Merge branch 'main' of github.com:CMSgov/bcda-app into kev/env-specif…

…ic-import

.github/CONTRIBUTING.md

@@ -0,0 +1,15 @@
+# Contribution expectations
+
+The following expectations apply to each PR:
+
+1. The PR and branch are named for [automatic linking](https://support.atlassian.com/jira-cloud-administration/docs/use-the-github-for-jira-app/) to the most relevant JIRA issue (for example, `JRA-123 Adds foo` for PR title and `jra-123-adds-foo` for branch name).
+2. Reviewers are selected to include people from all teams impacted by the changes in the PR.
+3. The PR has been assigned to the people who will respond to reviews and merge when ready (usually the person filing the review, but can change when a PR is handed off to someone else).
+4. The PR is reasonably limited in scope to ensure:
+   - It doesn't bunch together disparate features, fixes, refactorings, etc.
+   - There isn't too much of a burden on reviewers.
+   - Any problems it causes have a small blast radius.
+   - Changes will be easier to roll back if necessary.
+5. The PR includes any required documentation changes, including `README` updates and changelog or release notes entries.
+6. All new and modified code is appropriately commented to make the what and why of its design reasonably clear, even to those unfamiliar with the project.
+7. Any incomplete work introduced by the PR is detailed in `TODO` comments which include a JIRA ticket ID for any items that require urgent attention.

.github/pull_request_template.md

@@ -1,24 +1,21 @@
 ## 🎫 Ticket
 
-https://jira.cms.gov/browse/BCDA-xxx
+https://jira.cms.gov/browse/...
 
 ## 🛠 Changes
 
-(What was added, updated, or removed in this PR.)
+<!-- What was added, updated, or removed in this PR? -->
 
-## ℹ️ Context for reviewers
+## ℹ️ Context
 
-(Background context, more in-depth details of the implementation, and anything else you'd like to call out or ask reviewers.)
+<!-- Why were these changes made? Add background context suitable for a non-technical audience. -->
 
-## ✅ Acceptance Validation
+<!-- If any of the following security implications apply, this PR must not be merged without Stephen Walter's approval. Explain in this section and add @SJWalter11 as a reviewer.
+  - Adds a new software dependency or dependencies.
+  - Modifies or invalidates one or more of our security controls.
+  - Stores or transmits data that was not stored or transmitted before.
+  - Requires additional review of security implications for other reasons. -->
 
-(How were the changes verified? Did you fully test the acceptance criteria in the ticket? Provide reproducible testing instructions and screenshots if applicable.)
+## 🧪 Validation
 
-## 🔒 Security Implications
-
-- [ ] This PR adds a new software dependency or dependencies.
-- [ ] This PR modifies or invalidates one or more of our security controls.
-- [ ] This PR stores or transmits data that was not stored or transmitted before.
-- [ ] This PR requires additional review of its security implications for other reasons.
-
-If any security implications apply, add Jason Ashbaugh (GitHub username: StewGoin) as a reviewer and do not merge this PR without his approval.
+<!-- How were the changes verified? Did you fully test the acceptance criteria in the ticket? Provide reproducible testing instructions and screenshots if applicable. -->

.github/workflows/cclf-import-dev-deploy.yml

@@ -0,0 +1,40 @@
+name: cclf-import dev deploy
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - cclf-import/**
+      - .github/workflows/cclf-import-dev-deploy.yml
+  workflow_dispatch:
+
+jobs:
+  test:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: bcda
+    environment: dev
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+      - name: Build cclf-import zip file
+        env:
+          CGO_ENABLED: 0
+        run: |
+          go build -o bin/bootstrap ./lambda/cclf/main.go
+          zip -j function.zip bin/bootstrap
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-dev-github-actions
+      - name: Upload and reload
+        run: |
+          aws s3 cp --no-progress function.zip \
+            s3://bcda-dev-cclf-import-function/function-${{ github.sha }}.zip
+          aws lambda update-function-code --function-name bcda-dev-cclf-import \
+            --s3-bucket bcda-dev-cclf-import-function --s3-key function-${{ github.sha }}.zip

.github/workflows/cclf-import-prod-deploy.yml

@@ -0,0 +1,25 @@
+name: cclf-import prod deploy
+
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    environment: prod
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-prod-github-actions
+      - name: Promote lambda code from test to prod
+        run: |
+          aws s3 cp --no-progress \
+            s3://bcda-test-cclf-import-function/function-${{ github.sha }}.zip \
+            s3://bcda-prod-cclf-import-function/function-${{ github.sha }}.zip
+          aws lambda update-function-code --function-name bcda-prod-cclf-import \
+            --s3-bucket bcda-prod-cclf-import-function --s3-key function-${{ github.sha }}.zip
+

.github/workflows/cclf-import-test-deploy.yml

@@ -0,0 +1,35 @@
+name: cclf-import test deploy
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  test:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: bcda
+    environment: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+      - name: Build cclf-import zip file
+        env:
+          CGO_ENABLED: 0
+        run: |
+          go build -o bin/bootstrap ./lambda/cclf/main.go
+          zip -j function.zip bin/bootstrap
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-test-github-actions
+      - name: Upload and reload
+        run: |
+          aws s3 cp --no-progress function.zip \
+            s3://bcda-test-cclf-import-function/function-${{ github.sha }}.zip
+          aws lambda update-function-code --function-name bcda-test-cclf-import \
+            --s3-bucket bcda-test-cclf-import-function --s3-key function-${{ github.sha }}.zip

.github/workflows/cclf-import-test-integration.yml

@@ -0,0 +1,51 @@
+name: cclf-import test integration
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/cclf-import-test-integration.yml
+      - .github/workflows/cclf-import-test-deploy.yml
+      - cclf/**
+  workflow_dispatch:
+
+# Ensure we have only one integration test running at a time
+concurrency:
+  group: cclf-import-test-integration
+
+jobs:
+  # Deploy first if triggered by pull_request
+  deploy:
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: ./.github/workflows/cclf-import-test-deploy.yml
+    secrets: inherit
+
+  trigger:
+    if: ${{ always() }}
+    needs: deploy
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: bcda
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-test-cclf-import-function
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          # Note that we use the BFD role with access to the bucket
+          role-to-assume: arn:aws:iam::${{ secrets.BFD_ACCOUNT_ID }}:role/bfd-test-eft-bcda-bucket-role
+          role-chaining: true
+          role-skip-session-tagging: true
+      - name: Upload test file to the BFD bucket to trigger lambda function via SNS message
+        run: |
+          aws s3 cp --no-progress ../shared_files/cclf/files/synthetic/test/small/ZC0 \
+            s3://bfd-test-eft/bfdeft01/bcda/in/T.NGD.DPC.RSP.D$(date +'%y%m%d').T$(date +'%H%M%S')1.IN
+
+  # TODO Check bucket for response file
+  # TODO Run another job to check database for update

.github/workflows/ci-workflow.yml

@@ -4,7 +4,13 @@ on:
   push:
     branches:
       - main
+    paths-ignore:
+      - .github/workflows/opt-out-import-*
+      - optout/**
   pull_request:
+    paths-ignore:
+      - .github/workflows/opt-out-import-*
+      - optout/**
 
 env:
   COMPOSE_INTERACTIVE_NO_CLI: 1
@@ -59,6 +65,9 @@ jobs:
     name: Sonarqube Quality Gate
     needs: build
     runs-on: self-hosted
+    env:
+      # Workaround until https://jira.cms.gov/browse/PLT-338 is implemented.
+      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: "true"
     steps:
       - name: Download code coverage
         uses: actions/download-artifact@v2

.github/workflows/opt-out-import-dev-deploy.yml

@@ -0,0 +1,40 @@
+name: opt-out-import dev deploy
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - optout/**
+      - .github/workflows/opt-out-import-dev-deploy.yml
+  workflow_dispatch:
+
+jobs:
+  test:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: bcda
+    environment: dev
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+      - name: Build opt-out-import zip file
+        env:
+          CGO_ENABLED: 0
+        run: |
+          go build -o bin/bootstrap ./lambda/optout/main.go
+          zip -j function.zip bin/bootstrap
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-dev-github-actions
+      - name: Upload and reload
+        run: |
+          aws s3 cp --no-progress function.zip \
+            s3://bcda-dev-opt-out-import-function/function-${{ github.sha }}.zip
+          aws lambda update-function-code --function-name bcda-dev-opt-out-import \
+            --s3-bucket bcda-dev-opt-out-import-function --s3-key function-${{ github.sha }}.zip

.github/workflows/opt-out-import-prod-deploy.yml

@@ -0,0 +1,24 @@
+name: opt-out-import prod deploy
+
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    environment: prod
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-prod-github-actions
+      - name: Promote lambda code from test to prod
+        run: |
+          aws s3 cp --no-progress \
+            s3://bcda-test-opt-out-import-function/function-${{ github.sha }}.zip \
+            s3://bcda-prod-opt-out-import-function/function-${{ github.sha }}.zip
+          aws lambda update-function-code --function-name bcda-prod-opt-out-import \
+            --s3-bucket bcda-prod-opt-out-import-function --s3-key function-${{ github.sha }}.zip

.github/workflows/opt-out-import-test-deploy.yml

@@ -0,0 +1,35 @@
+name: opt-out-import test deploy
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+jobs:
+  test:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: bcda
+    environment: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+      - name: Build opt-out-import zip file
+        env:
+          CGO_ENABLED: 0
+        run: |
+          go build -o bin/bootstrap ./lambda/optout/main.go
+          zip -j function.zip bin/bootstrap
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-test-github-actions
+      - name: Upload and reload
+        run: |
+          aws s3 cp --no-progress function.zip \
+            s3://bcda-test-opt-out-import-function/function-${{ github.sha }}.zip
+          aws lambda update-function-code --function-name bcda-test-opt-out-import \
+            --s3-bucket bcda-test-opt-out-import-function --s3-key function-${{ github.sha }}.zip

.github/workflows/opt-out-import-test-integration.yml

@@ -0,0 +1,51 @@
+name: opt-out-import test integration
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/opt-out-import-test-integration.yml
+      - .github/workflows/opt-out-import-test-deploy.yml
+      - optout/**
+  workflow_dispatch:
+
+# Ensure we have only one integration test running at a time
+concurrency:
+  group: opt-out-import-test-integration
+
+jobs:
+  # Deploy first if triggered by pull_request
+  deploy:
+    if: ${{ github.event_name == 'pull_request' }}
+    uses: ./.github/workflows/opt-out-import-test-deploy.yml
+    secrets: inherit
+
+  trigger:
+    if: ${{ always() }}
+    needs: deploy
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./optout
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: arn:aws:iam::${{ secrets.ACCOUNT_ID }}:role/delegatedadmin/developer/bcda-test-opt-out-import-function
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          # Note that we use the BFD role with access to the bucket
+          role-to-assume: arn:aws:iam::${{ secrets.BFD_ACCOUNT_ID }}:role/bfd-test-eft-bcda-bucket-role
+          role-chaining: true
+          role-skip-session-tagging: true
+      - name: Upload test file to the BFD bucket to trigger lambda function via SNS message
+        run: |
+          aws s3 cp --no-progress ../shared_files/synthetic1800MedicareFiles/test/T\#EFT.ON.ACO.NGD1800.DPRF.D181120.T1000009 \
+            s3://bfd-test-eft/bfdeft01/bcda/in/T.NGD.DPC.RSP.D$(date +'%y%m%d').T$(date +'%H%M%S')1.IN
+
+  # TODO Check bucket for response file
+  # TODO Run another job to check database for update

.vscode/settings.json

@@ -16,6 +16,7 @@
         "BB_CLIENT_KEY_FILE": "${workspaceFolder}/shared_files/decrypted/bfd-dev-test-key.pem",
         "FHIR_PAYLOAD_DIR": "${workspaceFolder}/bcdaworker/data",
         "FHIR_STAGING_DIR": "${workspaceFolder}/bcdaworker/tmpdata",
+        "FHIR_TEMP_DIR": "${workspaceFolder}/bcdaworker/TEMP",
         "FHIR_ARCHIVE_DIR": "${workspaceFolder}/bcdaworker/archive",
     },
     "go.testEnvFile": "${workspaceFolder}/shared_files/decrypted/local.env",