From 65065e671c40fc03e849610ed55a0f122f75e326 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 25 Jul 2024 17:15:46 +0000
Subject: [PATCH] chore: sync files with stordco/common-config-elixir

---
 .credo.exs                                    |  2 +-
 .github/pull_request_template.md              |  6 ++
 .github/release-please-config-hotfix.json     | 28 ++++++
 ...json => release-please-config-stable.json} |  9 +-
 .github/workflows/ci.yaml                     | 42 ++++++++-
 .github/workflows/pr.yaml                     |  7 +-
 .github/workflows/release.yaml                | 92 ++++++++++++++++++-
 .github/workflows/staging.yaml                |  5 +-
 .trivy/fs-config.yaml                         | 18 ++++
 9 files changed, 197 insertions(+), 12 deletions(-)
 create mode 100644 .github/release-please-config-hotfix.json
 rename .github/{release-please-config.json => release-please-config-stable.json} (86%)
 create mode 100644 .trivy/fs-config.yaml

diff --git a/.credo.exs b/.credo.exs
index c8cec3f..4dd304d 100644
--- a/.credo.exs
+++ b/.credo.exs
@@ -81,7 +81,7 @@
         # You can customize the priority of any check
         # Priority values are: `low, normal, high, higher`
         #
-        {Credo.Check.Design.AliasUsage, [priority: :low, if_nested_deeper_than: 2, if_called_more_often_than: 2]},
+        {Credo.Check.Design.AliasUsage, [priority: :low, if_nested_deeper_than: 4, if_called_more_often_than: 2]},
         {Credo.Check.Design.DuplicatedCode, false},
         # You can also customize the exit_status of each check.
         # If you don't want TODO comments to cause `mix credo` to fail, just
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 7f00997..ef5b36c 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,3 +1,9 @@
+## Related Ticket(s)
+
+<!--
+Enter the Jira issue below in the following format: PROJECT-##
+-->
+
 ## Checklist
 
 <!--
diff --git a/.github/release-please-config-hotfix.json b/.github/release-please-config-hotfix.json
new file mode 100644
index 0000000..1775625
--- /dev/null
+++ b/.github/release-please-config-hotfix.json
@@ -0,0 +1,28 @@
+{
+  "$comment": "This file is synced with stordco/common-config-elixir. Any changes will be overwritten.",
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "changelog-sections": [
+    {
+      "type": "hotfix",
+      "section": "Hotfixes",
+      "hidden": false
+    }
+  ],
+  "draft": false,
+  "draft-pull-request": false,
+  "packages": {
+    ".": {
+      "extra-files": ["README.md"],
+      "release-type": "elixir"
+    }
+  },
+  "plugins": [
+    {
+      "type": "sentence-case"
+    }
+  ],
+  "prerelease": false,
+  "pull-request-header": "An automated hotfix release has been created for you.",
+  "pull-request-title-pattern": "chore(main): release hotfix ${version}",
+  "separate-pull-requests": true
+}
diff --git a/.github/release-please-config.json b/.github/release-please-config-stable.json
similarity index 86%
rename from .github/release-please-config.json
rename to .github/release-please-config-stable.json
index c90be46..8461d98 100644
--- a/.github/release-please-config.json
+++ b/.github/release-please-config-stable.json
@@ -7,6 +7,11 @@
       "section": "Features",
       "hidden": false
     },
+    {
+      "type": "hotfix",
+      "section": "Hotfixes",
+      "hidden": true
+    },
     {
       "type": "fix",
       "section": "Bug Fixes",
@@ -22,9 +27,7 @@
   "draft-pull-request": false,
   "packages": {
     ".": {
-      "extra-files": [
-        "README.md"
-      ],
+      "extra-files": ["README.md"],
       "release-type": "elixir"
     }
   },
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 48ed603..4b5c23a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -46,7 +46,7 @@ jobs:
 
       - id: changed
         name: Get Changed Files
-        uses: tj-actions/changed-files@v43
+        uses: tj-actions/changed-files@v44
         with:
           files_yaml: |
             database:
@@ -55,8 +55,14 @@ jobs:
             docker:
               - '.github/workflows/ci.yaml'
               - 'Dockerfile'
+            documentation:
+              - 'docs/**'
+              - 'priv/documentation/**'
+              - '**.ex'
+              - '**.md'
             elixir:
               - '.github/workflows/ci.yaml'
+              - '.tool-versions'
               - 'priv/**'
               - '**.ex'
               - '**.exs'
@@ -92,6 +98,9 @@ jobs:
     needs: [Changed]
     runs-on: ubuntu-latest
 
+    env:
+      MIX_ENV: test
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -128,7 +137,7 @@ jobs:
         run: mix dialyzer --format github
 
   Documentation:
-    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }}
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.documentation == 'true' }}
     needs: [Changed]
     runs-on: ubuntu-latest
 
@@ -209,3 +218,32 @@ jobs:
           - elixir: 1.15
             otp: 26
 
+  Trivy_Filesystem:
+    if: ${{ !startsWith(github.head_ref, 'release-please--branches') }}
+    name: Trivy Filesystem Scan
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Elixir
+        uses: stordco/actions-elixir/setup@v1
+        with:
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          hex-token: ${{ secrets.HEX_API_KEY }}
+          oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }}
+          oban-token: ${{ secrets.OBAN_LICENSE_KEY }}
+
+      - name: Trivy Scan
+        uses: stordco/actions-trivy@v1.1.1
+        with:
+          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+          scan-type: fs
+          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
+
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 13c604c..3371db3 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -30,7 +30,7 @@ jobs:
               return;
             }
 
-            const REGEX = /^(feat!|fix!|fix|feat|chore|(fix|feat|chore)\(\w.*\)):\s(\[\w{1,8}-\d{1,8}\]|.*).*/;
+            const REGEX = /^(feat!|fix!|hotfix!|fix|feat|chore|hotfix|(fix|feat|chore|hotfix)\(\w.*\)):\s(\[\w{1,8}-\d{1,8}\]|.*).*/;
 
             if (!REGEX.test(title)) {
               core.setFailed("Pull request title does not follow conventional commits");
@@ -43,7 +43,10 @@ jobs:
                 fix: [JIRA-1234] fix an existing feature
                 feat: [JIRA-1234] a new feature to release
                 feat!: a breaking change
+                hotfix: needed in production immediately
 
-            Note: Adding ! (i.e. \`feat!:\`) represents a breaking change and will result in a SemVer major release.
+            Adding ! (i.e. \`feat!:\`) represents a breaking change and will result in a SemVer major release.
+
+            Starting a commit with \`hotfix\` will result in a seperate hotfix release PR.
                 `.trim());
             }
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 17b6e41..92ed152 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -6,21 +6,107 @@ on:
   push:
     branches:
       - main
+      - main-hotfix
 
 concurrency:
   group: release
   cancel-in-progress: false
 
 jobs:
-  Please:
+  Hotfix:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main-hotfix'
     runs-on: ubuntu-latest
 
     steps:
       - id: release
         name: Release
-        uses: google-github-actions/release-please-action@v4
+        uses: googleapis/release-please-action@v4
         with:
-          config-file: .github/release-please-config.json
+          config-file: .github/release-please-config-hotfix.json
+          manifest-file: .github/release-please-manifest.json
+          target-branch: main-hotfix
+          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+
+      - if: steps.release.outputs.release_created
+        name: Clone
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: main
+          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+
+      - if: steps.release.outputs.release_created
+        name: Setup Git
+        run: |
+          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+          git config --global user.name "${{ github.actor }}"
+        shell: bash
+
+      - if: steps.release.outputs.release_created
+        name: Cherry Pick
+        run: |
+          git cherry-pick ${{ github.sha }} -m1 --no-edit
+        shell: bash
+
+      - if: steps.release.outputs.release_created
+        name: Push
+        run: |
+          git push origin main
+        shell: bash
+
+      - if: steps.release.outputs.release_created
+        name: Delete
+        run: |
+          git push -d origin main-hotfix
+        shell: bash
+
+  Stable:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+
+    steps:
+      - id: release
+        name: Release
+        uses: googleapis/release-please-action@v4
+        with:
+          config-file: .github/release-please-config-stable.json
           manifest-file: .github/release-please-manifest.json
           target-branch: main
           token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+
+      - if: startsWith(github.event.head_commit.message, 'hotfix:')
+        name: Clone
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: main
+          token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+
+      - if: startsWith(github.event.head_commit.message, 'hotfix:')
+        name: Checkout
+        run: |
+          if git show-ref --verify --quiet refs/heads/main-hotfix; then
+            git checkout main-hotfix
+          else
+            git checkout -b main-hotfix tags/$(git describe --tags "$(git rev-list --tags --max-count=1)")
+          fi
+        shell: bash
+
+      - if: startsWith(github.event.head_commit.message, 'hotfix:')
+        name: Setup Git
+        run: |
+          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+          git config --global user.name "${{ github.actor }}"
+        shell: bash
+
+      - if: startsWith(github.event.head_commit.message, 'hotfix:')
+        name: Cherry Pick
+        run: |
+          git cherry-pick ${{ github.sha }} -m1 --no-edit
+        shell: bash
+
+      - if: startsWith(github.event.head_commit.message, 'hotfix:')
+        name: Push
+        run: |
+          git push origin main-hotfix
+        shell: bash
diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml
index 8823dbe..3bff385 100644
--- a/.github/workflows/staging.yaml
+++ b/.github/workflows/staging.yaml
@@ -26,6 +26,9 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    env:
+      MIX_ENV: test
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -38,7 +41,7 @@ jobs:
           oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }}
           oban-token: ${{ secrets.OBAN_LICENSE_KEY }}
 
-      - name: Build
+      - name: Docs
         run: mix docs
 
       - name: Set CNAME
diff --git a/.trivy/fs-config.yaml b/.trivy/fs-config.yaml
new file mode 100644
index 0000000..c9b8366
--- /dev/null
+++ b/.trivy/fs-config.yaml
@@ -0,0 +1,18 @@
+# This file is synced with stordco/common-config-elixir. Any changes will be overwritten.
+
+exit-code: '1'
+format: 'json'
+output: 'trivy-fs-results.json'
+scanners:
+  - vuln
+severity:
+  - CRITICAL
+  - HIGH
+  - MEDIUM
+  - LOW
+  - UNKNOWN
+timeout: '3m'
+vulnerability:
+  type:
+    - os
+    - library