🐛(ci) fix helmfile linter

Latest helmfile version breaks lots of thing.

.github/ISSUE_TEMPLATE/Support_question.md

@@ -9,9 +9,9 @@ We primarily use GitHub as an issue tracker. If however you're encountering an i
 
 ---
 
-Please make sure you have read our [main Readme](https://github.com/proconnect-gouv/oidc2fer).
+Please make sure you have read our [main Readme](https://github.com/numerique-gouv/oidc2fer).
 
-Also make sure it was not already answered in [an open or close issue](https://github.com/proconnect-gouv/oidc2fer/issues).
+Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/oidc2fer/issues).
 
 If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
 

.github/workflows/docker-hub.yml

@@ -1,6 +1,7 @@
-name: 🐳 Build docker images
+name: Docker Hub Workflow
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - 'main'
@@ -13,37 +14,42 @@ on:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
-    permissions:
-      packages: write
     steps:
-      - name: Checkout repository
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "oidc2fer,secrets"
+      -
+        name: Checkout repository
         uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-
-      - name: Docker meta
+      -
+        name: Docker meta
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ github.repository }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=tag
-            type=ref,event=pr
-            type=sha,prefix=sha-
-            # set latest tag for default branch
-            type=raw,value=latest,enable={{is_default_branch}}
-
-      - name: Login to Github Container Registry
-        uses: docker/login-action@v3
+          images: lasuite/oidc2fer
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
         with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ github.token }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
+          secret-file: secrets/numerique-gouv/oidc2fer/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Login to DockerHub
+        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
+      -
+        name: Build and push
+        uses: docker/build-push-action@v5
         with:
           context: .
           target: production

.github/workflows/helmfile-linter.yml

@@ -0,0 +1,22 @@
+name: Helmfile lint
+run-name: Helmfile lint
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  helmfile-lint:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/helmfile/helmfile:v0.171.0
+    steps:
+      -
+        uses: numerique-gouv/action-helmfile-lint@main
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          helmfile-src: "src/helm"
+          repositories: "oidc2fer,secrets"

.github/workflows/oidc2fer.yml

@@ -1,4 +1,4 @@
-name: 💚 CI Tests
+name: OIDC2FER Workflow
 
 on:
   push:
@@ -23,7 +23,7 @@ jobs:
         run: git log
       - name: Enforce absence of print statements in code
         run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/**' | grep "print("
+          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/oidc2fer.yml' | grep "print("
       - name: Check absence of fixup commits
         run: |
           ! git log | grep 'fixup!'
@@ -43,7 +43,7 @@ jobs:
         with:
             fetch-depth: 0
       - name: Check that the CHANGELOG has been modified in the current branch
-        run: git log --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
+        run: git whatchanged --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
 
   lint-changelog:
     runs-on: ubuntu-latest
@@ -101,37 +101,3 @@ jobs:
           pip install --user .[dev]
       - name: Run tests
         run: ~/.local/bin/pytest
-
-  helmfile-lint:
-    runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/helmfile/helmfile:v0.171.0
-    steps:
-      -
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: numerique-gouv
-          repositories: secrets
-      -
-        name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
-      -
-        name: Helmfile lint
-        shell: bash
-        run: |
-          mkdir -p ~/.config/sops/age/
-          echo ${{ secrets.SOPS_PRIVATE }} > ~/.config/sops/age/keys.txt
-          set -e
-          HELMFILE=src/helm/helmfile.yaml
-          environments=$(awk '/environments:/ {flag=1; next} flag && NF {print} !NF {flag=0}' "$HELMFILE" | grep -E '^[[:space:]]{2}[a-zA-Z]+' | sed 's/^[[:space:]]*//;s/:.*//')
-          for env in $environments; do
-            echo "################### $env lint ###################"
-            helmfile -e $env -f src/helm/helmfile.yaml lint || exit 1
-            echo -e "\n"
-          done

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "secrets"]
 	path = secrets
-	url = ../../numerique-gouv/secrets
+	url = ../secrets

CHANGELOG.md

@@ -6,15 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.0.8] - 2025-09-10
-- fix secrets submodule path following move to `proconnect-gouv` organization
-- update other references to `numerique-gouv` organization
-- publish Docker images at ghcr.io/proconnect-gouv/oidc2fer
-
-## [1.0.7] - 2025-05-07
-- remove unused APT dependencies
-- upgrade to gunicorn 23.0.0
-
 ## [1.0.6] - 2025-03-11
 - upgrade to SATOSA 8.5.1
 - allow faculty, staff, employee, researcher, teacher affiliations

Dockerfile

@@ -1,11 +1,17 @@
 # ---- base image to inherit from ----
-FROM python:3.11.12-slim-bookworm AS common
+FROM python:3.11-slim-bookworm as common
 
 # Install xmlsec1 dependencies required for xmlsec (for SAML)
 # Needs to be kept before the `pip install`
 RUN apt-get update && \
     apt-get -y upgrade && \
-    apt-get install -qy --no-install-recommends xmlsec1 && \
+    apt-get install -y \
+        pkg-config \
+        gcc \
+        xmlsec1 \
+        libxml2-dev \
+        libxmlsec1-dev \
+        libxmlsec1-openssl && \
     rm -rf /var/lib/apt/lists/*
 
 # We want the most up-to-date stable pip release
@@ -13,7 +19,7 @@ RUN pip install --upgrade pip
 
 ENV PYTHONUNBUFFERED=1
 
-# Give the "root" group the same permissions AS the "root" user on /etc/passwd
+# Give the "root" group the same permissions as the "root" user on /etc/passwd
 # to allow a user belonging to the root group to add new users; typically the
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
@@ -35,7 +41,7 @@ COPY docker/files/usr/local/etc/gunicorn/satosa.py /usr/local/etc/gunicorn/satos
 CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 
 # ---- Development image ----
-FROM common AS development
+FROM common as development
 
 # Playwright browsers
 ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
@@ -61,7 +67,7 @@ COPY ./src/satosa /app/
 USER ${DOCKER_USER}
 
 # ---- Production image (keep last so it is the default target) ----
-FROM common AS production
+FROM common as production
 
 # Copy oidc2fer application (see .dockerignore)
 COPY ./src/satosa /app/

README.md

@@ -57,7 +57,7 @@ number and date.
 ## Deploying a release to production (DINUM instance)
 
 1. Make sure the release you want to deploy has been built and appears on
-   https://github.com/proconnect-gouv/oidc2fer/pkgs/container/oidc2fer
+   https://hub.docker.com/r/lasuite/oidc2fer/tags .
 2. Edit `image/tag` at the top of
    `src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl`.
 3. Commit and push to `main`.

src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl

@@ -1,7 +1,7 @@
 image:
   repository: lasuite/oidc2fer
   pullPolicy: Always
-  tag: "v1.0.7"
+  tag: "v1.0.6"
 
 satosa:
   replicas: 2

src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl

@@ -1,7 +1,7 @@
 image:
-  repository: ghcr.io/proconnect-gouv/oidc2fer
+  repository: lasuite/oidc2fer
   pullPolicy: Always
-  tag: "latest"
+  tag: "main"
 
 satosa:
   replicas: 2

src/satosa/pyproject.toml

@@ -24,17 +24,17 @@ readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
     "SATOSA==8.5.1",
-    "gunicorn==23.0.0",
+    "gunicorn==22.0.0",
     "redis==5.0.4",
     "JSON-log-formatter==1.0",
     "WhiteNoise==6.7.0",
 ]
 
 [project.urls]
-"Bug Tracker" = "https://github.com/proconnect-gouv/oidc2fer/issues/new"
-"Changelog" = "https://github.com/proconnect-gouv/oidc2fer/blob/main/CHANGELOG.md"
-"Homepage" = "https://github.com/proconnect-gouv/oidc2fer"
-"Repository" = "https://github.com/proconnect-gouv/oidc2fer"
+"Bug Tracker" = "https://github.com/numerique-gouv/oidc2fer/issues/new"
+"Changelog" = "https://github.com/numerique-gouv/oidc2fer/blob/main/CHANGELOG.md"
+"Homepage" = "https://github.com/numerique-gouv/oidc2fer"
+"Repository" = "https://github.com/numerique-gouv/oidc2fer"
 
 [project.optional-dependencies]
 dev = [