Modern Fullstack Developer Test — Roster (user management)

.dockerignore

@@ -0,0 +1,72 @@
+# See https://docs.docker.com/engine/reference/builder/#dockerignore-file for more about ignoring files.
+
+# Ignore git directory.
+/.git/
+/.gitignore
+
+# Ignore bundler config.
+/.bundle
+
+# Ignore all environment files.
+/.env*
+
+# Ignore all default key files.
+/config/master.key
+/config/credentials/*.key
+
+# Ignore all logfiles and tempfiles.
+/log/*
+/tmp/*
+!/log/.keep
+!/tmp/.keep
+
+# Ignore pidfiles, but keep the directory.
+/tmp/pids/*
+!/tmp/pids/.keep
+
+# Ignore storage (uploaded files in development and any SQLite databases).
+/storage/*
+!/storage/.keep
+/tmp/storage/*
+!/tmp/storage/.keep
+
+# Ignore assets.
+/node_modules/
+/app/assets/builds/*
+!/app/assets/builds/.keep
+/public/assets
+
+# Ignore CI service files.
+/.github
+
+# Ignore Kamal files.
+/config/deploy*.yml
+/.kamal
+
+# Ignore development files
+/.devcontainer
+
+# Ignore Docker-related files
+/.dockerignore
+/Dockerfile*
+
+# Ignore the test suite and coverage output: they are not needed in the
+# production image and only make it larger.
+/spec
+/coverage
+/.rspec_status
+
+# Ignore host-side operational scripts; they drive Docker from outside.
+/devops
+
+# Ignore the working documents that live beside the repository but are not part
+# of it. They are untracked, so a fresh clone has none of them -- but a build
+# from the machine they were written on would copy them straight into the image
+# somebody else pulls.
+/PLANO_TESTE_FULLSTACK_UMANNI.md
+/PENDENCIAS.md
+/CREDENCIAIS_LOCAIS.txt
+
+# The README screenshots are for people reading the repository, not for the
+# running application.
+/docs

.env.example

@@ -0,0 +1,13 @@
+# Copy to .env (bin/setup does it for you). These values are development-only;
+# production configuration is supplied by Kamal secrets, never by this file.
+
+# ── PostgreSQL ───────────────────────────────────────────────────────────────
+POSTGRES_USER=user_management
+POSTGRES_PASSWORD=development_only
+POSTGRES_DB=user_management_development
+TEST_POSTGRES_DB=user_management_test
+
+# ── Application ──────────────────────────────────────────────────────────────
+# Host port for the web server.
+WEB_PORT=3000
+RAILS_MAX_THREADS=5

.gitattributes

@@ -0,0 +1,9 @@
+# See https://git-scm.com/docs/gitattributes for more about git attribute files.
+
+# Mark the database schema as having been generated.
+db/schema.rb linguist-generated
+
+# Mark any vendored files as having been vendored.
+vendor/* linguist-vendored
+config/credentials/*.yml.enc diff=rails_credentials
+config/credentials.yml.enc diff=rails_credentials

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+- package-ecosystem: bundler
+  directory: "/"
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 10
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 10

.github/workflows/ci.yml

@@ -0,0 +1,73 @@
+# One job, running the same pipeline a person runs locally: bin/ci inside the
+# same container the application is developed in. A workflow that installs its
+# own Ruby and its own PostgreSQL would be a second definition of the
+# environment, free to drift from the one in the repository.
+name: CI
+
+on:
+  # Every branch, not only the default one: work in progress on a branch is
+  # exactly when the pipeline is worth having, and a pull request from a fork
+  # runs only after a maintainer approves it -- which is too late to be useful
+  # to whoever pushed.
+  push:
+  pull_request:
+
+# A push and a pull request on the same branch would otherwise start two
+# identical runs, and every new push would leave the previous one grinding away
+# on code nobody is looking at any more.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    name: Style, security and tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Share the checkout with the container's user
+        # The development image runs as uid 1000 -- the common host uid, which
+        # is what keeps bind-mounted files writable from both sides on a
+        # laptop. A runner checks the repository out as a different user, and
+        # Rails cannot so much as create tmp/cache in a directory it does not
+        # own, so the web container exits before it can answer a health check.
+        #
+        # Handing the tree over outright is too much, though: it locked the
+        # runner out of its own workspace, and the next step could not create
+        # .env. The container user owns the tree, the runner's group keeps
+        # write access, and both sides can write -- which is what a bind mount
+        # shared between two users needs.
+        run: |
+          sudo chown -R 1000:"$(id -g)" .
+          sudo chmod -R g+rwX .
+
+      - name: Cache the Docker layers
+        uses: docker/setup-buildx-action@v3
+
+      # The same script the README tells a person to run, rather than a
+      # separate sequence of docker commands that could quietly stop matching
+      # it: it writes .env, builds the image, creates and migrates the four
+      # databases, and waits for every service to report healthy. Without the
+      # databases the health check fails -- /up goes through the cache store,
+      # which has a database of its own.
+      - name: Set the environment up, exactly as the README says
+        run: devops/app/setup.sh --no-seed
+
+      - name: Run the pipeline
+        run: bin/ci
+
+      - name: Keep the coverage report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: coverage/
+          retention-days: 7
+
+      - name: Show the logs when something fails
+        if: failure()
+        run: docker compose logs --tail 200

.github/workflows/codeql-analysis.yml

@@ -1,3 +1,8 @@
+# CodeQL, as it comes with the repository -- brought up to date so it can
+# actually run. The workflow shipped pinned to github/codeql-action@v1, which
+# GitHub retired in January 2023 and which now refuses to start, and it asked
+# for no permissions, so the default read-only token could not write findings:
+# "Resource not accessible by integration".
 name: "Code scanning - action"
 
 on:
@@ -8,44 +13,26 @@ on:
 
 jobs:
   CodeQL-Build:
-
     runs-on: ubuntu-latest
 
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+    # The default GITHUB_TOKEN is read-only. CodeQL uploads what it finds, so
+    # it needs to write security events -- and nothing else.
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      # The languages are named rather than guessed: this is a Rails
+      # application with a handful of Stimulus controllers, and nothing
+      # compiled, so there is no Autobuild step to run.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ruby, javascript-typescript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.gitignore

@@ -0,0 +1,43 @@
+# See https://help.github.com/articles/ignoring-files for more about ignoring files.
+#
+# Temporary files generated by your text editor or operating system
+# belong in git's global ignore instead:
+# `$XDG_CONFIG_HOME/git/ignore` or `~/.config/git/ignore`
+
+# Ignore bundler config.
+/.bundle
+
+# Ignore all environment files, but keep the documented template.
+/.env*
+!/.env.example
+
+# Ignore all logfiles and tempfiles.
+/log/*
+/tmp/*
+!/log/.keep
+!/tmp/.keep
+
+# Ignore pidfiles, but keep the directory.
+/tmp/pids/*
+!/tmp/pids/
+!/tmp/pids/.keep
+
+# Ignore storage (uploaded files in development and any SQLite databases).
+/storage/*
+!/storage/.keep
+/tmp/storage/*
+!/tmp/storage/
+!/tmp/storage/.keep
+
+/public/assets
+
+# Ignore key files for decrypting credentials and more.
+/config/*.key
+
+
+# Ignore coverage reports and RSpec run state.
+/coverage
+/.rspec_status
+
+/app/assets/builds/*
+!/app/assets/builds/.keep

.kamal/secrets

@@ -0,0 +1,17 @@
+# Read by Kamal at deploy time and passed to the containers. Nothing here is a
+# secret itself: each line names where the value comes from, and the values
+# stay in the environment of whoever runs the deploy (or in a password
+# manager, via `kamal secrets fetch`).
+#
+#   export KAMAL_REGISTRY_PASSWORD=...
+#   export POSTGRES_PASSWORD=...
+#
+KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD
+
+# config/master.key is not in the repository; the deploying machine has it.
+RAILS_MASTER_KEY=$(cat config/master.key)
+
+POSTGRES_PASSWORD=$POSTGRES_PASSWORD
+
+# Only needed on the first deploy, together with SEED_ADMIN_EMAIL:
+# SEED_ADMIN_PASSWORD=$SEED_ADMIN_PASSWORD

.rspec

@@ -0,0 +1 @@
+--require spec_helper