Merge pull request #1715 from samply/release/v0.26.2

Release v0.26.2

.github/scripts/admin-api/create-invalid-jobs.sh

@@ -0,0 +1,25 @@
+#!/bin/bash -e
+
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+. "$SCRIPT_DIR/../util.sh"
+
+BASE="http://localhost:8080/fhir"
+
+ERROR_MESSAGE="$(curl -s -H 'Content-Type: application/fhir+json' -H 'Accept: application/fhir+json' -d "{\"resourceType\": \"Task\"}" "$BASE/__admin/Task" | jq -r '.issue[].details.text')"
+test "error message" "$ERROR_MESSAGE" "No allowed profile found."
+
+re-index-job() {
+cat <<END
+{
+  "resourceType": "Task",
+  "meta": {
+    "profile": [
+      "https://samply.github.io/blaze/fhir/StructureDefinition/ReIndexJob"
+    ]
+  }
+}
+END
+}
+
+ERROR_MESSAGE="$(curl -s -H 'Content-Type: application/fhir+json' -H 'Accept: application/fhir+json' -d "$(re-index-job)" "$BASE/__admin/Task" | jq -r '.issue[0].diagnostics')"
+test "error message" "$ERROR_MESSAGE" "Task.status: minimum required = 1, but only found 0 (from https://samply.github.io/blaze/fhir/StructureDefinition/ReIndexJob)"

.github/workflows/build.yml

@@ -310,7 +310,7 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 -p 8081:8081 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 -p 8081:8081 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
       if: ${{ matrix.variant == 'standalone' }}
 
     - name: Run Kafka, Cassandra and Blaze
@@ -794,11 +794,14 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e DB_BLOCK_CACHE_SIZE=2048 -p 8080:8080 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e DB_BLOCK_CACHE_SIZE=2048 -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
 
+    - name: Docker Logs
+      run: docker logs blaze
+
     - name: Check Capability Statement
       run: .github/scripts/check-capability-statement.sh
 
@@ -856,7 +859,7 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e ENFORCE_REFERENTIAL_INTEGRITY=false -p 8080:8080 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e ENFORCE_REFERENTIAL_INTEGRITY=false -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
@@ -879,6 +882,38 @@ jobs:
     - name: Check Referential Integrity Not Enforced For Delete
       run: .github/scripts/check-referential-integrity-for-delete.sh 204
 
+  admin-api-test:
+    needs: build
+    runs-on: ubuntu-22.04
+
+    steps:
+    - name: Check out Git repository
+      uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4
+
+    - name: Install Blazectl
+      run: .github/scripts/install-blazectl.sh
+
+    - name: Download Blaze Image
+      uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4
+      with:
+        name: blaze-image
+        path: /tmp
+
+    - name: Load Blaze Image
+      run: docker load --input /tmp/blaze.tar
+
+    - name: Run Blaze
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e ENABLE_ADMIN_API=true -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
+
+    - name: Wait for Blaze
+      run: .github/scripts/wait-for-url.sh http://localhost:8080/health
+
+    - name: Docker Logs
+      run: docker logs blaze
+
+    - name: Create Invalid Jobs
+      run: .github/scripts/admin-api/create-invalid-jobs.sh
+
   # This test uploads many small transactions in order to show that Blaze can handle many small requests containing
   # chunked payload blazectl uses. Versions of Blaze from 0.13.2 to 0.15.3, starting with the migration to Jetty, had
   # the problem that the JSON parser did not read the entire inputstream so that terminal chunks could remain, which
@@ -904,7 +939,7 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
@@ -945,7 +980,7 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
@@ -980,7 +1015,7 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e FHIR_OPERATION_EVALUATE_MEASURE_TIMEOUT=10 -p 8080:8080 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e FHIR_OPERATION_EVALUATE_MEASURE_TIMEOUT=10 -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
@@ -1015,11 +1050,14 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --rm -d -e JAVA_TOOL_OPTIONS=-Xmx1g -e ENFORCE_REFERENTIAL_INTEGRITY=false -p 8080:8080 blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e ENFORCE_REFERENTIAL_INTEGRITY=false -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
 
+    - name: Docker Logs
+      run: docker logs blaze
+
     - name: Test Include
       run: .github/scripts/include-without-referential-integrity.sh
 
@@ -1041,11 +1079,14 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --rm -d -e JAVA_TOOL_OPTIONS=-Xmx1g -e ENFORCE_REFERENTIAL_INTEGRITY=false -p 8080:8080 blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e ENFORCE_REFERENTIAL_INTEGRITY=false -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
 
+    - name: Docker Logs
+      run: docker logs blaze
+
     - name: Test Chaining
       run: .github/scripts/chaining-without-referential-integrity.sh
 
@@ -1072,11 +1113,14 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --rm -d -e JAVA_TOOL_OPTIONS=-Xmx1g -p 8080:8080 blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
 
+    - name: Docker Logs
+      run: docker logs blaze
+
     - name: Load Data
       run: blazectl --no-progress --server http://localhost:8080/fhir upload .github/test-data/bundle-with-references
 
@@ -1121,7 +1165,7 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
@@ -1270,11 +1314,14 @@ jobs:
       run: docker load --input /tmp/blaze.tar
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e DB_RESOURCE_CACHE_SIZE=0 -p 8080:8080 -v blaze-data:/app/data blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -e DB_RESOURCE_CACHE_SIZE=0 -p 8080:8080 --read-only --tmpfs /tmp:exec -v blaze-data:/app/data blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
 
+    - name: Docker Logs
+      run: docker logs blaze
+
     - name: Generate Large Binary Resources (JSON and XML)
       run: .github/scripts/generate-large-binary-resource.sh
 
@@ -1392,11 +1439,14 @@ jobs:
       run: mkdir data
 
     - name: Run Blaze
-      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 -v "$(pwd)/data:/app/data" blaze:latest
+      run: docker run --name blaze -d -e JAVA_TOOL_OPTIONS=-Xmx2g -p 8080:8080 --read-only --tmpfs /tmp:exec -v "$(pwd)/data:/app/data" blaze:latest
 
     - name: Wait for Blaze
       run: .github/scripts/wait-for-url.sh http://localhost:8080/health
 
+    - name: Docker Logs
+      run: docker logs blaze
+
     - name: Create Patient
       run: .github/scripts/create-patient-0.sh
 
@@ -1498,6 +1548,7 @@ jobs:
     - integration-test
     - integration-test-synthea-1000
     - not-enforcing-referential-integrity-test
+    - admin-api-test
     - small-transactions-test
     - big-transaction-test
     - evaluate-measure-timeout-test
@@ -1633,7 +1684,7 @@ jobs:
 
     steps:
     - name: Release
-      uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564 # v2
+      uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87 # v2
       with:
         files: target/blaze-*-standalone.jar
 

.github/workflows/coverage.yml

@@ -34,7 +34,7 @@ jobs:
       run: make test-coverage
 
     - name: Codecov Upload
-      uses: codecov/codecov-action@84508663e988701840491b86de86b666e8a86bed # v4
+      uses: codecov/codecov-action@5ecb98a3c6b747ed38dc09f787459979aebb39be # v4
       with:
         name: codecov-umbrella
         token: ${{ secrets.CODECOV_TOKEN }}

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## v0.26.2
+
+### Operation
+
+* Remove Need for FHIR Validator Local Package Cache ([#1709](https://github.com/samply/blaze/issues/1709))
+
+The full changelog can be found [here](https://github.com/samply/blaze/milestone/89?closed=1).
+
 ## v0.26.1
 
 ### Bugfixes

DEVELOPMENT.md

@@ -6,7 +6,7 @@ The main build artefact of Blaze is a single Docker image. Apart from the Docker
 
 ### Using GitHub CI
 
-The most reliable way to build Blaze is to use GitHub CI. If you create a PR, a Docker image with the label `pr-<num>` is created. You can use that image after the pipeline ended successfully.   
+The most reliable way to build Blaze is to use GitHub CI. If you create a PR, a Docker image with the label `pr-<num>` is created. You can use that image after the pipeline ended successfully.
 
 ### Using a Local Build Environment
 
@@ -32,7 +32,14 @@ The best way to use a REPL, is to use it from your IDE. If you use Intellij, the
 
 Inside the REPL you should be able to discover and play with the functions and execute unit tests. Developing a new feature will always include writing unit tests. Code coverage is measured in CI and should only increase. The unit tests should already ensure that the feature is implemented correctly on a module level. In addition to that, integration tests can be added to the GitHub CI pipeline available in the file `.github/workflows/build.yml`.
 
-In addition to the REPL development inside a single module, it's possible to run a REPL were Blaze can be started as a system. Such a REPL should be started with the namespace `blaze.dev` loaded available in the file `dev/blaze/dev.clj`. In that namespace Blaze can be started by invoking the `init` function. The configuration of the development system is done with the same environment variables used in the production system. That variables are documented [here](docs/deployment/environment-variables.md).
+In addition to the REPL development inside a single module, it is also possible to run a REPL were Blaze can be started as a system. This procedure is automated via a Makefile alias.
+
+```make repl```
+
+See the files `Makefile` and `dev/blaze/dev.clj` for more details.
+
+The configuration of the development system is done with the same environment variables used in the production system.
+Documentation: [Environment Variables](docs/deployment/environment-variables.md).
 
 ## Release Checklist
 
@@ -49,11 +56,7 @@ In addition to the REPL development inside a single module, it's possible to run
 
 ## Style Guide
 
-The Clojure code in this project follows the [Clojure Style Guide][2].
-
-### Exceptions:
-
-* we use two empty lines between top-level forms
+The Clojure code in this project mainly follows the [Clojure Style Guide][2], enforced by `cljfmt`. For more details, please check `cljfmt.edn`."
 
 ## Pure Functions
 
@@ -69,7 +72,7 @@ Such components reside in a namespace. There exists a constructor function calle
 
 ```clojure
 (ns blaze.db.node
-  (:require 
+  (:require
     [clojure.spec.alpha :as s]
     [integrant.core :as ig])
   (:import
@@ -81,7 +84,7 @@ Such components reside in a namespace. There exists a constructor function calle
   [dep-a dep-b])
 
 
-(defmethod ig/pre-init-spec :blaze.db/node [_]
+(defmethod m/pre-init-spec :blaze.db/node [_]
   (s/keys :req-un [dep-a dep-b]))
 
 
@@ -99,15 +102,15 @@ Such components reside in a namespace. There exists a constructor function calle
 
 In this example, you can see the `new-node` function which gets two dependencies `dep-a` and `dep-b` which could be config values or other components. The function returns the database node itself. In our case the database node holds resources which should be freed when it is no longer needed. A common idiom is to implement `java.lang.AutoCloseable` and call the `.close` method at the end of usage.
 
-While the pair of the function `new-node` and the method `.close` can be used in tests, integrant is used in production. In the example, you can see the multi-method instances `ig/pre-init-spec`, `ig/init-key` and `ig/halt-key!`. First `ig/pre-init-spec` is used to provide a spec for the dependency map `ig/init-key` receives. The spec is created using the `s/keys` form in order to validate a map. Second the `ig/init-key` method will be called by integrant when the component with the :blaze.db/node key is initialized. In this method we simply call our `new-node` function, passing all dependencies from the map as arguments. In addition to that we log a meaningful message at info level in order to make the startup of Blaze transparent. It's also a good idea to log out any config values here. Last the method `ig/halt-key!` is used to free any resources our component might hold. Here we call our `.close` on the component instance passed.
+While the pair of the function `new-node` and the method `.close` can be used in tests, integrant is used in production. In the example, you can see the multi-method instances `m/pre-init-spec`, `ig/init-key` and `ig/halt-key!`. First `m/pre-init-spec` is used to provide a spec for the dependency map `ig/init-key` receives. The spec is created using the `s/keys` form in order to validate a map. Second the `ig/init-key` method will be called by integrant when the component with the :blaze.db/node key is initialized. In this method we simply call our `new-node` function, passing all dependencies from the map as arguments. In addition to that we log a meaningful message at info level in order to make the startup of Blaze transparent. It's also a good idea to log out any config values here. Last the method `ig/halt-key!` is used to free any resources our component might hold. Here we call our `.close` on the component instance passed.
 
 ## Function Specs
 
 Every public function should have a spec. Function specs are declared in a namespace with the suffix `_spec` appended to the namespace of the function. In case the function is public on module level, the spec namespace resides in the `src` folder, otherwise it resides in the `test` folder. Having specs of inner-module public functions in the test folder ensures that they can be used in tests but also removes them from the overall class path of Blaze. Not having such specs on the global class path reduces uberjar and memory footprint. In addition to that it also reduces the number of instrumented functions in inter-module tests.
 
 ## Java Interop
 
-It is important that we don't use reflection. In order to see reflection warnings ```(set! *warn-on-reflection* true)``` should be used in every namespace which does Java interop.
+It is important to avoid using reflection. In order to see reflection warnings, make sure to use ```(set! *warn-on-reflection* true)``` in every namespace which does Java interop.
 
 ## REPL
 
@@ -116,7 +119,7 @@ It is important that we don't use reflection. In order to see reflection warning
 * add `-Dclojure.server.repl='{:address,\"0.0.0.0\",:port,5555,:accept,clojure.core.server/repl}'` to the `JAVA_TOOL_OPTIONS` env var
 * bind port 5555
 * create remote REPL in Cursive
-* 
+*
 
 [1]: <https://github.com/weavejester/integrant>
 [2]: <https://github.com/bbatsov/clojure-style-guide>

Dockerfile

@@ -1,24 +1,13 @@
-FROM mcr.microsoft.com/dotnet/sdk:6.0@sha256:5c0d4c483ce2781fa522c96a6069d12f719f1313635cba76f9e061dd17740077 as fhir-packages
-
-RUN dotnet tool install -g firely.terminal
-RUN /root/.dotnet/tools/fhir install hl7.fhir.r4.core 4.0.1
-RUN /root/.dotnet/tools/fhir install hl7.fhir.xver-extensions 0.1.0
-
-FROM eclipse-temurin:17-jre-jammy@sha256:ed5ea3ef6b4db2a39d241ba8f040394c11450f5373329824390c227da7f229be
+FROM eclipse-temurin:17.0.11_9-jre-jammy@sha256:d7d18c361578b6d2395054bc89b7a4790f696120d91a1955ac52ecf4e12d77c8
 
 RUN apt-get update && apt-get upgrade -y && \
     apt-get install libjemalloc2 -y && \
     apt-get purge wget libbinutils libctf0 libctf-nobfd0 libncurses6 -y && \
     apt-get autoremove -y && apt-get clean && \
     rm -rf /var/lib/apt/lists/
 
-RUN groupadd -g 1001 blaze
-RUN useradd -u 1001 -g 1001 --create-home blaze
-
 RUN mkdir -p /app/data && chown 1001:1001 /app/data
-COPY target/blaze-0.26.1-standalone.jar /app/
-COPY --from=fhir-packages /root/.fhir/packages /home/blaze/.fhir/packages/
-RUN chown -R 1001:1001 /home/blaze/.fhir
+COPY target/blaze-0.26.2-standalone.jar /app/
 
 WORKDIR /app
 USER 1001
@@ -31,4 +20,4 @@ ENV RESOURCE_DB_DIR="/app/data/resource"
 ENV ADMIN_INDEX_DB_DIR="/app/data/admin-index"
 ENV ADMIN_TRANSACTION_DB_DIR="/app/data/admin-transaction"
 
-CMD ["java", "-jar",  "blaze-0.26.1-standalone.jar"]
+CMD ["java", "-jar",  "blaze-0.26.2-standalone.jar"]

Makefile

@@ -48,6 +48,9 @@ deps-tree:
 deps-list:
 	clojure -X:deps list
 
+repl:
+	clj -M:test -e "(require 'blaze.dev) (in-ns 'blaze.dev)" --repl
+
 cloc-prod-root:
 	cloc src