Merge branch 'master' into MHV-42363-radiology-images

.github/workflows/audit_service_tags.yml

@@ -8,6 +8,7 @@ permissions:
  checks: write
 jobs:
  audit_service_tags:
+ permissions: write-all
  name: Audit Service Tags
  env:
  BUNDLE_ENTERPRISE__CONTRIBSYS__COM: ${{ secrets.BUNDLE_ENTERPRISE__CONTRIBSYS__COM }}
@@ -20,6 +21,14 @@ jobs:
  steps:
  - uses: actions/checkout@v4
 
+ - name: Remove Review label
+ if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ready-for-backend-review')
+ uses: actions-ecosystem/action-remove-labels@v1
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ ready-for-backend-review
+
  - uses: docker/login-action@v3
  with:
  username: ${{ secrets.DOCKERHUB_USER }}
@@ -61,8 +70,13 @@ jobs:
  cache-to: type=gha,mode=max
 
  - name: Setup Database
- run: |
- docker-compose -f docker-compose.test.yml run web bash \
+ uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+ with:
+ timeout_minutes: 20
+ retry_wait_seconds: 3 # Seconds
+ max_attempts: 3
+ command: |
+ docker compose -f docker-compose.test.yml run web bash \
  -c "CI=true RAILS_ENV=test DISABLE_BOOTSNAP=true bundle exec parallel_test -n 13 -e 'bin/rails db:reset'"
 
  - name: Get changed files
@@ -73,7 +87,29 @@ jobs:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
  - name: Run service tags audit controllers task
- run: |
- docker-compose -f docker-compose.test.yml run -e CHANGED_FILES=${{ env.CHANGED_FILES }} web bash \
- -c "CI=true DISABLE_BOOTSNAP=true bundle exec rake service_tags:audit_controllers_ci"
+ timeout-minutes: 20
+ uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
+ with:
+ timeout_minutes: 20
+ retry_wait_seconds: 3 # Seconds
+ max_attempts: 3
+ command: |
+ docker compose -f docker-compose.test.yml run -e CHANGED_FILES=${{ env.CHANGED_FILES }} web bash \
+ -c "CI=true DISABLE_BOOTSNAP=true bundle exec rake service_tags:audit_controllers_ci"
+
+ - name: Add Failure label
+ if: failure() && !contains(github.event.pull_request.labels.*.name, 'audit-service-failure')
+ uses: actions-ecosystem/action-add-labels@v1
+ with:
+ fail_on_error: true
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ audit-service-failure
 
+ - name: Remove Failure label
+ if: success() && contains(github.event.pull_request.labels.*.name, 'audit-service-failure')
+ uses: actions-ecosystem/action-remove-labels@v1
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ audit-service-failure

.github/workflows/be_review_prs.yml

@@ -0,0 +1,91 @@
+name: Require backend-review-group approval
+on:
+ pull_request:
+ types: [opened, reopened, review_requested, synchronize, ready_for_review]
+ pull_request_review:
+ types: [submitted]
+
+jobs:
+ check-approval-requirements:
+ permissions: write-all
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+
+ - name: Configure AWS Credentials
+ uses: aws-actions/[email protected]
+ with:
+ aws-access-key-id: ${{ secrets.aws_access_key_id }}
+ aws-secret-access-key: ${{ secrets.aws_secret_access_key }}
+ aws-region: "us-gov-west-1"
+
+ - name: Get bot token from Parameter Store
+ uses: marvinpinto/action-inject-ssm-secrets@latest
+ with:
+ ssm_parameter: /devops/VA_VSP_BOT_GITHUB_TOKEN
+ env_variable_name: VA_VSP_BOT_GITHUB_TOKEN
+
+
+# Find Backend Labels, Approvals and Comments
+ - name: Find Approval Comment
+ uses: peter-evans/find-comment@v3
+ id: find_backend_approval_comment
+ with:
+ issue-number: ${{ github.event.pull_request.number }}
+ body-includes: Backend-review-group approval confirmed.
+
+ - name: Get backend-review-group members
+ if: contains(github.event.pull_request.labels.*.name, 'require-backend-approval')
+ id: get_team_members
+ uses: octokit/[email protected]
+ with:
+ route: GET /orgs/department-of-veterans-affairs/teams/backend-review-group/members
+ env:
+ GITHUB_TOKEN: ${{ env.VA_VSP_BOT_GITHUB_TOKEN }}
+
+ - name: Check backend-review-group approval status
+ if: contains(github.event.pull_request.labels.*.name, 'require-backend-approval')
+ id: check_backend_review_group_approval_status
+ uses: octokit/[email protected]
+ with:
+ route: GET /repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number || github.event.pull_request_review.pull_request.number }}/reviews
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Verify backend-review-group approval
+ if: contains(github.event.pull_request.labels.*.name, 'require-backend-approval')
+ id: verify_approval
+ run: |
+ BACKEND_REVIEWERS=$(cat <<'EOF' | jq -r '.[].login' | tr '\n' '|' | sed 's/|$//'
+ ${{ steps.get_team_members.outputs.data }}
+ EOF
+ )
+
+ APPROVALS=$(cat <<'EOF' | jq -r '.[] | select(.state == "APPROVED") | .user.login' | grep -iE "$BACKEND_REVIEWERS" | wc -l
+ ${{ steps.check_backend_review_group_approval_status.outputs.data }}
+ EOF
+ )
+
+ echo "Number of backend-review-group approvals: $APPROVALS"
+ if [ "$APPROVALS" -eq 0 ]; then
+ echo "approval_status=required" >> $GITHUB_OUTPUT
+ exit 1
+ else
+ echo "approval_status=confirmed" >> $GITHUB_OUTPUT
+ fi
+
+ - name: Comment PR - Approval Confirmed
+ if: success() && steps.verify_approval.outputs.approval_status == 'confirmed' && steps.find_backend_approval_comment.outputs.comment-id == ''
+ uses: peter-evans/create-or-update-comment@v4
+ with:
+ issue-number: ${{ github.event.pull_request.number }}
+ body: "Backend-review-group approval confirmed."
+
+ - name: Remove ready-for-review label
+ if: success() && steps.verify_approval.outputs.approval_status == 'confirmed' && contains(github.event.pull_request.labels.*.name, 'ready-for-backend-review')
+ uses: actions-ecosystem/action-remove-labels@v1
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ ready-for-backend-review

.github/workflows/build-and-publish.yaml

@@ -33,7 +33,7 @@ jobs:
  uses: aws-actions/[email protected]
  with:
  mask-password: true
- - name: Build Docker Image
+ - name: Build vets-api Docker Image
  uses: docker/build-push-action@v6
  env:
  DOCKER_BUILD_SUMMARY: false
@@ -63,3 +63,20 @@ jobs:
  helm package vets-api
  aws ecr get-login-password --region us-gov-west-1 | helm registry login --username AWS --password-stdin 008577686731.dkr.ecr.us-gov-west-1.amazonaws.com
  helm push vets-api-${{ steps.version.outputs.version }}.tgz oci://008577686731.dkr.ecr.us-gov-west-1.amazonaws.com/dsva/helm
+
+
+ - name: Add Failure label
+ uses: actions-ecosystem/action-add-labels@v1
+ if: ${{ github.event_name == 'pull_request' && failure() && !contains(github.event.pull_request.labels.*.name, 'pe-failure') }}
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ pe-failure
+
+ - name: Remove Failure label
+ uses: actions-ecosystem/action-remove-labels@v1
+ if: ${{ github.event_name == 'pull_request' && success() && contains(github.event.pull_request.labels.*.name, 'pe-failure') }}
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ pe-failure

.github/workflows/build.yml

@@ -30,8 +30,17 @@ jobs:
  - name: Login to ECR
  id: login-ecr
  uses: aws-actions/amazon-ecr-login@v2
-
- - name: Build Docker Image
+ - name: Build Postman Docker Image
+ uses: docker/build-push-action@v6
+ env:
+ DOCKER_BUILD_SUMMARY: false
+ with:
+ context: ./postman
+ file: ./postman/Dockerfile
+ push: true
+ tags: |
+ ${{ steps.login-ecr.outputs.registry }}/dsva/vets-api-postman:${{ github.sha }}
+ - name: Build vets-api Docker Image
  uses: docker/build-push-action@v6
  env:
  DOCKER_BUILD_SUMMARY: false

.github/workflows/build_atlas_codeowners.yml

@@ -30,7 +30,7 @@ jobs:
 
  - name: Check codeowner changes
  id: check-codeowner-changes
- uses: tj-actions/changed-files@v44 # v36.3.0
+ uses: tj-actions/changed-files@v45 # v36.3.0
  with:
  files: |
  .github/CODEOWNERS
@@ -48,4 +48,3 @@ jobs:
  user_email: '[email protected]'
  user_name: 'va-vsp-bot'
  commit_message: 'Auto update Atlas with Vets-API CODEOWNERS'
-

.github/workflows/check_codeowners.yml

@@ -20,6 +20,14 @@ jobs:
  with:
  fetch-depth: 2
 
+ - name: Remove Review label
+ if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ready-for-backend-review')
+ uses: actions-ecosystem/action-remove-labels@v1
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ ready-for-backend-review
+
  - name: Configure AWS Credentials
  uses: aws-actions/[email protected]
  with:
@@ -41,11 +49,27 @@ jobs:
 
  - name: Respond to PR if check CODEOWNERS exists for new files fails
  if: ${{ failure() }}
- uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # v2.5.0
+ uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
  with:
  message: 'Error: A file (or its parent directories) does not have a CODEOWNERS entry. Please update the .github/CODEOWNERS file and add the entry for the Offending file: ${{ env.offending_file }}'
  GITHUB_TOKEN: ${{ env.VA_VSP_BOT_GITHUB_TOKEN }}
 
+ - name: Add Failure label
+ uses: actions-ecosystem/action-add-labels@v1
+ if: ${{ failure() }}
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ codeowners-addition-failure
+
+ - name: Remove Failure label
+ uses: actions-ecosystem/action-remove-labels@v1
+ if: ${{ success() }}
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ codeowners-addition-failure
+
  check-deletions:
  name: Check Codeowners Deletions
  runs-on: ubuntu-latest
@@ -56,6 +80,14 @@ jobs:
  with:
  fetch-depth: 2
 
+ - name: Remove Review label
+ if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ready-for-backend-review')
+ uses: actions-ecosystem/action-remove-labels@v1
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ ready-for-backend-review
+
  - name: Configure AWS Credentials
  uses: aws-actions/[email protected]
  with:
@@ -77,7 +109,23 @@ jobs:
 
  - name: Respond to PR if check CODEOWNERS exists for deleted files fails
  if: ${{ failure() }}
- uses: thollander/actions-comment-pull-request@fabd468d3a1a0b97feee5f6b9e499eab0dd903f6 # v2.5.0
+ uses: thollander/actions-comment-pull-request@e2c37e53a7d2227b61585343765f73a9ca57eda9 # v3.0.0
  with:
  message: 'Error: A file (or its parent directories) was deleted but its reference still exists in CODEOWNERS. Please update the .github/CODEOWNERS file and delete the entry for the Offending file: ${{ env.offending_file }}'
  GITHUB_TOKEN: ${{ env.VA_VSP_BOT_GITHUB_TOKEN }}
+
+ - name: Add Failure label
+ uses: actions-ecosystem/action-add-labels@v1
+ if: ${{ failure() }}
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ codeowners-delete-failure
+
+ - name: Remove Failure label
+ uses: actions-ecosystem/action-remove-labels@v1
+ if: ${{ success() }}
+ with:
+ number: ${{ github.event.pull_request.number }}
+ labels: |
+ codeowners-delete-failure