Merge from master

department-of-veterans-affairs · Nov 29, 2024 · 4998d37 · 4998d37
2 parents 1a971a6 + bbdab6b
commit 4998d37
Show file tree

Hide file tree

Showing 648 changed files with 29,037 additions and 12,755 deletions.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
diff --git a/.github/workflows/backend-pr-labeler.yml b/.github/workflows/backend-pr-labeler.yml
@@ -2,14 +2,205 @@ name: Backend PR Labeler
 on:
   pull_request:
     types: [opened, reopened, review_requested, review_request_removed, ready_for_review, converted_to_draft, labeled, unlabeled]
+  pull_request_review:
+    types: [submitted]
   workflow_run:
-    workflows: 
+    workflows:
       - "Code Checks"
     types: [completed]
 jobs:
+  get-pr-data:
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    outputs:
+      pr_number: ${{ steps.get_pr_data.outputs.pr_number }}
+      pr_draft: ${{ steps.get_pr_data.outputs.pr_draft }}
+      pr_labels: ${{ steps.get_pr_data.outputs.pr_labels }}
+      pr_requested_teams: ${{ steps.get_pr_data.outputs.pr_requested_teams }}
+    steps:
+      - name: Get pull_request data
+        id: get_pr_data
+        run: |
+          if ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_review'}}; then
+            echo "pr_number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+            echo "pr_draft=${{ github.event.pull_request.draft }}" >> $GITHUB_OUTPUT
+            echo "pr_labels=$(echo '${{ toJSON(github.event.pull_request.labels.*.name) }}' | jq -c '.')" >> $GITHUB_OUTPUT
+            echo "pr_requested_teams=$(echo '${{ toJSON(github.event.pull_request.requested_teams.*.name) }}' | jq -c '.')" >> $GITHUB_OUTPUT
+          elif ${{ github.event_name == 'workflow_run' }}; then
+            if ${{ github.event.workflow_run.event == 'push' }}; then
+              echo "Workflow was triggered by push to ${{ github.event.workflow_run.head_branch }}. Labeling not required."
+              exit 0
+            elif ${{ toJSON(github.event.workflow_run.pull_requests) != '[]' }}; then
+              PR_NUMBER="${{ github.event.workflow_run.pull_requests[0].number }}"
+              echo "pr_number=${PR_NUMBER}" >> $GITHUB_OUTPUT
+
+              # Fetch PR details from GitHub API
+              PR_INFO=$(gh api /repos/${{ github.repository }}/pulls/${PR_NUMBER} --jq '{
+                draft: .draft,
+                labels: [.labels[].name],
+                requested_teams: [.requested_teams[].slug]
+              }')
+
+              # Extract and store individual fields
+              echo "pr_draft=$(echo "$PR_INFO" | jq -r '.draft')" >> $GITHUB_OUTPUT
+              echo "pr_labels=$(echo "$PR_INFO" | jq -c '.labels')" >> $GITHUB_OUTPUT
+              echo "pr_requested_teams=$(echo "$PR_INFO" | jq -c '.requested_teams')" >> $GITHUB_OUTPUT
+            else
+              echo "Workflow run has no associated pull requests. Labeling not performed."
+              exit 0
+            fi
+          else
+            echo "event_name: ${{ github.event_name }}"
+            echo "Pull Request not successfully retrieved."
+            exit 1
+          fi
+
+      - name: Echo PR data
+        if: ${{ steps.get_pr_data.outputs.pr_number != '' }}
+        run: |
+          echo "pr_number: ${{ steps.get_pr_data.outputs.pr_number }}"
+          echo "pr_draft: ${{ steps.get_pr_data.outputs.pr_draft }}"
+          echo "pr_labels: ${{ steps.get_pr_data.outputs.pr_labels }}"
+          echo "pr_labels: ${{ fromJson(steps.get_pr_data.outputs.pr_labels)[0] }}"
+          echo "pr_requested_teams: ${{ steps.get_pr_data.outputs.pr_requested_teams }}"
+          echo "pr_requested_teams: ${{ fromJSON(steps.get_pr_data.outputs.pr_requested_teams)[0] }}"
+
   check-pr-status:
     runs-on: ubuntu-latest
+    needs: get-pr-data
+    if: ${{ needs.get-pr-data.outputs.pr_number != '' }}
+    env:
+      pr_labels: ${{ needs.get-pr-data.outputs.pr_labels }}
+      pr_requested_teams: ${{ needs.get-pr-data.outputs.pr_requested_teams }}
+    outputs:
+      test_status: ${{ steps.get_code_checks_conclusion.outputs.test_status }}
+      exempt: ${{ steps.check_exemption.outputs.exempt }}
+      failures_detected: ${{ steps.audit_pr_labels.outputs.failures_detected }}
+    steps:
+      - name: Print vars (DELETE ME)
+        run: |
+          echo "pr_labels=${{ needs.get-pr-data.outputs.pr_labels }}"
+          echo "pr_requested_teams=${{ needs.get-pr-data.outputs.pr_requested_teams }}"
+
+      - name: Get Code Checks result
+        if: github.event_name == 'workflow_run'
+        run: |
+          echo "test_status=${{ github.event.workflow_run.conclusion }}" >> $GITHUB_OUTPUT
+          echo "test_status: ${{ github.event.workflow_run.conclusion }}"
+
+      - name: Check for exemption
+        id: check_exemption
+        run: |
+          if ${{ contains(fromJSON(env.pr_requested_teams), 'backend-review-group') }}; then
+            echo "exempt=false" >> $GITHUB_OUTPUT
+            echo "PR requires backend approval."
+          else
+            echo "exempt=true" >> $GITHUB_OUTPUT
+            echo "PR is exempt from backend approval."
+          fi
+
+      - name: Check for failure labels
+        id: audit_pr_labels
+        run: |
+          if \
+            ${{ contains(env.pr_labels, 'code-health-failure') }} || \
+            ${{ contains(env.pr_labels, 'codeowners-addition-failure') }} || \
+            ${{ contains(env.pr_labels, 'codeowners-delete-failure') }} || \
+            ${{ contains(env.pr_labels, 'lint-failure') }} || \
+            ${{ contains(env.pr_labels, 'test-failure') }} ; then
+            echo "failures_detected=true" >> $GITHUB_OUTPUT
+            echo "Failure labels detected."
+          else
+            echo "failures_detected=false" >> $GITHUB_OUTPUT
+            echo "No failure labels detected."
+          fi
+
+  check-approvals:
+    runs-on: ubuntu-latest
+    needs: [get-pr-data, check-pr-status]
+    if: ${{ needs.check-pr-status.outputs.exempt == 'false' && needs.check-pr-status.outputs.pr_draft == 'false' }}
+    env:
+      pr_number: ${{ needs.get-pr-data.outputs.pr_number }}
+    outputs:
+      approval_status: ${{ steps.verify_approval.outputs.approval_status }}
+    steps:
+      - name: Print vars (DELETE ME)
+        run: |
+          echo "pr_number=${{ env.pr_number }}"
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/[email protected]
+        with:
+          aws-access-key-id: ${{ secrets.aws_access_key_id }}
+          aws-secret-access-key: ${{ secrets.aws_secret_access_key }}
+          aws-region: "us-gov-west-1"
+
+      - name: Get bot token from Parameter Store
+        uses: marvinpinto/action-inject-ssm-secrets@latest
+        with:
+          ssm_parameter: /devops/VA_VSP_BOT_GITHUB_TOKEN
+          env_variable_name: VA_VSP_BOT_GITHUB_TOKEN
+
+      - name: Get PR Reviews
+        id: get_pr_reviews
+        uses: octokit/[email protected]
+        with:
+          route: GET /repos/${{ github.repository }}/pulls/${{ env.pr_number }}/reviews
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get backend-review-group members
+        id: get_team_members
+        uses: octokit/[email protected]
+        with:
+          route: GET /orgs/department-of-veterans-affairs/teams/backend-review-group/members
+        env:
+          GITHUB_TOKEN: ${{ env.VA_VSP_BOT_GITHUB_TOKEN }}
+
+      # Confirm an approval exists from at least one BE team member
+      - name: Verify backend-review-group approval
+        id: verify_approval
+        run: |
+          BACKEND_REVIEWERS=$(cat <<'EOF' | jq -r '.[].login' | tr '\n' '|' | sed 's/|$//'
+          ${{ steps.get_team_members.outputs.data }}
+          EOF
+          )
+
+          APPROVALS=$(cat <<'EOF' | jq -r '.[] | select(.state == "APPROVED") | .user.login' | grep -iE "$BACKEND_REVIEWERS" | wc -l
+          ${{ steps.get_pr_reviews.outputs.data }}
+          EOF
+          )
+
+          echo "Number of backend-review-group approvals: $APPROVALS"
+          if [ "$APPROVALS" -eq 0 ]; then
+            echo "approval_status=required" >> $GITHUB_OUTPUT
+            echo "Backend-review-group approval required."
+          else
+            echo "approval_status=confirmed" >> $GITHUB_OUTPUT
+            echo "Backend-review-group approval confirmed."
+          fi
+
+  apply-labels:
+    runs-on: ubuntu-latest
+    needs: [get-pr-data, check-pr-status, check-approvals]
+    if: ${{ always() }}
+    env:
+      exempt: ${{ needs.check-pr-status.outputs.exempt }}
+      pr_number: ${{ needs.get-pr-data.outputs.pr_number }}
+      pr_draft: ${{ needs.get-pr-data.outputs.pr_draft }}
+      pr_labels: ${{ needs.get-pr-data.outputs.pr_labels }}
+      test_status: ${{ needs.check-pr-status.outputs.test_status }}
+      failures_detected: ${{ needs.check-pr-status.outputs.failures_detected }}
+      approval_status: ${{ needs.check-approvals.outputs.approval_status }}
     steps:
-      - name: Say Hi
+      - name: print vars (DELETE ME)
+        id: print-vars
         run: |
-          echo "Hi"
+          echo ${{ env.exempt }}
+          echo ${{ env.pr_number }}
+          echo ${{ env.pr_draft }}
+          echo ${{ env.pr_labels }}
+          echo ${{ env.test_status }}
+          echo ${{ env.failures_detected }}
+          echo ${{ env.approval_status }}
diff --git a/.github/workflows/be_review_prs.yml b/.github/workflows/be_review_prs.yml
@@ -1,9 +1,9 @@
 name: Require backend-review-group approval
 on:
-  pull_request:
-    types: [opened, reopened, review_requested, synchronize, ready_for_review]
   pull_request_review:
     types: [submitted]
+    branches:
+      - master
 
 jobs:
   check-approval-requirements:

diff --git a/.github/workflows/code_checks.yml b/.github/workflows/code_checks.yml
@@ -126,15 +126,15 @@ jobs:
       - name: Setup Database
         uses: nick-fields/retry@7152eba30c6575329ac0576536151aca5a72780e # v3.0.0
         with:
-          timeout_minutes: 20
+          timeout_minutes: 10
           retry_wait_seconds: 3 # Seconds
           max_attempts: 3
           command: |
             docker compose -f docker-compose.test.yml run web bash \
               -c "CI=true RAILS_ENV=test DISABLE_BOOTSNAP=true bundle exec parallel_test -n 24  -e 'bin/rails db:reset'"
 
       - name: Run Specs
-        timeout-minutes: 20
+        timeout-minutes: 15
         run: |
           docker compose -f docker-compose.test.yml run web bash \
           -c "CI=true DISABLE_BOOTSNAP=true bundle exec parallel_rspec spec/ modules/ -n 24 -o '--color --tty'"

diff --git a/.github/workflows/deploy_delay_notifications.yml b/.github/workflows/deploy_delay_notifications.yml
@@ -67,7 +67,7 @@ jobs:
           fi
 
       - name: Check deployment status for staging
-        if: ${{ env.latest_sha != '' && env.staging_deployed_sha != '' }}
+        if: ${{ always() && env.latest_sha != '' && env.staging_deployed_sha != '' }}
         id: check-staging-status
         run: |
           latest_sha=${{ env.latest_sha }}
@@ -145,10 +145,7 @@ jobs:
                 "type": "section",
                 "text": {
                   "type": "mrkdwn",
-                  "text": ">:scared_and_sweating_smiley: GitHub Action Runner Workflow failed! :scared_and_sweating_smiley:\n \
-                    <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} Run #${{ github.run_number }}>\n\n \
-                    *Development Summary:*\n${{ env.dev_summary }}\n\n \
-                    *Staging Summary:*\n${{ env.staging_summary }}"
+                  "text": ":scared_and_sweating_smiley: GitHub Action Runner Workflow failed! :scared_and_sweating_smiley:\n <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} Run #${{ github.run_number }}>\n\n *Development Summary:*\n${{ env.dev_summary }}\n\n *Staging Summary:*\n${{ env.staging_summary }}"
                 }
               },
               { "type": "divider" }
@@ -169,9 +166,7 @@ jobs:
                 "type": "section",
                 "text": {
                   "type": "mrkdwn",
-                  "text": ">:scared_and_sweating_smiley: GitHub Action Runner Workflow failed! :scared_and_sweating_smiley:\n\n \
-                    Unknown error occured. See logs:\n \
-                    <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} Run #${{ github.run_number }}>"
+                  "text": ":scared_and_sweating_smiley: GitHub Action Runner Workflow failed! :scared_and_sweating_smiley:\n\n Unknown error occured. See logs:\n <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} Run #${{ github.run_number }}>"
                 }
               },
               { "type": "divider" }

diff --git a/Gemfile b/Gemfile
@@ -64,7 +64,7 @@ gem 'connect_vbms', git: 'https://github.com/adhocteam/connect_vbms', tag: 'v2.1
 gem 'csv'
 gem 'date_validator'
 gem 'ddtrace'
-gem 'dogstatsd-ruby', '5.6.2'
+gem 'dogstatsd-ruby', '5.6.3'
 gem 'dry-struct'
 gem 'dry-types'
 gem 'ethon', '>=0.13.0'