Develop (#171)

rcbjBlueMars · web-flow · commit 7152372bdc53 · 2026-07-14T21:27:32.000-07:00
* Synching develop branch with master. (#161) * Feature/157 (#158) * Initial creation of terraform setup for AWS static-content site hosting. * Website deployment run locally works. Terraform AWS resource build run locally works. * Creating test self-hosted environment. Alwways run terraform in docker containers. * Removing all run on PR creation / modification. * Making redirect_uri and logout URL field defaults parameterized. * OIDC Authorization Code Flow with local keycoak is now working for test and prod hosted static-content site. * Updating Token History grouping. * Test suite works against test and prod sites with a local keycloak instance. The introspection endpoint in keycloak cannot be invoked from the browser. So, the static content site cannot call the keycloak instrospection site. The test suite looks for hte expected CORS error. Test suite must be run against a local build for full validation. * Feature/158 (#160) * Initial creation of terraform setup for AWS static-content site hosting. * Website deployment run locally works. Terraform AWS resource build run locally works. * Creating test self-hosted environment. Alwways run terraform in docker containers. * Removing all run on PR creation / modification. * Making redirect_uri and logout URL field defaults parameterized. * OIDC Authorization Code Flow with local keycoak is now working for test and prod hosted static-content site. * Updating Token History grouping. * Test suite works against test and prod sites with a local keycloak instance. The introspection endpoint in keycloak cannot be invoked from the browser. So, the static content site cannot call the keycloak instrospection site. The test suite looks for hte expected CORS error. Test suite must be run against a local build for full validation. * Minimize javascript for static content sites. Google analytics for static content sites. * feature/152 (#163) * Feature/157 (#158) * Initial creation of terraform setup for AWS static-content site hosting. * Website deployment run locally works. Terraform AWS resource build run locally works. * Creating test self-hosted environment. Alwways run terraform in docker containers. * Removing all run on PR creation / modification. * Making redirect_uri and logout URL field defaults parameterized. * OIDC Authorization Code Flow with local keycoak is now working for test and prod hosted static-content site. * Updating Token History grouping. * Test suite works against test and prod sites with a local keycloak instance. The introspection endpoint in keycloak cannot be invoked from the browser. So, the static content site cannot call the keycloak instrospection site. The test suite looks for hte expected CORS error. Test suite must be run against a local build for full validation. * Feature/158 (#160) * Initial creation of terraform setup for AWS static-content site hosting. * Website deployment run locally works. Terraform AWS resource build run locally works. * Creating test self-hosted environment. Alwways run terraform in docker containers. * Removing all run on PR creation / modification. * Making redirect_uri and logout URL field defaults parameterized. * OIDC Authorization Code Flow with local keycoak is now working for test and prod hosted static-content site. * Updating Token History grouping. * Test suite works against test and prod sites with a local keycloak instance. The introspection endpoint in keycloak cannot be invoked from the browser. So, the static content site cannot call the keycloak instrospection site. The test suite looks for hte expected CORS error. Test suite must be run against a local build for full validation. * Minimize javascript for static content sites. Google analytics for static content sites. * Feature/152 (#162) * Synching develop branch with master. (#161) * Feature/157 (#158) * Initial creation of terraform setup for AWS static-content site hosting. * Website deployment run locally works. Terraform AWS resource build run locally works. * Creating test self-hosted environment. Alwways run terraform in docker containers. * Removing all run on PR creation / modification. * Making redirect_uri and logout URL field defaults parameterized. * OIDC Authorization Code Flow with local keycoak is now working for test and prod hosted static-content site. * Updating Token History grouping. * Test suite works against test and prod sites with a local keycloak instance. The introspection endpoint in keycloak cannot be invoked from the browser. So, the static content site cannot call the keycloak instrospection site. The test suite looks for hte expected CORS error. Test suite must be run against a local build for full validation. * Feature/158 (#160) * Initial creation of terraform setup for AWS static-content site hosting. * Website deployment run locally works. Terraform AWS resource build run locally works. * Creating test self-hosted environment. Alwways run terraform in docker containers. * Removing all run on PR creation / modification. * Making redirect_uri and logout URL field defaults parameterized. * OIDC Authorization Code Flow with local keycoak is now working for test and prod hosted static-content site. * Updating Token History grouping. * Test suite works against test and prod sites with a local keycloak instance. The introspection endpoint in keycloak cannot be invoked from the browser. So, the static content site cannot call the keycloak instrospection site. The test suite looks for hte expected CORS error. Test suite must be run against a local build for full validation. * Minimize javascript for static content sites. Google analytics for static content sites. * Updated docker build instructions. * Initial page + test creation. (#164) * Initial page + test creation. * Adding ability to take a JWT and decompose it into JWT Header and JWT Payload fields on jwt_tools.html page. Updated test suite to test this. * Moving back to postgres18. Not sure when we lost that change. * Fixing test #13. * Fix coverage report. * Another change attempting to fix the code coverage bug. * Successful deployment to test.idptools.com and selenium test run. * Terraform creates IAM role with minimmum permissions. * Terraform creates IAM role with minimmum permissions. * Automatically run terraform against test when commmits / merge made to develop. * Updating develop / test 'test suite run' + terraform + static-content site deployment. * Test change to kick off pipelines. * Kick-off another workflow run. * Terraform deploy job didn't run as expected on push.
diff --git a/.github/workflows/terraform.yml b/.github/workflows/terraform.yml
@@ -3,22 +3,18 @@ name: Terraform
 # Runs Terraform inside the same container image used locally
 # (infra/terraform-local.sh). State is remote (S3).
 #
-# Triggers:
-#   - workflow_run after "Selenium Tests" succeeds on develop -> automatically
-#     `apply` the TEST environment. On a develop push the pipeline is:
-#     Selenium Tests -> Terraform (this) -> Deploy test.idptools.com.
-#   - workflow_dispatch -> manual run; choose environment (test|prod) and
-#     action (plan|apply), e.g. to apply prod.
+# Manual dispatch ONLY: choose environment (test|prod) and action (plan|apply),
+# e.g. to apply prod, or plan/apply test on demand.
 #
-# Deliberately NOT triggered on push/pull_request directly: develop changes go
-# through the test suite first, and PR content is never run with credentials.
+# The AUTOMATIC develop pipeline (apply TEST infra, then deploy the test site)
+# lives in the "Deploy Static Site (test.idptools.com)" workflow, which runs
+# terraform + deploy as ordered jobs after the Selenium Tests suite passes.
+# Terraform is NOT auto-run here on develop because chaining terraform -> deploy
+# across separate workflow_run workflows is unreliable: a workflow_run-triggered
+# run is attributed to the default branch, so the develop branch/SHA is lost on
+# the second hop.
 #
-# CI authenticates with static-key secrets (same pattern as the deploy
-# pipeline); local runs use your AWS SSO session.
-#
-# NOTE: workflow_run triggers only fire when this workflow file exists on the
-# repository's DEFAULT branch (master). Merge to the default branch for the
-# chain to take effect.
+# CI authenticates with static-key secrets; local runs use your AWS SSO session.
 
 on:
   # Run after the Selenium Tests suite passes for a develop push.
diff --git a/.github/workflows/website-deploy-test.yml b/.github/workflows/website-deploy-test.yml
@@ -1,34 +1,73 @@
 name: Deploy Static Site (test.idptools.com)
 
-# Builds the static client content and deploys it to the TEST site
-# (test.idptools.com) using the same container image as prod and local runs.
-# DEPLOY_ENV=test selects the test bucket / distribution / config.
+# Automatic develop pipeline, chained after the Selenium Tests suite:
 #
-# Ordering: chained AFTER the "Terraform" workflow via `workflow_run`. On a
-# develop push the full pipeline is:
-#   Selenium Tests -> Terraform apply (test) -> Deploy (this).
-# The test suite runs once, in the "Selenium Tests" workflow; this deploy only
-# happens if that suite passed and Terraform then applied successfully.
+#   Selenium Tests  --(workflow_run, develop, success)-->  this workflow
+#       job: terraform  -> apply the TEST infrastructure
+#       job: deploy     -> build + deploy TEST content to S3/CloudFront, then tag
+#                          (needs: terraform)
 #
-# NOTE: workflow_run triggers only fire when this workflow file exists on the
-# repository's DEFAULT branch (master). Merge to the default branch for the
-# chain to take effect.
+# Terraform and deploy are ORDERED JOBS in ONE workflow (not a second
+# workflow_run hop). A workflow_run-triggered run is attributed to the default
+# branch, so chaining terraform -> deploy across separate workflows loses the
+# develop branch/SHA. Chaining a single hop from Selenium Tests keeps it: both
+# jobs check out the exact develop commit the suite tested
+# (github.event.workflow_run.head_sha).
+#
+# The Selenium Tests suite runs once (in its own workflow) and gates this one.
+#
+# NOTE: workflow_run triggers only fire from the workflow file on the DEFAULT
+# branch (master) — keep this file updated there.
 
 on:
-  # Run after the Terraform workflow completes for a develop push.
+  # Run after the Selenium Tests suite completes for a develop push.
   workflow_run:
-    workflows: ["Terraform"]
+    workflows: ["Selenium Tests"]
     types: [completed]
     branches: [develop]
-  # Still allow manual deploys.
+  # Manual full run (apply TEST infra + deploy).
   workflow_dispatch:
 
 permissions:
   # write is needed to push the deploy tag back to the repo.
   contents: write
 
 jobs:
+  # ---- Apply the TEST infrastructure first ----
+  terraform:
+    runs-on: ubuntu-latest
+    # For a workflow_run trigger, only proceed if the suite succeeded on develop.
+    # Manual dispatch always proceeds.
+    if: >-
+      ${{ github.event_name == 'workflow_dispatch' ||
+          (github.event.workflow_run.conclusion == 'success' &&
+           github.event.workflow_run.head_branch == 'develop') }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v5
+        with:
+          # The exact commit the suite tested (workflow_run) or the dispatch ref.
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
+
+      - name: Build terraform image
+        run: docker build -t idptools-terraform -f infra/Dockerfile .
+
+      - name: Terraform apply (test)
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        run: |
+          docker run --rm \
+            -e AWS_ACCESS_KEY_ID \
+            -e AWS_SECRET_ACCESS_KEY \
+            -e AWS_REGION=us-west-2 \
+            -e TF_ENV=test \
+            -e TF_ACTION=apply \
+            idptools-terraform
+
+  # ---- Then build + deploy the static content (only if terraform succeeded) ----
   deploy:
+    needs: terraform
     runs-on: ubuntu-latest
     # For a workflow_run trigger, only deploy if Terraform succeeded on develop.
     # Manual dispatch always proceeds.
@@ -40,9 +79,6 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v5
         with:
-          # A workflow_run-triggered job checks out the default branch by
-          # default; check out the exact commit the chain ran against so the
-          # deployed content matches. Manual dispatch uses its own ref.
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
 
       - name: Build deploy image
