Merge remote-tracking branch 'gitHub/main' into task/main/DURACOM-508

Author: FrancescoMolinaro

.github/dependabot.yml

@@ -115,12 +115,14 @@ updates:
         - "actions/*"
         - "github/*"
     ignore:
-      # For official GitHub actions, ignore minor & patch releases because we reference these actions
+      # For official GitHub & Docker actions, ignore minor & patch releases because we reference these actions
       # via a major version tag which automatically uses the latest minor/patch version (e.g. "actions/checkout@v6")
       - dependency-name: "actions/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
       - dependency-name: "github/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
+      - dependency-name: "docker/*"
+        update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
   #####################
   ## dspace-10_x branch
   #####################
@@ -232,12 +234,14 @@ updates:
         - "actions/*"
         - "github/*"
     ignore:
-      # For official GitHub actions, ignore minor & patch releases because we reference these actions
+      # For official GitHub & Docker actions, ignore minor & patch releases because we reference these actions
       # via a major version tag which automatically uses the latest minor/patch version (e.g. "actions/checkout@v6")
       - dependency-name: "actions/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
       - dependency-name: "github/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
+      - dependency-name: "docker/*"
+        update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
   #####################
   ## dspace-9_x branch
   #####################
@@ -349,12 +353,14 @@ updates:
         - "actions/*"
         - "github/*"
     ignore:
-      # For official GitHub actions, ignore minor & patch releases because we reference these actions
+      # For official GitHub & Docker actions, ignore minor & patch releases because we reference these actions
       # via a major version tag which automatically uses the latest minor/patch version (e.g. "actions/checkout@v6")
       - dependency-name: "actions/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
       - dependency-name: "github/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
+      - dependency-name: "docker/*"
+        update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]
   #####################
   ## dspace-8_x branch
   #####################
@@ -468,9 +474,11 @@ updates:
         - "actions/*"
         - "github/*"
     ignore:
-      # For official GitHub actions, ignore minor & patch releases because we reference these actions
+      # For official GitHub & Docker actions, ignore minor & patch releases because we reference these actions
       # via a major version tag which automatically uses the latest minor/patch version (e.g. "actions/checkout@v6")
       - dependency-name: "actions/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
       - dependency-name: "github/*"
         update-types: [ "version-update:semver-minor", "version-update:semver-patch"]
+      - dependency-name: "docker/*"
+        update-types: [ "version-update:semver-minor", "version-update:semver-patch" ]

.github/pull_request_template.md

@@ -21,11 +21,12 @@ However, reviewers may request that you complete any actions in this list if you
 
 - [ ] My PR is **created against the `main` branch** of code (unless it is a backport or is fixing an issue specific to an older branch).
 - [ ] My PR is **small in size** (e.g. less than 1,000 lines of code, not including comments & specs/tests), or I have provided reasons as to why that's not possible.
+- [ ] My PR **follows all coding best practices** based on the [Code Conventions Guide](../CODE_CONVENTIONS.md)
 - [ ] My PR **passes [ESLint](https://eslint.org/)** validation using `npm run lint`
 - [ ] My PR **doesn't introduce circular dependencies** (verified via `npm run check-circ-deps`)
 - [ ] My PR **includes [TypeDoc](https://typedoc.org/) comments** for _all new (or modified) public methods and classes_. It also includes TypeDoc for large or complex private methods.
 - [ ] My PR **passes all specs/tests and includes new/updated specs or tests** based on the [Code Testing Guide](https://wiki.lyrasis.org/display/DSPACE/Code+Testing+Guide).
-- [ ] My PR **aligns with [Accessibility guidelines](https://wiki.lyrasis.org/display/DSDOC9x/Accessibility)** if it makes changes to the user interface.
+- [ ] My PR **aligns with [Accessibility guidelines](https://wiki.lyrasis.org/spaces/DSDOC10x/pages/408944958/Accessibility)** if it makes changes to the user interface.
 - [ ] My PR **uses i18n (internationalization) keys** instead of hardcoded English text, to allow for translations.
 - [ ] My PR **includes details on how to test it**. I've provided clear instructions to reviewers on how to successfully test this fix or feature.
 - [ ] If my PR includes new libraries/dependencies (in `package.json`), I've made sure their licenses align with the [DSpace BSD License](https://github.com/DSpace/DSpace/blob/main/LICENSE) based on the [Licensing of Contributions](https://wiki.lyrasis.org/display/DSPACE/Code+Contribution+Guidelines#CodeContributionGuidelines-LicensingofContributions) documentation.

.github/workflows/build.yml

@@ -4,7 +4,29 @@
 name: Build
 
 # Run this Build for all pushes / PRs to current branch
-on: [push, pull_request]
+on:
+  push:
+    # Don't run if PR is only updating static documentation or IDE/editor rules
+    paths-ignore:
+      - '.editorconfig'
+      - '.gitignore'
+      - '.vscode/*'
+      - 'docs/*'
+      - 'LICENSE'
+      - 'LICENSES_THIRD_PARTY'
+      - 'NOTICE'
+      - '**/*.md'
+  pull_request:
+    # Don't run if PR is only updating static documentation or IDE/editor rules
+    paths-ignore:
+      - '.editorconfig'
+      - '.gitignore'
+      - '.vscode/*'
+      - 'docs/*'
+      - 'LICENSE'
+      - 'LICENSES_THIRD_PARTY'
+      - 'NOTICE'
+      - '**/*.md'
 
 permissions:
   contents: read  # to fetch code (actions/checkout)
@@ -59,7 +81,7 @@ jobs:
 
       # https://github.com/actions/setup-node
       - name: Install Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -149,7 +171,7 @@ jobs:
       # https://github.com/cypress-io/github-action
       # (NOTE: to run these e2e tests locally, just use 'ng e2e')
       - name: Run e2e tests (integration tests)
-        uses: cypress-io/github-action@v7.4.0
+        uses: cypress-io/github-action@v7.4.3
         with:
           # Run tests in Chrome, headless mode (default)
           browser: chrome

.github/workflows/codescan.yml

@@ -15,10 +15,16 @@ on:
     branches:
       - main
       - 'dspace-**'
-    # Don't run if PR is only updating static documentation
+    # Don't run if PR is only updating static documentation or IDE/editor rules
     paths-ignore:
+      - '.editorconfig'
+      - '.gitignore'
+      - '.vscode/*'
+      - 'docs/*'
+      - 'LICENSE'
+      - 'LICENSES_THIRD_PARTY'
+      - 'NOTICE'
       - '**/*.md'
-      - '**/*.txt'
   schedule:
     - cron: "37 0 * * 1"
 
@@ -42,11 +48,8 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
-          languages: javascript
-
-      # Autobuild attempts to build any compiled languages
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+          # Codescan Javascript/Typescript code and GitHub actions/workflows
+          languages: javascript, actions
 
       # Perform GitHub Code Scanning.
       - name: Perform CodeQL Analysis

.github/workflows/docker.yml

@@ -13,7 +13,27 @@ on:
       - 'dspace-**'
     tags:
       - 'dspace-**'
+    # Don't run if PR is only updating static documentation or IDE/editor rules
+    paths-ignore:
+      - '.editorconfig'
+      - '.gitignore'
+      - '.vscode/*'
+      - 'docs/*'
+      - 'LICENSE'
+      - 'LICENSES_THIRD_PARTY'
+      - 'NOTICE'
+      - '**/*.md'
   pull_request:
+    # Don't run if PR is only updating static documentation or IDE/editor rules
+    paths-ignore:
+      - '.editorconfig'
+      - '.gitignore'
+      - '.vscode/*'
+      - 'docs/*'
+      - 'LICENSE'
+      - 'LICENSES_THIRD_PARTY'
+      - 'NOTICE'
+      - '**/*.md'
 
 permissions:
   contents: read  # to fetch code (actions/checkout)

.github/workflows/port_merged_pull_request.yml

@@ -19,15 +19,25 @@ permissions:
 jobs:
   port_pr:
     runs-on: ubuntu-slim
-    # Don't run on closed *unmerged* pull requests
-    if: github.event.pull_request.merged
+    # Only run on MERGED pull requests,
+    # and only run if the merged PR has a label that starts with "port to"
+    if: >
+      github.event.pull_request.merged &&
+      contains(toJSON(github.event.pull_request.labels.*.name), '"port to ')
     steps:
       # Checkout code
       - uses: actions/checkout@v7
+        with:
+          # When using 'pull_request_target' (see above), this 'checkout' step will always fail because it
+          # may make the codebase vulnerable to "pwn requests" via the user-created PR.
+          # See https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
+          # However, we are allowing this unsafe checkout because (1) it's required to backport the PR, and
+          # (2) this job only runs when a PR is MERGED, and merger only happens after a thorough review of the PR.
+          allow-unsafe-pr-checkout: true
       # Port PR to other branch (ONLY if labeled with "port to")
       # See https://github.com/korthout/backport-action
       - name: Create backport pull requests
-        uses: korthout/backport-action@v4.5.2
+        uses: korthout/backport-action@v4.6.0
         with:
           # Trigger based on a "port to [branch]" label on PR
           # (This label must specify the branch name to port to)

.github/workflows/pull_request_opened.yml

@@ -21,4 +21,4 @@ jobs:
     # Assign the PR to whomever created it. This is useful for visualizing assignments on project boards
     # See https://github.com/toshimaru/auto-author-assign
     - name: Assign PR to creator
-      uses: toshimaru/auto-author-assign@v3.0.3
+      uses: toshimaru/auto-author-assign@v3.1.0

.github/workflows/stale.yml

@@ -16,7 +16,7 @@ jobs:
   stale:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           # Number of GitHub API calls to allow in a single run (to avoid hitting GitHub's rate limit)
           # Default is 30. But, we've found that only results in processing ~7 issues or PRs. So, we've increased it.

.gitignore

@@ -42,3 +42,6 @@ yarn-error.log
 junit.xml
 
 /src/mirador-viewer/config.local.js
+
+## ignore the auto-generated decorator registries
+decorator-registries/

CODE_CONVENTIONS.md

@@ -0,0 +1,57 @@
+# DSpace Angular Code Conventions
+
+DSpace has established coding conventions or best practices that all contributions must follow in order
+to be accepted.
+
+These code conventions describe the best practices for design and implementation of DSpace code, helping ensure that all DSpace components have a consistent layout and follow the essential Web Content Accessibility Guidelines ([WCAG](https://www.w3.org/WAI/standards-guidelines/wcag/)).
+The best practices for formatting your code are defined in our separate [Code Style Guidelines](CODE_STYLE.md).
+
+For additional guidelines, see the wiki documentation for [User Interface Design Principles & Accessibility](https://wiki.lyrasis.org/spaces/DSDOC10x/pages/408945765/User+Interface+Design+Principles+Accessibility).
+
+1. [Enforcement of Guidelines](#enforcement-of-guidelines)
+2. [Angular Guidelines](#angular-guidelines)
+   1. [Templates in Base Theme should only use default Bootstrap styling](#templates-in-base-theme-should-only-use-default-Bootstrap-styling)
+   2. [Required Bootstrap Components must use `ng-bootstrap` library](#required-bootstrap-components-must-use-ng-bootstrap-library)
+   3. [Document methods and classes using TypeDoc](#document-methods-and-classes-using-typedoc)
+   4. [Align with DSpace's User Interface Design Guidelines](#align-with-dspaces-user-interface-design-guidelines)
+3. [Accessibility Guidelines](#accessibility-guidelines)
+   1. [Align with WCAG (Web Content Accessibility Guidelines) AA criteria](#align-with-wcag-web-content-accessibility-guidelines-aa-criteria)
+   2. [Align with DSpace's User Interface Accessibility Guidelines](#align-with-dspaces-user-interface-accessibility-guidelines)
+
+
+## Enforcement of Guidelines
+
+Enforcement of these code conventions is handled in two ways:
+* Some guidelines are enforced strictly via static code tools such as ESLint. Where possible, we prefer to automate enforcement.
+* All guidelines are enforced during code review by the assigned reviewers.
+
+## Angular Guidelines
+
+### Templates in Base Theme should only use default Bootstrap styling
+
+All templates in the Base Theme ([/src/app](/src/app) directories) should only use default Bootstrap styling. Documentation at: https://getbootstrap.com/docs/4.6/getting-started/introduction/
+* Exceptions may be made for accessibility purposes. For example, Bootstrap notes their [default color scheme does not always have sufficient color contrast](https://getbootstrap.com/docs/4.0/getting-started/accessibility/#color-contrast).
+
+### Required Bootstrap Components must use `ng-bootstrap` library
+
+When Bootstrap Components (accordion, dropdown, etc …) are required you MUST use the included `ng-bootstrap` library. Documentation at: https://ng-bootstrap.github.io/#/components/accordion/examples
+
+### Document methods and classes using TypeDoc
+
+Write [TypeDoc](https://typedoc.org/) comments for all new (or modified) public methods and classes, as well as for large or complex private methods.
+
+### Align with DSpace's User Interface Design Guidelines
+
+In order to ensure consistent layout and behavior on all pages, please refer to the [User Interface Design Guidelines](https://wiki.lyrasis.org/spaces/DSDOC10x/pages/408945765/User+Interface+Design+Principles+Accessibility#UserInterfaceDesignPrinciples%26Accessibility-UserInterfaceDesignGuidelines). This documentation provides more details regarding User Interface layout/design and the elements (or components) used by the DSpace User Interface. 
+
+## Accessibility Guidelines
+
+### Align with WCAG (Web Content Accessibility Guidelines) AA criteria
+
+The DSpace User Interface strives to align with [WCAG](https://www.w3.org/WAI/standards-guidelines/wcag/) AA criteria. Some AAA criteria may also be supported.  For more information see [Accessibility documentation](https://wiki.lyrasis.org/spaces/DSDOC10x/pages/408944958/Accessibility).
+
+The use of the Bootstrap framework can help in achieving some WCAG goals such as ‘Visual Presentation’ (AAA), 'Parsing' (A), ‘Orientation’ (AA), ‘Reflow’ (AA) and ‘Text Spacing’ (AA). See the Bootstrap chapter ["Accessibility"](https://getbootstrap.com/docs/4.0/getting-started/accessibility/) for an explanation of WCAG and where to find additional information.
+
+### Align with DSpace's User Interface Accessibility Guidelines
+
+Refer to the [User Interface Accessibility Guidelines](https://wiki.lyrasis.org/spaces/DSDOC10x/pages/408945765/User+Interface+Design+Principles+Accessibility#UserInterfaceDesignPrinciples%26Accessibility-UserInterfaceAccessibilityGuidelines) for more detailed recommendations regarding HTML structure, ARIA labelling and more.