Brandon/bb2 4669 selenium redo (#1638)

bwang-icf · clewellyn-nava · ryan-morosa · web-flow · commit 114a0ca0477e · 2026-07-09T08:05:28.000-05:00
* initial commit * add more boiler code * initial attempt at running api in codebuild runner * renive okd byukd oridyctuib cide * re-enable workflow dispatch * typo in compose * fix dockerfile * final initial changset 400 * fix path * 3rd time is the charm * path change again * fixed part 1003231 * fixing paths * use make for codebuild instance * I don't understand file paths * using the power of root paths * what if there were even more path changes * fix path * fix some more stuff * more path fixes * minor spelling mistake * one day..... * more path fixes * more changes * cooking with gas * maybe last changes but probably not * remove debugpy * cleaning some stuff up * remove return exit code * check db path * remove readonly from codebuild * attempt number 5000 * added integration tests and teardown * paths!!! * paths part 2 * almost there * still file paths * I hate you file paths * more path shenanigans * tests run but they error out now * unnecessary makefile changes * makefile beautification (also fix relative paths for docker) * make migrate simpler (scope creep) * cleanup env, make some make changes, migrate and collectstatic work * change mslsx for better teardown * podman support (does the database need a persistence volume?) * persist database locally * this worked before and now it doesn't * test certificate issue * tabs * not sure what changed here * change podman tmpfs which doesnt work in docker * cleaning up files * change makefile targets * lower tmp size in codebuild * check memory in action * not anything * add explicit env file * up memory limit on tmp * add container env to codebuild instance, remove from integration test * remove unused envvars * MAYBE? * ruff failure * Fail unit tests * change unit tests back * ruff failure * fail unit test * Fix unit tests * BB2-4183: Dynamic v3 Permissions Screen (#1531) * BB2-4183: Dynamic permissions screen for v3 * Add unit testing * Raise a no scopes provided error if there are no scopes in the DB for an app, or if the scopes passed in the scope param has no overlap with an app's scopes in DB * Ensure v3 only shows scopes that are both requested/in the DB * Add another unit test * Added bene name, some styling * Add svg icon, modify some styling, add unit tests * Finish up styling and make sure Rubik font shows correctly * New tab for privacy policy/ToS links and add icon for those as well * Modify format_patient_name, add profile to list of scopes that shows patient info on v3 permissions screen * BB2-4676: SAMHSA filtering v3 EOB calls (#1595) * Add param support for EOB call * BB2-4676: Add SAMHSA filtering for v3 EOB calls based on include_samhsa value * Add back ioncorrectly removed tag and override_switch on integration test * Use httpstatus.ok instead of 200 and remove commented out line * Address PR feedback * anna/bb2 4818 display app contact in permissions screen (#1606) Displays an application's contact email in the v3 permissions screen. * add application support email to v3 permissions screen * add changes to authorize_v3_coverage_only.html * match wording in figma files * fix template formatting * update contributors information (#1608) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Make apt get install Debian:13 lcms2 to version 2.16-2+deb13u2 (#1610) * Bump the pip group across 1 directory with 2 updates (#1601) * Bump the pip group across 1 directory with 2 updates Bumps the pip group with 2 updates in the /requirements directory: [idna](https://github.com/kjd/idna) and [urllib3](https://github.com/urllib3/urllib3). Updates `idna` from 3.7 to 3.15 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.7...v3.15) Updates `urllib3` from 2.6.3 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.6.3...2.7.0) --- updated-dependencies: - dependency-name: idna dependency-version: '3.15' dependency-type: direct:production - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Add back our via value --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Demery <jamesdemery@navapbc.com> * (NFC) Update synthetic beneficiary test password (#1609) * Fix integration test (#1600) * ryan-morosa/bb2-4860-respect-app-settings-follow-up (#1603) * Fix the search vs.read functionality * Work on more testing * Get unit tests to work for FHIRResourcesReadSearchTest * BB2-4183: Dynamic v3 Permissions Screen (#1531) * BB2-4183: Dynamic permissions screen for v3 * Add unit testing * Raise a no scopes provided error if there are no scopes in the DB for an app, or if the scopes passed in the scope param has no overlap with an app's scopes in DB * Ensure v3 only shows scopes that are both requested/in the DB * Add another unit test * Added bene name, some styling * Add svg icon, modify some styling, add unit tests * Finish up styling and make sure Rubik font shows correctly * New tab for privacy policy/ToS links and add icon for those as well * Modify format_patient_name, add profile to list of scopes that shows patient info on v3 permissions screen * BB2-4676: SAMHSA filtering v3 EOB calls (#1595) * Add param support for EOB call * BB2-4676: Add SAMHSA filtering for v3 EOB calls based on include_samhsa value * Add back ioncorrectly removed tag and override_switch on integration test * Use httpstatus.ok instead of 200 and remove commented out line * Address PR feedback * Fix some more integration tests * Get more integration tests to pass * Get all tests passing * Do some cleanup * Cleanup database setup commands * Remove from audit logger * Final cleanup * Cleanup some of the app scope permission code * Add app scope permission class to insurance card view * Add bundle for dic endpoint * Get insurance card endpoint to work with app scope permissions too * Update logic in read/search section of app scope permissions * Get rid of is_not_empty and rename dictionary lookup --------- Co-authored-by: James Demery <jamesdemery@navapbc.com> * BB2-4817 run scheduled django commands on GitHub Actions (#1604) Run scheduled Django management commands on GitHub actions. * add workflow_call to run-manage-command.yml and add scheduled commands workflow * add name for workflow * fix syntax * fix syntax (2) * fix syntax (3) * fix syntax (4) * update input description * add fail-fast: false and inherit secrets --------- Co-authored-by: James Demery <jamesdemery@navapbc.com> * update contributors information (#1612) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Noor1027/bb2 4604 prod fargate release clean (#1611) * BB2-4604: add prod SOPS config and fix ACM cert lookup for prod environment Set ACM domain to api.bluebutton.cms.gov in 20-microservices platform module since the default domain pattern does not match the prod cert. Add encrypted SOPS config for the prod environment. * updated SOPS and softlink * skip environment protection for workflow_call * fix environment protection bypass using skip_protection input * Rename test job to unit-test in workflow (#1613) Co-authored-by: ryan-morosa <Ryan.Morosa@icf.com> * BB2-4781: Revoke prior tokens on new auth flow (#1605) * BB2-4781: Revoke prior tokens on new auth flow * Ensure token revocation only happens on v3 auth flows * Move the revocation of prior tokens to form_valid of AuthorizationView from post of TokenView. Revoke all previous tokens as the newest one will not have been created yet at that point * Address PR feedback, remove no longer needed test * Address feedback - use previously existing utils function * Fix typo * Add unit test coverage * Delete unit test yaml file * Try to run sequentially * Add some debugging steps * change some of the commands * Get rid of inspection * Get back to normal * added validation around code_challenge_method to reject non S256 values (#1599) * added validation around code_challenge_method to reject non S256 values * intermediate commit * Fix authorize POST param handling in code_challenge_method validation Agent-Logs-Url: https://github.com/CMSgov/bluebutton-web-server/sessions/ec2649c7-d427-4f59-ad18-098613b75e4e Co-authored-by: bwang-icf <178809349+bwang-icf@users.noreply.github.com> * Remove stale commented lines in authorization GET handler Agent-Logs-Url: https://github.com/CMSgov/bluebutton-web-server/sessions/ec2649c7-d427-4f59-ad18-098613b75e4e Co-authored-by: bwang-icf <178809349+bwang-icf@users.noreply.github.com> * cleanup of previous pkce setup * removing unnecessary error handling * adding updated tests with pkce params as part of enforcing pkce params on auth * adding extra tests for pkce param verification before login * removing unnecessary change for this pr * reverting code_challenge_method back to post_auth * removing invalid code challenge method printing --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: bwang-icf <178809349+bwang-icf@users.noreply.github.com> Co-authored-by: annamontare-nava <267455234+annamontare-nava@users.noreply.github.com> * Noor1027/bb2 4816 release notes missing last commit (#1616) * Bug fix publish-release.yml always drops the oldest commit from release notes * temp change to run GHA * Revert "temp change to run GHA" This reverts commit dae8864. * BB2-4675: Add SAMHSA checkbox to v3 permissions screen (#1607) * BB2-4675: Add SAMHSA checkbox to v3 permissions screen * Use cache.add instead of cache.set, modify default for code * Address PR feedback - add docstrings * Add a new table to track user SAMHSA preferences rather than use caching * Address PR feedback * Remove commented out line * Address copilot feedback * Convert share_samhsa_data to a BooleanField to make the code less confusing * Revert "BB2-4675: Add SAMHSA checkbox to v3 permissions screen (#1607)" (#1619) This reverts commit e1b0b7b. * BB2-4890 - Add Fargate pre-deploy migrations safety gate * Revert "BB2-4890 - Add Fargate pre-deploy migrations safety gate" This reverts commit ffc450b. * update sops values (#1617) Co-authored-by: James Demery <jamesdemery@navapbc.com> * BB2-4851: Update lodash (#1621) * BB2-4851: Update lodash * Fix new vulnerability that popped up * BB2-4845: Update libgnutls (#1618) * BB2-4845: Update libgnutls * Update bb-css Dockerfile * Update gnutls in mslsx Dockerfile * Revert file mode change * docs(contributor): contributors readme action update (#1624) * update contributors information * Trigger unit tests --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: James Demery <jamesdemery@navapbc.com> * BB2-4574: Run unit and integration tests with pytest (#1614) * BB2-4574: Install pytest-django and add .ini file * Add conftest.py file, skip one test file, add a fixture * Add pytest.mark.integration, update ini file * Ensure all unit and integration tests pass with pytest, update some docs * removed unneeded code from conftest.py * Update unit test command for GHA * Remove commented out code * Address most PR feedback - still have documentation updates to make * Update documentation to reflect latest * Add strict-markers to toml file * B2-4890 Add pre/post-deploy migration support to Fargate deploy workflow (#1623) * masking hostname and removed gates * Update run-manage-command.yml * updated task def * removed multiple env for confirm apporvals * Updated Gate Approval for Post deploy * Fix New Relic reporting 401, 403, and 405 errors in Fargate * Fix New Relic ignoring status codes by dynamically creating config file on startup --------- Co-authored-by: jimmyfagan <90421499+jimmyfagan@users.noreply.github.com> * upgrading with npm --legacy-peer-deps (#1626) * Change workflow to run on push to any branch * Try just one test * Update docker compose codebuild to have no volumes * Roll back to run all integration tests * change it to run integration tests with pytest * Add aws credentials setup * testing certs * catch OOM traceback * Update Makefile * masking for test * test with codebuild VPC updates * Target impl for integration tests * adding health to chek certs are exisit * See if integration tag is working properly * Change the github action to use pytest instead of the old way * Separate out ruff and unit test jobs * Change back to regular integration testing bfd test * Only collect the ones that are deselected to compare * Put the collected tests into a file * Upload collected tests as an artifact to compare locally * Show integration and deslected that weren't integration * try to get deselected test summary in gha * BB2-4675: v3 Permissions Screen SAMHSA Checkbox (#1620) * BB2-4675: Add SAMHSA checkbox to v3 permissions screen * Use cache.add instead of cache.set, modify default for code * Address PR feedback - add docstrings * Add a new table to track user SAMHSA preferences rather than use caching * Address PR feedback * Remove commented out line * Address copilot feedback * Convert share_samhsa_data to a BooleanField to make the code less confusing * Small changes to get it back to the way it was * Delete unit tests yml since it is absorbed by pr checks now * Ensure runnign with bfd sbx locally still works * Help consolidate some of the make file selenium building and running locally * Comment changes * Make test names plural * Ensure we use make integration-test in make file * Change it back to pytest command * attempting selenium tests from exisiting folder * adding trigger to run on push for testing purposes * trying to add AWS creds to see if that allows selenium to work right * fixing external network issue * adding changes from master * explicitly adding localhost * adding wait for chrome * adding build css * changing to install * adding test for medicare.gov connectivity * changing to less specific css click * trying to remove possible duplicate click * committing for now * adding iproute2 * changing update location * adding bind-utils and pull_policy * attempting to run within codebuild * removing needs requirement * adding true to medicare login button * Merge and add Akamai diagnostic step * Merge and add Akamai diagnostic step * MSLSX auth mock for Selenium CI tests * removing requirement on push * removing curl command to akamai * cleanup * making readme updates and removing integration test dependency for now * attempting to fix local running issues --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: clewellyn-nava <connorlewellyn@navapbc.com> Co-authored-by: Ryan Morosa <Ryan.Morosa@icf.com> Co-authored-by: James Demery <jamesdemery@navapbc.com> Co-authored-by: annamontare-nava <267455234+annamontare-nava@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: jimmyfagan <90421499+jimmyfagan@users.noreply.github.com> Co-authored-by: noor1027 <noorulla@gmail.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: bwang-icf <178809349+bwang-icf@users.noreply.github.com>
diff --git a/.github/workflows/pull-request-checks.yml b/.github/workflows/pull-request-checks.yml
@@ -3,9 +3,6 @@ name: Pull Request Checks
 on:
   pull_request:
     branches: [master]
-    paths-ignore:
-      - 'docs/**'
-      - '*.md'
   workflow_dispatch:
 
 jobs:
@@ -92,3 +89,58 @@ jobs:
         run: |
           cd ./ops/containers/bb-api
           make teardown-codebuild
+
+  selenium-tests:
+    env:
+      AWS_REGION: us-east-1
+
+    permissions:
+      id-token: write
+      contents: read
+
+    # This will only run on test
+    runs-on: codebuild-bb-test-web-server-${{ github.run_id }}-${{ github.run_attempt }}
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Setup AWS credentials
+        uses: ./.github/actions/setup-tofu
+        with:
+          environment: test
+          non-prod-account: ${{ secrets.NON_PROD_ACCOUNT }}
+          prod-account: ${{ secrets.PROD_ACCOUNT }}
+          test-role-id: ${{ secrets.TEST_AWS_ROLE_ID_MASK }}
+          prod-role-id: ${{ secrets.PROD_AWS_ROLE_ID_MASK }}
+
+      - name: Build MSLSX
+        run: |
+          cd ./ops/containers/mslsx
+          make build-local
+
+      - name: Build BBAPI
+        run: |
+          cd ./ops/containers/bb-api
+          make build-codebuild
+
+      - name: Build Selenium
+        run: |
+          cd ./ops/containers/bb-api
+          make build-selenium
+
+      - name: Start Stack
+        run: |
+          cd ./ops/containers/bb-api
+          make run-codebuild-mock
+
+      - name: Execute Selenium Tests
+        run: |
+          cd ./ops/containers/bb-api
+          make run-codebuild-selenium
+
+      - name: Teardown Stack
+        if: always()
+        run: |
+          cd ./ops/containers/bb-api
+          make teardown-codebuild-selenium
diff --git a/Dockerfile b/Dockerfile
@@ -1,7 +1,7 @@
 FROM --platform=linux/amd64 python:3.12
 ENV PYTHONUNBUFFERED 1
 ENV PYDEVD_DISABLE_FILE_VALIDATION 1
-RUN apt-get update && apt-get install -y gettext liblcms2-2=2.16-2+deb13u2 libgnutls30t64=3.8.9-3+deb13u4
+RUN apt-get update && apt-get install -y gettext liblcms2-2=2.16-2+deb13u2 libgnutls30t64=3.8.9-3+deb13u4 libssh2-1t64=1.11.1-1+deb13u1 
 RUN useradd -m -s /bin/bash DEV
 USER DEV
 ADD . /code
diff --git a/apps/dot_ext/utils.py b/apps/dot_ext/utils.py
@@ -47,7 +47,7 @@ def validate_client_id(client_id: str) -> None:
         InvalidClientError: If the client_id does not match the expected pattern.
     """
     env = os.environ.get('TARGET_ENV', 'local')
-    if env == 'local':
+    if env in ('local', 'codebuild'):
         return
     if not CLIENT_ID_PATTERN.fullmatch(client_id):
         raise InvalidClientError(
diff --git a/ops/containers/bb-api/Dockerfile b/ops/containers/bb-api/Dockerfile
@@ -35,6 +35,7 @@ RUN dnf install -y \
     awscli \
     procps-ng \
     python3.12 \
+    bind-utils \
     shadow-utils && dnf clean all && rm -rf /var/cache/dnf
 
 #################################################################
diff --git a/ops/containers/bb-api/Makefile b/ops/containers/bb-api/Makefile
@@ -5,8 +5,9 @@ bfd         ?= test
 env         ?= local
 auth        ?= live
 
-.PHONY: build-local build-local-no-cache build-codebuild run-codebuild \
-        run-codebuild-integration teardown-codebuild run-local
+.PHONY: build-local build-local-no-cache build-codebuild build-selenium \
+        run-codebuild run-codebuild-mock run-codebuild-integration run-codebuild-selenium \
+        teardown-codebuild teardown-codebuild-selenium run-local
 
 build-local:
 	@echo "Building local"
@@ -29,11 +30,19 @@ build-codebuild:
 		--build-arg BUILD_TARGET="codebuild" \
 		-t bb-api:codebuild -f Dockerfile ../../..
 
+build-selenium:
+	$(MAKE) -C ../selenium build-selenium
+
 run-codebuild:
 	@echo "Running codebuild environment"
 	bfd="test" env="test" auth="live" TARGET_ENV="codebuild" \
 	bash $(ROOT_DIR)/scripts/external/prepare-environment.bash
 
+run-codebuild-mock:
+	@echo "Running codebuild environment with auth=mock"
+	bfd="test" env="test" auth="mock" TARGET_ENV="codebuild" \
+	bash $(ROOT_DIR)/scripts/external/prepare-environment.bash
+
 run-codebuild-integration:
 	@echo "integration tests in Codebuild"
 	docker compose \
@@ -43,6 +52,16 @@ run-codebuild-integration:
 teardown-codebuild:
 	docker compose -f ../docker-compose-codebuild.yaml down -v
 
+run-codebuild-selenium:
+	@echo "selenium tests in Codebuild"
+	docker compose \
+		-f ../docker-compose-codebuild-selenium.yaml \
+		run --rm selenium-tests
+
+teardown-codebuild-selenium:
+	docker compose -f ../docker-compose-codebuild-selenium.yaml down -v || true
+	docker compose -f ../docker-compose-codebuild.yaml down -v
+
 run-local:
 	bfd="$(bfd)" env="$(env)" auth="$(auth)" TARGET_ENV="local" \
 	bash $(ROOT_DIR)/scripts/external/prepare-environment.bash
diff --git a/ops/containers/bb-api/scripts/external/prepare-environment-support.bash b/ops/containers/bb-api/scripts/external/prepare-environment-support.bash
@@ -248,10 +248,17 @@ configure_slsx () {
         export DJANGO_USER_ID_ITERATIONS="2"
         DJANGO_MEDICARE_SLSX_REDIRECT_URI="http://localhost:8000/mymedicare/sls-callback"
         DJANGO_MEDICARE_SLSX_LOGIN_URI="http://localhost:8080/sso/authorize?client_id=bb2api"
-        DJANGO_SLSX_HEALTH_CHECK_ENDPOINT="http://msls:8080/health"
-        DJANGO_SLSX_TOKEN_ENDPOINT="http://msls:8080/sso/session"
-        DJANGO_SLSX_SIGNOUT_ENDPOINT="http://msls:8080/sso/signout"
-        DJANGO_SLSX_USERINFO_ENDPOINT="http://msls:8080/v1/users"
+
+        if [[ "${TARGET_ENV}" == "codebuild" ]]; then
+            MSLSX_HOST="localhost"
+        else
+            MSLSX_HOST="mslsx"
+        fi
+
+        DJANGO_SLSX_HEALTH_CHECK_ENDPOINT="http://${MSLSX_HOST}:8080/health"
+        DJANGO_SLSX_TOKEN_ENDPOINT="http://${MSLSX_HOST}:8080/sso/session"
+        DJANGO_SLSX_SIGNOUT_ENDPOINT="http://${MSLSX_HOST}:8080/sso/signout"
+        DJANGO_SLSX_USERINFO_ENDPOINT="http://${MSLSX_HOST}:8080/v1/users"
         
         DJANGO_SLSX_CLIENT_ID=bb2api
         DJANGO_SLSX_CLIENT_SECRET="xxxxx"
diff --git a/ops/containers/docker-compose-codebuild-selenium.yaml b/ops/containers/docker-compose-codebuild-selenium.yaml
@@ -0,0 +1,37 @@
+services:
+  ####################
+  # Selenium Tests - Codebuild
+  selenium-tests:
+    image: selenium-local:latest
+    command: /code/ops/containers/selenium/start-selenium-codebuild.sh
+    network_mode: "host"
+    depends_on:
+      chrome:
+        condition: service_healthy
+    environment:
+      - HOSTNAME_URL=http://localhost:8000
+      - USE_MSLSX=true
+      - USE_LOGIN_WITH_MEDICARE_BUTTON=true
+      - USE_NEW_PERM_SCREEN=true
+      - DJANGO_SETTINGS_MODULE=hhs_oauth_server.settings.test
+      - SELENIUM_GRID=true
+      - SELENIUM_GRID_HOST=localhost
+      - DEBUG_MODE=false
+      - TARGET_ENV=codebuild
+      - PYTEST_SHOW_TRACE_OPT=
+    volumes:
+      - type: bind
+        source: ../..
+        target: /code
+  ####################
+  # Chrome for Selenium Remote
+  chrome:
+    image: selenium/standalone-chromium
+    hostname: chrome
+    network_mode: "host"
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:4444/wd/hub/status || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+      start_period: 10s
diff --git a/ops/containers/docker-compose-codebuild.yaml b/ops/containers/docker-compose-codebuild.yaml
@@ -3,6 +3,7 @@ services:
   # Blue Button - Codebuild
   bb-api:
     image: bb-api:codebuild
+    pull_policy: never
     network_mode: "host"
     env_file: ./bb-api/files/external/.env.codebuild
     healthcheck:
@@ -11,3 +12,11 @@ services:
       timeout: 2s
       retries: 30
       start_period: 90s
+
+  ####################
+  # Local MSLS server for Selenium Auth Mock
+  mslsx:
+    image: mslsx:latest
+    pull_policy: never
+    network_mode: "host"
+    command: scripts/internal/entrypoint.bash
diff --git a/ops/containers/selenium/Dockerfile.selenium b/ops/containers/selenium/Dockerfile.selenium
@@ -2,7 +2,7 @@ FROM selenium/standalone-chromium
 
 USER root
 
-RUN apt-get update ; apt-get install -yq python3 python3-venv socat
+RUN apt-get update ; apt-get install -yq python3 python3-venv socat iproute2
 RUN ln -s /usr/bin/python3 /usr/local/bin/python
 
 # switch to existing seluser from selenium docker
diff --git a/ops/containers/selenium/README.md b/ops/containers/selenium/README.md
@@ -7,10 +7,14 @@ This document describes the selenium test harness for Blue Button
 ## Overview
 
 - Selenium tests are run inside a Docker image (`selenium-local:latest`) defined in `ops/containers/selenium/Dockerfile.selenium`.
-- The compose file `ops/containers/selenium/docker-compose-selenium.yaml` starts two services:
+- Locally, the compose file `ops/containers/selenium/docker-compose-selenium.yaml` starts two services:
   - `selenium-tests` — Django app / Selenium instance / do-it-all
   - `chrome` — a standalone Chrome instance for hitting local and remote
-- Tests are invoked via the helper Makefile in `ops/containers`
+- In CI (CodeBuild), the compose file `ops/containers/docker-compose-codebuild-selenium.yaml` starts:
+  - `selenium-tests` — runs the pytest Selenium suite
+  - `chrome` — standalone Chrome
+  - `mslsx` — the mock SLS (Medicare login) service used in place of live SLSx
+- Tests are invoked via the helper Makefiles in `ops/containers/bb-api` (CI) and `ops/containers/selenium` (local).
 
 ---
 
@@ -63,3 +67,51 @@ All of these can be run from root.
   make run-selenium-local auth=live debug=true
 
 ---
+
+## CI / Pull Request Checks
+
+The `selenium-tests` job in `.github/workflows/pull-request-checks.yml` runs the
+Selenium suite inside the CodeBuild runner on every pull request against `master`
+(and on new commits pushed to a PR branch). It uses the **mock SLS** (`mslsx`)
+service rather than the live SLSx endpoints.
+
+All commands are driven through the helper targets in
+`ops/containers/bb-api/Makefile`. The job runs them in this order:
+
+1. **Build MSLSX** — `cd ops/containers/mslsx && make build-local`
+   Builds the `mslsx:latest` mock Medicare login image.
+
+2. **Build BBAPI** — `cd ops/containers/bb-api && make build-codebuild`
+   Builds the `bb-api:codebuild` application image.
+
+3. **Build Selenium** — `cd ops/containers/bb-api && make build-selenium`
+   Delegates to `ops/containers/selenium` to build `selenium-local:latest`.
+
+4. **Start Stack** — `cd ops/containers/bb-api && make run-codebuild-mock`
+   Brings up the CodeBuild stack with `auth=mock`, so `bb-api` points at the
+   `mslsx` endpoints instead of live SLSx.
+
+5. **Execute Selenium Tests** — `cd ops/containers/bb-api && make run-codebuild-selenium`
+   Runs the `selenium-tests` service from
+   `ops/containers/docker-compose-codebuild-selenium.yaml`, which also starts the
+   `mslsx` and `chrome` services.
+
+6. **Teardown Stack** — `cd ops/containers/bb-api && make teardown-codebuild-selenium`
+   Tears down both the selenium and codebuild compose stacks (runs with
+   `if: always()`).
+
+### Mock SLS networking
+
+In CodeBuild, all compose services use `network_mode: "host"`, so there is no
+Docker DNS. Containers reach each other over `localhost`:
+
+- `mslsx` listens on `localhost:8080`
+- `bb-api` listens on `localhost:8000`
+
+`configure_slsx` in
+`ops/containers/bb-api/scripts/external/prepare-environment-support.bash` uses
+`localhost` for the `mslsx` endpoints when `TARGET_ENV=codebuild`, and the Docker
+DNS name `mslsx` when running locally.
+
+---
+
diff --git a/ops/containers/selenium/docker-compose-selenium.yaml b/ops/containers/selenium/docker-compose-selenium.yaml
@@ -7,22 +7,20 @@ services:
     ports:
       - "8910:8910"
       - "7890:7890"
+      - "4444:4444"
+      - "5901:5901"
     extra_hosts:
       - "host.docker.internal:host-gateway"
     env_file:
       - .env.selenium
     volumes:
       - ../../..:/code
-    depends_on:
-      chrome:
-        condition: service_started
   ####################
-  # Chrome for Selenium Remote
+  # Chrome for Selenium Remote — shares selenium-tests' network namespace so
+  # socat in selenium-tests proxies localhost:8000/8080 for Chrome as well.
   chrome:
     image: selenium/standalone-chromium
-    hostname: chrome
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    ports:
-      - "4444:4444"
-      - "5901:5901"
+    network_mode: "service:selenium-tests"
+    depends_on:
+      selenium-tests:
+        condition: service_started
diff --git a/ops/containers/selenium/run-selenium-local.sh b/ops/containers/selenium/run-selenium-local.sh
@@ -45,7 +45,9 @@ echo_msg 'Blue Button is running. Starting selenium tests...'
 
 docker compose -f docker-compose-selenium.yaml down --remove-orphans || true
 
-docker compose -f docker-compose-selenium.yaml run --rm --service-ports selenium-tests
+# Use 'up' so that chrome (which shares selenium-tests' network namespace) starts
+# alongside selenium-tests. --exit-code-from captures pytest's exit code.
+docker compose -f docker-compose-selenium.yaml up --exit-code-from selenium-tests
 EXIT_CODE=$?
 
 docker compose -f docker-compose-selenium.yaml down
diff --git a/ops/containers/selenium/start-selenium-codebuild.sh b/ops/containers/selenium/start-selenium-codebuild.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# This script runs inside the selenium docker container for codebuild environments.
+# Unlike the local version, it does NOT use socat relays since containers communicate
+# directly via docker networking.
+
+source /code/ops/containers/selenium/utility-functions.bash
+
+echo_msg ""
+echo_msg "DJANGO_SETTINGS_MODULE: " ${DJANGO_SETTINGS_MODULE}
+echo_msg "TARGET ENV: " ${TARGET_ENV}
+echo_msg "HOSTNAME_URL: " ${HOSTNAME_URL}
+echo_msg "SELENIUM GRID: " ${SELENIUM_GRID}
+echo_msg "USE MSLSX: " ${USE_MSLSX}
+echo_msg "DEBUG: " ${DEBUG_MODE}
+echo_msg "PERMISSION SCREEN: " ${USE_NEW_PERM_SCREEN}
+echo_msg
+
+set_slsx () {
+		export DJANGO_MEDICARE_SLSX_LOGIN_URI="https://test.medicare.gov/sso/authorize?client_id=bb2api"
+		export DJANGO_SLSX_HEALTH_CHECK_ENDPOINT="https://test.accounts.cms.gov/health"
+		export DJANGO_SLSX_TOKEN_ENDPOINT="https://test.medicare.gov/sso/session"
+		export DJANGO_SLSX_SIGNOUT_ENDPOINT="https://test.medicare.gov/sso/signout"
+		export DJANGO_SLSX_USERINFO_ENDPOINT="https://test.accounts.cms.gov/v1/users"
+}
+
+if [ "$USE_MSLSX" = true ]; then
+    # In codebuild, MSLSX would need to be available on the network
+    export DJANGO_MEDICARE_SLSX_LOGIN_URI="http://mslsx:8080/sso/authorize?client_id=bb2api"
+    export DJANGO_SLSX_HEALTH_CHECK_ENDPOINT="http://mslsx:8080/health"
+    export DJANGO_SLSX_TOKEN_ENDPOINT="http://mslsx:8080/sso/session"
+    export DJANGO_SLSX_SIGNOUT_ENDPOINT="http://mslsx:8080/sso/signout"
+    export DJANGO_SLSX_USERINFO_ENDPOINT="http://mslsx:8080/v1/users"
+else
+    set_slsx
+fi
+
+DEBUG_CMD=""
+if [ "$DEBUG_MODE" = true ]; then
+    DEBUG_CMD="python3 -m debugpy --listen 0.0.0.0:7890 --wait-for-client -m "
+    echo_msg "DEBUG MODE ENABLED - Debugger waiting on 0.0.0.0:7890"
+fi
+
+${DEBUG_CMD}pytest -s --tb=line ./apps/integration_tests/selenium_tests.py ./apps/integration_tests/selenium_spanish_tests.py ${PYTEST_SHOW_TRACE_OPT}
diff --git a/ops/containers/selenium/start-selenium.sh b/ops/containers/selenium/start-selenium.sh
