Update to 1.18

.dockerignore

@@ -11,9 +11,10 @@
 !/TRADEMARK
 
 # Exclude
-src/dashboard/frontend/node_modules
-src/dashboard/src/media/js/build
+src/archivematica/dashboard/frontend/node_modules
+src/archivematica/dashboard/media/js/build
 **/*~
 **/*.log
 **/node_modules
 **/Thumbs.db
+**/*.egg-info

.gitattributes

@@ -1,6 +1,4 @@
-*.py ident
-*.sh ident
-src/dashboard/frontend/app/locale/*.po linguist-generated=true
-src/dashboard/frontend/app/locale/*.pot linguist-generated=true
-src/dashboard/frontend/app/locale/translations.json linguist-generated=true
-src/dashboard/frontend/package-lock.json linguist-generated=true
+src/archivematica/dashboard/frontend/app/locale/*.po linguist-generated=true
+src/archivematica/dashboard/frontend/app/locale/*.pot linguist-generated=true
+src/archivematica/dashboard/frontend/app/locale/translations.json linguist-generated=true
+src/archivematica/dashboard/frontend/package-lock.json linguist-generated=true

.github/dependabot.yml

@@ -0,0 +1,29 @@
+version: 2
+updates:
+  - package-ecosystem: "docker-compose"
+    directory: "/hack"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 1
+    groups:
+      docker-compose-dev:
+        patterns:
+          - "*"
+  - package-ecosystem: "docker-compose"
+    directory: "/tests/integration"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 1
+    groups:
+      docker-compose-tests:
+        patterns:
+          - "*"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/acceptance-test.yml

@@ -14,7 +14,7 @@ jobs:
   test:
     if: "${{ github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.label.name == 'AMAUAT') }}"
     name: "Test ${{ matrix.tag }} on ${{ matrix.browser }}"
-    runs-on: "ubuntu-22.04"
+    runs-on: "ubuntu-24.04"
     strategy:
       fail-fast: false
       matrix:
@@ -35,12 +35,12 @@ jobs:
     steps:
       - name: "Check out repository"
         if: "${{ github.event_name != 'workflow_dispatch' }}"
-        uses: "actions/checkout@v4"
+        uses: "actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955" # v4.3.0
         with:
           submodules: true
       - name: "Check out repository (manually triggered)"
         if: "${{ github.event_name == 'workflow_dispatch' }}"
-        uses: "actions/checkout@v4"
+        uses: "actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955" # v4.3.0
         with:
           ref: "${{ inputs.am_version || 'qa/1.x' }}"
           submodules: true
@@ -83,7 +83,7 @@ jobs:
         working-directory: ./hack
       - name: "Upload docker logs on failure"
         if: "${{ (failure() && steps.amauat-run.outcome == 'failure') || (cancelled() && steps.amauat-run.outcome == 'cancelled') }}"
-        uses: "actions/upload-artifact@v4"
+        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02" # v4.6.2
         with:
           name: "docker-logs-${{ matrix.tag }}-${{ matrix.browser }}"
           path: "./hack/docker-logs"

.github/workflows/build.yml

@@ -34,7 +34,7 @@ jobs:
       ARCHIVEMATICA_MCP_SERVER_IMAGE_TAG: ${{ steps.generate_mcp_server_image_tag.outputs.ARCHIVEMATICA_MCP_SERVER_IMAGE_TAG}}
       ARCHIVEMATICA_MCP_CLIENT_IMAGE_TAG: ${{ steps.generate_mcp_client_image_tag.outputs.ARCHIVEMATICA_MCP_CLIENT_IMAGE_TAG}}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       - name: Set ECR domain env var
         id: set_ecr_domain
         run: echo "ECR_DOMAIN=364159549467.dkr.ecr.$AWS_REGION.amazonaws.com" >> "$GITHUB_ENV"
@@ -62,7 +62,7 @@ jobs:
     env:
       ARCHIVEMATICA_DASHBOARD_IMAGE_TAG: ${{ needs.generate_image_tags.outputs.ARCHIVEMATICA_DASHBOARD_IMAGE_TAG}}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           repository: ${{ inputs.target_repo }}
       - run: docker build -t $ARCHIVEMATICA_DASHBOARD_IMAGE_TAG --target archivematica-dashboard -f hack/Dockerfile .
@@ -81,7 +81,7 @@ jobs:
     env:
       ARCHIVEMATICA_MCP_SERVER_IMAGE_TAG: ${{ needs.generate_image_tags.outputs.ARCHIVEMATICA_MCP_SERVER_IMAGE_TAG}}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           repository: ${{ inputs.target_repo }}
       - run: docker build -t $ARCHIVEMATICA_MCP_SERVER_IMAGE_TAG --target archivematica-mcp-server -f hack/Dockerfile .
@@ -100,7 +100,7 @@ jobs:
     env:
       ARCHIVEMATICA_MCP_CLIENT_IMAGE_TAG: ${{ needs.generate_image_tags.outputs.ARCHIVEMATICA_MCP_CLIENT_IMAGE_TAG}}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
         with:
           repository: ${{ inputs.target_repo }}
       - run: docker build -t $ARCHIVEMATICA_MCP_CLIENT_IMAGE_TAG --target archivematica-mcp-client -f hack/Dockerfile .

.github/workflows/generate-sbom.yml

@@ -14,13 +14,13 @@ jobs:
       options: --entrypoint ""
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up cache
-        uses: actions/cache@v4
+        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
         with:
           path: .trivycache/
-          key: ${{ runner.os }}-trivy-${{ hashFiles('requirements*.txt', 'src/dashboard/frontend/package-lock.json') }}
+          key: ${{ runner.os }}-trivy-${{ hashFiles('requirements*.txt', 'src/archivematica/dashboard/frontend/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-trivy-
 
@@ -30,7 +30,7 @@ jobs:
           TRIVY_NO_PROGRESS: "true"
 
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sbom
           path: sbom.xml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download SBOM artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: sbom
 

.github/workflows/oidc-integration-test.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: "ubuntu-24.04"
     steps:
       - name: "Check out repository"
-        uses: "actions/checkout@v4"
+        uses: "actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955" # v4.3.0
       - name: "Save user id"
         id: user_id
         run: |
@@ -18,7 +18,7 @@ jobs:
         run: |
           echo "group_id=$(id -g)" >> $GITHUB_OUTPUT
       - name: "Set up buildx"
-        uses: "docker/setup-buildx-action@v3"
+        uses: "docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435" # v3.11.1
       - name: "Run tests"
         run: |
           ./run.sh
@@ -27,7 +27,7 @@ jobs:
         env:
           USER_ID: ${{ steps.user_id.outputs.user_id }}
           GROUP_ID: ${{ steps.group_id.outputs.group_id }}
-          UBUNTU_VERSION: "22.04"
+          UBUNTU_VERSION: "24.04"
           PYTHON_VERSION: "3.9"
           COMPOSE_DOCKER_CLI_BUILD: 1
           DOCKER_BUILDKIT: 1

.github/workflows/push-images.yml

@@ -0,0 +1,32 @@
+name: "Push images to Docker Hub"
+on: workflow_dispatch
+jobs:
+  build:
+    name: "Build and push images"
+    runs-on: "ubuntu-24.04"
+    strategy:
+      fail-fast: false
+      matrix:
+        component:
+          - archivematica-dashboard
+          - archivematica-mcp-client
+          - archivematica-mcp-server
+    steps:
+      - name: "Check out repository"
+        uses: "actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955" # v4.3.0
+      - name: "Set up buildx"
+        uses: "docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435" # v3.11.1
+      - name: "Log in to Docker Hub"
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+      - name: "Build and push ${{ matrix.component }}"
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          push: true
+          load: true
+          file: ./hack/Dockerfile
+          target: ${{ matrix.component }}
+          tags: artefactual/${{ matrix.component }}:latest