Merge branch 'saleor:main' into master

.devcontainer/docker-compose.yml

@@ -17,13 +17,13 @@ services:
       - ..:/app
 
   dashboard:
-    image: ghcr.io/saleor/saleor-dashboard:3.15.2
+    image: ghcr.io/saleor/saleor-dashboard:3.20
     restart: unless-stopped
     ports:
       - 9000:80
 
   db:
-    image: library/postgres:13-alpine
+    image: library/postgres:15-alpine
     restart: unless-stopped
     volumes:
       - saleor-db:/var/lib/postgresql/data

.github/workflows/publish-containers.yml

@@ -1,13 +1,23 @@
 name: Publish
 
 on:
-  push:
-    tags:
-      # Matches stable and pre-releases
-      - "[0-9]+.[0-9]+.[0-9]+*"
-    branches:
-      - main
-      - ci/**
+  workflow_call:
+    inputs:
+      prefix:
+        description: Optional image prefix for branch build
+        required: false
+        type: string
+      version:
+        description: Optional custom image version tag
+        required: false
+        type: string
+    secrets:
+      SLACK_WEBHOOK_URL:
+      SLACK_MENTION_GROUP_ID:
+    outputs:
+      version:
+        description: Docker image version
+        value: ${{ jobs.docker.outputs.version }}
 
 jobs:
   docker:
@@ -17,6 +27,9 @@ jobs:
       contents: read
       packages: write
 
+    outputs:
+      version: ${{ steps.meta.outputs.version }}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -36,9 +49,10 @@ jobs:
           images: |
             ghcr.io/${{ steps.image.outputs.image_name }}
           tags: |
-            type=ref,event=branch,prefix=unstable-
+            type=ref,event=branch,prefix=${{ inputs.prefix }}
             type=pep440,pattern={{version}}
             type=pep440,pattern={{major}}.{{minor}}
+            type=raw,value=${{ inputs.version }},enable=${{ inputs.version != null }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -66,7 +80,7 @@ jobs:
           context: .
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
 
       - name: Image digest
@@ -75,21 +89,12 @@ jobs:
             Digest: ${{ steps.docker_build.outputs.digest }}
             Tags: ${{ steps.meta.outputs.tags }}"
 
-      - name: Trigger staging deployment for tagged release
-        if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        run: |
-          curl -f -X POST \
-            -H "Accept: application/vnd.github.v3+json" \
-            -H "Authorization: Bearer ${{ secrets.SALEOR_RELEASE_TOKEN }}" \
-            https://api.github.com/repos/saleor/saleor-multitenant/dispatches \
-            -d "{\"event_type\":\"deploy-staging\",\"client_payload\":{\"version\":\"${{ steps.meta.outputs.version }}\"}}"
-
       - name: Notify Slack
         if: ${{ failure() }}
         env:
           JOB_STATUS: ${{ job.status }}
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLOUD_CI_WEBHOOK_URL }}
-          SLACK_MENTION_GROUP_ID: ${{ secrets.SLACK_CORE_SUPPORT_GROUP_ID }}
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_MENTION_GROUP_ID: ${{ secrets.SLACK_MENTION_GROUP_ID }}
           JOB_TITLE: "Build of Saleor Core ${{ steps.meta.outputs.version }}"
         run: |
           python3 ./.github/workflows/notify/notify-slack.py

.github/workflows/publish-load-test.yml

@@ -0,0 +1,48 @@
+name: Publish for load test
+
+on:
+  pull_request:
+    types: [reopened, synchronize, labeled]
+    branches: ["**"]
+
+jobs:
+  init:
+    if: ${{ ((github.event.action == 'labeled') && (github.event.label.name == 'load test')) || ((github.event.action != 'labeled') && contains(github.event.pull_request.labels.*.name, 'load test')) }}
+    runs-on: ubuntu-20.04
+    outputs:
+      version: ${{ steps.variables.outputs.version }}
+    steps:
+      - name: Prepare variables
+        id: variables
+        run:
+          set -x
+
+          branch=${{ github.event.pull_request.head.ref }}
+          branch_slug=$(echo "$branch" | sed 's@/@-@g')
+          branch_sha=${{ github.event.pull_request.head.sha }}
+          image_version="${branch_slug}-${branch_sha:0:8}"
+
+          echo "VERSION=${image_version}" >> $GITHUB_OUTPUT
+
+  publish:
+    needs:
+      - init
+    uses: ./.github/workflows/publish-containers.yml
+    with:
+      version: ${{ needs.init.outputs.version }}
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLOUD_CI_WEBHOOK_URL }}
+      SLACK_MENTION_GROUP_ID: ${{ secrets.SLACK_CORE_SUPPORT_GROUP_ID }}
+
+  deploy:
+    runs-on: ubuntu-20.04
+    needs:
+      - publish
+    steps:
+      - name: Trigger load test deployment
+        run: |
+          curl -f -X POST \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: Bearer ${{ secrets.SALEOR_RELEASE_TOKEN }}" \
+            https://api.github.com/repos/saleor/saleor-multitenant/dispatches \
+            -d "{\"event_type\":\"deploy-load-test\",\"client_payload\":{\"version\":\"${{ needs.publish.outputs.version }}\",\"branch\":\"${{ github.event.pull_request.base.ref }}\"}}"

.github/workflows/publish-main.yml

@@ -0,0 +1,16 @@
+name: Publish main
+
+on:
+  push:
+    branches:
+      - main
+      - ci/**
+
+jobs:
+  publish:
+    uses: ./.github/workflows/publish-containers.yml
+    with:
+      prefix: unstable-
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLOUD_CI_WEBHOOK_URL }}
+      SLACK_MENTION_GROUP_ID: ${{ secrets.SLACK_CORE_SUPPORT_GROUP_ID }}

.github/workflows/publish-release-tag.yml

@@ -0,0 +1,27 @@
+name: Publish release tag
+
+on:
+  push:
+    tags:
+      # Matches stable and pre-releases
+      - "[0-9]+.[0-9]+.[0-9]+*"
+
+jobs:
+  publish:
+    uses: ./.github/workflows/publish-containers.yml
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CLOUD_CI_WEBHOOK_URL }}
+      SLACK_MENTION_GROUP_ID: ${{ secrets.SLACK_CORE_SUPPORT_GROUP_ID }}
+
+  deploy:
+    runs-on: ubuntu-20.04
+    needs:
+      - publish
+    steps:
+      - name: Trigger staging deployment for tagged release
+        run: |
+          curl -f -X POST \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: Bearer ${{ secrets.SALEOR_RELEASE_TOKEN }}" \
+            https://api.github.com/repos/saleor/saleor-multitenant/dispatches \
+            -d "{\"event_type\":\"deploy-staging\",\"client_payload\":{\"version\":\"${{ needs.publish.outputs.version }}\"}}"

.github/workflows/pytest.yml

@@ -57,7 +57,7 @@ jobs:
 
       - name: Cache the venv
         id: cached-poetry-dependencies
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-venv-${{ hashFiles('**/poetry.lock') }}
@@ -92,17 +92,19 @@ jobs:
             --junitxml=junit/test-results.xml \
             --django-db-bench=${{ env.BENCH_PATH }}
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         with:
           path: ~/.cache/pre-commit
           key: ${{ runner.os }}-pre-commit-${{ hashFiles('**/.pre-commit-config.yaml') }}
           restore-keys: |
             ${{ runner.os }}-pre-commit-
 
       # Publish coverage and test results
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@v4
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: pytest-results
           path: junit/test-results.xml

.github/workflows/test-migrations-compatibility.yml

@@ -38,31 +38,55 @@ jobs:
 
       - name: Install and configure poetry
         run: |
-          python -m pip install poetry==1.7.0
+          pip install poetry==1.7.0
 
-      - name: Cache the venv
-        id: cached-poetry-dependencies
-        uses: actions/cache@v3
+      - name: Restore venv from cache
+        id: cached-poetry-dependencies-restore
+        uses: actions/cache/restore@v4
         with:
-          path: ~/.venv
+          path: ~/.cache/pypoetry/virtualenvs
           key: ${{ runner.os }}-venv-${{ hashFiles('**/poetry.lock') }}
+          # If no cache hit occurs for the key, fall back to a partial match
+          # of the most recently created artifact from the default branch
+          restore-keys: ${{ runner.os }}-venv-
 
+      # Sync dependencies if cache is not hit or there is a partial key match
       - name: Install dependencies
+        if: steps.cached-poetry-dependencies-restore.outputs.cache-hit != 'true'
         run: |
-          python -m poetry install --no-root
-        if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
+          poetry env use python3.9
+          poetry install --sync --no-root
+
+      - name: Add Python Virtual Environment to PATH
+        run: |
+          # Note: requires `poetry env use` to be ran, otherwise poetry
+          # may not be able to find which virtual environment is in use.
+          # Ticket: https://github.com/python-poetry/poetry/issues/7190
+          echo "$(poetry env info -p)"/bin >> $GITHUB_PATH
+
+      - name: Cache venv
+        uses: actions/cache/save@v4
+        if: steps.cached-poetry-dependencies-restore.outputs.cache-hit != 'true'
+        with:
+          path: ~/.cache/pypoetry/virtualenvs
+          key: ${{ steps.cached-poetry-dependencies-restore.outputs.cache-primary-key }}
 
       - name: Migrate
         run: |
           export DJANGO_SETTINGS_MODULE=saleor.tests.settings
-          python -m poetry run python manage.py migrate
+          python manage.py migrate
 
       - name: Checkout base
         uses: actions/checkout@v4
         with:
           ref: ${{ github['base_ref'] }}
 
+      # Sync dependencies to ensure consistency with base branch
+      - name: Synchronize dependencies
+        run: |
+          poetry install --sync --no-root
+
       - name: Run tests
         run: |
           export PYTEST_DB_URL=$DATABASE_URL
-          python -m poetry run pytest -n 0 --reuse-db
+          pytest -n 0 --reuse-db

.pre-commit-config.yaml

@@ -1,7 +1,7 @@
 exclude: ^.semgrep/
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v4.6.0
     hooks:
       - id: trailing-whitespace
         exclude: ^templates/templated_email/compiled/
@@ -11,25 +11,25 @@ repos:
         exclude_types: [svg]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.3.4
+    rev: v0.4.10
     hooks:
       - id: ruff
       - id: ruff-format
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.9.0
+    rev: v1.10.0
     hooks:
       - id: mypy
         language: system
         exclude: tests/
 
   - repo: https://github.com/fpgmaas/deptry.git
-    rev: "0.15.0"
+    rev: "0.16.1"
     hooks:
       - id: deptry
 
   - repo: https://github.com/returntocorp/semgrep
-    rev: v1.66.2
+    rev: v1.73.0
     hooks:
     - id: semgrep
       language_version: python3.9
@@ -46,9 +46,6 @@ repos:
         - --error
         # Do not check for version updates, it slows down the execution.
         - --disable-version-check
-        # Do not append directory names to the rules, otherwise
-        # it may misbehave.
-        - --no-rewrite-rule-ids
         # Quiet mode in order to not pollute the pre-commit outputs.
         # Replace --quiet with --verbose to debug issues.
         - --quiet

.semgrep/Makefile

@@ -3,9 +3,8 @@ test:
 
 scan:
 	semgrep scan \
-		--metrics=off \  # Disable Telemetry
+		--metrics=off \
 		--disable-version-check \
-		--no-rewrite-rule-ids \  # Don't put directory name in the rule IDs
-		--error \  # Exit with error code 1 if there are finding
-		-c rules/ \
+		--error \
+		-c . \
 		../

.semgrep/correctness/celery/task-logger-without-suffix.py

@@ -0,0 +1,39 @@
+import logging
+from celery.utils.log import get_task_logger
+
+def same_name_using___name__():
+    # Using the same name (__name__) should match.
+    # ruleid: task-logger-without-suffix
+    logger = logging.getLogger(__name__)
+    task_logger = get_task_logger(__name__)
+
+def same_name_with_celery_first():
+    # Using the same name (__name__) should match,
+    # even if get_task_logger() is called before logging.getLogger().
+    # ruleid: task-logger-without-suffix
+    task_logger = get_task_logger(__name__)
+    logger = logging.getLogger(__name__)
+
+def different_name_get_task_logger():
+    # Using a different name in `get_task_logger()` shouldn't match.
+    # ok: task-logger-without-suffix
+    task_logger = get_task_logger(f"{__name__}.celery")
+
+def different_name_logging_getlogger():
+    # Using a different name in logging.getLogger shouldn't match.
+    # ok: task-logger-without-suffix
+    logger = logging.getLogger("foo")
+    task_logger = get_task_logger(__name__)
+
+def same_name_hardcoded():
+    # Using the same name as a string literal should match.
+    # ruleid: task-logger-without-suffix
+    logger = logging.getLogger("foo")
+    task_logger = get_task_logger("foo")
+
+def same_name_without_variables():
+    # Using the same name without creating variables should match.
+    # ruleid: task-logger-without-suffix
+    logging.getLogger("foo")
+    get_task_logger("foo")
+