Modernize the action

.github/renovate.json

@@ -0,0 +1,3 @@
+{
+  "extends": ["github>open-turo/renovate-config#v1"]
+}

.github/workflows/ci.yaml

@@ -1,22 +1,22 @@
 name: CI
 
 on:
+  workflow_dispatch:
   pull_request:
-    branches: [main]
 
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: open-turo/actions-gha/lint@v1
+      - uses: open-turo/actions-gha/lint@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: open-turo/actions-gha/test@v1
+      - uses: open-turo/actions-gha/test@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yaml

@@ -2,22 +2,22 @@ name: Release
 
 on:
   push:
-    branches: [main]
+    branches: [main, "v*"]
 
 jobs:
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: open-turo/actions-gha/lint@v1
+      - uses: open-turo/actions-gha/lint@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: open-turo/actions-gha/test@v1
+      - uses: open-turo/actions-gha/test@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -30,6 +30,6 @@ jobs:
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: open-turo/actions-gha/release@v1
+      - uses: open-turo/actions-gha/release@v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/security-scan.yaml

@@ -0,0 +1,17 @@
+name: Security scan
+
+on:
+  pull_request: {}
+  workflow_dispatch: {}
+  push:
+    branches: [main]
+
+jobs:
+  security-scan:
+    name: Security scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: open-turo/actions-security/static-analysis@v1
+        with:
+          semgrep-app-token: ${{ secrets.SEMGREP_APP_TOKEN }}

.github/workflows/update-dependencies.yaml

@@ -0,0 +1,26 @@
+name: Update dependencies
+concurrency: update-dependencies
+
+on:
+  schedule:
+    # Every day at midnight
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+  issue_comment:
+    types:
+      - edited
+  pull_request:
+    types:
+      - edited
+
+jobs:
+  update-dependencies:
+    runs-on: ubuntu-latest
+    name: Update dependencies
+    # Only run in turo-dependency-manager PRs or when manually triggered or as part of a schedule
+    if: (github.event_name == 'issue_comment' && github.event.issue.user.login == 'turo-dependency-manager') || (github.event_name == 'pull_request' && github.actor == 'turo-dependency-manager') || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Update dependencies
+        uses: open-turo/action-renovate@v1
+        with:
+          github-token: ${{ secrets.TURO_GITHUB_DEPENDENCY_MANAGER_TOKEN }}

.pre-commit-config.yaml

@@ -1,26 +1,23 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0 # Use the ref you want to point at
+    rev: v4.5.0
     hooks:
       - id: check-json
       - id: check-yaml
-      - id: pretty-format-json
-        args:
-          - --autofix
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v2.5.1
+    rev: v3.1.0
     hooks:
       - id: prettier
         stages: [commit]
   - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
-    rev: v8.0.0
+    rev: v9.9.0
     hooks:
       - id: commitlint
         stages: [commit-msg]
         additional_dependencies: ["@open-turo/commitlint-config-conventional"]
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.6.8
+    rev: v1.6.26
     hooks:
       - id: actionlint

.releaserc.json

@@ -1,15 +1,3 @@
 {
-  "branches": [
-    "main",
-    {
-      "channel": "next",
-      "name": "(f|b|c)/*",
-      "prerelease": "beta-<%= (/^\\w+-\\d+/.exec(name.substr(2)) || [])[0] %>"
-    }
-  ],
-  "plugins": [
-    "@semantic-release/commit-analyzer",
-    "@semantic-release/release-notes-generator",
-    "@semantic-release/github"
-  ]
+  "extends": "@open-turo/semantic-release-config"
 }

run-sync/action.yaml

@@ -32,40 +32,7 @@ runs:
     - name: setup docker-compose.yaml
       working-directory: ${{ runner.temp }}/kubesealer
       shell: bash
-      run: |
-
-        cat << EOF > docker-compose.yaml
-        version: "3.4"
-
-        services:
-          op-connect-api:
-            image: 1password/connect-api:latest
-            ports:
-              - "8080:8080"
-            volumes:
-              - "./1password-credentials.json:/home/opuser/.op/1password-credentials.json"
-              - "data:/home/opuser/.op/data"
-            healthcheck:
-              test: ["CMD", "curl", "-f", "http://localhost:8080/heartbeat"]
-              interval: 2s
-              timeout: 1s
-              retries: 5
-              start_period: 5s
-          op-connect-sync:
-            image: 1password/connect-sync:latest
-            ports:
-              - "8081:8080"
-            volumes:
-              - "./1password-credentials.json:/home/opuser/.op/1password-credentials.json"
-              - "data:/home/opuser/.op/data"
-          kubesealer:
-            image: turo/kubesealer:latest
-            env_file: .env
-
-        volumes:
-          data:
-
-        EOF
+      run: cp ${{ github.action_path }}/docker-compose.yaml .
 
     - name: docker versions
       shell: bash

run-sync/docker-compose.yaml

@@ -0,0 +1,29 @@
+version: "3.4"
+
+services:
+  op-connect-api:
+    image: 1password/connect-api:latest
+    ports:
+      - "8080:8080"
+    volumes:
+      - "./1password-credentials.json:/home/opuser/.op/1password-credentials.json"
+      - "data:/home/opuser/.op/data"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8080/heartbeat"]
+      interval: 2s
+      timeout: 1s
+      retries: 5
+      start_period: 5s
+  op-connect-sync:
+    image: 1password/connect-sync:latest
+    ports:
+      - "8081:8080"
+    volumes:
+      - "./1password-credentials.json:/home/opuser/.op/1password-credentials.json"
+      - "data:/home/opuser/.op/data"
+  kubesealer:
+    image: turo/kubesealer:4.11.0
+    env_file: .env
+
+volumes:
+  data:

script/bootstrap

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+# script/bootstrap: Resolve all dependencies that the application requires to
+#                   run.
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+# Local only checks
+if [[ $CI != "true" ]]; then
+  echo -e "==>  Setting up commit hooks"
+  pre-commit install
+  pre-commit install --hook-type commit-msg
+fi

script/setup

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+# script/setup: Set up application for the first time after cloning, or set it
+#               back to the initial first unused state.
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+script/bootstrap