From 53d52e4b622dc1b0b076a8014b4261c0bc8a49b2 Mon Sep 17 00:00:00 2001 From: Keenan Date: Tue, 28 Oct 2025 13:10:28 -0400 Subject: [PATCH 01/14] chore: azure migration --- pipelines/deploy_dv.yaml | 43 +++++++++++++ server/Dockerfile.prod | 126 +++++++++++++++++++++++++------------- server/entrypoint.prod.sh | 25 ++++++++ server/sshd_config | 13 ++++ 4 files changed, 166 insertions(+), 41 deletions(-) create mode 100644 pipelines/deploy_dv.yaml create mode 100644 server/entrypoint.prod.sh create mode 100644 server/sshd_config diff --git a/pipelines/deploy_dv.yaml b/pipelines/deploy_dv.yaml new file mode 100644 index 00000000..6f80d67b --- /dev/null +++ b/pipelines/deploy_dv.yaml @@ -0,0 +1,43 @@ +trigger: none + +resources: + repositories: + - repository: templates + type: github + name: PHACDataHub/ADO-Pipeline-Templates + # Service connection to GitHub configured in Azure DevOps + endpoint: DMIA + +parameters: + - name: Image + displayName: Image + type: string + default: 'App' + values: + - App + +jobs: +- template: django_azure_app_service_deployment.yaml@templates + parameters: + env: 'Dev' + repository: 'nsp/spib-sdse-hopic-dv' + appName: 'was-spib-sdse-hopic-dv' + subscription: 'SPIB-SDSE-HOPIC-CICDLZSP-DT' + resourceGroup: 'rg-spib-sdse-hopic-dv' + poolName: spib-sdse-hopic-agents-dv + image: ${{ parameters.Image }} + containerCommand: 'gunicorn --bind 0.0.0.0:8000 omd.wsgi --timeout 1000' + envars: | + DB_HOST=pgsql-spib-sdse-hopic-dv.postgres.database.azure.com + DB_PORT=5432 + DB_SSLMODE=require + SECRET_KEY=@Microsoft.KeyVault(SecretUri=https://kvspibsdsehopicdv.vault.azure.net/secrets/hopic-django-secret-key/) + WEBSITES_PORT=8000 + LATEST_COMMIT_SHA=$(Build.SourceVersion) + ALLOWED_HOSTS=was-spib-sdse-hopic-dv.azurewebsites.net + CSRF_TRUSTED_ORIGINS=https://was-spib-sdse-hopic-dv.azurewebsites.net + DB_NAME=hopicdb + DB_PASSWORD=@Microsoft.KeyVault(SecretUri=https://kvspibsdsehopicdv.vault.azure.net/secrets/hopicapp-pgsql-password/) + DB_USER=hopicapp + ENV=dev + AZCOPY_AUTO_LOGIN_TYPE=MSI diff --git a/server/Dockerfile.prod b/server/Dockerfile.prod index 38810aad..9573071d 100644 --- a/server/Dockerfile.prod +++ b/server/Dockerfile.prod @@ -1,60 +1,104 @@ -###################### -# DEPENDENCY BUILDER # -###################### -# NOTE: builder layer must mach python and distribution versions of distroless runtime layer! -FROM python:3.11-bookworm as build_env - -# MUST keep these envs in sync with the Dockerfile.prod "FINAL" layer AND with Dockerfile.dev-management -ENV HOME=/cpho -ENV APP_HOME=$HOME/web -ENV PYTHON_DEPS=$HOME/python_deps +# Builds a Prod Image expecting to write to ACR and run the image in an app service container -RUN mkdir "${HOME}" && \ - mkdir "${APP_HOME}" && \ - mkdir "${PYTHON_DEPS}" +########### +# BUILDER # +########### +FROM python:3.11-slim-bookworm as builder -# Update pip -RUN pip install --upgrade pip +# set work directory +WORKDIR /usr/src/app -COPY ./requirements.txt . -COPY ./requirements_dev.txt . -COPY ./requirements_formatting.txt . +# set environment variables +ENV PYTHONDONTWRITEBYTECODE=1 \ + PYTHONUNBUFFERED=1 -ARG DEPENDENCY_SET="prod" +# Install build dependencies +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + build-essential \ + libpq-dev \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* -RUN [ "${DEPENDENCY_SET}" = "prod" ] \ - && pip install --no-cache-dir --target "${PYTHON_DEPS}" -r requirements.txt \ - || : +RUN pip install --upgrade pip wheel setuptools -RUN [ "${DEPENDENCY_SET}" = "test" ] \ - && pip install --no-cache-dir --target "${PYTHON_DEPS}" -r requirements.txt -r requirements_dev.txt -r requirements_formatting.txt \ - || : +# requirements and wheels +COPY requirements.txt . +RUN pip wheel --no-cache-dir --no-deps --wheel-dir /usr/src/app/wheels -r requirements.txt ######### # FINAL # ######### -FROM gcr.io/distroless/python3-debian12 +# pull official base image +FROM python:3.11-slim-bookworm + +# Make sure setuptools is always up to date +RUN pip install --upgrade pip setuptools -# MUST keep these envs in sync with the Dockerfile.prod "DEPENDENCY BUILDER" layer AND with Dockerfile.dev-management -ENV HOME=/cpho +# Environment Variables +ENV APP_NAME=hopicapp +ENV APP_USER=${APP_NAME}user +ENV HOME=/${APP_NAME} ENV APP_HOME=$HOME/web -ENV PYTHON_DEPS=$HOME/python_deps +ENV VIRTUALENV=$HOME/env +ENV WHEELDIR=$HOME/wheels +ENV PATH=$VIRTUALENV/bin:$PATH +ENV PYTHONDONTWRITEBYTECODE=1 +ENV PYTHONUNBUFFERED=1 + +EXPOSE 8000 + +# Install minimal runtime dependencies +RUN apt-get update && \ + apt-get upgrade -y && \ + apt-get install -y --no-install-recommends \ + gosu \ + libpq5 \ + netcat-traditional \ + openssh-server \ + postgresql-common \ + && addgroup --system $APP_NAME \ + && adduser --disabled-password --shell /bin/bash $APP_USER --system --ingroup $APP_NAME --home $HOME \ + && mkdir -p $APP_HOME $VIRTUALENV $WHEELDIR \ + && chown -R $APP_USER:$APP_NAME $HOME \ + && echo "root:Docker!" | chpasswd \ + && echo -e "HOPIC Container\n\nFor management commands run: \ncd $APP_HOME \npython manage\n\n" > /etc/motd \ + && echo -e "cd $APP_HOME\n" >> /etc/profile -# this is the ID of the distroless "nonroot" user, using ID instead of user name because the k8s runAsNonRoot security context -# can't verify non-rootness when the docker file sets user by name -# https://github.com/GoogleContainerTools/distroless/blob/9c5d2c431825d7aa21017551b2ec75c29c1f23c6/common/variables.bzl#L18 -ENV NONROOT_USER_ID=65532 +WORKDIR $APP_HOME -ENV PATH="${PYTHON_DEPS}/bin:${PATH}" -ENV PYTHONPATH="${PYTHON_DEPS}:${PYTHONPATH}" +# Copy wheels from builder stage +COPY --chown=$APP_USER:$APP_NAME --from=builder /usr/src/app/wheels $WHEELDIR -COPY --chown=$NONROOT_USER_ID:$NONROOT_USER_ID --from=build_env $HOME $HOME -COPY --chown=$NONROOT_USER_ID:$NONROOT_USER_ID . $APP_HOME -WORKDIR $APP_HOME -USER $NONROOT_USER_ID +# Create and configure virtual environment +RUN python -m venv $VIRTUALENV && \ + $VIRTUALENV/bin/pip install --no-cache-dir $WHEELDIR/* && \ + rm -rf $WHEELDIR + +# Make sure setuptools is always up to date +RUN pip install --upgrade setuptools + +# Copy project files +COPY --chown=$APP_USER:$APP_NAME src/ $APP_HOME + +# copy sshd_config file +COPY src/sshd_config /etc/ssh/ + +# copy version file +# COPY version.txt $APP_HOME + +# Setup entrypoint and create staticfiles +RUN chmod +x $APP_HOME/entrypoint.prod.sh && \ + rm -f $APP_HOME/sshd_config && \ + mkdir -p $APP_HOME/staticfiles && \ + SECRET_KEY=t ALLOWED_HOSTS=* DB_NAME=d DB_USER=d DB_PASSWORD=d DB_HOST=d DB_PORT=1 python -m manage collectstatic --no-input -EXPOSE 8080 +# Set entrypoint and default command +# Wrapping the dynamic entrypoint call to ensure parameters are passed through correctly +RUN echo '#!/bin/bash\n"${APP_HOME}/entrypoint.prod.sh" "$@"' > /entrypoint-wrapper.sh && \ + chmod +x /entrypoint-wrapper.sh -ENTRYPOINT [ "python", "./entrypoint.prod.py" ] +ENTRYPOINT ["/entrypoint-wrapper.sh"] +CMD ["gunicorn", "--bind", "0.0.0.0:8000", "server.wsgi"] diff --git a/server/entrypoint.prod.sh b/server/entrypoint.prod.sh new file mode 100644 index 00000000..7b106f4c --- /dev/null +++ b/server/entrypoint.prod.sh @@ -0,0 +1,25 @@ +#!/bin/bash +echo "Starting SSH server..." +service ssh start + +echo "Generating static files..." +python manage.py collectstatic --no-input + +if [ ! -z "$DB_HOST" ] && [ ! -z "$DB_PORT" ]; then + echo "Waiting for postgres ($DB_HOST:$DB_PORT)..." + + while ! nc -z $DB_HOST $DB_PORT; do + sleep 0.1 + done + sleep 1 + + echo "PostgreSQL started" + echo "applying migrations..." + python manage.py migrate + echo "migrations applied" + +fi + +eval $(printenv | sed -n "s/^\([^=]\+\)=\(.*\)$/export \1=\2/p" | sed 's/"/\\\"/g' | sed '/=/s//="/' | sed 's/$/"/' >> /etc/profile) + +exec gosu ${APP_USER} "$@" diff --git a/server/sshd_config b/server/sshd_config new file mode 100644 index 00000000..c6ceb581 --- /dev/null +++ b/server/sshd_config @@ -0,0 +1,13 @@ +Port 2222 +ListenAddress 0.0.0.0 +LoginGraceTime 180 +X11Forwarding yes +Ciphers aes128-cbc,3des-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr +MACs hmac-sha1,hmac-sha1-96 +StrictModes yes +SyslogFacility DAEMON +PasswordAuthentication yes +PermitEmptyPasswords no +PermitRootLogin yes +Subsystem sftp internal-sftp + From 8b3b6a250db70bb10e227538d24ffafdbaecde32 Mon Sep 17 00:00:00 2001 From: Keenan Date: Tue, 28 Oct 2025 13:17:59 -0400 Subject: [PATCH 02/14] change deploy script --- pipelines/deploy_dv.yaml | 94 ++++++++++++++++++++++++++++++---------- 1 file changed, 71 insertions(+), 23 deletions(-) diff --git a/pipelines/deploy_dv.yaml b/pipelines/deploy_dv.yaml index 6f80d67b..5e6b8e98 100644 --- a/pipelines/deploy_dv.yaml +++ b/pipelines/deploy_dv.yaml @@ -1,33 +1,22 @@ trigger: none -resources: - repositories: - - repository: templates - type: github - name: PHACDataHub/ADO-Pipeline-Templates - # Service connection to GitHub configured in Azure DevOps - endpoint: DMIA - parameters: - name: Image - displayName: Image + displayName: Build Container Image type: string - default: 'App' + default: "prod" values: - - App + # - dev + - prod -jobs: -- template: django_azure_app_service_deployment.yaml@templates - parameters: - env: 'Dev' - repository: 'nsp/spib-sdse-hopic-dv' - appName: 'was-spib-sdse-hopic-dv' - subscription: 'SPIB-SDSE-HOPIC-CICDLZSP-DT' - resourceGroup: 'rg-spib-sdse-hopic-dv' - poolName: spib-sdse-hopic-agents-dv - image: ${{ parameters.Image }} - containerCommand: 'gunicorn --bind 0.0.0.0:8000 omd.wsgi --timeout 1000' - envars: | +variables: + registry: "hcsccrrc.azurecr.io" + repository: "nsp/sdse-spib-hopic-dv" + tag: "$(Build.SourceVersion)" + appName: was-spib-sdse-hopic-dv + subscription: SPIB-SDSE-HOPIC-CICDLZSP-DT + resourceGroup: rg-spib-sdse-hopic-dv + envars: > DB_HOST=pgsql-spib-sdse-hopic-dv.postgres.database.azure.com DB_PORT=5432 DB_SSLMODE=require @@ -41,3 +30,62 @@ jobs: DB_USER=hopicapp ENV=dev AZCOPY_AUTO_LOGIN_TYPE=MSI + + +pool: + name: spib-sdse-hopic-agents-dv + +jobs: + - job: Deploy_DV + steps: + - script: | + sudo apt-get update + sudo apt-get install unzip + displayName: "Install Unzip" + + - script: | + sudo apt install -y docker.io + sudo apt install docker-buildx + sudo systemctl start docker + sudo usermod -aG docker $(id -un) + sudo chmod 666 /var/run/docker.sock + displayName: "Install and Configure Docker" + + - script: | + curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash + displayName: "Install AZ CLI" + + - task: AzureCLI@2 + displayName: "Login to ACR" + inputs: + azureSubscription: $(subscription) + scriptType: bash + scriptLocation: inlineScript + inlineScript: | + az --version + az acr login --name hcsccrrc + + - ${{ if eq(parameters.Image, 'prod')}}: + - script: | + docker build -t $(registry)/$(repository):$(tag) -f server/Dockerfile.prod . + docker push $(registry)/$(repository):$(tag) + displayName: "Build and Push $(repository) Image" + + - task: AzureWebAppContainer@1 + displayName: "Install $(repository) into $(appName)" + inputs: + azureSubscription: "$(subscription)" + appName: "$(appName)" + deployToSlotOrASE: true + resourceGroupName: "$(resourceGroup)" + containers: "$(registry)/$(repository):$(tag)" + containerCommand: "gunicorn --bind 0.0.0.0:8000 server.wsgi --timeout 1000" + + - task: AzureCLI@2 + displayName: "AppSettings for $(appName)" + inputs: + azureSubscription: $(subscription) + scriptType: bash + scriptLocation: inlineScript + inlineScript: | + az webapp config appsettings set -g $(resourceGroup) -n $(appName) --settings ${{ variables.envars }} From ccaabe445f4314b2f2c950a1b18b7e2ecf336a2e Mon Sep 17 00:00:00 2001 From: Keenan Date: Tue, 28 Oct 2025 13:41:03 -0400 Subject: [PATCH 03/14] move sshd config --- server/Dockerfile.prod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/Dockerfile.prod b/server/Dockerfile.prod index 9573071d..c8559864 100644 --- a/server/Dockerfile.prod +++ b/server/Dockerfile.prod @@ -84,7 +84,7 @@ RUN pip install --upgrade setuptools COPY --chown=$APP_USER:$APP_NAME src/ $APP_HOME # copy sshd_config file -COPY src/sshd_config /etc/ssh/ +COPY server/sshd_config /etc/ssh/ # copy version file # COPY version.txt $APP_HOME From 839ffcbb2964804c7ae6fab5dfc7db5b5c153151 Mon Sep 17 00:00:00 2001 From: Keenan Date: Tue, 28 Oct 2025 13:48:08 -0400 Subject: [PATCH 04/14] update dockerfile --- server/Dockerfile.prod | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/Dockerfile.prod b/server/Dockerfile.prod index c8559864..f01e89d1 100644 --- a/server/Dockerfile.prod +++ b/server/Dockerfile.prod @@ -23,7 +23,7 @@ RUN apt-get update && \ RUN pip install --upgrade pip wheel setuptools # requirements and wheels -COPY requirements.txt . +COPY server/requirements.txt . RUN pip wheel --no-cache-dir --no-deps --wheel-dir /usr/src/app/wheels -r requirements.txt ######### @@ -81,7 +81,7 @@ RUN python -m venv $VIRTUALENV && \ RUN pip install --upgrade setuptools # Copy project files -COPY --chown=$APP_USER:$APP_NAME src/ $APP_HOME +COPY --chown=$APP_USER:$APP_NAME server/ $APP_HOME # copy sshd_config file COPY server/sshd_config /etc/ssh/ From 04749a0d4cef04144e3b0bbd29e194bc9f86b67e Mon Sep 17 00:00:00 2001 From: Keenan Date: Tue, 28 Oct 2025 13:55:33 -0400 Subject: [PATCH 05/14] add quotes for some env vars --- pipelines/deploy_dv.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pipelines/deploy_dv.yaml b/pipelines/deploy_dv.yaml index 5e6b8e98..ccd0c260 100644 --- a/pipelines/deploy_dv.yaml +++ b/pipelines/deploy_dv.yaml @@ -20,13 +20,13 @@ variables: DB_HOST=pgsql-spib-sdse-hopic-dv.postgres.database.azure.com DB_PORT=5432 DB_SSLMODE=require - SECRET_KEY=@Microsoft.KeyVault(SecretUri=https://kvspibsdsehopicdv.vault.azure.net/secrets/hopic-django-secret-key/) + SECRET_KEY='@Microsoft.KeyVault(SecretUri=https://kvspibsdsehopicdv.vault.azure.net/secrets/hopic-django-secret-key/)' WEBSITES_PORT=8000 LATEST_COMMIT_SHA=$(Build.SourceVersion) ALLOWED_HOSTS=was-spib-sdse-hopic-dv.azurewebsites.net CSRF_TRUSTED_ORIGINS=https://was-spib-sdse-hopic-dv.azurewebsites.net DB_NAME=hopicdb - DB_PASSWORD=@Microsoft.KeyVault(SecretUri=https://kvspibsdsehopicdv.vault.azure.net/secrets/hopicapp-pgsql-password/) + DB_PASSWORD='@Microsoft.KeyVault(SecretUri=https://kvspibsdsehopicdv.vault.azure.net/secrets/hopicapp-pgsql-password/)' DB_USER=hopicapp ENV=dev AZCOPY_AUTO_LOGIN_TYPE=MSI From 95aa546d85643d3785c5a9017106fa70c00db286 Mon Sep 17 00:00:00 2001 From: Keenan Date: Tue, 28 Oct 2025 14:07:10 -0400 Subject: [PATCH 06/14] change CSRF_TRUSTED_ORIGINS --- server/server/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/server/settings.py b/server/server/settings.py index 03d2bf47..551fece3 100644 --- a/server/server/settings.py +++ b/server/server/settings.py @@ -96,7 +96,7 @@ # Additional CORS allowed and CSRF trusted origins should be empty until if/when the app # is serving a REST/GraphQL API for external consumption CORS_ALLOWED_ORIGINS = [] -CSRF_TRUSTED_ORIGINS = [] +CSRF_TRUSTED_ORIGINS = config("CSRF_TRUSTED_ORIGINS", default="", cast=Csv()) # Prod only security settings if not IS_DEV: From 675525a0d371f2b5cc64bde93f62d101d6cb7712 Mon Sep 17 00:00:00 2001 From: Keenan Date: Tue, 28 Oct 2025 14:08:05 -0400 Subject: [PATCH 07/14] change csrf back for now --- server/server/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/server/settings.py b/server/server/settings.py index 551fece3..03d2bf47 100644 --- a/server/server/settings.py +++ b/server/server/settings.py @@ -96,7 +96,7 @@ # Additional CORS allowed and CSRF trusted origins should be empty until if/when the app # is serving a REST/GraphQL API for external consumption CORS_ALLOWED_ORIGINS = [] -CSRF_TRUSTED_ORIGINS = config("CSRF_TRUSTED_ORIGINS", default="", cast=Csv()) +CSRF_TRUSTED_ORIGINS = [] # Prod only security settings if not IS_DEV: From 6f7261704d2feadcfe5e8adfc00f3ac8ea1bbcaf Mon Sep 17 00:00:00 2001 From: Keenan Date: Wed, 29 Oct 2025 11:45:07 -0400 Subject: [PATCH 08/14] make CSRF_TRUSTED_ORIGINS an env var --- server/server/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/server/settings.py b/server/server/settings.py index 03d2bf47..551fece3 100644 --- a/server/server/settings.py +++ b/server/server/settings.py @@ -96,7 +96,7 @@ # Additional CORS allowed and CSRF trusted origins should be empty until if/when the app # is serving a REST/GraphQL API for external consumption CORS_ALLOWED_ORIGINS = [] -CSRF_TRUSTED_ORIGINS = [] +CSRF_TRUSTED_ORIGINS = config("CSRF_TRUSTED_ORIGINS", default="", cast=Csv()) # Prod only security settings if not IS_DEV: From 82cb74819e0bf1ae27bb313448cb630fb48d73bf Mon Sep 17 00:00:00 2001 From: Keenan Date: Fri, 31 Oct 2025 10:04:16 -0400 Subject: [PATCH 09/14] updates --- pipelines/deploy_dv.yaml | 2 +- server/server/settings.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pipelines/deploy_dv.yaml b/pipelines/deploy_dv.yaml index ccd0c260..15fb4e2c 100644 --- a/pipelines/deploy_dv.yaml +++ b/pipelines/deploy_dv.yaml @@ -25,7 +25,7 @@ variables: LATEST_COMMIT_SHA=$(Build.SourceVersion) ALLOWED_HOSTS=was-spib-sdse-hopic-dv.azurewebsites.net CSRF_TRUSTED_ORIGINS=https://was-spib-sdse-hopic-dv.azurewebsites.net - DB_NAME=hopicdb + DB_NAME=hopicdb_migration_test DB_PASSWORD='@Microsoft.KeyVault(SecretUri=https://kvspibsdsehopicdv.vault.azure.net/secrets/hopicapp-pgsql-password/)' DB_USER=hopicapp ENV=dev diff --git a/server/server/settings.py b/server/server/settings.py index 551fece3..7b000370 100644 --- a/server/server/settings.py +++ b/server/server/settings.py @@ -100,7 +100,7 @@ # Prod only security settings if not IS_DEV: - SECURE_SSL_REDIRECT = True + # SECURE_SSL_REDIRECT = True # For K8S Health Check SECURE_REDIRECT_EXEMPT = [ "^healthcheck/", From 413406c24e84f875c75311b223ec555e050b7616 Mon Sep 17 00:00:00 2001 From: Keenan Date: Fri, 31 Oct 2025 10:14:26 -0400 Subject: [PATCH 10/14] put SECURE_SSL_REDIRECT back --- server/server/settings.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/server/settings.py b/server/server/settings.py index 7b000370..551fece3 100644 --- a/server/server/settings.py +++ b/server/server/settings.py @@ -100,7 +100,7 @@ # Prod only security settings if not IS_DEV: - # SECURE_SSL_REDIRECT = True + SECURE_SSL_REDIRECT = True # For K8S Health Check SECURE_REDIRECT_EXEMPT = [ "^healthcheck/", From 15fdc1af7388fd1f5c9b616312fbc3b1f38d1e24 Mon Sep 17 00:00:00 2001 From: Keenan Date: Fri, 31 Oct 2025 10:47:01 -0400 Subject: [PATCH 11/14] remove get_project_config --- server/server/settings.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/server/settings.py b/server/server/settings.py index 551fece3..d37826e1 100644 --- a/server/server/settings.py +++ b/server/server/settings.py @@ -16,7 +16,7 @@ from django.urls import reverse_lazy -from decouple import Csv +from decouple import Csv, config from server.config_util import get_project_config, is_running_tests @@ -25,7 +25,7 @@ BASE_DIR = Path(__file__).resolve().parent.parent -config = get_project_config() +# config = get_project_config() IS_LOCAL = config("IS_LOCAL", cast=bool, default=False) IS_DEV = config("IS_DEV", cast=bool, default=False) From 4cdf717b51b8980940d271b2f7f70fa9d5bd6faa Mon Sep 17 00:00:00 2001 From: Todd McDonald Date: Fri, 9 Jan 2026 12:46:07 -0500 Subject: [PATCH 12/14] expiry check call --- pipelines/secret_expiry_check.yaml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 pipelines/secret_expiry_check.yaml diff --git a/pipelines/secret_expiry_check.yaml b/pipelines/secret_expiry_check.yaml new file mode 100644 index 00000000..92cf4a37 --- /dev/null +++ b/pipelines/secret_expiry_check.yaml @@ -0,0 +1,30 @@ +trigger: none + +pool: spib-sdse-hopic-agents-dv + +resources: + repositories: + - repository: templates + type: github + name: PHACDataHub/ADO-Pipeline-Templates + # Service connection to GitHub configured in Azure DevOps + endpoint: DMIA + - repository: test_secret_check + type: github + name: PHACDataHub/ADO-Pipeline-Templates + ref: refs/heads/tm-secret-expiry-check + +steps: +- script: | + curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash + displayName: Install AZ CLI + +- template: run_bash_secret_expiry_check.yaml@test_secret_check + parameters: + subscription: SPIB-SDSE-HOPIC-CICDLZSP-DT + warningDays: 30 + appNames: + - 'SPIB-SDSE-HOPIC-CICDLZSP-DT' + - 'CDSB-DMIA-HOPIC-SSO-pr' + - 'CDSB-DMIA-HOPIC-SSO-dv' + - 'HOPIC/CPHO' From 799f01df2ec6380c9e027a878c2b10fc20beae1d Mon Sep 17 00:00:00 2001 From: Todd McDonald Date: Fri, 9 Jan 2026 12:50:46 -0500 Subject: [PATCH 13/14] forgot the endpoint --- pipelines/secret_expiry_check.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/pipelines/secret_expiry_check.yaml b/pipelines/secret_expiry_check.yaml index 92cf4a37..8c6097af 100644 --- a/pipelines/secret_expiry_check.yaml +++ b/pipelines/secret_expiry_check.yaml @@ -13,6 +13,7 @@ resources: type: github name: PHACDataHub/ADO-Pipeline-Templates ref: refs/heads/tm-secret-expiry-check + endpoint: DMIA steps: - script: | From 938e5f5ec112fdb936b2644db0b51e4206c0ab89 Mon Sep 17 00:00:00 2001 From: Todd McDonald Date: Fri, 9 Jan 2026 12:53:13 -0500 Subject: [PATCH 14/14] wrong parameter --- pipelines/secret_expiry_check.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pipelines/secret_expiry_check.yaml b/pipelines/secret_expiry_check.yaml index 8c6097af..b08aa4b2 100644 --- a/pipelines/secret_expiry_check.yaml +++ b/pipelines/secret_expiry_check.yaml @@ -22,7 +22,7 @@ steps: - template: run_bash_secret_expiry_check.yaml@test_secret_check parameters: - subscription: SPIB-SDSE-HOPIC-CICDLZSP-DT + azureSubscription: SPIB-SDSE-HOPIC-CICDLZSP-DT warningDays: 30 appNames: - 'SPIB-SDSE-HOPIC-CICDLZSP-DT'