Merge branch 'master' of https://github.com/inventree/InvenTree into pr/LqdBcnAtWork/9394

Author: matmair

.devcontainer/Dockerfile

@@ -34,7 +34,7 @@ RUN apt install -y \
    yarn nodejs npm
 
 # Update to the latest stable node version
-RUN npm install -g n --ignore-scripts && n lts
+RUN npm install -g n@10.1.0 --ignore-scripts && n lts
 
 RUN yarn config set network-timeout 600000 -g
 

.devcontainer/postCreateCommand.sh

@@ -27,7 +27,7 @@ python3 -m pip install --upgrade pip
 pip3 install --ignore-installed --upgrade invoke Pillow
 
 # install base level packages
-pip3 install -Ur --require-hashes contrib/container/requirements.txt
+pip3 install -Ur contrib/container/requirements.txt --require-hashes
 
 # Run initial InvenTree server setup
 invoke update -s

.github/actions/setup/action.yaml

@@ -64,7 +64,9 @@ runs:
       - name: Install Specific Python Dependencies
         if: ${{ inputs.pip-dependency }}
         shell: bash
-        run: uv pip install ${{ inputs.pip-dependency }}
+        run: uv pip install ${PIP_DEPS}
+        env:
+          PIP_DEPS: ${{ inputs.pip-dependency }}
 
       # NPM installs
       - name: Install node.js ${{ env.node_version }}
@@ -78,8 +80,10 @@ runs:
         shell: bash
         run: |
           sudo apt-get update
-          sudo apt-get install ${{ inputs.apt-dependency }}
-          sudo apt-get install ${{ inputs.apt-dependency }}
+          sudo apt-get install ${APT_DEPS}
+          sudo apt-get install ${APT_DEPS}
+        env:
+          APT_DEPS: ${{ inputs.apt-dependency }}
 
       # Invoke commands
       - name: Install dev requirements

.github/dependabot.yml

@@ -23,19 +23,6 @@ updates:
     directories:
     - /docs
     - /contrib/dev_reqs
-    schedule:
-      interval: weekly
-      day: friday
-    groups:
-      dependencies:
-        patterns:
-          - "*" # Include all dependencies
-    assignees:
-      - "matmair"
-    versioning-strategy: increase
-
-  - package-ecosystem: pip
-    directories:
     - /contrib/container
     - /src/backend
     schedule:
@@ -52,7 +39,6 @@ updates:
   - package-ecosystem: npm
     directories:
     - /src/frontend
-    - /src/backend
     schedule:
       interval: weekly
     groups:

.github/workflows/docker.yaml

@@ -72,7 +72,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set Up Python ${{ env.python_version }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # pin@v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # pin@v5.6.0
         with:
           python-version: ${{ env.python_version }}
       - name: Version Check
@@ -120,6 +120,7 @@ jobs:
           test -f data/config.yaml
           test -f data/plugins.txt
           test -f data/secret_key.txt
+          test -f data/oidc.pem
       - name: Run Unit Tests
         run: |
           echo "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> contrib/container/docker.dev.env
@@ -138,7 +139,7 @@ jobs:
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # [email protected]
       - name: Set up cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # [email protected].1
+        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # [email protected].2
       - name: Check if Dockerhub login is required
         id: docker_login
         run: |

.github/workflows/qc_checks.yaml

@@ -86,7 +86,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.python_version }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # pin@v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # pin@v5.6.0
         with:
           python-version: ${{ env.python_version }}
           cache: "pip"
@@ -109,7 +109,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.python_version }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # pin@v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # pin@v5.6.0
         with:
           python-version: ${{ env.python_version }}
       - name: Check Config
@@ -193,7 +193,6 @@ jobs:
           diff -u src/backend/InvenTree/schema.yml api.yaml && echo "no difference in API schema " || exit 2
       - name: Check schema - including warnings
         run: invoke dev.schema
-        continue-on-error: true
       - name: Extract version for publishing
         id: version
         if: github.ref == 'refs/heads/master' && needs.paths-filter.outputs.api == 'true'
@@ -203,22 +202,22 @@ jobs:
           echo "Version: $version"
           echo "version=$version" >> "$GITHUB_OUTPUT"
       - name: Extract settings / tags
-        run: invoke int.export-definitions --basedir src/backend/InvenTree
+        run: invoke int.export-definitions --basedir docs
       - name: Upload settings
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # [email protected]
         with:
           name: inventree_settings.json
-          path: src/backend/InvenTree/inventree_settings.json
+          path: docs/generated/inventree_settings.json
       - name: Upload tags
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # [email protected]
         with:
           name: inventree_tags.yml
-          path: src/backend/InvenTree/inventree_tags.yml
+          path: docs/generated/inventree_tags.yml
       - name: Upload filters
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # [email protected]
         with:
           name: inventree_filters.yml
-          path: src/backend/InvenTree/inventree_filters.yml
+          path: docs/generated/inventree_filters.yml
 
   schema-push:
     name: Push new schema
@@ -238,7 +237,7 @@ jobs:
       - name: Create artifact directory
         run: mkdir -p artifact
       - name: Download schema artifact
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # pin@v4.2.1
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # pin@v4.3.0
         with:
           path: artifact
           merge-multiple: true
@@ -255,7 +254,7 @@ jobs:
           echo "after move"
           ls -la artifact
           rm -rf artifact
-      - uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # pin@v5.1.0
+      - uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # pin@v5.2.0
         name: Commit schema changes
         with:
           commit_message: "Update API schema for ${{ env.version }} / ${{ github.sha }}"
@@ -343,8 +342,14 @@ jobs:
         run: python3 .github/scripts/check_migration_files.py
       - name: Coverage Tests
         run: invoke dev.test --coverage --translations
+      - name: Upload raw coverage to artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # [email protected]
+        with:
+          name: coverage
+          path: .coverage
+          retention-days: 14
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # [email protected].0
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # [email protected].3
         if: always()
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -487,7 +492,7 @@ jobs:
       - name: Run Tests
         run: invoke dev.test --migrations --report --coverage --translations
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # [email protected].0
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # [email protected].3
         if: always()
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -554,7 +559,7 @@ jobs:
           chmod +rw /home/runner/work/InvenTree/db.sqlite3
           invoke migrate
 
-  platform_ui:
+  web_ui:
     name: Tests - Web UI
     runs-on: ubuntu-24.04
     timeout-minutes: 60
@@ -584,7 +589,7 @@ jobs:
       INVENTREE_DB_PASSWORD: inventree_password
       INVENTREE_DEBUG: true
       INVENTREE_PLUGINS_ENABLED: false
-      VITE_COVERAGE: true
+      VITE_COVERAGE_BUILD: true
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # [email protected]
@@ -599,13 +604,13 @@ jobs:
           apt-dependency: postgresql-client libpq-dev
           pip-dependency: psycopg2
       - name: Set up test data
-        run: invoke dev.setup-test -iv
-      - name: Rebuild thumbnails
-        run: invoke int.rebuild-thumbnails
+        run: |
+          invoke dev.setup-test -iv
+          invoke int.rebuild-thumbnails
       - name: Install dependencies
-        run: invoke int.frontend-compile
-      - name: Install Playwright Browsers
-        run: cd src/frontend && npx playwright install --with-deps
+        run: |
+          invoke int.frontend-compile
+          cd src/frontend && npx playwright install --with-deps
       - name: Run Playwright tests
         id: tests
         run: cd src/frontend && npx nyc playwright test
@@ -616,24 +621,25 @@ jobs:
           path: src/frontend/playwright-report/
           retention-days: 14
       - name: Report coverage
-        if: always()
+        if: github.event_name != 'pull_request'
         run: cd src/frontend && npx nyc report --report-dir ./coverage --temp-dir .nyc_output --reporter=lcov --exclude-after-remap false
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # [email protected].0
-        if: always()
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # [email protected].3
+        if: github.event_name != 'pull_request'
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: inventree/InvenTree
           flags: web
       - name: Upload bundler info
+        if: github.event_name != 'pull_request'
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         run: |
           cd src/frontend
           yarn install
           yarn run build
 
-  platform_ui_build:
+  web_ui_build:
     name: Build - Web UI
     runs-on: ubuntu-24.04
     timeout-minutes: 60
@@ -681,7 +687,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # pin@v3
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # pin@v3
         with:
           sarif_file: results.sarif
           category: zizmor

.github/workflows/release.yaml

@@ -6,10 +6,12 @@ on:
     types: [published]
 permissions:
   contents: read
+env:
+  python_version: 3.9
 
 jobs:
   stable:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Write release to stable branch
     permissions:
       contents: write
@@ -34,7 +36,7 @@ jobs:
           force: true
 
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     name: Build and attest frontend
     permissions:
       id-token: write
@@ -53,7 +55,7 @@ jobs:
       - name: Build frontend
         run: cd src/frontend && npm run compile && npm run build
       - name: Create SBOM for frontend
-        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # pin@v0
+        uses: anchore/sbom-action@e11c554f704a0b820cbf8c51673f6945e0731532 # pin@v0
         with:
           artifact-name: frontend-build.spdx
           path: src/frontend
@@ -69,7 +71,7 @@ jobs:
           zip -r ../frontend-build.zip * .vite
       - name: Attest Build Provenance
         id: attest
-        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # pin@v1
+        uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # pin@v1
         with:
           subject-path: "${{ github.workspace }}/src/backend/InvenTree/web/static/frontend-build.zip"
 
@@ -89,3 +91,46 @@ jobs:
           file: ${{ steps.attest.outputs.bundle-path}}
           tag: ${{ github.ref }}
           overwrite: true
+
+  docs:
+    runs-on: ubuntu-24.04
+    name: Build and publish documentation
+    permissions:
+      contents: write
+    env:
+      INVENTREE_DB_ENGINE: sqlite3
+      INVENTREE_DB_NAME: inventree
+      INVENTREE_MEDIA_ROOT: /home/runner/work/InvenTree/test_inventree_media
+      INVENTREE_STATIC_ROOT: /home/runner/work/InvenTree/test_inventree_static
+      INVENTREE_BACKUP_DIR: /home/runner/work/InvenTree/test_inventree_backup
+      INVENTREE_SITE_URL: http://localhost:8000
+      INVENTREE_DEBUG: true
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # [email protected]
+        with:
+          persist-credentials: false
+      - name: Environment Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          npm: true
+      - name: Install dependencies
+        run: |
+          pip install --require-hashes -r contrib/dev_reqs/requirements.txt
+          pip install --require-hashes -r docs/requirements.txt
+      - name: Build documentation
+        run: |
+          invoke build-docs --mkdocs
+      - name: Zip build docs
+        run: |
+          cd docs/site
+          zip -r docs-html.zip *
+      - name: Publish documentation
+        uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd # [email protected]
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: docs/site/docs-html.zip
+          asset_name: docs-html.zip
+          tag: ${{ github.ref }}
+          overwrite: true

.github/workflows/scorecard.yaml

@@ -37,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -67,6 +67,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
+        uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
         with:
           sarif_file: results.sarif

.github/workflows/translations.yaml

@@ -49,11 +49,14 @@ jobs:
           git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"
           git add src/backend/InvenTree/locale/en/LC_MESSAGES/django.po src/frontend/src/locales/en/messages.po
+          echo "Adding commit (or ignoring if no changes)"
           git commit -m "add translations" || true
+          echo "Removing all other changes"
           git reset --hard
-          git reset HEAD~
+          echo "Resetting to HEAD~"
+          git reset HEAD~ || true
       - name: crowdin action
-        uses: crowdin/github-action@2cc7959c565767d6bc118118d6df3b63bf361370 # pin@v2
+        uses: crowdin/github-action@b8012bd5491b8aa8578b73ab5b5f5e7c94aaa6e2 # pin@v2
         with:
           upload_sources: true
           upload_translations: false