Deploy to prod

.docker-hub/print/Dockerfile

@@ -1,6 +1,6 @@
 # build stage
-FROM node:24.13.0 AS build-stage
+FROM node:24.14.0 AS build-stage
 ARG SENTRY_AUTH_TOKEN
 ARG SENTRY_ORG
 ARG SENTRY_PRINT_PROJECT
 ARG SENTRY_RELEASE_NAME
@@ -11,7 +11,7 @@
 
 COPY print/package*.json ./
 
 ENV NUXT_SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN
 ENV NUXT_SENTRY_ORG=$SENTRY_ORG
 ENV NUXT_SENTRY_PROJECT=$SENTRY_PRINT_PROJECT
 ENV NUXT_SENTRY_RELEASE_NAME=$SENTRY_RELEASE_NAME
@@ -22,13 +22,13 @@
 RUN npm run build
 
 # production stage
-FROM node:24.13.0 AS production-stage
+FROM node:24.14.0 AS production-stage
 WORKDIR /app
 
 COPY --from=build-stage /app/.output ./.output
 
 ENV NITRO_HOST 0.0.0.0
 ENV NITRO_PORT 80
 
 EXPOSE 80
 CMD node ./.output/server/index.mjs

.github/workflows/check-dependencies.yml

@@ -22,11 +22,11 @@ jobs:
     name: 'Api Platform check dependencies'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.5.2'
+          php-version: '8.5.4'
           tools: composer:2.9.0
           coverage: xdebug
 

.github/workflows/check-renovate-config.yml

@@ -14,6 +14,6 @@ jobs:
     name: 'renovate: validate config'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - run: docker run --rm -e LOG_LEVEL=debug -v "$PWD:/workspace" -w /workspace renovate/renovate:43.25.6 --platform=local

.github/workflows/continuous-integration-optional.yml

@@ -17,11 +17,11 @@ jobs:
     name: 'Validate Api Platform composer.lock'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.5.2'
+          php-version: '8.5.4'
           tools: composer:2.9.0
           coverage: xdebug
 
@@ -32,11 +32,11 @@ jobs:
     name: 'Lint: API (psalm)'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.5.2'
+          php-version: '8.5.4'
           tools: composer:2.9.0
           coverage: xdebug
 
@@ -62,11 +62,11 @@ jobs:
     name: 'Lint: API (phpstan)'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.5.2'
+          php-version: '8.5.4'
           tools: composer:2.9.0
           coverage: xdebug
 
@@ -110,11 +110,11 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.5.2'
+          php-version: '8.5.4'
           tools: composer:2.9.0
           coverage: xdebug
 

.github/workflows/continuous-integration.yml

@@ -87,11 +87,11 @@ jobs:
       - api-check-needed
     if: needs.api-check-needed.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.5.2'
+          php-version: '8.5.4'
           tools: composer:2.9.0
           coverage: none
 
@@ -120,11 +120,11 @@ jobs:
       - frontend-check-needed
     if: needs.frontend-check-needed.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.13.1'
+          node-version: '24.14.0'
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
@@ -149,11 +149,11 @@ jobs:
     name: 'Lint: ClientPrint (ESLint)'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.13.1'
+          node-version: '24.14.0'
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
@@ -178,11 +178,11 @@ jobs:
     name: 'Lint: Print (ESLint)'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.13.1'
+          node-version: '24.14.0'
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
@@ -210,11 +210,11 @@ jobs:
       - e2e-check-needed
     if: needs.e2e-check-needed.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.13.1'
+          node-version: '24.14.0'
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
@@ -260,11 +260,11 @@ jobs:
           --health-retries 5
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.5.2'
+          php-version: '8.5.4'
           extensions: intl-73.1
           tools: composer:2.9.0
           coverage: pcov
@@ -336,7 +336,7 @@ jobs:
           sed -i "s|$(pwd)/api/|api/|g" api/build/logs/clover.xml
           api/vendor/bin/php-coveralls -v \
                                   --coverage_clover api/build/logs/clover.xml \
-                                  --json_path api/build/logs/coveralls-upload.json
+                                  --json_path api/build/logs/coveralls-upload.json || true
         env:
           COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           COVERALLS_PARALLEL: true
@@ -349,11 +349,11 @@ jobs:
       - frontend-check-needed
     if: needs.frontend-check-needed.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.13.1'
+          node-version: '24.14.0'
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
@@ -392,11 +392,11 @@ jobs:
     name: 'Tests: Print'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.13.1'
+          node-version: '24.14.0'
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
@@ -431,11 +431,11 @@ jobs:
     name: 'Tests: PDF'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - uses: actions/setup-node@v6
         with:
-          node-version: '24.13.1'
+          node-version: '24.14.0'
 
       - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:

.github/workflows/deploy-ecamp3-logging.yml

@@ -31,7 +31,7 @@ jobs:
             }
 
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Dump secrets to /tmp/secrets.yaml
         run: |

.github/workflows/deploy-ingress.yml

@@ -7,20 +7,31 @@ on:
         description: 'Choose environment'
         type: environment
         default: dev
+      action:
+        description: "Choose action"
+        type: choice
+        required: true
+        default: diff
+        options:
+          - diff
+          - deploy
   push:
     branches:
       - devel
     paths:
       - .github/workflows/deploy-ingress.yml
       - .ops/ingress/**
 
+env:
+  action: ${{ github.event.inputs.action || 'deploy' }}
+
 jobs:
   deploy-ingress:
     name: "Deploy ingress"
     runs-on: ubuntu-latest
     environment: ${{ github.event.inputs.environment }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup helm
         run: |
@@ -37,6 +48,7 @@ jobs:
         working-directory: .ops/ingress
 
       - name: Deploy
+        if: env.action == 'deploy'
         run: |
           ./deploy.sh deploy
         working-directory: .ops/ingress

.github/workflows/deploy-ops-dashboard.yml

@@ -31,7 +31,7 @@ jobs:
             }
 
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Dump secrets to /tmp/secrets.yaml
         run: |

.github/workflows/deployment-pr-cleanup.yml

@@ -13,7 +13,7 @@ jobs:
       to-uninstall: ${{ steps.to-uninstall.outputs.list }}
       never-uninstall: ${{ steps.to-uninstall.outputs.never_uninstall }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Find all open PRs that have a "deploy!" label
         id: deployment-candidates

.github/workflows/reusable-build-and-push.yml

@@ -39,7 +39,7 @@ jobs:
           script: |
             return context.repo.owner.toLowerCase()
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ inputs.sha }}
 
@@ -122,7 +122,7 @@ jobs:
       tags: ${{ needs.build-info.outputs.tags }}
       repo-owner: ${{ needs.build-info.outputs.repo-owner }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ inputs.sha }}
           fetch-depth: 100
@@ -154,10 +154,10 @@ jobs:
           fi
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ vars.DOCKER_HUB_USERNAME || env.repo-owner }}
           password: ${{ secrets.DOCKER_HUB_PASSWORD }}
@@ -245,7 +245,7 @@ jobs:
           echo "result: ${{ toJSON(steps.transform-build-args.outputs) }}"
 
       - name: Build and push image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         if: steps.check-image.outputs.result == 'false'
         with:
           push: true

.github/workflows/reusable-e2e-tests-build.yml

@@ -9,15 +9,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       # build API (using cache; provide image to docker compose)
       - name: Build docker image (API/PHP)
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           file: api/Dockerfile
           context: './api'
@@ -30,7 +30,7 @@ jobs:
           cache-to: type=gha,scope=api,mode=max
           outputs: type=docker,dest=/tmp/ecamp3-dev-api.tar
 
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         with:
           name: e2e-tests-images
           path: /tmp/ecamp3-dev-*.tar

.github/workflows/reusable-e2e-tests-run.yml

@@ -22,16 +22,16 @@ jobs:
           - firefox
           - edge
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - run: cp .env.ci .env
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Restore tmp folder
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: e2e-tests-images
           path: /tmp
@@ -79,7 +79,7 @@ jobs:
         if: always()
 
       # store screenshots and videos on GitHub as artifacts, for downloading and debugging in case of problems
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v7
         if: always()
         with:
           name: cypress-output-${{ matrix.browser }}${{ inputs.run-identifier != null && format('-{0}', inputs.run-identifier) }}