Release OpenProject 14.4.0

.github/dependabot.yml

@@ -21,3 +21,9 @@ updates:
     target-branch: "dev"
     open-pull-requests-limit: 3
     versioning-strategy: lockfile-only
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "dev"
+    open-pull-requests-limit: 3

.github/pull_request_template.md

@@ -0,0 +1,23 @@
+<!-- Contributors: Please check our [PR guide](https://www.openproject.org/docs/development/code-review-guidelines/#preparing-your-pull-request) before opening a PR. -->
+
+<!-- Reviewers: Please check our [Review guide](https://www.openproject.org/docs/development/code-review-guidelines/#reviewing) -->
+
+# What are you trying to accomplish?
+<!-- Provide a description of the changes. -->
+
+## Screenshots
+<!-- Provide before/after screenshots, videos, or graphs for any visual changes; otherwise, remove this section -->
+
+# What approach did you choose and why?
+<!-- This section is a place for you to describe your thought process in making these changes.
+     List any tradeoffs you made to take on or pay down tech debt.
+     Describe any alternative approaches you considered and why you discarded them. -->
+
+# Ticket
+<!-- Provide the link to respective work package -->
+
+# Merge checklist
+
+- [ ] Added/updated tests
+- [ ] Added/updated documentation in Lookbook (patterns, previews, etc)
+- [ ] Tested major browsers (Chrome, Firefox, Edge, ...)

.github/workflows/brakeman-scan-core.yml

@@ -25,7 +25,7 @@ jobs:
       RUBY_GC_HEAP_INIT_SLOTS: 100000
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@v1
@@ -44,6 +44,6 @@ jobs:
             --output output.sarif.json
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: output.sarif.json

.github/workflows/crowdin.yml

@@ -41,7 +41,7 @@ jobs:
           - dev
           - "${{ needs.setup.outputs.latest_release_branch }}"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           ref: ${{ matrix.branch }}
           fetch-depth: 1
@@ -65,7 +65,7 @@ jobs:
             bundle exec script/i18n/generate_seeders_i18n_source_file
           fi
       - name: "Crowdin: upload sources and download translations"
-        uses: crowdin/github-action@v1
+        uses: crowdin/github-action@v2
         with:
           # Upload current source files
           upload_sources: true

.github/workflows/danger.yml

@@ -17,8 +17,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
         with:
-          ruby-version: '3.3.3'
-      - uses: MeilCli/danger-action@v5
+          ruby-version: '3.3.4'
+      - uses: MeilCli/danger-action@v6
         with:
           danger_file: 'Dangerfile'
           danger_id: 'danger-pr'

.github/workflows/docker.yml

@@ -85,10 +85,11 @@ jobs:
           ./docker/prod/setup/precompile-assets.sh
           # public/assets will be saved as artifact, so temporarily copying config file there as well
           cp config/frontend_assets.manifest.json public/assets/frontend_assets.manifest.json
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           path: public/
           name: public-assets-${{ github.sha }}
+          overwrite: true
     outputs:
       version: ${{ steps.extract_version.outputs.version }}
       checkout_ref: ${{ steps.extract_version.outputs.checkout_ref }}
@@ -106,22 +107,27 @@ jobs:
       matrix:
         include:
           - platform: linux/amd64
+            digest: amd64-slim
             bim_support: true
             target: slim
             runner: runner=4cpu-linux-x64
           - platform: linux/arm64/v8
+            digest: arm64-slim
             bim_support: false
             target: slim
             runner: runner=4cpu-linux-arm64
           - platform: linux/amd64
+            digest: amd64-aio
             bim_support: true
             target: all-in-one
             runner: runner=4cpu-linux-x64
           - platform: linux/arm64/v8
+            digest: arm64-aio
             bim_support: false
             target: all-in-one
             runner: runner=4cpu-linux-arm64
           - platform: linux/ppc64le
+            digest: ppc-aio
             bim_support: false
             target: all-in-one
             runner: runner=4cpu-linux-x64
@@ -134,7 +140,7 @@ jobs:
         run: |
           cp ./docker/prod/Dockerfile ./Dockerfile
       - name: Download precompiled public assets
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: public-assets-${{ github.sha }}
           path: public/
@@ -164,7 +170,7 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           context: git
           labels: |
@@ -177,7 +183,7 @@ jobs:
             ${{ env.REGISTRY_IMAGE }}
       - name: Build image
         id: build
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: ${{ matrix.platform }}
@@ -209,7 +215,7 @@ jobs:
           wget -O- --retry-on-http-error=503,502 --retry-connrefused http://localhost:8080/api/v3
       - name: Push image
         id: push
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: ${{ matrix.platform }}
@@ -226,9 +232,9 @@ jobs:
           digest="${{ steps.push.outputs.digest }}"
           touch "/tmp/digests/${digest#sha256:}"
       - name: Upload digest
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: digests-${{ matrix.target }}
+          name: digests-${{ matrix.target }}-${{ matrix.digest }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -241,10 +247,16 @@ jobs:
       - setup
       - build
     steps:
+      - name: Merge digests
+        uses: actions/upload-artifact/merge@v4
+        with:
+          pattern: digests-*
+          overwrite: true
+          name: "merged-digests-${{ matrix.target }}-${{ github.run_number }}-${{ github.run_attempt }}"
       - name: Download digests
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          name: digests-${{ matrix.target }}
+          name: "merged-digests-${{ matrix.target }}-${{ github.run_number }}-${{ github.run_attempt }}"
           path: /tmp/digests
       - name: Set suffix
         id: set_suffix
@@ -256,7 +268,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY_IMAGE }}
           labels: |

.github/workflows/eslint-core.yml

@@ -14,10 +14,10 @@ jobs:
     name: eslint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '18.13'
           cache: npm

.github/workflows/openapi.yaml

@@ -18,11 +18,11 @@ jobs:
     if: github.repository == 'opf/openproject'
     runs-on: [ubuntu-latest]
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@v1
       with:
         bundler-cache: true
-    - uses: actions/setup-node@v2
+    - uses: actions/setup-node@v4
       with:
         node-version: '20'
     - run: ./script/api/validate_spec

.github/workflows/pullpreview.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: Generate .env.pullpreview file
       run: |
         echo "OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET=false" >> .env.pullpreview

.github/workflows/rubocop-core.yml

@@ -9,16 +9,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Fetch head commit of base branch
-        run: git fetch --depth 1 origin ${{ github.event.pull_request.base.sha }}
       - uses: ruby/setup-ruby@v1
-      - uses: opf/action-rubocop@master
+      - uses: reviewdog/action-rubocop@v2
         with:
           github_token: ${{ secrets.github_token }}
           rubocop_version: gemfile
           rubocop_extensions: >
             rubocop-capybara:gemfile
             rubocop-factory_bot:gemfile
+            rubocop-openproject:gemfile
             rubocop-performance:gemfile
             rubocop-rails:gemfile
             rubocop-rspec:gemfile

.rubocop.yml

@@ -1,10 +1,8 @@
 require:
+  - rubocop-openproject
   - rubocop-rails
   - rubocop-rspec
   - rubocop-rspec_rails
-  - ./lib_static/rubocop/cop/open_project/add_preview_for_view_component.rb
-  - ./lib_static/rubocop/cop/open_project/no_do_end_block_with_rspec_capybara_matcher_in_expect.rb
-  - ./lib_static/rubocop/cop/open_project/use_service_result_factory_methods.rb
   - rubocop-capybara
   - rubocop-factory_bot
   - rubocop-performance
@@ -145,7 +143,7 @@ Naming/VariableNumber:
   AllowedPatterns:
     - '\w_20\d\d' # allow dates like christmas_2022 or date_2034_04_12
     - '\w\d++(_\d++)+' # allow hierarchical data like child1_2_5 (second + in regex is possessive qualifier)
-
+    - 'custom_field_\d+' # allow custom field method names to be called with send :custom_field_1001
 # There are valid cases in which to use methods like:
 # * update_all
 # * touch_all
@@ -238,6 +236,8 @@ RSpec/DescribeMethod:
 # Don't force the second argument of describe
 # to match the exact file name
 RSpec/SpecFilePathFormat:
+  CustomTransform:
+    OAuthClients: oauth_clients
   IgnoreMethods: true
 
 # Prevent  "fit" or similar to be committed
@@ -461,3 +461,10 @@ Style/HashTransformValues:
 
 Performance/Casecmp:
   Enabled: false
+
+OpenProject/AddPreviewForViewComponent:
+  Include:
+    - app/components/op_turbo/**.rb
+    - app/components/op_primer/**.rb
+    - app/components/open_project/**.rb
+    - app/components/concerns/**.rb

.ruby-version

@@ -1 +1 @@
-3.3.3
+3.3.4

Gemfile

@@ -209,14 +209,15 @@ gem "mini_magick", "~> 4.13.0", require: false
 gem "validate_url"
 
 # Storages support code
+gem "dry-auto_inject"
 gem "dry-container"
 gem "dry-monads"
 
 # ActiveRecord extension which adds typecasting to store accessors
 gem "store_attribute", "~> 1.0"
 
 # Appsignal integration
-gem "appsignal", "~> 3.8.1", require: false
+gem "appsignal", "~> 3.10.0", require: false
 
 gem "view_component"
 # Lookbook
@@ -227,6 +228,7 @@ gem "factory_bot", "~> 6.4.0", require: false
 # require factory_bot_rails for convenience in core development
 gem "factory_bot_rails", "~> 6.4.0", require: false
 
+gem "turbo_power", "~> 0.6.2"
 gem "turbo-rails", "~> 2.0.0"
 
 gem "httpx"
@@ -331,6 +333,7 @@ group :development, :test do
   gem "rubocop", require: false
   gem "rubocop-capybara", require: false
   gem "rubocop-factory_bot", require: false
+  gem "rubocop-openproject", require: false
   gem "rubocop-performance", require: false
   gem "rubocop-rails", require: false
   gem "rubocop-rspec", require: false
@@ -389,6 +392,6 @@ gemfiles.each do |file|
   send(:eval_gemfile, file) if File.readable?(file)
 end
 
-gem "openproject-octicons", "~>19.14.1"
-gem "openproject-octicons_helper", "~>19.14.1"
-gem "openproject-primer_view_components", "~>0.35.2"
+gem "openproject-octicons", "~>19.17.0"
+gem "openproject-octicons_helper", "~>19.17.0"
+gem "openproject-primer_view_components", "~>0.40.0"