v4.7 (#12478)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Co-authored-by: Aditya Tripathi <aditya@climactic.co>

scripts/transfer-test/extras-e2e.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Add fake records around debian-root on A (tokens, DNS, secret manager link, tunnel token, GitHub App + runner config,
-# resource links, canvas positions, team variable, maintenance mode, proxy error page, project icon, and an app of the
+# image scan opt-in, rules and an ignore, resource links, canvas positions, team variable, maintenance mode, proxy error page, project icon, and an app of the
 # same project on the other VM), transfer debian-root to B through the Transfer page, and check them on B and A.
 # Run reset.sh before and after.
 source "$(dirname "$0")/lib.sh"

scripts/transfer-test/seed-extras.php

@@ -10,6 +10,8 @@ use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
 use App\Models\GithubRunnerConfig;
 use App\Models\GithubRunnerExecution;
+use App\Models\ImageScanIgnore;
+use App\Models\ImageScanPolicy;
 use App\Models\IntegrationToken;
 use App\Models\ManagedDnsRecord;
 use App\Models\ResourceLink;
@@ -79,6 +81,14 @@ SharedEnvironmentVariable::create(['type' => 'team', 'team_id' => $teamId, 'key'
 EnvironmentVariable::create(['key' => 'USES_TEAM', 'value' => '{{team.FAKE_TEAM_VAR}}', 'resourceable_type' => $app->getMorphClass(), 'resourceable_id' => $app->id]);
 $app->forceFill(['is_maintenance_enabled' => true, 'maintenance_page' => '<h1>fake maintenance</h1>'])->saveQuietly();
 
+// Image scan: server opt-in, server and app rules, and an ignore of the app
+$server->settings->forceFill(['is_image_scan_enabled' => true])->saveQuietly();
+$quiet(ImageScanPolicy::class, ['scope_type' => $server->getMorphClass(), 'scope_id' => $server->id, 'gate_mode' => 'strict']);
+$quiet(ImageScanPolicy::class, ['scope_type' => $app->getMorphClass(), 'scope_id' => $app->id, 'on_scan_error' => 'block']);
+$quiet(ImageScanIgnore::class, ['team_id' => $teamId, 'resource_type' => $app->getMorphClass(), 'resource_id' => $app->id, 'vulnerability_id' => 'CVE-2024-0001', 'reason' => 'fake ignore']);
+$quiet(ImageScanIgnore::class, ['team_id' => $teamId, 'vulnerability_id' => 'CVE-2024-0002', 'reason' => 'fake team-wide ignore']);
+$app->settings->forceFill(['is_image_scan_enabled' => false, 'image_builds_by_team' => true])->saveQuietly();
+
 // A git application that uses a system-wide GitHub App, which the transfer does not move
 $systemApp = $quiet(GithubApp::class, ['name' => 'fake-system-wide-app', 'api_url' => 'https://api.github.com', 'html_url' => 'https://github.com', 'team_id' => 0, 'is_system_wide' => true, 'is_public' => false]);
 $gitApp = Application::create([

scripts/transfer-test/verify-extras-target.php

@@ -6,6 +6,8 @@ use App\Models\Application;
 use App\Models\Environment;
 use App\Models\GithubApp;
 use App\Models\GithubRunnerConfig;
+use App\Models\ImageScanIgnore;
+use App\Models\ImageScanPolicy;
 use App\Models\IntegrationToken;
 use App\Models\ManagedDnsRecord;
 use App\Models\ResourceLink;
@@ -63,6 +65,14 @@ $check('team shared variable created', SharedEnvironmentVariable::where('type',
 $check('app variable that uses it moved', $app?->environment_variables()->where('key', 'USES_TEAM')->value('value') === '{{team.FAKE_TEAM_VAR}}');
 $check('maintenance mode moved', $app?->is_maintenance_enabled === true && $app?->maintenance_page === '<h1>fake maintenance</h1>');
 
+$check('image scan opt-in of the server moved', $server?->settings?->is_image_scan_enabled === true);
+$serverPolicy = ImageScanPolicy::where('scope_type', $server?->getMorphClass())->where('scope_id', $server?->id)->first();
+$check('server scan rules moved', $serverPolicy?->gate_mode?->value === 'strict');
+$check('app scan rules moved', ImageScanPolicy::where('scope_type', $app?->getMorphClass())->where('scope_id', $app?->id)->first()?->on_scan_error?->value === 'block');
+$check('app scan switch and image builds by team moved', $app?->settings?->is_image_scan_enabled === false && $app->settings->image_builds_by_team === true);
+$check('team-wide ignore stays on the source', ! ImageScanIgnore::where('vulnerability_id', 'CVE-2024-0002')->exists());
+$check('app ignore moved', ImageScanIgnore::where('resource_type', $app?->getMorphClass())->where('resource_id', $app?->id)->where('vulnerability_id', 'CVE-2024-0001')->exists());
+
 $gitShop = Application::where('name', 'git-shop')->first();
 $check('git-shop moved without its system-wide source', $gitShop !== null && $gitShop->source_id === null);
 $check('finish list has a git source step for git-shop', collect(data_get($server?->server_metadata, 'transfer.finish.items'))->contains('key', 'git_source:'.$gitShop?->uuid));

scripts/upgrade.sh

@@ -14,6 +14,7 @@ else
 fi
 SKIP_BACKUP=${4:-false}
 STATUS_FILE="/data/coolify/source/.upgrade-status"
+STATUS_LOCK_FILE="/data/coolify/source/.upgrade-status.lock"
 
 DATE=$(date +%Y-%m-%d-%H-%M-%S)
 LOGFILE="/data/coolify/source/upgrade-${DATE}.log"
@@ -32,10 +33,17 @@ log_section() {
 }
 
 # Helper function to write upgrade status for API polling
+# Holds the lock that Coolify takes when it writes an error before an upgrade starts, so neither write is lost.
 write_status() {
-    local step="$1"
-    local message="$2"
-    echo "${step}|${message}|$(date -Iseconds)" > "$STATUS_FILE"
+    local line="${1}|${2}|$(date -Iseconds)"
+    if command -v flock >/dev/null 2>&1; then
+        (
+            flock -w 10 9 || true
+            echo "$line" > "$STATUS_FILE"
+        ) 9>"$STATUS_LOCK_FILE"
+    else
+        echo "$line" > "$STATUS_FILE"
+    fi
 }
 
 # Print the first gateway of a network that Docker reports with a prefix length (fd00::1/64).