Merge branch 'master' into user-setting-gloss-suggest

.github/workflows/backend.yml

@@ -48,7 +48,7 @@ jobs:
         run: dotnet test Backend.Tests/Backend.Tests.csproj
         shell: bash
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           if-no-files-found: error
           name: coverage
@@ -91,7 +91,7 @@ jobs:
         with:
           name: coverage
       - name: Upload coverage report
-        uses: codecov/codecov-action@84508663e988701840491b86de86b666e8a86bed # v4.3.0
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true
@@ -138,7 +138,7 @@ jobs:
       - name: Autobuild
         uses: github/codeql-action/autobuild@d39d31e687223d841ef683f52467bd88e9b21c14 # v3.25.3
       - name: Upload artifacts if build failed
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         if: ${{ failure() }}
         with:
           name: tracer-logs

.github/workflows/commit_message_check.yml

@@ -10,4 +10,4 @@ permissions: # added using https://github.com/step-security/secure-workflows
 
 jobs:
   commit-message-lint:
-    uses: sillsdev/FieldWorks/.github/workflows/CommitMessage.yml@53b16bd9d629a65054d424cb059e4e2ce943ba97
+    uses: sillsdev/FieldWorks/.github/workflows/CommitMessage.yml@1841598026f41661ed53c3072589dbfed5c14a12

.github/workflows/dependency-review.yml

@@ -24,4 +24,4 @@ jobs:
       - name: "Checkout Repository"
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3
+        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

.github/workflows/frontend.yml

@@ -24,9 +24,9 @@ jobs:
           disable-sudo: true
           egress-policy: block
           allowed-endpoints: >
-            *.actions.githubusercontent.com:443
             api.github.com:443
             github.com:443
+            objects.githubusercontent.com:443
             registry.npmjs.org:443
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -53,9 +53,9 @@ jobs:
           disable-sudo: true
           egress-policy: block
           allowed-endpoints: >
-            *.actions.githubusercontent.com:443
             api.github.com:443
             github.com:443
+            objects.githubusercontent.com:443
             registry.npmjs.org:443
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -68,7 +68,7 @@ jobs:
         env:
           CI: true
       - name: Upload coverage artifact
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           if-no-files-found: error
           name: coverage
@@ -101,7 +101,7 @@ jobs:
         with:
           name: coverage
       - name: Upload coverage report
-        uses: codecov/codecov-action@84508663e988701840491b86de86b666e8a86bed # v4.3.0
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: true
@@ -121,7 +121,6 @@ jobs:
           disable-sudo: true
           egress-policy: block
           allowed-endpoints: >
-            *.actions.githubusercontent.com:443
             auth.docker.io:443
             files.pythonhosted.org:443
             github.com:443

.github/workflows/pages.yml

@@ -26,7 +26,7 @@ jobs:
             github.com:443
             pypi.org:443
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+      - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
         with:
           python-version: 3.11
       - name: Install dependencies

.github/workflows/python.yml

@@ -30,7 +30,7 @@ jobs:
             pypi.org:443
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies

.github/workflows/scorecards.yml

@@ -81,7 +81,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: SARIF file
           path: results.sarif

.gitignore

@@ -82,8 +82,12 @@ src/resources/dictionaries/*.txt
 deploy/scripts/semantic_domains/json/*.json
 database/semantic_domains/*
 
+# Intermediate and output files for tutorial video subtitling
+*.srt
+*.mp4
+
 # Combine installer
-installer/combine-installer.run
+installer/*.run
 installer/makeself-*
 installer/README.pdf
 

Backend/BackendFramework.csproj

@@ -16,13 +16,13 @@
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.3" />
     <PackageReference Include="Microsoft.IdentityModel.Tokens" Version="7.5.1" />
     <PackageReference Include="System.IdentityModel.Tokens.Jwt" Version="7.5.1" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
-    <PackageReference Include="MongoDB.Driver" Version="2.27.0" />
-    <PackageReference Include="MailKit" Version="4.7.0" />
+    <PackageReference Include="MailKit" Version="4.7.1.1" />
+    <PackageReference Include="MongoDB.Driver" Version="2.28.0" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="6.7.0" />
     <PackageReference Include="Xabe.FFmpeg" Version="5.2.6"/>
 
     <!-- SIL Maintained Dependencies. -->
-    <PackageReference Include="icu.net" Version="2.10.1-beta.4" />
+    <PackageReference Include="icu.net" Version="2.10.1-beta.5" />
     <PackageReference Include="Icu4c.Win.Full.Lib" Version="62.2.3-beta" />
     <PackageReference Include="SIL.Core" Version="14.1.1" />
     <PackageReference Include="SIL.Core.Desktop" Version="14.1.1">

Backend/Dockerfile

@@ -1,5 +1,13 @@
+############################################################
+# IMPORTANT
+#
+# Supported Platforms:
+#   - Intel/AMD 64-bit
+#   - ARM 64-bit
+############################################################
+
 # Docker multi-stage build
-FROM mcr.microsoft.com/dotnet/sdk:8.0.302-1-jammy-amd64 AS builder
+FROM mcr.microsoft.com/dotnet/sdk:8.0.303-jammy AS builder
 WORKDIR /app
 
 # Copy csproj and restore (fetch dependencies) as distinct layers.
@@ -11,7 +19,7 @@ COPY . ./
 RUN dotnet publish -c Release -o build
 
 # Build runtime image.
-FROM mcr.microsoft.com/dotnet/aspnet:8.0.6-jammy-amd64
+FROM mcr.microsoft.com/dotnet/aspnet:8.0.7-jammy
 
 ENV ASPNETCORE_URLS=http://+:5000
 ENV COMBINE_IS_IN_CONTAINER=1

Backend/Helper/GrammaticalCategory.cs

@@ -50,7 +50,7 @@ public bool Matches(string gramCat)
             }
         }
 
-        // The following patterns cover all grammatical categories in Fieldworks for:
+        // The following patterns cover all grammatical categories in FieldWorks for:
         //   English (en), Spanish (es), French (fr), Portuguese (pt), Russian (ru), Chinese (zh)
         // Omissions due to conflicting abbreviations:
         //   Spanish "indf" for Indefinite Pronoun (conflicts with abbrev. for Indefinite article)

Backend/Services/PermissionService.cs

@@ -170,7 +170,7 @@ public string GetUserId(HttpContext request)
         /// <summary> Creates a JWT token for the given user. </summary>
         public async Task<User?> MakeJwt(User user)
         {
-            const int hoursUntilExpires = 4;
+            const int hoursUntilExpires = 12;
             var tokenHandler = new JwtSecurityTokenHandler();
             var secretKey = Environment.GetEnvironmentVariable("COMBINE_JWT_SECRET_KEY")!;
             var key = Encoding.ASCII.GetBytes(secretKey);

Dockerfile

@@ -1,3 +1,11 @@
+############################################################
+# IMPORTANT
+#
+# Supported Platforms:
+#   - Intel/AMD 64-bit
+#   - ARM 64-bit
+############################################################
+
 # User guide build environment
 FROM python:3.10.14-slim-bookworm AS user_guide_builder
 

README.md

@@ -58,6 +58,7 @@ A rapid word collection tool. See the [User Guide](https://sillsdev.github.io/Th
    7. [Add or Update Dictionary Files](#add-or-update-dictionary-files)
    8. [Cleanup Local Repository](#cleanup-local-repository)
    9. [Generate Installer Script for The Combine](#generate-installer-script-for-the-combine-linux-only)
+   10. [Generate Tutorial Video Subtitles](#generate-tutorial-video-subtitles)
 3. [Setup Local Kubernetes Cluster](#setup-local-kubernetes-cluster)
    1. [Install Rancher Desktop](#install-rancher-desktop)
    2. [Install Docker Desktop](#install-docker-desktop)
@@ -531,14 +532,29 @@ cd installer
 ./make-combine-installer.sh combine-release-number
 ```
 
-where `combine-release-number` is the Combine release to be installed, e.g. `v1.2.0`.
+where `combine-release-number` is the Combine release to be installed, e.g. `v2.1.0`.
+
+Options:
+
+- `--net-install` - build an installer that will download the required images at installation time. The default is to
+  package the images in the installation script.
 
 To update the PDF copy of the installer README.md file, run the following from the `installer` directory:
 
 ```console
 pandoc --pdf-engine=weasyprint README.md -o README.pdf
 ```
 
+## Generate Tutorial Video Subtitles
+
+Tutorial video transcripts are housed in `docs/tutorial_subtitles`, together with timestamps aligning transcripts with
+the corresponding videos and any transcript translations downloaded from Crowdin. To generate subtitle files (and
+optionally attach them to a video file), run from within a Python virtual environment:
+
+```bash
+python scripts/subtitle_tutorial_video.py -s <subtitles_subfolder_name> [-i <input_video_path> -o <output_video_path] [-v]
+```
+
 ## Setup Local Kubernetes Cluster
 
 This section describes how to create a local Kubernetes cluster using either _Rancher Desktop_ or _Docker Desktop_.
@@ -636,7 +652,7 @@ environment. (See the [Python](#python) section to create the virtual environmen
 Install the required charts by running:
 
 ```bash
-python deploy/scripts/setup_cluster.py
+python deploy/scripts/setup_cluster.py --type development
 ```
 
 `deploy/scripts/setup_cluster.py` assumes that the `kubectl` configuration file is setup to manage the desired
@@ -1151,8 +1167,9 @@ The process for configuring and deploying _TheCombine_ for production targets is
 - [JS](https://www.w3schools.com/js/default.asp)
 - [TS](https://www.typescriptlang.org/docs/handbook/typescript-in-5-minutes.html)
 - [Our style guide](docs/style_guide/ts_style_guide.md)
-- [React](https://reactjs.org/)
-- [React Hooks](https://reactjs.org/docs/hooks-intro.html)
+- [React](https://react.dev/learn)
+- [React Hooks](https://react.dev/reference/react/hooks)
+- [MUI](https://mui.com/material-ui/getting-started/) (styled/themed components)
 - [Redux concepts](https://redux.js.org/tutorials/fundamentals/part-2-concepts-data-flow)
 - [Redux tutorials](https://redux.js.org/tutorials/typescript-quick-start)
 - [React-i18next](https://react.i18next.com/) (text localization)

database/Dockerfile

@@ -1,3 +1,10 @@
+############################################################
+# IMPORTANT
+#
+# Supported Platforms:
+#   - Intel/AMD 64-bit
+#   - ARM 64-bit
+############################################################
 FROM mongo:7.0.12-jammy
 
 WORKDIR /

deploy/Dockerfile

@@ -1,12 +1,9 @@
-# Dockerfile to build a Kubernetes Worker container for the Combine.  The
-# image shall contain a collection of scripts to perform the following functions:
-#  - backup The Combine database and backend data files
-#  - restore The Combine database and backend data files from a previous backup
-#  - monitor specified secrets for changes and push the updated secrets to AWS
-#    S3 storage
-#  - check the current TLS secret for updates in AWS S3 storage and update the
-#    secret accordingly.
-# The scripts are written in Python.
+############################################################
+# IMPORTANT
+#
+# Supported Platforms:
+#   - Intel/AMD 64-bit
+############################################################
 
 FROM ubuntu:22.04
 

deploy/ansible/group_vars/nuc/main.yml

@@ -14,17 +14,13 @@
 k8s_engine: k3s
 
 image_pull_secret: aws-login-credentials
+use_airgap_images: false
 
 # k8s namespaces
 app_namespace: thecombine
 
 k8s_user: sillsdev
 
-################################################
-# Helm Installation
-################################################
-install_helm: no
-
 ################################################
 # Support Tool Settings
 ################################################

deploy/ansible/group_vars/server/main.yml

@@ -9,21 +9,13 @@
 # Configure Kubernetes cluster
 ################################################
 
-# Specify which Kubernetes engine to install -
-# one of k3s, or none.
-k8s_engine: none
-
 image_pull_secret: aws-login-credentials
+use_airgap_images: false
 
 create_namespaces: []
 # k8s namespaces
 app_namespace: thecombine
 
-################################################
-# Helm Installation
-################################################
-install_helm: no
-
 ################################################
 # Support Tool Settings
 ################################################

deploy/ansible/host_vars/localhost/main.yml

@@ -7,22 +7,14 @@
 # Configure Kubernetes cluster
 ################################################
 
-# Specify which Kubernetes engine to install -
-# one of k3s or none.
-k8s_engine: k3s
-
 image_pull_secret: aws-login-credentials
+use_airgap_images: true
 
 # k8s namespaces
 app_namespace: thecombine
 
 k8s_user: "{{ ansible_user_id }}"
 
-################################################
-# Helm Installation
-################################################
-install_helm: yes
-
 ################################################
 # Support Tool Settings
 ################################################

deploy/ansible/playbook_desktop_setup.yaml

@@ -15,27 +15,23 @@
 
   vars_files:
     - "vars/config_common.yml"
+    - "vars/k3s_versions.yml"
 
   tasks:
-    - name: Update packages
-      apt:
-        update_cache: yes
-        upgrade: "yes"
-
     - name: Setup WiFi Access Point
       import_role:
         name: wifi_ap
       when: has_wifi
 
-    - name: Enable hardware monitoring
-      import_role:
-        name: monitor_hardware
-      when: include_hw_monitoring
-
     - name: Configure Network Interfaces
       import_role:
         name: network_config
 
+    - name: Install Preloaded Images
+      import_role:
+        name: container_images
+      when: install_airgap_images
+
     - name: Install Container Engine
       import_role:
         name: container_engine
@@ -47,7 +43,7 @@
     - name: Install Helm
       import_role:
         name: helm_install
-      when: install_helm
+      when: not install_airgap_images
 
     - name: Setup Support Tool
       import_role: