Skip to content

Commit 29bee35

Browse files
ccostinoccostino
authored
Merge pull request #1746 from GSA/main
5/30/25 Production Deploy
2 parents 76df88d + 6d8e222 commit 29bee35

File tree

13 files changed

+787
-480
lines changed

13 files changed

+787
-480
lines changed

‎.ds.baseline‎

Lines changed: 247 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,253 @@
136136
"line_number": 18,
137137
"is_secret": false
138138
}
139+
],
140+
".github/workflows/checks.yml": [
141+
{
142+
"type": "Secret Keyword",
143+
"filename": ".github/workflows/checks.yml",
144+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
145+
"is_verified": false,
146+
"line_number": 28,
147+
"is_secret": false
148+
},
149+
{
150+
"type": "Basic Auth Credentials",
151+
"filename": ".github/workflows/checks.yml",
152+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
153+
"is_verified": false,
154+
"line_number": 45,
155+
"is_secret": false
156+
}
157+
],
158+
".github/workflows/daily_checks.yml": [
159+
{
160+
"type": "Secret Keyword",
161+
"filename": ".github/workflows/daily_checks.yml",
162+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
163+
"is_verified": false,
164+
"line_number": 71,
165+
"is_secret": false
166+
},
167+
{
168+
"type": "Basic Auth Credentials",
169+
"filename": ".github/workflows/daily_checks.yml",
170+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
171+
"is_verified": false,
172+
"line_number": 87,
173+
"is_secret": false
174+
}
175+
],
176+
"app/enums.py": [
177+
{
178+
"type": "Secret Keyword",
179+
"filename": "app/enums.py",
180+
"hashed_secret": "12322e07b94ee3c7cd65a2952ece441538b53eb3",
181+
"is_verified": false,
182+
"line_number": 123,
183+
"is_secret": false
184+
}
185+
],
186+
"app/notifications/receive_notifications.py": [
187+
{
188+
"type": "Base64 High Entropy String",
189+
"filename": "app/notifications/receive_notifications.py",
190+
"hashed_secret": "d70eab08607a4d05faa2d0d6647206599e9abc65",
191+
"is_verified": false,
192+
"line_number": 29,
193+
"is_secret": false
194+
}
195+
],
196+
"deploy-config/sandbox.yml": [
197+
{
198+
"type": "Secret Keyword",
199+
"filename": "deploy-config/sandbox.yml",
200+
"hashed_secret": "113151dd10316fcb0d5507b6215d78e2f3fe9e54",
201+
"is_verified": false,
202+
"line_number": 11,
203+
"is_secret": false
204+
}
205+
],
206+
"sample.env": [
207+
{
208+
"type": "Basic Auth Credentials",
209+
"filename": "sample.env",
210+
"hashed_secret": "5b98cf4c3d794c8af1fcd7991e89cd4e52fb42a4",
211+
"is_verified": false,
212+
"line_number": 16,
213+
"is_secret": false
214+
}
215+
],
216+
"tests/app/clients/test_document_download.py": [
217+
{
218+
"type": "Secret Keyword",
219+
"filename": "tests/app/clients/test_document_download.py",
220+
"hashed_secret": "3acfb2c2b433c0ea7ff107e33df91b18e52f960f",
221+
"is_verified": false,
222+
"line_number": 14,
223+
"is_secret": false
224+
}
225+
],
226+
"tests/app/clients/test_performance_platform.py": [
227+
{
228+
"type": "Base64 High Entropy String",
229+
"filename": "tests/app/clients/test_performance_platform.py",
230+
"hashed_secret": "76bb66c38ac4046bf73cd4a2c35a2b0af94aeb61",
231+
"is_verified": false,
232+
"line_number": 84,
233+
"is_secret": false
234+
}
235+
],
236+
"tests/app/dao/test_services_dao.py": [
237+
{
238+
"type": "Secret Keyword",
239+
"filename": "tests/app/dao/test_services_dao.py",
240+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
241+
"is_verified": false,
242+
"line_number": 289,
243+
"is_secret": false
244+
}
245+
],
246+
"tests/app/dao/test_users_dao.py": [
247+
{
248+
"type": "Secret Keyword",
249+
"filename": "tests/app/dao/test_users_dao.py",
250+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
251+
"is_verified": false,
252+
"line_number": 69,
253+
"is_secret": false
254+
},
255+
{
256+
"type": "Secret Keyword",
257+
"filename": "tests/app/dao/test_users_dao.py",
258+
"hashed_secret": "f2c57870308dc87f432e5912d4de6f8e322721ba",
259+
"is_verified": false,
260+
"line_number": 199,
261+
"is_secret": false
262+
}
263+
],
264+
"tests/app/db.py": [
265+
{
266+
"type": "Secret Keyword",
267+
"filename": "tests/app/db.py",
268+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
269+
"is_verified": false,
270+
"line_number": 90,
271+
"is_secret": false
272+
}
273+
],
274+
"tests/app/notifications/test_receive_notification.py": [
275+
{
276+
"type": "Secret Keyword",
277+
"filename": "tests/app/notifications/test_receive_notification.py",
278+
"hashed_secret": "913a73b565c8e2c8ed94497580f619397709b8b6",
279+
"is_verified": false,
280+
"line_number": 27,
281+
"is_secret": false
282+
},
283+
{
284+
"type": "Base64 High Entropy String",
285+
"filename": "tests/app/notifications/test_receive_notification.py",
286+
"hashed_secret": "d70eab08607a4d05faa2d0d6647206599e9abc65",
287+
"is_verified": false,
288+
"line_number": 57,
289+
"is_secret": false
290+
}
291+
],
292+
"tests/app/notifications/test_validators.py": [
293+
{
294+
"type": "Base64 High Entropy String",
295+
"filename": "tests/app/notifications/test_validators.py",
296+
"hashed_secret": "6c1a8443963d02d13ffe575a71abe19ea731fb66",
297+
"is_verified": false,
298+
"line_number": 672,
299+
"is_secret": false
300+
}
301+
],
302+
"tests/app/service/test_rest.py": [
303+
{
304+
"type": "Secret Keyword",
305+
"filename": "tests/app/service/test_rest.py",
306+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
307+
"is_verified": false,
308+
"line_number": 1285,
309+
"is_secret": false
310+
}
311+
],
312+
"tests/app/test_cloudfoundry_config.py": [
313+
{
314+
"type": "Secret Keyword",
315+
"filename": "tests/app/test_cloudfoundry_config.py",
316+
"hashed_secret": "e5e178db7317356946d13e5d2da037d39ac61c71",
317+
"is_verified": false,
318+
"line_number": 12,
319+
"is_secret": false
320+
},
321+
{
322+
"type": "Basic Auth Credentials",
323+
"filename": "tests/app/test_cloudfoundry_config.py",
324+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
325+
"is_verified": false,
326+
"line_number": 14,
327+
"is_secret": false
328+
},
329+
{
330+
"type": "Secret Keyword",
331+
"filename": "tests/app/test_cloudfoundry_config.py",
332+
"hashed_secret": "cfd48edeb81ba7d48cbddcf1eeede25ba67057e8",
333+
"is_verified": false,
334+
"line_number": 33,
335+
"is_secret": false
336+
}
337+
],
338+
"tests/app/user/test_rest.py": [
339+
{
340+
"type": "Secret Keyword",
341+
"filename": "tests/app/user/test_rest.py",
342+
"hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
343+
"is_verified": false,
344+
"line_number": 110,
345+
"is_secret": false
346+
},
347+
{
348+
"type": "Secret Keyword",
349+
"filename": "tests/app/user/test_rest.py",
350+
"hashed_secret": "0beec7b5ea3f0fdbc95d0dd47f3c5bc275da8a33",
351+
"is_verified": false,
352+
"line_number": 864,
353+
"is_secret": false
354+
}
355+
],
356+
"tests/notifications_utils/clients/antivirus/test_antivirus_client.py": [
357+
{
358+
"type": "Secret Keyword",
359+
"filename": "tests/notifications_utils/clients/antivirus/test_antivirus_client.py",
360+
"hashed_secret": "932b25270abe1301c22c709a19082dff07d469ff",
361+
"is_verified": false,
362+
"line_number": 16,
363+
"is_secret": false
364+
}
365+
],
366+
"tests/notifications_utils/clients/encryption/test_encryption_client.py": [
367+
{
368+
"type": "Secret Keyword",
369+
"filename": "tests/notifications_utils/clients/encryption/test_encryption_client.py",
370+
"hashed_secret": "f1e923a9667de11be6a210849a8651c1bfd81605",
371+
"is_verified": false,
372+
"line_number": 13,
373+
"is_secret": false
374+
}
375+
],
376+
"tests/notifications_utils/clients/zendesk/test_zendesk_client.py": [
377+
{
378+
"type": "Secret Keyword",
379+
"filename": "tests/notifications_utils/clients/zendesk/test_zendesk_client.py",
380+
"hashed_secret": "913a73b565c8e2c8ed94497580f619397709b8b6",
381+
"is_verified": false,
382+
"line_number": 16,
383+
"is_secret": false
384+
}
139385
]
140386
},
141-
"generated_at": "2025-05-12T16:45:34Z"
387+
"generated_at": "2025-06-02T13:22:36Z"
142388
}

‎.github/actions/setup-project/action.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,10 @@ runs:
1515
python-version: "3.12.3"
1616
- name: Install poetry
1717
shell: bash
18-
run: pip install poetry==1.8.5
18+
run: pip install poetry==2.1.3
19+
- name: Install poetry export
20+
shell: bash
21+
run: poetry self add poetry-plugin-export
1922
- name: Downgrade virtualenv to compatible version
2023
shell: bash
2124
run: pip install "virtualenv<20.30"

‎.github/workflows/checks.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,12 +87,20 @@ jobs:
8787
- uses: actions/checkout@v4
8888
- uses: ./.github/actions/setup-project
8989
- name: Create requirements.txt
90-
run: poetry export --without-hashes --format=requirements.txt > requirements.txt
91-
- uses: pypa/gh-action-pip-audit@v1.0.8
90+
run: poetry export --output requirements_tmp.txt --without-hashes
91+
- name: Filter requirements.txt
92+
run: grep -v "oscrypto@ git" requirements_tmp.txt > requirements.txt
93+
- name: Verify requirements.txt
94+
run: ls -l requirements.txt
95+
- name: Print requirements.txt
96+
run: |
97+
echo "Contents of requirements.txt:"
98+
cat requirements.txt
99+
- uses: pypa/gh-action-pip-audit@v1.1.0
92100
with:
93101
inputs: requirements.txt
94102
ignore-vulns: |
95-
PYSEC-2022-43162
103+
PYSEC-2023-312
96104
97105
static-scan:
98106
runs-on: ubuntu-latest

‎.github/workflows/daily_checks.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,20 @@ jobs:
2626
- uses: actions/checkout@v4
2727
- uses: ./.github/actions/setup-project
2828
- name: Create requirements.txt
29-
run: poetry export --without-hashes --format=requirements.txt > requirements.txt
29+
run: poetry export --output requirements_tmp.txt --without-hashes
30+
- name: Filter requirements.txt
31+
run: grep -v "oscrypto@ git" requirements_tmp.txt > requirements.txt
32+
- name: Verify requirements.txt
33+
run: ls -l requirements.txt
34+
- name: Print requirements.txt
35+
run: |
36+
echo "Contents of requirements.txt:"
37+
cat requirements.txt
3038
- uses: pypa/gh-action-pip-audit@v1.1.0
3139
with:
3240
inputs: requirements.txt
41+
ignore-vulns: |
42+
PYSEC-2023-312
3343
- name: Upload pip-audit artifact
3444
uses: actions/upload-artifact@v4
3545
with:

‎.github/workflows/deploy-demo.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
run: make bootstrap
4545

4646
- name: Create requirements.txt
47-
run: poetry export --without-hashes --format=requirements.txt > requirements.txt
47+
run: poetry export --output requirements.txt
4848

4949
- name: Deploy to cloud.gov
5050
uses: cloud-gov/cg-cli-tools@main

‎.github/workflows/deploy-prod.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848
run: make bootstrap
4949

5050
- name: Create requirements.txt
51-
run: poetry export --without-hashes --format=requirements.txt > requirements.txt
51+
run: poetry export --output requirements.txt
5252

5353
- name: Deploy to cloud.gov
5454
uses: cloud-gov/cg-cli-tools@main

‎.github/workflows/deploy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
run: make bootstrap
5151

5252
- name: Create requirements.txt
53-
run: poetry export --without-hashes --format=requirements.txt > requirements.txt
53+
run: poetry export --output requirements.txt
5454

5555
- name: Deploy to cloud.gov
5656
uses: cloud-gov/cg-cli-tools@main

‎Makefile‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,7 @@ GIT_HOOKS_PATH ?= $(shell git config --global core.hooksPath || echo "")
1616
.PHONY: bootstrap
1717
bootstrap: ## Set up everything to run the app
1818
make generate-version-file
19-
poetry lock --no-update
20-
poetry install --sync --no-root
19+
poetry sync --no-root
2120
poetry run pre-commit install
2221
createdb notification_api || true
2322
createdb test_notification_api || true
@@ -26,8 +25,7 @@ bootstrap: ## Set up everything to run the app
2625
.PHONY: bootstrap-with-git-hooks
2726
bootstrap-with-git-hooks: ## Sets everything up and accounts for pre-existing git hooks
2827
make generate-version-file
29-
poetry lock --no-update
30-
poetry install --sync --no-root
28+
poetry sync --no-root
3129
git config --global --unset-all core.hooksPath
3230
poetry run pre-commit install
3331
git config --global core.hookspath "${GIT_HOOKS_PATH}"
@@ -112,19 +110,19 @@ test: ## Run tests and create coverage report
112110

113111
.PHONY: py-lock
114112
py-lock: ## Syncs dependencies and updates lock file without performing recursive internal updates
115-
poetry lock --no-update
116-
poetry install --sync
113+
poetry sync --no-root
114+
poetry lock
117115

118116
.PHONY: freeze-requirements
119117
freeze-requirements: ## Pin all requirements including sub dependencies into requirements.txt
120-
poetry export --without-hashes --format=requirements.txt > requirements.txt
118+
poetry export --output > requirements.txt
121119

122120
.PHONY: audit
123121
audit:
124122
poetry requirements > requirements.txt
125123
poetry requirements --dev > requirements_for_test.txt
126-
poetry run pip-audit -r requirements.txt
127-
poetry run pip-audit -r requirements_for_test.txt
124+
poetry run pip-audit -r requirements.txt --skip-editable
125+
poetry run pip-audit -r requirements_for_test.txt --skip-editable
128126

129127
.PHONY: static-scan
130128
static-scan:

0 commit comments

Comments
 (0)