update gems and rubocop linting (#317)

.dockerignore

@@ -6,14 +6,14 @@
 # Ignore bundler config.
 /.bundle
 
+# Ignore all environment files (except templates).
+/.env*
+!/.env*.erb
+
 # Ignore all default key files.
 /config/master.key
 /config/credentials/*.key
 
-# Ignore all environment files.
-/.env*
-!/.env.example
-
 # Ignore all logfiles and tempfiles.
 /log/*
 /tmp/*
@@ -22,14 +22,12 @@
 
 # Ignore pidfiles, but keep the directory.
 /tmp/pids/*
-!/tmp/pids/
 !/tmp/pids/.keep
 
 # Ignore storage (uploaded files in development and any SQLite databases).
 /storage/*
 !/storage/.keep
 /tmp/storage/*
-!/tmp/storage/
 !/tmp/storage/.keep
 
 # Ignore assets.

.node-version

@@ -1 +1 @@
-18.13.0
+18.13.0

.rubocop.yml

@@ -10,15 +10,15 @@ require:
 
 AllCops:
   Exclude:
-    - 'vendor/**/*'
-    - '**/vendor/**/*'
-    - '*/spec/dummy/**/*'
-    - 'sandbox/**/*'
-    - '**/templates/**/*'
-    - 'guides/node_modules/**/*'
-    - '**/spec/system/**/*'
-    - 'app/helpers/spree/base_helper.rb'
-    - 'db/schema.rb'
+    - "vendor/**/*"
+    - "**/vendor/**/*"
+    - "*/spec/dummy/**/*"
+    - "sandbox/**/*"
+    - "**/templates/**/*"
+    - "guides/node_modules/**/*"
+    - "**/spec/system/**/*"
+    - "app/helpers/spree/base_helper.rb"
+    - "db/schema.rb"
   TargetRubyVersion: 3.3.4
 
 Gemspec/DeprecatedAttributeAssignment:
@@ -198,7 +198,6 @@ Rails/WhereExists: # new in 2.7
 Rails/WhereNot: # new in 2.8
   Enabled: true
 
-
 # We use class vars and will have to continue doing so for compatability
 Style/ClassVars:
   Enabled: false
@@ -304,7 +303,7 @@ Rails/DynamicFindBy:
 # It's okay to skip model validations to setup a spec.
 Rails/SkipsModelValidations:
   Exclude:
-    - '**/spec/**/*'
+    - "**/spec/**/*"
 
 # We use a lot of
 #
@@ -315,15 +314,15 @@ Rails/SkipsModelValidations:
 # syntax in the specs files.
 Lint/AmbiguousBlockAssociation:
   Exclude:
-    - '*/spec/**/*'
-    - 'spec/**/*' # For the benefit of apps that inherit from this config
+    - "*/spec/**/*"
+    - "spec/**/*" # For the benefit of apps that inherit from this config
 
 # We use eval to add common_spree_dependencies into the Gemfiles of each of our gems
 Security/Eval:
   Exclude:
-    - 'Gemfile'
-    - 'common_spree_dependencies.rb'
-    - '*/Gemfile'
+    - "Gemfile"
+    - "common_spree_dependencies.rb"
+    - "*/Gemfile"
 
 Naming/VariableNumber:
   Enabled: false
@@ -518,7 +517,7 @@ Lint/SuppressedException:
 Style/RedundantPercentQ:
   Enabled: true
   Exclude:
-    - 'spec/components/image_component_spec.rb'
+    - "spec/components/image_component_spec.rb"
 
 Layout/LineContinuationLeadingSpace: # new in 1.31
   Enabled: true
@@ -815,4 +814,40 @@ RSpec/MultipleExpectations:
 RSpec/ExampleLength:
   Enabled: false
 Gemspec/AddRuntimeDependency: # new in 1.65
-  Enabled: true
+  Enabled: true
+Lint/DuplicateSetElement: # new in 1.67
+  Enabled: true
+Lint/UselessNumericOperation: # new in 1.66
+  Enabled: true
+Style/RedundantInterpolationUnfreeze: # new in 1.66
+  Enabled: true
+Rails/EnumSyntax: # new in 2.26
+  Enabled: true
+RSpec/StringAsInstanceDoubleConstant: # new in 3.1
+  Enabled: true
+Lint/HashNewWithKeywordArgumentsAsDefault: # new in 1.69
+  Enabled: true
+Lint/NumericOperationWithConstantResult: # new in 1.69
+  Enabled: true
+Lint/UnescapedBracketInRegexp: # new in 1.68
+  Enabled: true
+Lint/UselessDefined: # new in 1.69
+  Enabled: true
+Style/AmbiguousEndlessMethodDefinition: # new in 1.68
+  Enabled: true
+Style/BitwisePredicate: # new in 1.68
+  Enabled: true
+Style/CombinableDefined: # new in 1.68
+  Enabled: true
+Style/DigChain: # new in 1.69
+  Enabled: true
+Style/FileNull: # new in 1.69
+  Enabled: true
+Style/FileTouch: # new in 1.69
+  Enabled: true
+Style/KeywordArgumentsMerging: # new in 1.68
+  Enabled: true
+Style/SafeNavigationChainLength: # new in 1.68
+  Enabled: true
+Performance/StringBytesize: # new in 1.23
+  Enabled: true

Dockerfile

@@ -2,37 +2,38 @@
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version and Gemfile
 ARG RUBY_VERSION=3.3.4
-FROM ruby:$RUBY_VERSION-slim as base
+FROM ruby:$RUBY_VERSION-slim AS base
 
 LABEL fly_launch_runtime="rails"
 
 # Rails app lives here
 WORKDIR /rails
 
 # Set production environment
-ENV RAILS_ENV="production" \
-    BUNDLE_PATH="vendor/bundle" \
-    BUNDLE_WITHOUT="development:test"
+ENV BUNDLE_DEPLOYMENT="1" \
+    BUNDLE_PATH="/usr/local/bundle" \
+    BUNDLE_WITHOUT="development:test" \
+    RAILS_ENV="production"
 
-# Update gems and preinstall the desired version of bundler
-ARG BUNDLER_VERSION=2.3.26
+# Update gems and bundler
 RUN gem update --system --no-document && \
-    gem install -N bundler -v ${BUNDLER_VERSION}
+    gem install -N bundler
 
 # Install packages needed to install nodejs
 RUN apt-get update -qq && \
-    apt-get install --no-install-recommends -y curl unzip && \
+    apt-get install --no-install-recommends -y curl && \
     rm -rf /var/lib/apt/lists /var/cache/apt/archives
 
 # Install Node.js
 ARG NODE_VERSION=18.13.0
-RUN curl -fsSL https://fnm.vercel.app/install | bash && \
-    /root/.local/share/fnm/fnm install $NODE_VERSION
-ENV PATH=/root/.local/share/fnm/aliases/default/bin/:$PATH
+ENV PATH=/usr/local/node/bin:$PATH
+RUN curl -sL https://github.com/nodenv/node-build/archive/master.tar.gz | tar xz -C /tmp/ && \
+    /tmp/node-build-master/bin/node-build "${NODE_VERSION}" /usr/local/node && \
+    rm -rf /tmp/node-build-master
 
 
 # Throw-away build stage to reduce size of final image
-FROM base as build
+FROM base AS build
 
 # Install packages needed to build gems and node modules
 RUN apt-get update -qq && \
@@ -42,13 +43,17 @@ RUN apt-get update -qq && \
 ARG YARN_VERSION=1.22.19
 RUN npm install -g yarn@$YARN_VERSION
 
+# Build options
+ENV PATH="/usr/local/node/bin:$PATH"
+
 # Install application gems
-COPY .ruby-version Gemfile Gemfile.lock ./
-RUN bundle _${BUNDLER_VERSION}_ install
+COPY Gemfile Gemfile.lock ./
+RUN bundle install && \
+    rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git
 
 # Install node modules
-COPY package.json package-lock.json yarn.lock .
-RUN yarn install
+COPY package.json package-lock.json yarn.lock ./
+RUN yarn install --frozen-lockfile
 
 # Copy application code
 COPY . .
@@ -62,12 +67,19 @@ FROM base
 
 # Install packages needed for deployment
 RUN apt-get update -qq && \
-    apt-get install --no-install-recommends -y postgresql-client && \
+    apt-get install --no-install-recommends -y curl postgresql-client && \
     rm -rf /var/lib/apt/lists /var/cache/apt/archives
 
-# Copy built application from previous stage
+# Copy built artifacts: gems, application
+COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
 COPY --from=build /rails /rails
 
+# Run and own only the runtime files as a non-root user for security
+RUN groupadd --system --gid 1000 rails && \
+    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
+    chown -R 1000:1000 db log tmp
+USER 1000:1000
+
 # Deployment options
 ENV RAILS_LOG_TO_STDOUT="1" \
     RAILS_SERVE_STATIC_FILES="true"

Gemfile

@@ -14,12 +14,12 @@ gem 'sass-rails', '>= 6'
 
 # Use of devise and Omniauth for authentication
 gem 'aasm'
-gem 'appsignal'
 gem 'cancancan'
 gem 'chord_diagrams'
 gem 'coltrane'
 gem 'devise'
 gem 'devise-i18n'
+gem 'drb'
 gem 'evernote_oauth'
 gem 'evernote_utils'
 gem 'fomantic-ui-sass', '~> 2.8', '< 2.9'
@@ -29,6 +29,7 @@ gem 'html_to_plain_text'
 gem 'httparty'
 gem 'jbuilder', '~> 2'
 gem 'jquery-rails'
+gem 'mutex_m'
 gem 'omniauth'
 gem 'omniauth-evernote'
 gem 'omniauth-rails_csrf_protection', '~> 1'
@@ -64,6 +65,7 @@ end
 
 group :development do
   gem 'better_errors'
+  gem "dockerfile-rails"
   gem 'binding_of_caller'
   gem 'listen', '~> 3.9.0'
   gem "ruby-lsp-rspec", require: false
@@ -74,7 +76,5 @@ gem 'openssl'
 
 gem 'importmap-rails', '~> 2'
 
-gem "dockerfile-rails", ">= 1.0", group: :development
-
 gem "service_actor-rails", "~> 1"
 gem "cssbundling-rails"