Pin dependencies

Reviewed-on: #2

.changes/2.13.0.md

@@ -0,0 +1,3 @@
+## 2.13.0 - 2026-07-10
+### Release
+* Release chill with bundles version 5.1.3

.changes/2.13.1.md

@@ -0,0 +1,5 @@
+## 2.13.1 - 2026-09-17
+### Fixed
+* Dockerfile: create cache directory for helm deployment
+### DX
+* Build image with gitea actions

.changes/2.13.2.md

@@ -0,0 +1,3 @@
+## 2.13.2 - 2026-09-17
+### DX
+* Fix permissions for writing to cache directory during helm deployment

.changes/2.13.3.md

@@ -0,0 +1,3 @@
+## 2.13.3 - 2026-09-17
+### DX
+* Upgrade to php version 8.4 in Dockerfile

.changes/2.13.4.md

@@ -0,0 +1,3 @@
+## 2.13.4 - 2026-09-17
+### DX
+* Fix Dockerfile permissions to be able to write to the whole /var/www/app/ directory 

.changes/unreleased/Release-renovate-1791597776657.yaml

@@ -0,0 +1,16 @@
+kind: Release
+body: |
+  - axllent/mailpit:  ->  
+  - chill/base-image: 8.4-edge ->  8.4-edge
+  - composer: 2 ->  2
+  - docker.elastic.co/logstash/logstash-oss: 8.1.0-amd64 ->  8.1.0-amd64
+  - gitea.champs-libres.be/chill-project/chill-skeleton-basic/base-image: latest ->  latest
+  - intl-messageformat: ^10.5.11 ->  10.7.18
+  - nginx:  ->  
+  - php: 8.4-fpm-alpine ->  8.4-fpm-alpine
+  - redis:  ->  
+  - registry.gitlab.com/champs-libres/public/relatorio-tornado/app: latest ->  latest
+
+time: 2026-10-10T02:02:56+00:00
+custom:
+  Issue: ""

.drone.yml

@@ -1,87 +0,0 @@
----
-kind: pipeline
-type: docker
-name: build-images
-
-image_pull_secrets:
-    - dockerconfig
-
-trigger:
-    event:
-        - tag
-
-steps:
-    - name: build-base-image
-      image: plugins/docker
-      settings:
-          username:
-              from_secret: docker_username
-          password:
-              from_secret: docker_password
-          registry: h3m6q87t.gra7.container-registry.ovh.net
-          repo: h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php-base
-          tag: latest
-          target: chill_base_php82
-          pull_image: true
-          cache_from:
-              - h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php-base:latest
-              - chill/base-image:latest
-
-    - name: composer-install
-      image: h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php-base:latest
-      pull: always
-      commands:
-          - composer install --no-scripts --no-interaction
-          - bin/console cache:clear
-      depends_on:
-          - build-base-image
-
-    - name: build-assets
-      image: node:20
-      pull: always
-      commands:
-          - yarn install
-          - yarn list
-          - yarn run encore production
-      depends_on:
-          - composer-install
-
-    - name: build-image-php
-      image: plugins/docker
-      settings:
-          pull_image: true
-          username:
-              from_secret: docker_username
-          password:
-              from_secret: docker_password
-          registry: h3m6q87t.gra7.container-registry.ovh.net
-          repo: h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php
-          tag:
-            - ${DRONE_TAG}
-          cache_from:
-              - h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php-base:latest
-              - chill/base-image:latest
-      depends_on:
-          - build-assets
-          - composer-install
-
-    - name: build-image-nginx
-      image: plugins/docker
-      settings:
-          pull_image: true
-          username:
-              from_secret: docker_username
-          password:
-              from_secret: docker_password
-          registry: h3m6q87t.gra7.container-registry.ovh.net
-          repo: h3m6q87t.gra7.container-registry.ovh.net/chillbasics/nginx
-          tag:
-            - ${DRONE_TAG}
-          Dockerfile: docker/nginx/Dockerfile
-      depends_on:
-          - build-assets
----
-kind: signature
-hmac: 510f151634e776218c6135bb830480fe0c265eb1dd96c16ef640001a23f351ae
-
-...

.gitea/workflows/release/build-image.yaml

@@ -0,0 +1,47 @@
+name: build-images
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build-and-push:
+    runs-on: cth-ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Log in to Docker Registry
+        uses: https://github.com/docker/login-action@v3
+        with:
+          registry: h3m6q87t.gra7.container-registry.ovh.net
+          username: ${{ vars.OVH_REGISTRY_USERNAME }}
+          password: ${{ secrets.OVH_REGISTRY_PASSWORD }}
+
+      - name: Install Dependencies and Build Assets
+        uses: docker://chill/base-image:8.4-edge@sha256:dd1e5379861a98aa3d70e46b3c4546bd020d66c94a70a7edf5f2f33ebb9a673c
+        env:
+          APP_ENV: prod
+        with:
+          entrypoint: /bin/sh
+          # We install node/yarn inside the PHP container to ensure translations are available
+          args: -c "apk add --no-cache nodejs yarn && composer install --no-scripts --no-interaction && bin/console cache:clear && yarn install && yarn run encore production"
+
+      - name: Set up Docker Buildx
+        uses: https://github.com/docker/setup-buildx-action@v3
+
+      - name: Build and Push PHP Image
+        uses: https://github.com/docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: h3m6q87t.gra7.container-registry.ovh.net/chillbasics/php:${{ github.ref_name }}
+
+      - name: Build and Push Nginx Image
+        uses: https://github.com/docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/nginx/Dockerfile
+          push: true
+          tags: h3m6q87t.gra7.container-registry.ovh.net/chillbasics/nginx:${{ github.ref_name }}

.gitea/workflows/release/update-composer-lock.yaml

@@ -19,7 +19,7 @@ jobs:
               with:
                 cmd: 'cat composer.lock | jq --raw-output ''.packages[] | select ( .name | contains ("chill-project/chill-bundles")) | .version'''
             - name: run composer update to update composer.lock
-              uses: docker://gitea.champs-libres.be/chill-project/chill-skeleton-basic/base-image:latest
+              uses: docker://gitea.champs-libres.be/chill-project/chill-skeleton-basic/base-image:latest@sha256:d728a939475e465c488056ec8b9c12f31601ea27251aad830499577857b7be94
               with:
                   # this is where we set the command to execute
                   args: composer update --no-install

CHANGELOG.md

@@ -6,6 +6,28 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 2.13.4 - 2026-09-17
+### DX
+* Fix Dockerfile permissions to be able to write to the whole /var/www/app/ directory 
+
+## 2.13.3 - 2026-09-17
+### DX
+* Upgrade to php version 8.4 in Dockerfile
+
+## 2.13.2 - 2026-09-17
+### DX
+* Fix permissions for writing to cache directory during helm deployment
+
+## 2.13.1 - 2026-09-17
+### Fixed
+* Dockerfile: create cache directory for helm deployment
+### DX
+* Build image with gitea actions
+
+## 2.13.0 - 2026-07-10
+### Release
+* Release chill with bundles version 5.1.3
+
 ## 2.12.0 - 2025-11-10
 ### Release
 * Update chill bundles to v4.7.0

Dockerfile

@@ -1,6 +1,6 @@
-FROM php:8.3-fpm-alpine AS chill_base_php82
+FROM php:8.4-fpm-alpine@sha256:78cd8de9970a9cd6ff4d98860a94eb5bf37dd2d5776b4785562dbfad01c29d5a AS chill_base_php82
 
-ENV POSTGRES_VERSION=15
+ENV POSTGRES_VERSION=16
 
 # default UID for the PHP user
 ARG UID=1000
@@ -56,7 +56,7 @@ RUN curl -o /usr/local/bin/php-cs-fixer https://cs.symfony.com/download/php-cs-f
 # to make php-cs-fixer works with php 8.2
 ENV PHP_CS_FIXER_IGNORE_ENV=1
 
-COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+COPY --from=composer:2@sha256:af98f42dfff7c68ba8d53c2164fd9fde1087b7d449514baa38c418b1f6bc4bac /usr/bin/composer /usr/bin/composer
 ENV COMPOSER_ALLOW_SUPERUSER=1
 ENV COMPOSER_MEMORY_LIMIT=-1
 
@@ -96,6 +96,12 @@ ADD ./entrypoint.sh /.
 
 RUN chmod +x /entrypoint.sh
 
+RUN mkdir -p /var/www/app/var/cache /var/www/app/var/log && \
+    chown -R 82:82 /var/www/app && \
+    chmod -R 755 /var/www/app && \
+    chown -R 82:82 /usr/local/etc/php/conf.d && \
+    chmod -R 755 /usr/local/etc/php/conf.d
+
 ENTRYPOINT ["/entrypoint.sh"]
 
 ENV PHP_FPM_USER=www-data \

compose.override.yaml

@@ -3,7 +3,7 @@ version: '3'
 services:
 ###> symfony/mailer ###
   mailer:
-    image: axllent/mailpit
+    image: axllent/mailpit@sha256:b68349e3a014b90c5610bfb26b2ae36f3892d7b8cf25ee140c6c71c98d2fcf48
     ports:
       - "1025"
       - "8025"

compose.yaml

@@ -17,9 +17,9 @@ services:
 
 ###> chill-project/chill-bundles ###
   redis:
-      image: redis
+      image: redis@sha256:2c2dff791878316e3b083188be0d578423b24813cdda5de0e80ea4f7b3e6bfd6
   relatorio:
-      image: registry.gitlab.com/champs-libres/public/relatorio-tornado/app:latest
+      image: registry.gitlab.com/champs-libres/public/relatorio-tornado/app:latest@sha256:2c4aa2f422c389d940adfd760b0856d237023d66cded0aa026b532b29192212e
 ###< chill-project/chill-bundles ###
 
 volumes:

composer.json

@@ -15,7 +15,7 @@
   },
   "require": {
     "ext-redis": "*",
-    "chill-project/chill-bundles": "v4.7.0",
+    "chill-project/chill-bundles": "v5.1.3",
     "hslavich/oneloginsaml-bundle": "^2.10",
     "symfony/runtime": "^5.4.0",
     "symfony/console": "5.4.*",

config/bundles.php

@@ -30,6 +30,7 @@ return [
     Chill\BudgetBundle\ChillBudgetBundle::class => ['all' => true],
     Chill\WopiBundle\ChillWopiBundle::class => ['all' => true],
     Chill\EventBundle\ChillEventBundle::class => ['all' => true],
+    Chill\TicketBundle\ChillTicketBundle::class => ['all' => true],
     Doctrine\Bundle\FixturesBundle\DoctrineFixturesBundle::class => ['dev' => true, 'test' => true],
     Nelmio\Alice\Bridge\Symfony\NelmioAliceBundle::class => ['dev' => true, 'test' => true],
     Symfony\Bundle\DebugBundle\DebugBundle::class => ['dev' => true],

config/packages/doctrine_migrations_chill.yaml

@@ -13,6 +13,7 @@ doctrine_migrations:
         'Chill\Migrations\AsideActivity': '@ChillAsideActivityBundle/migrations'
         'Chill\Migrations\Calendar': '@ChillCalendarBundle/migrations'
         'Chill\Migrations\Budget': '@ChillBudgetBundle/migrations'
+        'Chill\Migrations\Ticket': '@ChillTicketBundle/migrations'
     all_or_nothing:
         true
 

config/packages/security.yaml

@@ -49,6 +49,7 @@ security:
                 path: /logout
             switch_user: true
         # end of lines added by chill-bundles recipe
+            user_checker: chill_security.user_checker
 
     # Easy way to control access for large sections of your site
     # Note: Only the *first* access control that matches will be used

docker/logstash/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.elastic.co/logstash/logstash-oss:8.1.0-amd64
+FROM docker.elastic.co/logstash/logstash-oss:8.1.0-amd64@sha256:f48c2f7db8b63572fa36db259c98c3894d89fb28d37f9546c26acfc0de525338
 
 RUN \
   bin/logstash-plugin install logstash-output-gelf \

docker/nginx/Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx
+FROM nginx@sha256:f9ea18bfa4fad859e1ed38259d711da7ccad2c3516e875cec3351a57c859f571
 
 COPY ./public /var/www/app/public
 

package.json

@@ -6,7 +6,7 @@
   "devDependencies": {
     "@symfony/ux-translator": "file:vendor/symfony/ux-translator/assets",
     "bootstrap": "5.2.3",
-    "intl-messageformat": "^10.5.11"
+    "intl-messageformat": "10.7.18"
   },
   "scripts": {
     "specs-build": "yaml-merge vendor/chill-project/chill-bundles/src/Bundle/ChillMainBundle/chill.api.specs.yaml vendor/chill-project/chill-bundles/src/Bundle/ChillPersonBundle/chill.api.specs.yaml vendor/chill-project/chill-bundles/src/Bundle/ChillCalendarBundle/chill.api.specs.yaml vendor/chill-project/chill-bundles/src/Bundle/ChillThirdPartyBundle/chill.api.specs.yaml vendor/chill-project/chill-bundles/src/Bundle/ChillDocStoreBundle/chill.api.specs.yaml> templates/api/specs.yaml",

renovate.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

webpack.config.js

@@ -94,19 +94,26 @@ module.exports = (async () => {
     Encore
         .setOutputPath('public/build/')
         .setPublicPath('/build')
-        .enableSassLoader()
+        .enableSassLoader(function (options) {
+            // If set to true, Sass won’t print warnings that are caused by dependencies (like bootstrap):
+            // https://sass-lang.com/documentation/js-api/interfaces/options/#quietDeps
+            options.sassOptions.quietDeps = true;
+            options.sassOptions.silenceDeprecations = ['import'];
+        })
         .enableVueLoader(() => {}, {
             version: 3,
-            runtimeCompilerBuild: true,
         })
-        .enableTypeScriptLoader(/*function (tsConfig){
+        .enableTypeScriptLoader(function (tsConfig){
             tsConfig.appendTsSuffixTo = [/\.vue$/];
             tsConfig.appendTsxSuffixTo = [/\.vue$/];
             // temporary fix for https://github.com/vuejs/vue-loader/issues/1915 and https://github.com/vuejs/core/issues/2855
             tsConfig.compilerOptions = {strict: !Encore.isProduction()};
-         tsConfig.compilerOptions.paths = {"translator": [resolve(__dirname, "./assets/translator.ts")]};
+            // disable type checking in ts-loader: Vue files are already checked by vue-tsc,
+            // and the generated code (e.g. mergeModels) may use APIs not yet in the bundled @vue/runtime-core types.
+            // see https://github.com/vuejs/core/issues/10331#issuecomment-1938909170
+            tsConfig.transpileOnly = true;
             tsConfig.silent = false;
-      }*/)
+        })
         //.enableForkedTypeScriptTypesChecking()
         .autoProvidejQuery()
         .enableSourceMaps(!Encore.isProduction())
@@ -129,7 +136,7 @@ module.exports = (async () => {
     ;
 
     Encore.addAliases({
-        translator: resolve(__dirname, './vendor/chill-project/chill-bundles/assets/translator')
+        translator: resolve(__dirname, './vendor/chill-project/chill-bundles/assets/translator'),
     });
 
     // populate config with chill entries