Sync upstream repo of password pusher

.erb_lint.yml

@@ -0,0 +1,9 @@
+---
+exclude:
+  - 'vendor/bundle/**/*'
+EnableDefaultLinters: true
+linters:
+  SpaceAroundErbTag:
+    enabled: true
+  ExtraNewline:
+    enabled: true

.gitattributes

@@ -1,2 +1,3 @@
-# reclassifies `.html` files as Ruby so the repo language is correct:
 *.html linguist-language=Ruby
+app/assets/stylesheets/themes/* linguist-vendored=true
+app/assets/javascripts/application.js linguist-vendored=true

.github/ISSUE_TEMPLATE/bug_report.md

@@ -26,15 +26,30 @@ Steps to reproduce the behavior:
 
 Where are you running/using Password Pusher?
 
+<!-- These are checkboxes that can be clicked after issue creation. -->
+
 - [ ] pwpush.com
+- [ ] oss.pwpush.com
 - [ ] Docker Image
   - [ ] pwpush
-  - [ ] custom image
-- [ ] Heroku
+  - [ ] pwpush-public-gateway
+  - [ ] pwpush-worker
+  - [ ] Custom image
 - [ ] Digital Ocean
+  - [ ] App Platform
+  - [ ] Kubernetes Service
+- [ ] Heroku
 - [ ] Microsoft Azure
+  - [ ] App Service
+  - [ ] Container Instances (ACI)
+  - [ ] Kubernetes Service (AKS)
 - [ ] Google Cloud
+  - [ ] App Engine
+  - [ ] Cloud Run
+  - [ ] Kubernetes Engine
 - [ ] AWS
+  - [ ] Elastic Container Service (ECS)
+  - [ ] Kubernetes Service (AKS)
 - [ ] Source Code
 - [ ] Other (please specify)
 

.github/ISSUE_TEMPLATE/feature_request.md

@@ -21,5 +21,3 @@ assignees:
 ## 📎 Additional context
 
 <!-- Add any other context or screenshots about the feature request here. -->
-
-<!-- ...and thank you for your input - Password Pusher has gotten to this point largely from community input and feedback. -->

.github/release-drafter.yml

@@ -19,15 +19,32 @@ categories:
     labels: [dependencies]
 
 template: |
-  ## What’s Changed
+  ## :memo: What’s Changed
 
   $CHANGES
 
   ## :busts_in_silhouette: List of contributors
 
   $CONTRIBUTORS
 
-  ## Docker Images
+  ## :motor_boat: Docker Images
 
   Available on Docker Hub:
   https://hub.docker.com/r/pglombardo/pwpush
+
+  ## :running_man: Run This Version
+
+  ```bash
+  docker run -d -p 5100:5100 pglombardo/pwpush:$NEXT_PATCH_VERSION
+  ```
+
+  ..and go to `http://localhost:5100`
+
+  ## :link: Useful Links
+
+  * [Documentation](https://docs.pwpush.com)
+  * [Docker Hub](https://hub.docker.com/r/pglombardo/pwpush)
+  * [GitHub](https://github.com/pglombardo/PasswordPusher)
+  * [Website](https://pwpush.com)
+  * [Twitter](https://twitter.com/pwpush)
+  * [Newsletter](https://buttondown.email/pwpush)

.github/workflows/brakeman.yml

@@ -0,0 +1,59 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow integrates Brakeman with GitHub's Code Scanning feature
+# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications
+
+name: Brakeman Scan
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "master" ]
+  schedule:
+    - cron: '20 4 * * 4'
+
+permissions:
+  contents: read
+
+jobs:
+  brakeman-scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    name: Brakeman Scan
+    runs-on: ubuntu-latest
+    steps:
+    # Checkout the repository to the GitHub Actions runner
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    # Customize the ruby version depending on your needs
+    - name: Setup Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: '3.4'
+        bundler-cache: true
+
+    - name: Setup Brakeman
+      env:
+        BRAKEMAN_VERSION: '6.2.2'
+      run: |
+        gem install brakeman --version $BRAKEMAN_VERSION
+
+    # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis
+    - name: Scan
+      continue-on-error: true
+      run: |
+        brakeman -f sarif -o output.sarif.json .
+
+    # Upload the SARIF file generated in the previous step
+    - name: Upload SARIF
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: output.sarif.json

.github/workflows/docker-containers.yml

@@ -4,7 +4,6 @@ name: Docker Container Builds
 on:
   push:
     tags:
-      - "release"
       - "v*.*.*"
 
   workflow_dispatch:
@@ -16,19 +15,30 @@ on:
         default: false
   schedule:
     # * is a special character in YAML so you have to quote this string
-    # Run every day at 5:24 UTC - build 'latest' docker containers
+    # Run every day at 5:24 UTC - build 'nightly' docker containers
     - cron: "24 17 * * *"
+
+  pull_request_target:
+    types:
+      - labeled
+
 env:
   DOCKER_PUSH: true
 jobs:
-  build:
+  pwpush-container:
+    if: github.event.label && github.event.label.name == 'docker' || github.event_name != 'pull_request_target'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && format('refs/pull/{0}/head', github.event.pull_request.number) || github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          fetch-depth: 1
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:master
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -38,15 +48,14 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ secrets.DOCKER_USERNAME }}/pwpush
-          flavor: |
-            latest=false
           tags: |
-            type=match,pattern=release
-            type=schedule,pattern=latest
+            type=ref,event=pr,format=pr-{{ref}}-docker
+            type=match,pattern=stable
+            type=schedule,pattern=nightly
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=semver,pattern=latest
+            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
 
       - name: Login to DockerHub
         uses: docker/login-action@v3
@@ -55,7 +64,7 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           file: ./containers/docker/Dockerfile
           platforms: linux/amd64,linux/arm64
@@ -66,3 +75,105 @@ jobs:
           cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/pwpush:buildcache
           cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/pwpush:buildcache,mode=max,ignore-error=${{env.DOCKER_PUSH == 'false'}}
 
+  public-gateway-container:
+    if: github.event.label && github.event.label.name == 'docker' || github.event_name != 'pull_request_target'
+    needs: pwpush-container
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && format('refs/pull/{0}/head', github.event.pull_request.number) || github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          fetch-depth: 1
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:master
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Populate Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ secrets.DOCKER_USERNAME }}/pwpush-public-gateway
+          tags: |
+            type=ref,event=pr,format=pr-{{ref}}-docker
+            type=match,pattern=stable
+            type=schedule,pattern=nightly
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: ./containers/docker/Dockerfile.public-gateway
+          platforms: linux/amd64,linux/arm64
+          provenance: false
+          push: true
+          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/pwpush-public-gateway:buildcache
+          cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/pwpush-public-gateway:buildcache,mode=max,ignore-error=${{env.DOCKER_PUSH == 'false'}}
+
+  worker-container:
+    if: github.event.label && github.event.label.name == 'docker' || github.event_name != 'pull_request_target'
+    needs: pwpush-container
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'pull_request_target' && format('refs/pull/{0}/head', github.event.pull_request.number) || github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+          fetch-depth: 1
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:master
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Populate Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ secrets.DOCKER_USERNAME }}/pwpush-worker
+          tags: |
+            type=ref,event=pr,format=pr-{{ref}}-docker
+            type=match,pattern=stable
+            type=schedule,pattern=nightly
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          file: ./containers/docker/Dockerfile.worker
+          platforms: linux/amd64,linux/arm64
+          provenance: false
+          push: true
+          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/pwpush-worker:buildcache
+          cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/pwpush-worker:buildcache,mode=max,ignore-error=${{env.DOCKER_PUSH == 'false'}}
+

.github/workflows/greetings.yml

@@ -1,6 +1,6 @@
 name: Greetings
 
-on: [pull_request, issues]
+on: [pull_request_target, issues]
 
 permissions:
   contents: read