Merge branch 'main' into ans_oah_tests

Author: anselmbradford

.dockerignore

@@ -26,6 +26,5 @@
 !yarn.lock
 
 # ...but DO ignore these others
-cfgov/apache
 cfgov/f
 cfgov/static_built

.env_SAMPLE

@@ -20,26 +20,20 @@ export DJANGO_ADMIN_PASSWORD=admin
 
 ######################################################
 # Wagtail-Sharing - for sharing unpublished drafts.
-#
-# Used in initial_data script to set sharing hostname.
 # See https://github.com/cfpb/wagtail-sharing.
 #####################################################
-export WAGTAIL_SHARING_HOSTNAME=content.localhost
+export WAGTAILSHARING_HOST=content.localhost:8000
 
 ########################################
 # Application feature related variables.
 ########################################
 
-# Location used by refresh_data.sh for retrieving latest database dump.
-#export CFGOV_PROD_DB_LOCATION=<some_database_dump_url>
-
 #export ENABLE_DEFAULT_CACHE=1
 #export EMAIL_HOST=<email_server_hostname>
 #export ADMIN_EMAILS=<comma_delimited_list_of_emails>
 #export WAGTAILADMIN_NOTIFICATION_FROM_EMAIL=<wagtail_notification_from_email>
 #export LOGIN_FAIL_TIME_PERIOD=<time_between_failed_attempts>
 #export LOGIN_FAILS_ALLOWED=<number_of_fails_allowed_before_lockout>
-export ALLOW_ADMIN_URL=True
 #export ENABLE_AKAMAI_CACHE_PURGE=True
 #export AKAMAI_OBJECT_ID=<akamai_object_id>
 #export AKAMAI_ACCESS_TOKEN=<akamai_access_token>
@@ -49,9 +43,9 @@ export ALLOW_ADMIN_URL=True
 #export AKAMAI_PURGE_ALL_URL=<akamai_purge_all_url>
 #export AKAMAI_PURGE_HOSTNAMES=<akamai_purge_hostnames>
 
-# export ENABLE_CLOUDFRONT_CACHE_PURGE=True
-# export CLOUDFRONT_DISTRIBUTION_ID_FILES=<cloudfront_distribution_id_files_cf_gov>
-# export CLOUDFRONT_PURGE_HOSTNAMES=<cloudfront_purge_hostnames>
+# export ENABLE_FILES_CACHE_PURGE=True
+# export AKAMAI_FILES_OBJECT_ID=<akamai_files_object_id>
+# export AKAMAI_FILES_PURGE_HOSTNAMES=<files_purge_hostnames>
 
 #####################################################################
 # Override Django database URL.

.github/workflows/apache.yml

@@ -4,21 +4,20 @@ on:
   workflow_dispatch:
   pull_request:
     paths:
-      - '**.py'
-      - 'requirements/**.txt'
-      - '**.html'
-      - '**.mo'
-      - '**.po'
+      - "**.py"
+      - "requirements/**.txt"
+      - "**.html"
+      - "**.mo"
+      - "**.po"
   merge_group:
+  push:
+    branches:
+      - main
 
 jobs:
   backend:
     runs-on: ubuntu-latest
 
-    env:
-      # LD_LIBRARY_PATH is set so that validate-translations can find gettext.
-      LD_LIBRARY_PATH: /usr/local/lib
-
     strategy:
       matrix:
         toxenv:
@@ -32,46 +31,63 @@ jobs:
       postgres:
         # https://help.github.com/en/actions/configuring-and-managing-workflows/creating-postgresql-service-containers
         # https://github.com/actions/example-services/blob/master/.github/workflows/postgres-service.yml
-        image: postgres:13
+        image: postgres:17
         env:
           POSTGRES_USER: cfpb
           POSTGRES_PASSWORD: cfpb
           POSTGRES_DB: cfgov
         ports:
-        - 5432:5432
+          - 5432:5432
         # needed because the postgres container does not provide a healthcheck
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
 
       elasticsearch:
         image: elasticsearch:7.10.1
         ports:
-        - 9200/tcp
+          - 9200/tcp
         options: -e="discovery.type=single-node" --health-cmd="curl http://localhost:9200/_cluster/health" --health-interval=10s --health-timeout=5s --health-retries=10
 
     steps:
       - uses: actions/checkout@v4
 
+      - name: Check cache for gettext
+        id: cache-gettext
+        if: matrix.toxenv == 'validate-translations'
+        uses: actions/cache@v4
+        with:
+          path: ${{ github.workspace }}/gettext-install
+          key: ${{ runner.os }}-gettext-0.25
+
       - name: Install gettext for translations
         if: matrix.toxenv == 'validate-translations'
+        run: |
+          if [ "${{ steps.cache-gettext.outputs.cache-hit }}" != "true" ]; then
+            curl -LO https://ftp.gnu.org/pub/gnu/gettext/gettext-0.25.tar.gz
+            tar xzvf gettext-0.25.tar.gz
+            cd gettext-0.25
+            ./configure --prefix=${{ github.workspace }}/gettext-install
+            make -j$(nproc)
+            make install
+          fi
+
+          # Always add gettext to path, whether built or restored from cache.
+          echo "${{ github.workspace }}/gettext-install/bin" >> $GITHUB_PATH
+          echo "LD_LIBRARY_PATH=${{ github.workspace }}/gettext-install/lib:$LD_LIBRARY_PATH" >> $GITHUB_ENV
+
+      - name: Install lxml dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y build-essential
-          curl -LO https://ftp.gnu.org/pub/gnu/gettext/gettext-0.25.tar.gz
-          tar xzvf gettext-0.25.tar.gz
-          cd gettext-0.25
-          ./configure --prefix=/usr/local
-          make -j$(nproc)
-          sudo make install
+          sudo apt-get install python3.12-dev libxml2-dev libxslt-dev
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: 3.13
 
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-            node-version: '24.x'
+          node-version: "24.x"
 
       - name: Install dependencies
         run: |
@@ -105,12 +121,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 2
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: 3.13
 
       - name: Install dependencies
         run: |
@@ -125,4 +141,11 @@ jobs:
 
       - name: Check backend test coverage
         run: |
-          diff-cover backend_coverage/coverage.xml --compare-branch=origin/main --fail-under=100
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            git fetch origin main
+            COMPARE_FLAG="--compare-branch=origin/main"
+          else
+            git diff HEAD~1 HEAD > diff.txt
+            COMPARE_FLAG="--diff-file=diff.txt"
+          fi
+          diff-cover backend_coverage/coverage.xml $COMPARE_FLAG --fail-under=100

.github/workflows/backend.yml

@@ -2,19 +2,68 @@ name: Build cf.gov Docker images
 
 on:
   pull_request:
+  push:
+    branches:
+      - main
   merge_group:
   workflow_dispatch:
 
 jobs:
   build-docker-images:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Extract metadata
+        id: meta
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          echo "short_sha=$SHORT_SHA" >> $GITHUB_OUTPUT
+
+          ORG_LOWER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          echo "org_lower=$ORG_LOWER" >> $GITHUB_OUTPUT
+
+      - name: Determine if we should push to GHCR
+        id: should_push
+        run: |
+          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
+            echo "result=true" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
+            echo "result=true" >> $GITHUB_OUTPUT
+          else
+            echo "result=false" >> $GITHUB_OUTPUT
+          fi
+
       - name: Build cfgov image
-        run: docker build -t cfgov:latest .
+        run: docker build -t cfgov:local .
+
+      - name: Log in to GHCR
+        if: steps.should_push.outputs.result == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push to GHCR on pushes to main
+        if: github.ref == 'refs/heads/main' && steps.should_push.outputs.result == 'true'
+        run: |
+          IMAGE_NAME="ghcr.io/${{ steps.meta.outputs.org_lower }}/cfgov/cfgov"
+          docker tag cfgov:local $IMAGE_NAME:latest
+          docker tag cfgov:local $IMAGE_NAME:sha-${{ steps.meta.outputs.short_sha }}
+          docker push $IMAGE_NAME:latest
+          docker push $IMAGE_NAME:sha-${{ steps.meta.outputs.short_sha }}
 
-      - name: Build cfgov-apache image
-        run: docker build -t cfgov-apache:latest cfgov/apache
+      - name: Push on PRs
+        if: github.event_name == 'pull_request' && steps.should_push.outputs.result == 'true'
+        run: |
+          IMAGE_NAME="ghcr.io/${{ steps.meta.outputs.org_lower }}/cfgov/cfgov"
+          docker tag cfgov:local $IMAGE_NAME:pr-${{ github.event.pull_request.number }}
+          docker tag cfgov:local $IMAGE_NAME:pr-${{ github.event.pull_request.number }}-${{ steps.meta.outputs.short_sha }}
+          docker push $IMAGE_NAME:pr-${{ github.event.pull_request.number }}
+          docker push $IMAGE_NAME:pr-${{ github.event.pull_request.number }}-${{ steps.meta.outputs.short_sha }}