Dev to Test

.env.local

@@ -27,7 +27,6 @@ OAS_VALIDATION_RULESET=basic-ruleset
 GWA_PROD_ENV_SLUG=E0000000
 GWA_RES_SVR_CLIENT_ID=gwa-api
 GWA_RES_SVR_CLIENT_SECRET=18900468-3db1-43f7-a8af-e75f079eb742
-STEP_TOKEN_URL=http://step-token-api.localtest.me:2020
 KEYCLOAK_AUTH_URL=http://keycloak.localtest.me:9081/auth
 KEYCLOAK_REALM=master
 EMAIL_ENABLED=true

.github/workflows/.build.yml

@@ -0,0 +1,61 @@
+on:
+  workflow_call:
+    inputs:
+      name:
+        required: true
+        type: string
+      context:
+        required: true
+        type: string
+        default: '.'
+
+jobs:
+  build-image:
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Image meta
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/${{ github.repository }}/${{ inputs.name }}
+
+      - name: Set DEPLOY_ID
+        run: |
+          echo "DEPLOY_ID=${{ steps.meta.outputs.version }}" >> "$GITHUB_OUTPUT"
+          echo "APP_VERSION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}" >> "$GITHUB_OUTPUT"
+          echo "APP_REVISION=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}" >> "$GITHUB_OUTPUT"
+        id: set-deploy-id
+
+      - name: Get deploy ID
+        run: echo "The DEPLOY_ID is ${{ steps.set-deploy-id.outputs.DEPLOY_ID }}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          logout: false
+
+      - name: Create image
+        uses: docker/build-push-action@v7
+        with:
+          context: ${{ inputs.context }}
+          file: ${{ inputs.context }}/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            APP_VERSION=${{ steps.set-deploy-id.outputs.APP_VERSION }}
+            APP_REVISION=${{ steps.set-deploy-id.outputs.APP_REVISION }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/aps-cypress-e2e.yaml

@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Build GWA API Image
         run: |
-          git clone https://github.com/bcgov/gwa-api.git --branch feature/aps-4665
+          git clone https://github.com/bcgov/gwa-api.git --branch dev
           cd gwa-api/microservices/gatewayApi
           docker build -t gwa-api:e2e .
 

.github/workflows/ci-build-only.yaml

@@ -2,15 +2,24 @@ name: Build and Deploy Refactor
 
 on:
   push:
-    branches: [hotfix/*]
+    branches: [hotfix/*, task/*]
 
 env:
   REGISTRY: ghcr.io
   REGISTRY_USERNAME: ${{ secrets.CONTAINER_REGISTRY_USERNAME }}
   REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
 
 jobs:
-  build:
+  build-provisioner:
+    uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
+      packages: write # 🚀 Crucial permission needed to push to ghcr.io
+    with:
+      name: provisioner-svc
+      context: ./provisioner-api
+
+  build-others:
     runs-on: ubuntu-latest
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -84,4 +93,3 @@ jobs:
             GITHUB_API_TOKEN=${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
             APP_VERSION=${{ steps.set-deploy-id.outputs.APP_VERSION }}
             APP_REVISION=${{ steps.set-deploy-id.outputs.APP_REVISION }}
-

.github/workflows/ci-build-provisioner-api.yaml

@@ -2,39 +2,40 @@ name: Build Provisioner API
 
 on:
   push:
-    branches: [feature/*, dev, test]
+    branches: [tmp/*, feature/*, dev, test]
 
 permissions:
   contents: read
-  packages: write
-
-env:
-  REGISTRY: ghcr.io
-  REGISTRY_USERNAME: ${{ secrets.CONTAINER_REGISTRY_USERNAME }}
-  REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
 
 jobs:
   build:
+    uses: ./.github/workflows/.build.yml
+    permissions:
+      contents: read
+      packages: write # 🚀 Crucial permission needed to push to ghcr.io
+    with:
+      name: provisioner-svc
+      context: ./provisioner-api
+
+  deploy:
     runs-on: ubuntu-latest
+    needs: [build]
     steps:
-      - name: Docker meta
-        id: docker_meta
+      - uses: actions/checkout@v2
+
+      - name: Image meta
+        id: meta
         uses: docker/metadata-action@v6
         with:
-          images: ${{ env.REGISTRY }}/bcgov/api-services-portal/provisioner
+          images: ghcr.io/${{ github.repository }}/provisioner-svc
 
       - name: Set DEPLOY_ID
         run: |
-          echo '::set-output name=DEPLOY_ID::${{ steps.docker_meta.outputs.version }}'
-          echo '::set-output name=APP_VERSION::${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }}'
-          echo '::set-output name=APP_REVISION::${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.revision'] }}'
+          echo '::set-output name=DEPLOY_ID::${{ steps.meta.outputs.version }}'
+          echo '::set-output name=APP_VERSION::${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.version'] }}'
+          echo '::set-output name=APP_REVISION::${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}'
         id: set-deploy-id
 
-      - name: Get deploy ID
-        run: echo "The DEPLOY_ID is ${{ steps.set-deploy-id.outputs.DEPLOY_ID }}"
-
-      - uses: actions/checkout@v2
-
       - name: Install oc
         uses: redhat-actions/oc-installer@v1
         with:
@@ -51,30 +52,6 @@ jobs:
 
           namespace: ${{ env.OPENSHIFT_NAMESPACE }}
 
-      - name: Log in to Container Registry
-        uses: docker/login-action@v1
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ env.REGISTRY_USERNAME }}
-          password: ${{ env.REGISTRY_PASSWORD }}
-
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: provisioner-api
-          file: provisioner-api/Dockerfile
-          push: true
-          build-args: |
-            GITHUB_API_TOKEN=${{ secrets.CONTAINER_REGISTRY_PASSWORD }}
-            APP_VERSION=${{ steps.set-deploy-id.outputs.APP_VERSION }}
-            APP_REVISION=${{ steps.set-deploy-id.outputs.APP_REVISION }}
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
-
       - name: 'Get Helm'
         if: github.ref != 'refs/heads/dev'
         run: |
@@ -97,7 +74,7 @@ jobs:
             maxSurge: 50%
 
           image:
-            repository: ${{ env.REGISTRY }}/bcgov/api-services-portal/provisioner
+            repository: ghcr.io/bcgov/api-services-portal/provisioner-svc
             tag: ${{ steps.set-deploy-id.outputs.DEPLOY_ID }}
             pullPolicy: Always
 

.github/workflows/pr-review.yaml

@@ -0,0 +1,18 @@
+name: Review PR
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        required: true
+        type: string
+
+jobs:
+  review:
+    uses: bcgov/aps-devops/.github/workflows/pr-multi-review.yml@pr-multi-review
+    with:
+      pr_number: ${{ inputs.pr_number }}
+    secrets: inherit
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write

docker-compose.yml

@@ -504,6 +504,7 @@ services:
       - --allow-write
       - --allow-read
       - /app/main.ts
+      - '2020'
     # Needed when running portal outside of docker compose
     ports:
       - 2020:2020
@@ -514,6 +515,34 @@ services:
         aliases:
           - step-token-api.localtest.me
 
+  # Second, independent instance of the same CA token mock so that
+  # per-environment routing through the provisioner (SP136) is observable
+  # locally: each environment's `ca_token_url` can point at a distinct CA.
+  # Runs on its own internal port (2022) rather than sharing 2020 with the
+  # first instance, since containers reached from inside the docker network
+  # (the provisioner) use the container's internal port, not the host
+  # port mapping.
+  mocks-step-token-api-2:
+    image: denoland/deno:2.7.12
+    container_name: mocks-step-token-api-2
+    command:
+      - deno
+      - run
+      - --allow-net=:2022,deno.land
+      - --allow-write
+      - --allow-read
+      - /app/main.ts
+      - '2022'
+    # Needed when running portal outside of docker compose
+    ports:
+      - 2022:2022
+    volumes:
+      - ./local/mocks/step-token-api/main.ts:/app/main.ts
+    networks:
+      aps-net:
+        aliases:
+          - step-token-api-2.localtest.me
+
   mocks-sdx-edge-api:
     image: denoland/deno:2.7.12
     container_name: mocks-sdx-edge-api