Release v2026.2

.env.template

@@ -43,6 +43,9 @@ HTTPS_PORT=443
 # SENTRY_PROJECT=
 # SENTRY_TRACE_RATE=
 
+# Optional: configure frontend error reporting
+# SENTRY_DSN_FRONTEND=
+
 # Optional: configure S3-compatible storage for binary files
 # S3_SERVER=
 # S3_ACCESS_KEY=

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,14 +1,12 @@
+> [!WARNING]
+> Branch off and target `next`, not `master`. The `master` is stable and used in production (exception: documentation/infrastructure-only changes).
+
 Closes #
 
 #### What has been done to verify that this works as intended?
 
 #### Why is this the best possible solution? Were any other approaches considered?
 
-#### How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?
+#### How does this change impact users? Describe intentional behavior changes from code updates. What are the regression risks?
 
 #### Does this change require updates to documentation? If so, please file an issue [here](https://github.com/getodk/docs/issues/new) and include the link below.
-
-#### Before submitting this PR, please make sure you have:
-
-- [ ] branched off and targeted the `next` branch OR only changed documentation/infrastructure (`master` is stable and used in production)
-- [ ] verified that any code or assets from external sources are properly credited in comments or that everything is internally sourced

.github/workflows/main.yml

@@ -0,0 +1,173 @@
+name: Test, Build, Publish
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      publish_image:
+        description: 'Publish image to registry?'
+        required: true
+        type: boolean
+        default: false
+
+jobs:
+  test-misc: # quick, simple checks
+    timeout-minutes: 2
+    runs-on: ubuntu-latest
+    steps:
+    - run: docker --version
+    - run: docker compose version
+    - uses: actions/checkout@v5
+    - run: ./test/check-submodules.sh
+    - run: ./test/test-with-pgenvblock.sh
+    - run: sudo apt-get install shellcheck
+    - run: ./test/check-scripts.sh
+    - run: ./test/check-for-large-files.sh
+    - run: ./test/check-dockerfiles.sh
+    - run: cd test && npm clean-install
+    - run: cd test && npm run lint
+    - run: cd test && npm run test:github-actions
+  test-envsub:
+    timeout-minutes: 2
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+    - run: cd test/envsub && ./run-tests.sh
+  test-nginx:
+    timeout-minutes: 4
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+    - uses: actions/setup-node@v5
+      with:
+        node-version-file: test/package.json
+    - run: cd test/nginx && npm clean-install
+    - run: cd test/nginx && ./setup-tests.sh
+    - run: cd test/nginx && npm run test:nginx:mocha
+    - run: cd test/nginx && ./lint-config.sh
+
+    - run: cd test/nginx && npx playwright install --with-deps chromium-headless-shell
+    - run: cd test/nginx && npm run test:nginx:playwright
+
+    - if: always()
+      run: cd test/nginx && docker compose -f nginx.test.docker-compose.yml logs --no-log-prefix nginx-ssl-selfsign
+    - if: always()
+      run: cd test/nginx && docker compose -f nginx.test.docker-compose.yml logs --no-log-prefix nginx-ssl-upstream
+    - if: always()
+      run: cd test/nginx && docker compose -f nginx.test.docker-compose.yml logs --no-log-prefix service
+    - if: always()
+      run: cd test/nginx && docker compose -f nginx.test.docker-compose.yml logs --no-log-prefix enketo
+    - if: always()
+      run: cd test/nginx && docker compose -f nginx.test.docker-compose.yml logs --no-log-prefix sentry-mock
+  test-secrets:
+    timeout-minutes: 2
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+    - run: ./test/test-secrets.sh
+  test-service:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        submodules: true
+    - uses: actions/setup-node@v5
+      with:
+        node-version-file: test/package.json
+    - run: cd test/nginx && npm clean-install
+    - run: cd test/nginx && npm run test:service
+  test-images:
+    timeout-minutes: 10
+    needs:
+    - test-misc
+    - test-envsub
+    - test-nginx
+    - test-secrets
+    - test-service
+    runs-on: ubuntu-latest # TODO matrix to run on all expected versions?
+    steps:
+    - uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
+        fetch-tags: true
+        submodules: recursive
+
+    - run: ./test/check-docker-context.sh --min-size 5000 --max-size 10000 --min-count 600 --max-count 700
+
+    - name: Extract FRONTEND_VERSION
+      run: |
+           touch .env
+           echo "FRONTEND_VERSION=$(
+             docker compose config --format json | jq -r .services.nginx.build.args.FRONTEND_VERSION
+           )" >> "$GITHUB_ENV"
+
+    - run: FRONTEND_BUILD_MODE=fetch ./test/test-images.sh
+
+    # Check out the current frontend version referenced by docker-compose, as it should build OK.
+    - run: |
+           git clone \
+               --depth 1 \
+               --branch "$FRONTEND_VERSION" \
+               https://github.com/getodk/central-frontend.git \
+               client
+    - run: FRONTEND_BUILD_MODE=source ./test/test-images.sh
+
+    - if: always()
+      run: docker compose logs
+  build-push-image:
+    if: |
+      (github.event_name == 'workflow_dispatch' && inputs.publish_image == true) ||
+      (github.event_name != 'workflow_dispatch' && (
+        github.ref == 'refs/heads/master' ||
+        startsWith(github.ref, 'refs/tags/v')
+      ))
+    needs:
+    - test-images
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        image: [nginx, service]
+    env:
+      REGISTRY: ghcr.io
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
+        fetch-tags: true
+        submodules: recursive
+    - name: Log into registry ${{ env.REGISTRY }}
+      uses: docker/login-action@v4
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Show Docker Context
+      run: ./test/check-docker-context.sh --report
+
+    - name: Extract Docker metadata
+      id: meta
+      uses: docker/metadata-action@v6
+      with:
+        images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/central-${{ matrix.image }}
+
+    - name: Set up QEMU emulator for multi-arch images
+      uses: docker/setup-qemu-action@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Build and push ${{ matrix.image }} Docker image
+      uses: docker/build-push-action@v7
+      with:
+        file: ${{ matrix.image }}.dockerfile
+        context: .
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        platforms: 'linux/amd64,linux/arm64'

.gitignore

@@ -2,6 +2,7 @@
 *.swp
 *.swo
 /.env
+/client/
 /docker-compose.override.yml
 /version.txt
 

.gitmodules

@@ -1,6 +1,3 @@
 [submodule "server"]
 	path = server
 	url = https://github.com/getodk/central-backend.git
-[submodule "client"]
-	path = client
-	url = https://github.com/getodk/central-frontend.git

README.md

@@ -41,6 +41,16 @@ This repository serves administrative functions, but it also contains the Docker
 
 To learn how to run such a stack in production, please take a look at [our DigitalOcean installation guide](https://docs.getodk.org/central-install-digital-ocean/).
 
+### Sentry (optional)
+
+To enable frontend error reporting and performance monitoring via Sentry, set `SENTRY_DSN_FRONTEND` in your `.env` file (see `.env.template`) and restart:
+
+```sh
+docker compose up -d
+```
+
+Deployments that omit this variable are unaffected — Sentry will remain disabled.
+
 ## Node.js version
 
 We aim to use the latest [active LTS version of Node.js](https://github.com/nodejs/release/blob/main/README.md#release-schedule). This means that we generally update the major Node version used across all Central components once a year. Each time we do a Central release, we update to the latest version within the active LTS line. Node updates are done near the end of the release cycle but before regression testing.