chore(deps): lock file maintenance (main)

.dockerignore

@@ -1,10 +1,28 @@
-.idea
-.buildpath
-.project
-.settings
-app/config/parameters.yml
-app/config/parameters.ini
-/app/config/ldap_ou_team_mapping.yml
-app/cache/*
-app/logs/*.log
-core
+**/*.log
+**/*.md
+**/*.php~
+**/._*
+**/.dockerignore
+**/.DS_Store
+**/.git/
+**/.gitattributes
+**/.gitignore
+**/.gitmodules
+**/docker-compose.*.yaml
+**/docker-compose.*.yml
+**/docker-compose.yaml
+**/docker-compose.yml
+**/Dockerfile
+**/Thumbs.db
+.editorconfig
+.env.*.local
+.env.local
+.env.local.php
+.php_cs.cache
+bin/*
+!bin/console
+docker/db/data/
+helm/
+public/bundles/
+var/
+vendor/

.editorconfig

@@ -8,16 +8,69 @@ root = true
 # Change these settings to your own preference
 indent_style = space
 indent_size = 4
-tab_width = 4
-
-[*.json]
-# Change these settings to your own preference
-indent_style = space
-indent_size = 2
-tab_width = 2
 
 # We recommend you to keep these unchanged
 end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
+
+[*.{js,html}]
+indent_style = space
+indent_size = 2
+
+[*.json]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.php]
+indent_style = space
+indent_size = 4
+
+[*.sh]
+indent_style = tab
+indent_size = 4
+
+[*.xml{,.dist}]
+indent_style = space
+indent_size = 4
+
+[*.{yaml,yml}]
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = false
+
+[api/helm/api/**.yaml]
+indent_style = space
+indent_size = 2
+
+[.github/workflows/*.yml]
+indent_style = space
+indent_size = 2
+
+[.gitmodules]
+indent_style = tab
+indent_size = 4
+
+[.php_cs{,.dist}]
+indent_style = space
+indent_size = 4
+
+[.travis.yml]
+indent_style = space
+indent_size = 2
+
+[composer.json]
+indent_style = space
+indent_size = 4
+
+[docker-compose{,.*}.{yaml,yml}]
+indent_style = space
+indent_size = 2
+
+[Dockerfile]
+indent_style = tab
+indent_size = 4

.env

@@ -0,0 +1,66 @@
+# In all environments, the following files are loaded if they exist,
+# the latter taking precedence over the former:
+#
+#  * .env                contains default values for the environment variables needed by the app
+#  * .env.local          uncommitted file with local overrides
+#  * .env.$APP_ENV       committed environment-specific defaults
+#  * .env.$APP_ENV.local uncommitted environment-specific overrides
+#
+# Real environment variables win over .env files.
+#
+# DO NOT DEFINE PRODUCTION SECRETS IN THIS FILE NOR IN ANY OTHER COMMITTED FILES.
+# https://symfony.com/doc/current/configuration/secrets.html
+#
+# Run "composer dump-env prod" to compile .env files for production use (requires symfony/flex >=1.2).
+# https://symfony.com/doc/current/best_practices.html#use-environment-variables-for-infrastructure-configuration
+
+locale=en
+
+LDAP_HOST="ldap.acme.org"
+LDAP_PORT=636 # 636, 389
+LDAP_ENCRYPTION=ssl # ssl, tls, none
+
+LDAP_BASE_DN="DC=ACME,DC=ORG"
+LDAP_SEARCH_DN="cn=readuser,DC=ACME,DC=ORG"
+LDAP_SEARCH_PASSWORD="readuser"
+LDAP_UID_KEY="sAMAccountName"
+LDAP_FILTER="({uid_key}={username})"
+LDAP_DN_STRING="acme\\{username}"
+
+
+LDAP_DEFAULT_ROLE='ROLE_DEV'
+# whether to create users in TimeTracker after successfully authenticated by LDAP but not existing in TimeTracker
+# also see ldap_ou_team_mapping.yml.dist
+LDAP_CREATE_USER=true
+
+APP_LOGO_URL="images/logo.png"
+APP_MONTHLY_OVERVIEW_URL="https://stats.timetracker.nr/?user="
+APP_TITLE="Netresearch TimeTracker"
+APP_HEADER_URL=""
+
+APP_SHOW_BILLABLE_FIELD_IN_EXPORT=false
+
+# CSV list of user who will always get ROLE_ADMIN applied
+APP_ADMIN_USERS=''
+
+###> symfony/framework-bundle ###
+APP_ENV=dev
+APP_SECRET=ca347f9e9be41d6439cb31f4f8e4159f
+###< symfony/framework-bundle ###
+
+###> doctrine/doctrine-bundle ###
+# Format described at https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
+# IMPORTANT: You MUST configure your server version, either here or in config/packages/doctrine.yaml
+#
+# DATABASE_URL="sqlite:///%kernel.project_dir%/var/data.db"
+# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=8&charset=utf8mb4"
+DATABASE_URL="postgresql://app:!ChangeMe!@127.0.0.1:5432/app?serverVersion=14&charset=utf8"
+###< doctrine/doctrine-bundle ###
+
+###> symfony/mailer ###
+# MAILER_DSN=null://null
+###< symfony/mailer ###
+
+###> nelmio/cors-bundle ###
+CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
+###< nelmio/cors-bundle ###

.env.test

@@ -0,0 +1,6 @@
+# define your env variables for the test env here
+KERNEL_CLASS='App\Kernel'
+APP_SECRET='$ecretf0rt3st'
+SYMFONY_DEPRECATIONS_HELPER=999999
+PANTHER_APP_ENV=panther
+PANTHER_ERROR_SCREENSHOT_DIR=./var/error-screenshots

.gitattributes

@@ -0,0 +1,16 @@
+* text=auto eol=lf
+
+*.conf text eol=lf
+*.html text eol=lf
+*.ini text eol=lf
+*.js text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+*.php text eol=lf
+*.sh text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+bin/console text eol=lf
+
+*.ico binary
+*.png binary

.github/workflows/docker-publish.yml

@@ -1,93 +1,69 @@
 name: Docker
 
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
 on:
+  workflow_dispatch:
   schedule:
     - cron: '44 12 * * *'
   push:
-    branches: [ master ]
-    # Publish semver tags as releases.
+    branches: [ main ]
     tags: [ 'v*.*.*' ]
   pull_request:
-    branches: [ master ]
+    branches: [ main ]
 
 env:
   # Use docker.io for Docker Hub if empty
   REGISTRY: ghcr.io
   # github.repository as <account>/<repo>
   IMAGE_NAME: ${{ github.repository }}
 
-
 jobs:
   build:
-
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
-      # This is used to complete the identity challenge
-      # with sigstore/fulcio when running outside of PRs.
+      # Used for keyless signing with Fulcio.
       id-token: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
-
-      # Install the cosign tool except on PR
-      # https://github.com/sigstore/cosign-installer
-      - name: Install cosign
-        if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@1e95c1de343b5b0c23352d6417ee3e48d5bcd422
-        with:
-          cosign-release: 'v1.4.0'
+        uses: actions/checkout@v4
 
-
-      # Workaround: https://github.com/docker/build-push-action/issues/461
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
+        uses: docker/setup-buildx-action@v3
 
-      # Login against a Docker registry except on PR
-      # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Extract metadata (tags, labels) for Docker
-      # https://github.com/docker/metadata-action
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        uses: docker/metadata-action@v5
         with:
+          flavor: |
+            latest=false
+            prefix=
+            suffix=
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=ref,event=pr
+            type=edge,branch=main
 
-      # Build and push Docker image with Buildx (don't push on PR)
-      # https://github.com/docker/build-push-action
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-      # Sign the resulting Docker image digest except on PRs.
-      # This will only write to the public Rekor transparency log when the Docker
-      # repository is public to avoid leaking data.  If you would like to publish
-      # transparency data even for private images, pass --force to cosign below.
-      # https://github.com/sigstore/cosign
-      - name: Sign the published Docker image
-        if: ${{ github.event_name != 'pull_request' }}
-        env:
-          COSIGN_EXPERIMENTAL: "true"
-        # This step uses the identity token to provision an ephemeral certificate
-        # against the sigstore community Fulcio instance.
-        run: cosign sign ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
+          target: symfony_php
+          # Enable GitHub Actions-based caching for faster builds.
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -1,20 +1,22 @@
-/.idea
-/.buildpath
-/.project
-/.settings
-/app/config/parameters.yml
-/app/config/parameters.ini
-/app/config/ldap_ou_team_mapping.yml
-/app/config/sentry.yml
-/app/logs/*.log
-/app/cache/*
-/app/build/
-/app/bootstrap.php.cache
-/bin/*
-/web/bundles/*
-/web/.htaccess
-/vendor/*
-/timalytics
-/web/stats
-/core
-/README.html
+/.vscode
+/.php-cs-fixer.cache
+
+###> symfony/framework-bundle ###
+/.env.local
+/.env.local.php
+/.env.*.local
+/config/secrets/prod/prod.decrypt.private.php
+/public/bundles/
+/var/
+/vendor/
+###< symfony/framework-bundle ###
+
+###> symfony/phpunit-bridge ###
+.phpunit.result.cache
+/phpunit.xml
+###< symfony/phpunit-bridge ###
+
+###> phpunit/phpunit ###
+/phpunit.xml
+.phpunit.result.cache
+###< phpunit/phpunit ###