2026-01-28 | MAIN --> PROD | DEV (e5fe6da) --> STAGING #5347
Conversation
neilmb
added
autogenerated
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Terraform plan for production Plan: 1 to add, 2 to change, 1 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
-/+ destroy and then create replacement
Terraform will perform the following actions:
# module.production.module.cors.null_resource.cors_header must be replaced
-/+ resource "null_resource" "cors_header" {
!~ id = "*******************" -> (known after apply)
!~ triggers = { # forces replacement
!~ "always_run" = "2026-01-27T18:06:30Z" -> (known after apply)
}
}
# module.production.module.newrelic.newrelic_notification_destination.email_destination will be updated in-place
!~ resource "newrelic_notification_destination" "email_destination" {
id = "e7c0bf9e-3e32-454e-98e6-40aa0694adbc"
name = "email_destination"
# (6 unchanged attributes hidden)
- property {
- key = "email" -> null
- value = "[email protected],[email protected]" -> null
# (2 unchanged attributes hidden)
}
+ property {
+ key = "email"
+ value = "[email protected]"
# (2 unchanged attributes hidden)
}
}
# module.production.module.newrelic.newrelic_workflow.alert_workflow will be updated in-place
!~ resource "newrelic_workflow" "alert_workflow" {
id = "d725c3a4-b865-432c-857e-a7f12339793a"
name = "production_alert_workflow"
# (8 unchanged attributes hidden)
- issues_filter {
- filter_id = "2f4e1c77-5496-4e01-af2b-b6d6a54253ff" -> null
name = null
- type = "FILTER" -> null
- predicate {
- attribute = "labels.policyIds" -> null
- operator = "EXACTLY_MATCHES" -> null
- values = [
- "5422816",
] -> null
}
}
+ issues_filter {
+ filter_id = (known after apply)
+ name = "filter"
+ type = "FILTER"
+ predicate {
+ attribute = "labels.policyIds"
+ operator = "EXACTLY_MATCHES"
+ values = [
+ "5422816",
]
}
}
# (1 unchanged block hidden)
}
Plan: 1 to add, 2 to change, 1 to destroy.✅ Plan applied in Deploy to the Production Environment #154 |
|
Terraform plan for staging Plan: 1 to add, 0 to change, 1 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement
Terraform will perform the following actions:
# module.staging.module.cors.null_resource.cors_header must be replaced
-/+ resource "null_resource" "cors_header" {
!~ id = "*******************" -> (known after apply)
!~ triggers = { # forces replacement
!~ "always_run" = "2026-01-28T10:49:56Z" -> (known after apply)
}
}
Plan: 1 to add, 0 to change, 1 to destroy.✅ Plan applied in Deploy to the Staging Environment #418 |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Deploy to cloud.gov Environment | ||
| runs-on: ubuntu-latest | ||
| environment: ${{ inputs.environment }} | ||
| env: | ||
| space: ${{ inputs.environment }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ inputs.ref }} | ||
| fetch-depth: 0 # So we can get tags | ||
| - name: Restore npm cache | ||
| uses: actions/[email protected] | ||
| id: cache-npm | ||
| with: | ||
| path: ~/.npm | ||
| key: fac-build-npm-${{ hashFiles('**/package-lock.json') }} | ||
| restore-keys: | | ||
| fac-build-npm- | ||
| fac-build- | ||
|
|
||
| - name: Set up Python 3.12 | ||
| uses: actions/[email protected] | ||
| with: | ||
| python-version: '3.12' | ||
|
|
||
| - name: Restore pip cache | ||
| uses: actions/[email protected] | ||
| id: cache-pip | ||
| with: | ||
| path: | | ||
| ~/.cache/pip | ||
| /opt/hostedtoolcache/Python/ | ||
| key: fac-build-pip-${{ hashFiles('**/requirements.txt') }}-${{ hashFiles('**/dev-requirements.txt') }} | ||
| restore-keys: | | ||
| fac-build-pip-${{ hashFiles('**/requirements.txt') }}- | ||
| fac-build-pip- | ||
| fac-build- | ||
|
|
||
| - name: Install npm dependencies | ||
| working-directory: ./backend | ||
| run: npm ci --production | ||
|
|
||
| - name: Compile JS/CSS assets | ||
| working-directory: ./backend | ||
| run: npm run build | ||
|
|
||
| - name: Update service keys | ||
| uses: cloud-gov/cg-cli-tools@main | ||
| env: | ||
| SAM_API_KEY: ${{ secrets.SAM_API_KEY }} | ||
| DJANGO_SECRET_LOGIN_KEY: $${{ secrets.DJANGO_SECRET_LOGIN_KEY }} | ||
| LOGIN_CLIENT_ID: $${{ secrets.LOGIN_CLIENT_ID }} | ||
| SECRET_KEY: ${{ secrets.SECRET_KEY }} | ||
| with: | ||
| cf_username: ${{ secrets.CF_USERNAME }} | ||
| cf_password: ${{ secrets.CF_PASSWORD }} | ||
| cf_org: gsa-tts-oros-fac | ||
| cf_space: ${{ env.space }} | ||
| cf_command: update-user-provided-service fac-key-service -p '"{\"SAM_API_KEY\":\"${{ secrets.SAM_API_KEY }}\", \"DJANGO_SECRET_LOGIN_KEY\":\"${{ secrets.DJANGO_SECRET_LOGIN_KEY }}\", \"LOGIN_CLIENT_ID\":\"${{ secrets.LOGIN_CLIENT_ID }}\", \"SECRET_KEY\":\"${{ secrets.SECRET_KEY}}\"}"' | ||
|
|
||
| - name: Backup the database | ||
| if: startsWith(github.ref, 'refs/tags/v1.') | ||
| uses: cloud-gov/cg-cli-tools@main | ||
| with: | ||
| cf_username: ${{ secrets.CF_USERNAME }} | ||
| cf_password: ${{ secrets.CF_PASSWORD }} | ||
| cf_org: gsa-tts-oros-fac | ||
| cf_space: ${{ env.space }} | ||
| command: cf run-task gsa-fac -k 7G -m 3G --name deploy_backup --command "./fac-backup-util.sh v0.1.11 deploy_backup" --wait | ||
|
|
||
| - name: Deploy FAC Application to cloud.gov in the preview Environment | ||
| if: ${{ inputs.environment == 'preview' }} | ||
| uses: cloud-gov/cg-cli-tools@main | ||
| with: | ||
| cf_username: ${{ secrets.CF_USERNAME }} | ||
| cf_password: ${{ secrets.CF_PASSWORD }} | ||
| cf_org: gsa-tts-oros-fac | ||
| cf_space: ${{ env.space }} | ||
| cf_manifest: backend/manifests/manifest-preview.yml | ||
| cf_vars_file: backend/manifests/vars/vars-${{ env.space }}.yml | ||
| command: bin/ops/deploy_preview.sh | ||
|
|
||
| - name: Deploy FAC Application to cloud.gov in the ${{ env.space }} Environment | ||
| if: ${{ inputs.environment != 'preview' }} | ||
| uses: cloud-gov/cg-cli-tools@main | ||
| with: | ||
| cf_username: ${{ secrets.CF_USERNAME }} | ||
| cf_password: ${{ secrets.CF_PASSWORD }} | ||
| cf_org: gsa-tts-oros-fac | ||
| cf_space: ${{ env.space }} | ||
| cf_manifest: backend/manifests/manifest-fac.yml | ||
| cf_vars_file: backend/manifests/vars/vars-${{ env.space }}.yml | ||
| command: bin/ops/deploy.sh | ||
|
|
||
| # Similar to below with the logshipper, we have found that restarting the proxy helps things move along post deploy. | ||
| - name: Restart the proxy application | ||
| uses: cloud-gov/cg-cli-tools@main | ||
| with: | ||
| cf_username: ${{ secrets.CF_USERNAME }} | ||
| cf_password: ${{ secrets.CF_PASSWORD }} | ||
| cf_org: gsa-tts-oros-fac | ||
| cf_space: "${{ env.space }}-egress" | ||
| command: cf restart https-proxy | ||
|
|
||
| # This has to happen after an application deployment because the manifest (currently) is responsible | ||
| # for binding the "logdrain service" to the "gsa-fac application". This also needs to be done | ||
| # based on the suspicion that fluentbit cannot register the incoming logs when it is initially | ||
| # created, resulting in a 502. Restarting the application after everything is configured results | ||
| # in a 201, or, the expected status when transmitting logs. | ||
| - name: Restart the logshipper application | ||
| uses: cloud-gov/cg-cli-tools@main | ||
| with: | ||
| cf_username: ${{ secrets.CF_USERNAME }} | ||
| cf_password: ${{ secrets.CF_PASSWORD }} | ||
| cf_org: gsa-tts-oros-fac | ||
| cf_space: ${{ env.space }} | ||
| command: cf restart logshipper | ||
|
|
||
| check-tables: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 days ago
In general, the fix is to explicitly specify permissions for the GITHUB_TOKEN either at the top workflow level (applies to all jobs) or at the individual job level, and set them to the least privilege the workflow needs. This workflow only needs to read repository contents for actions/checkout, and there’s no evidence it needs to write to GitHub (no PR/issue/status updates), so contents: read is a suitable minimal starting point.
The single best way to fix this without changing existing behavior is to add a permissions block at the workflow root, between name: and on:. This keeps the configuration simple and applies to both jobs (push-with-creds and check-tables). We’ll set permissions: contents: read, which is equivalent to a read-only default for repository contents. No additional imports or methods are needed; it’s purely a YAML configuration change in .github/workflows/deploy-application-manual.yml.
Concretely:
- Edit
.github/workflows/deploy-application-manual.yml. - Insert:
permissions:
contents: readright after the name: Deploy Application Manual Trigger line (line 2 in the provided snippet). No other lines need modification.
| @@ -1,5 +1,7 @@ | ||
| --- | ||
| name: Deploy Application Manual Trigger | ||
| permissions: | ||
| contents: read | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: |
| needs: [push-with-creds] | ||
| uses: ./.github/workflows/fac_backup-check-tables.yml | ||
| secrets: inherit | ||
| with: | ||
| environment: ${{ inputs.environment }} | ||
| util_version: "v0.1.11" | ||
| backup_operation: "check_tables" No newline at end of file |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 days ago
In general, the fix is to add an explicit permissions: block to the workflow, granting only the minimal scopes the jobs need, instead of relying on implicit repository defaults. This can be done at the top (root) level of the workflow, which applies to all jobs that don’t override it, or per-job if different jobs need different scopes. Since this deployment workflow appears to only need to read repository contents (for actions/checkout) and does not obviously require write access to the repo, a minimal and safe choice is permissions: contents: read at the workflow root.
The single best fix here without changing existing functionality is to add a root-level permissions: block just below the name: field and above on:. actions/checkout@v4 only requires contents: read when doing a regular checkout; we are not using persist-credentials: false or any operation that needs write access, and the remaining steps authenticate with explicit Cloud Foundry credentials via secrets. Therefore, setting permissions: contents: read should not break the workflow but will ensure GITHUB_TOKEN is restricted. No additional imports, methods, or other definitions are required because this is a YAML configuration-only change in .github/workflows/deploy-application-manual.yml.
| @@ -1,5 +1,7 @@ | ||
| --- | ||
| name: Deploy Application Manual Trigger | ||
| permissions: | ||
| contents: read | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: |
Minimum allowed line rate is |
This is an auto-generated pull request to merge main into prod for a staging release on 2026-01-28 with the last commit being merged as e5fe6da