Merge pull request #1946 from ChildMindInstitute/release/2025.09.2

Release 2025.09.2

Author: aweiland

.github/workflows/_build.yaml

@@ -3,6 +3,9 @@ name: Build
 on:
   workflow_call:
     inputs:
+      env-name:
+        required: true
+        type: string
       tag-name:
         description: Docker tag to create
         required: false
@@ -30,16 +33,23 @@ env:
   BUILD_NUMBER: ${{github.run_id}}
 
   OUT_DIR: ./out
-  AWS_REGION : "us-east-1"
 
-  ECR_REPO: 917902836630.dkr.ecr.us-east-1.amazonaws.com/api-server
-  ECR_ADDRESS: 917902836630.dkr.ecr.us-east-1.amazonaws.com
+#  ECR_REPO: 917902836630.dkr.ecr.us-east-1.amazonaws.com/api-server
+#  ECR_ADDRESS: 917902836630.dkr.ecr.us-east-1.amazonaws.com
 
 
 jobs:
+  setup-vars:
+    uses: ./.github/workflows/_setup.yaml
+    with:
+      env-name: ${{ inputs.env-name }}
+
   build:
     name: Docker Build and Push
     runs-on: ubuntu-latest
+    needs: setup-vars
+    env:
+      AWS_REGION: ${{ needs.setup-vars.outputs.region }}
     outputs:
       image-name: ${{ steps.sha.outputs.IMAGE_NAME }}
       image-sha: ${{ steps.sha.outputs.SHORT_SHA }}
@@ -55,27 +65,21 @@ jobs:
       - name: configure aws credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::917902836630:role/cmiml-devops-oidc-github-role
+          role-to-assume: ${{ needs.setup-vars.outputs.devops-role }}
           role-session-name: gha-oidc-runner
-          aws-region: ${{ env.AWS_REGION }}
+          aws-region: ${{ needs.setup-vars.outputs.region }}
 
-      - name: Get secrets by name and by ARN
-        uses: aws-actions/aws-secretsmanager-get-secrets@v2
-        with:
-          parse-json-secrets: true
-          secret-ids: |
-            ,cmiml-devops
 
       - name: Login to ECR
         run: |
-          aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin ${{ env.ECR_ADDRESS }}
+          aws ecr get-login-password --region ${{ needs.setup-vars.outputs.region }} | docker login --username AWS --password-stdin ${{ needs.setup-vars.outputs.ecr-repo }}
 
       - name: Generate short sha
         id: sha
         run: |
           SHORT_SHA=$(git rev-parse --short HEAD)
           echo "SHORT_SHA=${SHORT_SHA}" >> $GITHUB_OUTPUT
-          echo "IMAGE_NAME=${ECR_REPO}:${SHORT_SHA}" >> "$GITHUB_OUTPUT"
+          echo "IMAGE_NAME=${{ needs.setup-vars.outputs.ecr-repo }}/api-server:${SHORT_SHA}" >> "$GITHUB_OUTPUT"
 
       - name: Build and push
         uses: docker/build-push-action@v6
@@ -87,33 +91,10 @@ jobs:
             PIPENV_EXTRA_ARGS=--dev
             DD_GIT_REPOSITORY_URL=${{ github.repositoryUrl }}
             DD_GIT_COMMIT_SHA=${{ github.sha }}
-          cache-to: mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref=${{ env.ECR_REPO }}:cache
-          cache-from: type=registry,ref=${{ env.ECR_REPO }}:cache
+          cache-to: mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref=${{ needs.setup-vars.outputs.ecr-repo }}/api-server:cache
+          cache-from: type=registry,ref=${{ needs.setup-vars.outputs.ecr-repo }}/api-server:cache
           tags: |
-            ${{ env.ECR_REPO }}:${{ inputs.tag-name }}
-            ${{ env.ECR_REPO }}:${{ steps.sha.outputs.SHORT_SHA }}
+            ${{ needs.setup-vars.outputs.ecr-repo }}/api-server:${{ inputs.tag-name }}
+            ${{ needs.setup-vars.outputs.ecr-repo }}/api-server:${{ steps.sha.outputs.SHORT_SHA }}
           platforms: linux/amd64,linux/arm64
 
-#      # TODO What is this used for?  Leftover artifact from Jenkins
-#      - name: Extract Jira ticket numbers from commit message
-#        run: |
-#          tickets=$(git log -1 --pretty=%B | grep -io 'M2-[0-9]\+' | tr '[:lower:]' '[:upper:]' | sort | uniq | tr '\n' ' ')
-#          if [ -z "$tickets" ]; then
-#              echo "No Jira tickets found in the latest commit message."
-#          else
-#              echo "Jira ticket numbers found: ${tickets}"
-#              if [ "${GITHUB_BRANCH_OR_TAG}" != "develop" ]; then
-#                  echo "Skipping saving Jira ticket numbers to a file because the branch is not develop"
-#              else
-#                file="jira-tickets.json"
-#                echo "{ \"issues\": $(echo "${tickets}" | jq -R -s -c 'split(" ")[:-1]') }" > "${file}"
-#                echo "Jira ticket numbers saved to ${file}"
-#              fi
-#          fi
-#
-#      - name: Upload artifacts
-#        uses: actions/upload-artifact@v4
-#        with:
-#          name: build-artifacts
-#          path: |
-#            ${GITHUB_REPO_NAME}/${OUT_DIR}/jira-tickets.json

.github/workflows/_deploy.yaml

@@ -111,7 +111,7 @@ jobs:
           SLACK_COLOR: failure
           SLACK_WEBHOOK: ${{ secrets.slack-webhook }}
           MSG_MINIMAL: actions url
-          SLACK_TITLE: Deployment to ${{ inputs.env-name }} environment
+          SLACK_TITLE: Backend deployed to ${{ inputs.env-name }}
           SLACK_MESSAGE: '🚨 Error when executing deployment!'
 
   on-deploy-success:
@@ -120,7 +120,15 @@ jobs:
     needs:
       - deploy
     steps:
-      - uses: actions/checkout@v4
+      - name: "Send Slack message on success"
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_COLOR: success
+          SLACK_WEBHOOK: ${{ secrets.slack-webhook }}
+          MSG_MINIMAL: actions url
+          SLACK_TITLE: Backend deployed to ${{ inputs.env-name }}
+          SLACK_MESSAGE: '🚀 Deployment was successful. Version: *${{ inputs.image-tag }}*'
+
       - name: configure aws credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -135,11 +143,4 @@ jobs:
                   --type "String" \
                   --overwrite
 
-      - name: "Send Slack message on success"
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_COLOR: success
-          SLACK_WEBHOOK: ${{ secrets.slack-webhook }}
-          MSG_MINIMAL: actions url
-          SLACK_TITLE: Deployment to ${{ inputs.env-name }} environment
-          SLACK_MESSAGE: '🚀 Deployment was successful. Version: *${{ inputs.image-tag }}*'
+      

.github/workflows/_setup.yaml

@@ -3,8 +3,11 @@ on:
   workflow_call:
     outputs:
       role:
-        description: Role name
+        description: Environment Role ARN
         value: ${{ jobs.setup-vars.outputs.role }}
+      devops-role:
+        description: Environment Devops Role ARN
+        value: ${{ jobs.setup-vars.outputs.devops-role }}
       region:
         description: AWS Region name
         value: ${{ jobs.setup-vars.outputs.region }}
@@ -46,7 +49,7 @@ jobs:
             "prod")
               echo 'role=arn:aws:iam::410431445687:role/cmiml-prod-oidc-github-role' >> "$GITHUB_OUTPUT"
             ;;
-            "prod-dr")
+            "prod-dr-us-west-2")
               echo 'role=arn:aws:iam::973422231492:role/cmiml-dr-oidc-github-role' >> "$GITHUB_OUTPUT"
             ;;
             *)
@@ -59,7 +62,7 @@ jobs:
         run: |
           ENV_NAME="${{ inputs.env-name }}"
           case "$ENV_NAME" in
-            "prod-dr")
+            "prod-dr-us-west-2")
               echo "region=us-west-2" >> "$GITHUB_OUTPUT"
               ;;
             *)
@@ -71,7 +74,7 @@ jobs:
         run: |
           ENV_NAME="${{ inputs.env-name }}"
           case "$ENV_NAME" in
-            "prod-dr")
+            "prod-dr-us-west-2")
               echo "cluster=prod-dr-us-west-2" >> "$GITHUB_OUTPUT"
               ;;
             *)
@@ -83,16 +86,30 @@ jobs:
         run: |
           ENV_NAME="${{ inputs.env-name }}"
           case "$ENV_NAME" in
-            "prod-dr")
-              echo "repo=973422231492.dkr.ecr.us-east-1.amazonaws.com" >> "$GITHUB_OUTPUT"
+            "prod-dr-us-west-2")
+              echo "repo=973422231492.dkr.ecr.us-west-2.amazonaws.com" >> "$GITHUB_OUTPUT"
               ;;
             *)
               echo "repo=917902836630.dkr.ecr.us-east-1.amazonaws.com" >> "$GITHUB_OUTPUT"
               ;;
           esac
 
+      - name: Map env to devops role
+        id: devops-role
+        run: |
+          ENV_NAME="${{ inputs.env-name }}"
+          case "$ENV_NAME" in
+            "prod-dr-us-west-2")
+              echo "role=arn:aws:iam::973422231492:role/cmiml-devops-oidc-github-role" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "role=arn:aws:iam::917902836630:role/cmiml-devops-oidc-github-role" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
+
     outputs:
       role: ${{ steps.role.outputs.role }}
       region: ${{ steps.region.outputs.region }}
       cluster: ${{ steps.cluster.outputs.cluster }}
       ecr-repo: ${{ steps.ecr.outputs.repo }}
+      devops-role: ${{ steps.devops-role.outputs.role }}

.github/workflows/run_build_deploy_dev.yaml

@@ -38,6 +38,7 @@ jobs:
     uses: ./.github/workflows/_build.yaml
     with:
       tag-name: ${{ needs.version.outputs.short-sha }}
+      env-name: dev
 
   migrations:
     needs: [version, build]

.github/workflows/run_build_deploy_dr.yaml

@@ -0,0 +1,72 @@
+name: Build and Deploy to DR
+
+on:
+  release:
+    types:
+      - released
+  workflow_dispatch:
+    inputs:
+      target-ref:
+        description: The tag to use
+        required: true
+        type: string
+
+
+concurrency:
+  cancel-in-progress: false
+  group: api-build-deploy-dr
+
+permissions:
+  id-token: write
+  contents: read
+  issues: write
+
+jobs:
+  ref:
+    name: Get target ref
+    runs-on: ubuntu-latest
+    outputs:
+      target-ref: ${{ steps.ref.outputs.ref }}
+    steps:
+      - id: ref
+        name: Select Ref
+        run: |
+          TARGET_REF="${{ github.event.inputs.target-ref }}"
+          # Use shell parameter expansion to provide a default value if input is unset or empty
+          # github.ref_name will be used if the input is not provided or empty
+          # Remove "refs/heads/" or "refs/tags/" if present in github.ref_name
+          TARGET_REF=${TARGET_REF:-$(echo "${{ github.event.release.tag_name }}" | sed 's/refs\/heads\///g' | sed 's/refs\/tags\///g')}
+
+          echo "Target reference: $TARGET_REF"
+          echo "ref=$TARGET_REF" >> $GITHUB_OUTPUT
+
+  build:
+    name: Build
+    needs: ref
+    secrets: inherit
+    uses: ./.github/workflows/_build.yaml
+    with:
+      env-name: prod-dr-us-west-2
+      tag-name: ${{ needs.ref.outputs.target-ref }}
+      git-ref: ${{ needs.ref.outputs.target-ref }}
+
+  migrations:
+    name: Run Migrations in Prod-DR
+    needs: [build, ref]
+    secrets:
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK_DEPLOY_TO_DR }}
+    uses: ./.github/workflows/_migrations.yaml
+    with:
+      env-name: prod-dr-us-west-2
+      image-tag: ${{ needs.ref.outputs.target-ref }}
+
+
+  deploy-prod:
+    name: Deploy to Prod-DR
+    needs: [ build, migrations, ref ]
+    secrets:
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK_DEPLOY_TO_DR }}
+    uses: ./.github/workflows/_deploy.yaml
+    with:
+      env-name: prod-dr-us-west-2
+      image-tag: ${{ needs.ref.outputs.target-ref }}

.github/workflows/run_build_deploy_prod.yaml

@@ -48,6 +48,7 @@ jobs:
     with:
       tag-name: ${{ needs.ref.outputs.target-ref }}
       git-ref: ${{ needs.ref.outputs.target-ref }}
+      env-name: prod
 
   migrations:
     name: Run Migrations in Prod

.github/workflows/run_build_deploy_uat.yaml

@@ -48,6 +48,7 @@ jobs:
     with:
       tag-name: ${{ needs.ref.outputs.target-ref }}
       git-ref: ${{ needs.ref.outputs.target-ref }}
+      env-name: uat
 
 
   migrations:

src/apps/activity_assignments/service.py

@@ -178,9 +178,15 @@ async def send_email_notification(
                 else f"{domain}/{path}/{applet.id}"
             )
 
+            subject_text = service.get_localized_text_template(
+                template_name="assignment_notification",
+                language=language,
+                applet_name=applet.display_name,
+            )
+
             message = MessageSchema(
                 recipients=[respondent_subject.email],
-                subject=self._get_email_assignment_subject(language),
+                subject=subject_text,
                 body=service.get_localized_html_template(
                     template_name=self._get_email_template_name(),
                     language=language,
@@ -482,11 +488,3 @@ async def get_assigned_activity_or_flow_ids_for_subject(
     @staticmethod
     def _get_email_template_name() -> str:
         return "new_activity_assignments"
-
-    @staticmethod
-    def _get_email_assignment_subject(language: str) -> str:
-        translations = {
-            "en": "Assignment Notification",
-            "fr": "Notification d'attribution",
-        }
-        return translations.get(language, translations["en"])