bcgov · gurjmatharu · Feb 16, 2023 · Feb 16, 2023
diff --git a/.github/actions/dev-env-setup/action.yml b/.github/actions/dev-env-setup/action.yml
@@ -0,0 +1,43 @@
+name: "Set up CIIP dev environment"
+description: "Sets up asdf, perl, and configures the cache"
+runs:
+  using: composite
+  steps:
+    - name: asdf setup
+      uses: asdf-vm/actions/setup@v1
+    - uses: shogo82148/actions-setup-perl@v1
+    - name: install pg perl library
+      run: sudo apt-get install -y libpq-dev libdbd-pg-perl
+      shell: bash
+    - name: set perl env variables
+      shell: bash
+      run: | # pragma: allowlist secret
+        echo "PERL5LIB=/home/runner/perl5/lib/perl5" >> $GITHUB_ENV
+        echo "PERL_LOCAL_LIB_ROOT=/home/runner/perl5" >> $GITHUB_ENV
+        echo "PERL_MB_OPT=--install_base '/home/runner/perl5'" >> $GITHUB_ENV
+        echo "PERL_MM_OPT=INSTALL_BASE=/home/runner/perl5" >> $GITHUB_ENV
+        echo "/home/runner/perl5/bin" >> $GITHUB_PATH
+        echo "CURRENT_PERL_VERSION=$(perl -e 'print "$^V\n"')" >> $GITHUB_ENV
+    - uses: actions/cache@v2
+      id: asdf-cache
+      with:
+        path: |
+          ~/.asdf
+        key: ${{ runner.os }}-asdf-cache-${{ hashFiles('.tool-versions') }}
+    - uses: actions/cache@v2
+      id: perl-cache
+      with:
+        path: |
+          ~/perl5
+        key: ${{ runner.os }}-perl-cache-${{ env.CURRENT_PERL_VERSION }}-${{ hashFiles('cpanfile') }}
+    - uses: actions/cache@v2
+      id: yarn-cache
+      with:
+        path: |
+          ~/.cache/yarn
+          ~/.cache/Cypress
+          ./app/node_modules
+        key: ${{ runner.os }}-yarn-cache-${{ hashFiles('app/yarn.lock') }}-v2
+    - name: update submodules
+      run: git submodule update --init
+      shell: bash
diff --git a/.github/actions/local-app-run/action.yml b/.github/actions/local-app-run/action.yml
@@ -0,0 +1,17 @@
+name: "Local CIIP app run"
+description: "Runs the CIIP app locally"
+runs:
+  using: composite
+  steps:
+    - name: start postgres and create database
+      shell: bash
+      run: pg_ctl start && createdb `whoami` && createdb ciip_portal_dev && pushd schema && ./data/deploy-data.sh -prod
+    - name: deploy migrations
+      shell: bash
+      run: docker run --network=host -e "PGUSER=postgres" ghcr.io/bcgov/cas-ciip-schema:$509e525a9a799bb168193ecd2b339f9186dfe57e sqitch deploy
+    - name: deploy mocks_schema migrations
+      shell: bash
+      run: docker run --network=host -e "PGUSER=postgres" --workdir="/root/mocks_schema" ghcr.io/bcgov/cas-ciip-schema:${{ github.sha }} sqitch deploy
+    - name: start app
+      shell: bash
+      run: docker run -d --network=host -e "PGUSER=postgres" -e "GROWTHBOOK_API_KEY={{ secrets.GROWTHBOOK_API_KEY }}" -e "BYPASS_GROWTHBOOK=true" -e "PROGRAM_DIRECTOR_NAME=director name" -e "PROGRAM_DIRECTOR_EMAIL=director@email.com" -p 3004:3004 ghcr.io/bcgov/cas-cif-app:${{ github.sha }} "/usr/bin/env" "bash" "-c" "ENABLE_MOCK_TIME='true' SHOW_KC_LOGIN='true' ENABLE_MOCK_AUTH='true' yarn start"
diff --git a/.github/workflows/codeql-analyze.yml b/.github/workflows/codeql-analyze.yml
@@ -0,0 +1,70 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [develop]
+  schedule:
+    - cron: "19 23 * * 5"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/immutable-sqitch-change.yml b/.github/workflows/immutable-sqitch-change.yml
@@ -0,0 +1,16 @@
+name: Test sqitch changes immutability
+
+on:
+  push:
+    branches: [develop]
+  pull_request:
+    branches: [develop]
+
+jobs:
+  check_immutable_files:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - run: .bin/sqitch-check-immutable-files.sh schema origin/master
diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml
@@ -0,0 +1,12 @@
+name: Pre-release checks
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  sqitch-plan-ends-with-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: ./.bin/sqitch-last-change-is-tag.sh schema
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -0,0 +1,183 @@
+name: CI
+
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+    branches: [develop, master]
+
+env:
+  PGUSER: postgres
+  PROGRAM_DIRECTOR_NAME: director name
+  PROGRAM_DIRECTOR_EMAIL: director@email.com
+
+jobs:
+  install-dev-tools:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: dev env setup
+        uses: ./.github/actions/dev-env-setup
+      - run: cat .tool-versions | xargs -n2 asdf global
+      - run: make install_dev_tools
+      - run: make stop_pg # cleanly stop the database, otherwise it will complain in the subsequent jobs
+      - run: yarn install --frozen-lockfile
+        working-directory: ./app
+
+  yarn-test:
+    needs: install-dev-tools
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: dev env setup
+        uses: ./.github/actions/dev-env-setup
+      - run: yarn test
+        working-directory: ./app
+  yarn-audit:
+    needs: install-dev-tools
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: dev env setup
+        uses: ./.github/actions/dev-env-setup
+      - run: yarn audit
+        working-directory: ./app
+  db-schema-is-up-to-date:
+    needs: install-dev-tools
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: dev env setup
+        uses: ./.github/actions/dev-env-setup
+      - run: pg_ctl start
+      - run: createdb `whoami`
+      - run: createdb ciip_portal_dev
+      - run: pushd schema && ./data/deploy-data.sh -prod && popd
+      - run: cd ../app && yarn build:schema
+        working-directory: ./schema
+      - run: git diff --exit-code || (echo 'The contents of the `schema` folder are out of sync with `app/server/schema.graphql`. Did you forget to \"yarn build:schema\"?' && false)
+
+  pre-commit:
+    needs: install-dev-tools
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: dev env setup
+        uses: ./.github/actions/dev-env-setup
+      - name: set pre-commit cache directory
+        run: |
+          echo "PRE_COMMIT_HOME=$GITHUB_WORKSPACE/.pre-commit-cache" >> $GITHUB_ENV
+      - name: set PY
+        run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
+      - name: create commitlint COMMIT_EDITMSG if not exists
+        run: |
+          if test -f ".git/COMMIT_EDITMSG"; then
+              echo "COMMIT_EDITMSG EXISTS, skipping"
+          else
+              touch .git/COMMIT_EDITMSG
+          fi
+      - uses: actions/cache@v2
+        with:
+          path: |
+            ./.pre-commit-cache
+          key: pre-commit-${{ env.PY }}-${{ hashFiles('.pre-commit-config.yaml') }}-v3
+      - run: pre-commit run --all-files
+
+  docker-build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - image: ghcr.io/bcgov/cas-ciip-app
+            context: .
+            dockerfile: app/Dockerfile
+            name: app
+          - image: ghcr.io/bcgov/cas-ciip-schema
+            context: .
+            dockerfile: schema/Dockerfile
+            name: schema
+    name: Build ${{ matrix.name }} docker image
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          install: true
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v3
+        with:
+          images: ${{ matrix.image }}
+          tags: |
+            type=sha,format=long,prefix=
+            latest
+            type=ref,event=pr
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Cache Docker layers
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ matrix.name }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-${{ matrix.name }}
+      - name: Build image
+        uses: docker/build-push-action@v3
+        with:
+          context: ${{ matrix.context }}
+          builder: ${{ steps.buildx.outputs.name }}
+          push: true
+          file: ${{ matrix.dockerfile }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new
+        # Temp fix
+        # https://github.com/docker/build-push-action/issues/252
+        # https://github.com/moby/buildkit/issues/1896
+      - name: Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+
+  e2e:
+    needs: ["docker-build", "install-dev-tools"]
+    runs-on: ubuntu-latest
+    env:
+      CYPRESS_TEST_INTERNAL_USERNAME: ${{ secrets.TEST_INTERNAL_USERNAME }}
+      CYPRESS_TEST_INTERNAL_PASSWORD: ${{ secrets.TEST_INTERNAL_PASSWORD }}
+      CYPRESS_TEST_ADMIN_USERNAME: ${{ secrets.TEST_ADMIN_USERNAME }}
+      CYPRESS_TEST_ADMIN_PASSWORD: ${{ secrets.TEST_ADMIN_PASSWORD }}
+      CYPRESS_TEST_UNAUTHORIZED_USERNAME: ${{ secrets.TEST_UNAUTHORIZED_USERNAME }}
+      CYPRESS_TEST_UNAUTHORIZED_PASSWORD: ${{ secrets.TEST_UNAUTHORIZED_PASSWORD }}
+      HAPPO_API_KEY: ${{ secrets.HAPPO_API_KEY }}
+      HAPPO_API_SECRET: ${{ secrets.HAPPO_API_SECRET }}
+      SMTP_CONNECTION_STRING: smtp://@localhost:1025
+      SENDER_EMAIL: example@cas.com
+      ADMIN_EMAIL: GHGRegulator@gov.bc.ca
+      SUPPORT_EMAIL: ggircs@gov.bc.ca
+      ENABLE_DB_MOCKS_COOKIES_ONLY: "true" # Allow cookies to be set by cypress
+    steps:
+      - uses: actions/checkout@v2
+      - name: dev env setup
+        uses: ./.github/actions/dev-env-setup
+      - run: pg_ctl start
+      - run: createdb `whoami`
+      - run: createdb ciip_portal_dev
+      - run: pushd schema && ./data/deploy-data.sh -prod && popd
+      - run: cd ./app && yarn build:schema
+      - run: cd ./test_helper_schema && SQITCH_TARGET="ciip_portal_dev" sqitch deploy
+      - run: cd ./schema && SQITCH_TARGET="ciip_portal_dev" sqitch deploy
+      - run: docker run -d -p 1025:1025 -p 8025:8025 mailhog/mailhog
+      - run: cd ./app && yarn build:relay && yarn build:next
+      - run: cd ./app && yarn start AS_CYPRESS & yarn wait-on http://localhost:3004 || true
+      - run: yarn test:e2e-snapshots
+        env:
+          SMTP_CONNECTION_STRING: smtp://@localhost:1025
+          ENABLE_DB_MOCKS: "true"
+        working-directory: ./app