Update main from develop

.env-example

@@ -41,6 +41,7 @@ LDAP_BIND_USER =
 LDAP_BIND_PW =
 LDAP_USER_FILTER =
 LDAP_SHARED_ACCOUNT_FILTER =
+LDAP_SERVICE_ACCOUNT_FILTER =
 LDAP_ROLE_FILTER =
 LDAP_USER_BASE =
 ENABLE_LDAP = false

.github/workflows/build.yml

@@ -22,10 +22,10 @@ jobs:
     container:
       image: node:18
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Cache and restore node_modules
         id: cache-node
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ./node_modules
           key: ${{ runner.os }}-node-${{ hashFiles('./package-lock.json') }}
@@ -38,10 +38,10 @@ jobs:
     container:
       image: node:18
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Cache and restore node_modules
         id: cache-node
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ./node_modules
           key: ${{ runner.os }}-node-${{ hashFiles('./package-lock.json') }}
@@ -117,12 +117,12 @@ jobs:
       STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_TEST_SECRET }}
       SKIP_SQLITE_DEFAULTS: true
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Cache and restore node_modules
         id: cache-node
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ./node_modules
           key: ${{ runner.os }}-node-${{ hashFiles('./package-lock.json') }}
@@ -131,7 +131,7 @@ jobs:
       - run: openssl genrsa -out ./config/jwt.key 2048 && chmod 0777 ./config/jwt.key
       - run: npm run swagger:validate
       - run: npm run coverage-ci # Separate command to limit the number of workers to prevent timeouts
-      - run: git config --global --add safe.directory $GITHUB_WORKSPACE # To avoid dubious ownership
+      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE" # To avoid dubious ownership
         if: ${{ matrix.typeorm-connection == 'mariadb' }}
 
       - name: "Cannot commit code coverage cross-fork"
@@ -206,12 +206,12 @@ jobs:
           MARIADB_USER: sudosos-ci
           MARIADB_PASSWORD: sudosos-ci
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Cache and restore node_modules
         id: cache-node
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ./node_modules
           key: ${{ runner.os }}-node-${{ hashFiles('./package-lock.json') }}

.github/workflows/docker-build.yml

@@ -15,32 +15,33 @@ jobs:
       image: docker:dind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Determine Docker tag
         id: tag
         run: |
-          if [[ "${{ github.actor }}" == "dependabot[bot]" ]]; then
-            echo "docker_actor=dependabot" >> $GITHUB_ENV
+          ACTOR="${{ github.actor }}"
+          if [[ "$ACTOR" == "dependabot\[bot\]" ]]; then
+            echo "docker_actor=dependabot" >> "$GITHUB_ENV"
           else
-            echo "docker_actor=${{ github.actor }}" >> $GITHUB_ENV
+            echo "docker_actor=$ACTOR" >> "$GITHUB_ENV"
           fi
 
       - name: Get Docker meta across forks
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ env.docker_actor }}/${{ github.repository }}
           tags: |
             type=ref,event=pr
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       # Build and push Docker image with Buildx (don't push on PR)
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64 #SudoSOS does not run on linux/arm64

.github/workflows/docker-push.yml

@@ -17,11 +17,11 @@ jobs:
       image: docker:dind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Get Docker meta (for tags)
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ vars.DOCKER_REGISTRY }}/${{ vars.DOCKER_TAG }}
@@ -32,7 +32,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to Registry (GitHub)
         uses: docker/login-action@v3
@@ -52,15 +52,15 @@ jobs:
 
       - name: Login to SudoSOS Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ vars.DOCKER_REGISTRY }}
           username: ${{ secrets.SVC_GH_SUDOSOS_USERNAME }}
           password: ${{ secrets.SVC_GH_SUDOSOS_PWD }}
 
       # Build and push Docker image with Buildx (don't push on PR)
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64 #SudoSOS does not run on linux/arm64

.github/workflows/docs.yaml

@@ -17,11 +17,11 @@ jobs:
       image: docker:dind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Get Docker meta (for tags)
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ vars.DOCKER_REGISTRY }}/${{ vars.DOCKER_DOCS_TAG }}
@@ -32,17 +32,17 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ vars.DOCKER_REGISTRY }}
           username: ${{ secrets.SVC_GH_SUDOSOS_USERNAME }}
           password: ${{ secrets.SVC_GH_SUDOSOS_PWD }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile-docs

.github/workflows/release.yml

@@ -41,30 +41,30 @@ jobs:
       image: docker:dind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Get Docker meta (for tags)
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ vars.DOCKER_REGISTRY }}/${{ vars.DOCKER_TAG }}
           tags: |
             ${{ needs.versioning.outputs.next_version }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to SudoSOS Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ vars.DOCKER_REGISTRY }}
           username: ${{ secrets.SVC_GH_SUDOSOS_USERNAME }}
           password: ${{ secrets.SVC_GH_SUDOSOS_PWD }}
 
 
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           context: .
           platforms: linux/amd64

init_scripts/start.sh

@@ -3,4 +3,5 @@ chmod +x /app/init_scripts/00_make_sudosos_data_dirs.sh
 chmod +x /app/init_scripts/00_regen_sudosos_secrets.sh
 sh /app/init_scripts/00_make_sudosos_data_dirs.sh
 sh /app/init_scripts/00_regen_sudosos_secrets.sh
-pm2 start /app/pm2.json --attach
+pm2 start /app/pm2.json
+pm2 logs