # Check for Docker base image updates
+  - package-ecosystem: docker
+    directory: /docker
+    schedule:
+      interval: weekly
+      day: monday
+      time: '08:00'
+    groups:
+      docker:
+        patterns:
+          - '*' # Group all updates together

.github/workflows/ci-build.yml

@@ -5,7 +5,6 @@ on:
   pull_request:
     branches:
       - '**'
-    types: [ opened, reopened, synchronize ]
   workflow_call:
     inputs:
       platforms:
@@ -38,29 +37,33 @@ env:
 jobs:
 
   tests:
-    name: Tests (${{ matrix.name }})
+    name: Tests
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: common-unit
-            project: Common.Tests/Common.Tests.csproj
-          - name: api-integration
-            project: API.IntegrationTests/API.IntegrationTests.csproj
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-dotnet@v5
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '${{ env.DOTNET_VERSION }}'
 
-      - name: Run ${{ matrix.name }} tests
+      - name: Run tests
         run: |
           set -euo pipefail
-          dotnet test -c Release --project ${{ matrix.project }}
+          dotnet test -c Release --solution OpenShockBackend.slnx \
+            --results-directory "artifacts/test-results" \
+            -- \
+            --report-trx \
+            --report-trx-filename test-results.trx
+
+      - name: Upload test artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-results
+          path: artifacts/test-results
+          if-no-files-found: warn
 
   build:
     name: Build (${{ matrix.image }})
@@ -78,13 +81,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -101,7 +104,7 @@ jobs:
 
   promote-image:
     name: Promote Image (${{ matrix.image }})
-    needs: [build, tests]
+    needs: [build]
     runs-on: ubuntu-latest
     if: ${{ inputs.push || (github.ref_protected && github.event_name != 'pull_request') }}
     strategy:
@@ -114,10 +117,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -137,15 +140,13 @@ jobs:
     environment: production
     steps:
       - name: Send repository dispatch
-        uses: peter-evans/repository-dispatch@v4
+        uses: OpenShock/actions/repository-dispatch@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
         with:
-          token: ${{ secrets.GITOPS_PAT }}
-          repository: openshock/kubernetes-cluster-gitops
+          repo: openshock/kubernetes-cluster-gitops
           event-type: update-backend-prod
           client-payload: |
-            {
-              "tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"
-            }
+            {"tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"}
+          token: ${{ secrets.GITOPS_PAT }}
 
   deploy-staging:
     runs-on: ubuntu-latest
@@ -155,15 +156,13 @@ jobs:
 
     steps:
       - name: Send repository dispatch
-        uses: peter-evans/repository-dispatch@v4
+        uses: OpenShock/actions/repository-dispatch@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
         with:
-          token: ${{ secrets.GITOPS_PAT }}
-          repository: openshock/kubernetes-cluster-gitops
+          repo: openshock/kubernetes-cluster-gitops
           event-type: update-backend-staging
           client-payload: |
-            {
-              "tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"
-            }
+            {"tag": "${{ inputs.tag-prefix  || 'rn' }}-${{ github.run_number }}-a${{ github.run_attempt }}"}
+          token: ${{ secrets.GITOPS_PAT }}
 
   deploy-dev:
     runs-on: ubuntu-latest
@@ -172,12 +171,12 @@ jobs:
     environment: development
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .github
 
       - uses: ./.github/actions/watchtower-update
         with:
           url: ${{ vars.WATCHTOWER_URL }}
-          token: ${{ secrets.WATCHTOWER_TOKEN }}
+          token: ${{ secrets.WATCHTOWER_TOKEN }}

.github/workflows/ci-tag.yml

@@ -21,11 +21,9 @@ jobs:
     steps:
       - name: Find latest tag
         id: latest-tag
-        uses: oprypin/find-latest-tag@v1
+        uses: OpenShock/actions/find-latest-tag@21ca2d511bca92cf24fb502fa302f82700822584 # v1.1.1
         with:
-          repository: ${{ github.repository }}
-          regex: '^\d+\.\d+\.\d+$'
-          releases-only: false
+          regex: '^[0-9]+\.[0-9]+\.[0-9]+$'
 
   # Delegate building and containerizing to a single workflow.
   build-and-containerize:

.github/workflows/codeql.yml

@@ -27,17 +27,17 @@ jobs:
       contents: read
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@e58424170fb0262c8d7ed60a2e84b9bffe205c67 # codeql-bundle-v2.26.1
       with:
         languages: csharp
         build-mode: manual
 
     - name: Setup .NET SDK ${{ env.DOTNET_VERSION }}
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
       with:
         dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -50,6 +50,6 @@ jobs:
         dotnet publish Cron/Cron.csproj -c Release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@e58424170fb0262c8d7ed60a2e84b9bffe205c67 # codeql-bundle-v2.26.1
       with:
         category: "/language:csharp"