Merge dependabot-pip-urllib3-1.26.18 into combine-prs-branch

.env.development

@@ -0,0 +1,5 @@
+FLASK_APP=app.py
+FLASK_ENV=development
+FLASK_RUN_PORT=5000
+FLASK_RUN_HOST=localhost
+DATABASE_URL=postgresql://postgres:password@localhost:5432/fund_store

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+_Add ticket reference to Pull Request title: e.g. 'FS-123: Add content', if there is no ticket prefix with BAU_
+
+
+### Change description
+_A brief description of the pull request_
+
+- [ ] Unit tests and other appropriate tests added or updated
+- [ ] README and other documentation has been updated / added (if needed)
+- [ ] Commit messages are meaningful and follow good commit message guidelines (e.g. "FS-XXXX: Add margin to nav items preventing overlapping of logo")
+
+
+### How to test
+_If manual testing is needed, give suggested testing steps_
+
+
+### Screenshots of UI changes (if applicable)

.github/workflows/copilot.yml

@@ -0,0 +1,59 @@
+name: Copilot Workflows
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+        environment:
+          description:  Which AWS Account to use
+          type: choice
+          required: true
+          options:
+          - test
+        # Shared workflow consideration
+        # application:
+        #   description:  Application Name
+        #   type: string/choice
+        # - notification
+        #   required: true
+        init:
+          description: Initialise the application?
+          type: boolean
+          default: false
+        service:
+          description: Service Name
+          type: string
+          required: true
+          default: 'funding-service-design-fund-store'
+        port:
+          description: Access port
+          type: string
+          default: '80'
+        type:
+          description: Type of service to deploy
+          type: choice
+          options:
+          - 'Backend Service'
+          - 'Load Balanced Web Service'
+          - 'Request-Driven Web Service'
+          - 'Scheduled Job'
+          - 'Worker Service'
+          default: 'Backend Service'
+
+
+jobs:
+  deployment:
+    concurrency: deploy-${{ inputs.environment || 'test' }} # Forces only one workflow at a time can run on the environment
+    permissions:
+      id-token: write # This is required for requesting the JWT
+      contents: read  # This is required for actions/checkout
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment || 'test' }}
+    steps:
+      - name: Git clone the repository
+        uses: actions/checkout@v3
+
+      - name: Get current date
+        id: currentdatetime
+        run: echo "::set-output name=datetime::$(date +'%Y%m%d%H%M%S')"

.github/workflows/deploy.yml

@@ -1,24 +1,102 @@
-name: Deploy to Gov PaaS
+name: Deploy fsd-fund-store to Gov PaaS
 
 on:
   workflow_dispatch:
+    inputs:
+      environment:
+        description:  Which AWS Account to use
+        type: choice
+        required: true
+        options:
+        - test
+        - uat
+      copilot:
+        description: Whether to deploy to AWS?
+        type: boolean
+        required: false
+        default: false
+      deploy_to_dev:
+        required: false
+        default: false
+        type: boolean
+        description: Deploy to CloudFoundry dev?
   push:
     paths-ignore:
       - '**/README.md'
 
 jobs:
   test_and_deploy:
-    uses: communitiesuk/funding-design-service-workflows/.github/workflows/deploy.yml@main
+    if: ${{github.event.inputs.copilot != 'true'}}
+    uses: communitiesuk/funding-service-design-workflows/.github/workflows/deploy.yml@main
     with:
       app_name: ${{ github.event.repository.name }}
       api: true
-      users: 2
-      spawn-rate: 2
-      run-time: 11s
-    if: ${{ github.actor != 'dependabot[bot]' }}
+      postgres_unit_testing: true
+      deploy_to_dev: false
+      run_performance_tests: true
+      run_e2e_tests: true
     secrets:
       CF_API: ${{secrets.CF_API}}
       CF_ORG: ${{secrets.CF_ORG}}
       CF_SPACE: ${{secrets.CF_SPACE}}
-      CF_USER: ${{secrets.CF_USER}}
+      CF_USER: ${{secrets.CF_USERNAME}}
       CF_PASSWORD: ${{secrets.CF_PASSWORD}}
+      E2E_PAT: ${{secrets.E2E_PAT}}
+  paketo_build:
+    permissions:
+      packages: write
+    uses: communitiesuk/funding-service-design-workflows/.github/workflows/package.yml@main
+    with:
+      version_to_build: $(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
+      owner: ${{ github.repository_owner }}
+      application: funding-service-design-fund-store
+  pre_deploy_tests:
+    if: ${{github.event.inputs.copilot == 'true'}}
+    secrets:
+      E2E_PAT: ${{secrets.E2E_PAT}}
+    uses: communitiesuk/funding-service-design-workflows/.github/workflows/pre-deploy.yml@main
+    with:
+      # Note - no db-name, so defaults to postgres_db
+      postgres_unit_testing: true
+  copilot_build:
+    if: ${{github.event.inputs.copilot == 'true'}}
+    needs: [pre_deploy_tests, paketo_build]
+    concurrency: deploy-${{ inputs.environment || 'test' }}
+    permissions:
+      id-token: write # This is required for requesting the JWT
+      contents: read  # This is required for actions/checkout
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment || 'test' }}
+    steps:
+    - name: Git clone the repository
+      uses: actions/checkout@v3
+
+    - name: Get current date
+      id: currentdatetime
+      run: echo "datetime=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
+
+    - name: configure aws credentials
+      uses: aws-actions/configure-aws-credentials@v2
+      with:
+        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/GithubCopilotDeploy
+        role-session-name: FUNDSTORE_COPILOT_${{ steps.currentdatetime.outputs.datetime }}
+        aws-region: eu-west-2
+
+    - name: Install AWS Copilot CLI
+      run: |
+        curl -Lo aws-copilot https://github.com/aws/copilot-cli/releases/latest/download/copilot-linux && chmod +x aws-copilot && sudo mv aws-copilot /usr/local/bin/copilot
+
+    - name: Inject Git SHA into manifest
+      run: |
+        yq -i '.variables.GITHUB_SHA = "${{ github.sha }}"'  copilot/fsd-fund-store/manifest.yml
+
+    - name: Inject replacement image into manifest
+      run: |
+        yq -i '.image.location = "ghcr.io/communitiesuk/funding-service-design-fund-store:${{ github.ref_name == 'main' && 'latest' || github.ref_name }}"'  copilot/fsd-fund-store/manifest.yml
+
+    - name: Run database migrations
+      run: scripts/migration-task-script.py ${{ inputs.environment || 'test' }} 'fsd-fund-store'
+
+    - name: Copilot deploy
+      run: |
+        copilot svc deploy --env ${{ inputs.environment || 'test' }}

.github/workflows/manual-dev-deploy.yml

@@ -0,0 +1,58 @@
+  name: Manual Dev Deploy
+  on:
+    workflow_dispatch:
+  jobs:
+    deploy_dev:
+      runs-on: ubuntu-latest
+      concurrency: deploy_dev_${{github.repository}}
+      environment: Dev
+      env:
+        FLASK_ENV: dev
+      steps:
+        - name: checkout code
+          uses: actions/checkout@v3
+        - name: Set up Python
+          uses: actions/setup-python@v4
+          with:
+            python-version: 3.10.x
+        - name: create python env
+          run: python -m venv .venv
+        - name: install dependencies
+          run: source .venv/bin/activate && python -m pip install --upgrade pip && pip install -r requirements.txt
+        - name: download previous build
+          uses: actions/download-artifact@v2
+        - name: Deploy to Gov PaaS
+          uses: citizen-of-planet-earth/cf-cli-action@v2
+          with:
+            cf_api:      ${{secrets.CF_API}}
+            cf_org:      ${{secrets.CF_ORG}}
+            cf_space:    ${{secrets.CF_SPACE }}
+            cf_username: ${{secrets.CF_USERNAME}}
+            cf_password: ${{secrets.CF_PASSWORD}}
+            command: push funding-service-design-fund-store-dev --var GITHUB_SHA="${{ github.sha }}"
+        - name: Apply network policy for notification service
+          uses: citizen-of-planet-earth/cf-cli-action@v2
+          with:
+            cf_api:      ${{secrets.CF_API}}
+            cf_org:      ${{secrets.CF_ORG}}
+            cf_space:    ${{secrets.CF_SPACE }}
+            cf_username: ${{secrets.CF_USERNAME}}
+            cf_password: ${{secrets.CF_PASSWORD}}
+            command: add-network-policy funding-service-design-fund-store-dev funding-service-design-notification-dev --protocol tcp --port 8080
+
+    run-shared-tests_dev:
+      needs: deploy_dev
+      concurrency: run-shared-tests_dev
+      uses: communitiesuk/funding-service-design-workflows/.github/workflows/run-shared-tests.yml@main
+      with:
+        perf_test_target_url_application_store: https://funding-service-design-application-store-dev.london.cloudapps.digital
+        perf_test_target_url_fund_store: https://funding-service-design-fund-store-dev.london.cloudapps.digital
+        perf_test_target_url_assessment_store: https://funding-service-design-assessment-store-dev.london.cloudapps.digital
+        e2e_tests_target_url_frontend: https://fsd:[email protected]  # pragma: allowlist secret
+        e2e_tests_target_url_authenticator: https://fsd:[email protected]  # pragma: allowlist secret
+        e2e_tests_target_url_form_runner: https://fsd:[email protected]  # pragma: allowlist secret
+        e2e_tests_target_url_assessment: https://fsd:[email protected]  # pragma: allowlist secret
+        run_performance_tests: true
+        run_e2e_tests: false
+      secrets:
+        E2E_PAT: ${{secrets.E2E_PAT}}

.github/workflows/tag-to-release.yaml

@@ -1,8 +1,18 @@
 name: tag-to-release
+
+permissions:
+  contents: write
+
 on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - main
   push:
     tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - v[0-9]+.[0-9]+.[0-9]+
+      - v[0-9]+.[0-9]+.[0-9]+-prerelease
 
     paths-ignore:
       - '**/README.md'
@@ -14,25 +24,17 @@ env:
 
 
 jobs:
-  deploy_dev:
-    runs-on: ubuntu-latest
-    steps:
-
-      - name: Set env
-        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
-
-      - name: checkout code
-        uses: actions/checkout@v2
-
-      - name: Archive Release
-        uses: thedoctor0/zip-release@main
-        with:
-          type: 'zip'
-          filename: '${{ github.event.repository.name }}-${{github.ref_name}}.zip'
-          exclusions: '*.git* *.venv/* *tests/*'
-
-      - name: Upload Release
-        uses: ncipollo/release-action@v1
-        with:
-          artifacts: '${{ github.event.repository.name }}-${{github.ref_name}}.zip'
-          token: ${{ secrets.GITHUB_TOKEN }}
+  tag-to-release:
+    if: ${{ github.actor != 'dependabot[bot]' }}
+    uses: communitiesuk/funding-service-design-workflows/.github/workflows/tag-to-release.yml@main
+    with:
+      build_static_assets: false
+  paketo_build:
+    needs: tag-to-release
+    permissions:
+      packages: write
+    uses: communitiesuk/funding-service-design-workflows/.github/workflows/package.yml@main
+    with:
+      version_to_build: ${{ needs.tag-to-release.outputs.new_tag }}
+      owner: ${{ github.repository_owner }}
+      application: funding-service-design-fund-store

.gitignore

@@ -225,8 +225,6 @@ $RECYCLE.BIN/
 
 # End of https://www.toptal.com/developers/gitignore/api/python,macos,windows
 
-# Visual Studio Code config
-.vscode
 
 # Flask
 flask_session

.pre-commit-config.yaml

@@ -5,13 +5,13 @@ repos:
     - id: black
       language_version: python3
       args:
-        - --line-length=79
         - --experimental-string-processing
--   repo: https://gitlab.com/pycqa/flake8
+-   repo: https://github.com/PyCQA/flake8
     rev: 3.9.2
     hooks:
     - id: flake8
       args:
+        - --max-line-length=120
         - --ignore=E203,W503
 -   repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.2.0
@@ -25,3 +25,10 @@ repos:
       - id: reorder-python-imports
         name: Reorder Python imports (src, tests)
         args: ["--application-directories", "src"]
+- repo: https://github.com/Yelp/detect-secrets
+  rev: v1.4.0
+  hooks:
+  -   id: detect-secrets
+      args: ['--disable-plugin', 'HexHighEntropyString',
+        '--disable-plugin', 'Base64HighEntropyString']
+      exclude: .env.development