Merge pull request #79 from ASFHyP3/develop

Release 0.1.0

.github/dependabot.yml

@@ -0,0 +1,19 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - bumpless
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - bumpless

.github/workflows/changelog.yml

@@ -13,6 +13,4 @@ on:
 
 jobs:
   call-changelog-check-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@main
-    secrets:
-      USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    uses: ASFHyP3/actions/.github/workflows/[email protected]

.github/workflows/create-jira-issue.yml

@@ -0,0 +1,15 @@
+name: Create Jira issue
+
+on:
+  issues:
+    types: [labeled]
+
+jobs:
+  call-create-jira-issue-workflow:
+    uses: ASFHyP3/actions/.github/workflows/[email protected]
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_PROJECT: ${{ secrets.JIRA_PROJECT }}
+      JIRA_FIELDS: ${{ secrets.JIRA_FIELDS }}

.github/workflows/deploy.yml

@@ -1,4 +1,3 @@
-
 name: Deploy to AWS
 
 on:
@@ -7,6 +6,8 @@ on:
       - main
       - develop
 
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
 env:
   AWS_REGION: us-west-2
   TEMPLATE_BUCKET: cf-templates-aubvn3i9olmk-us-west-2
@@ -21,7 +22,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ secrets.TOOLS_BOT_PAK }}
@@ -36,22 +37,22 @@ jobs:
           echo "STACK_NAME=hyp3-event-monitoring" >> $GITHUB_ENV
           echo "HYP3_URL=https://hyp3-api.asf.alaska.edu" >> $GITHUB_ENV
 
-      - uses: aws-actions/configure-aws-credentials@v1
+      - uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ env.AWS_REGION }}
 
-      - uses: actions/setup-python@v1
+      - uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: 3.12
 
       - name: install dependencies and render templates
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -r find_new/requirements.txt -t find_new/src
-          python -m pip install -r api/requirements.txt -t api/src
-          python -m pip install -r harvest_products/requirements.txt -t harvest_products/src
+          python -m pip install -r requirements-find-new.txt -t find_new/src
+          python -m pip install -r requirements-api.txt -t api/src
+          python -m pip install -r requirements-harvest-products.txt -t harvest_products/src
 
       - name: Package and deploy
         run: |
@@ -73,6 +74,6 @@ jobs:
   call-bump-version-workflow:
     if: github.ref == 'refs/heads/main'
     needs: deploy
-    uses: ASFHyP3/actions/.github/workflows/reusable-bump-version.yml@main
+    uses: ASFHyP3/actions/.github/workflows/reusable-bump-version.yml@v0.11.2
     secrets:
       USER_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}

.github/workflows/labeled-pr.yml

@@ -0,0 +1,15 @@
+name: Is PR labeled?
+
+on:
+  pull_request:
+    types:
+      - opened
+      - labeled
+      - unlabeled
+      - synchronize
+    branches:
+      - main
+
+jobs:
+  call-labeled-pr-check-workflow:
+    uses: ASFHyP3/actions/.github/workflows/[email protected]

.github/workflows/release-template-comment.yml

@@ -0,0 +1,14 @@
+on:
+  pull_request:
+    types:
+      - opened
+    branches:
+      - main
+
+jobs:
+  call-release-checklist-workflow:
+    uses: ASFHyP3/actions/.github/workflows/[email protected]
+    permissions:
+      pull-requests: write
+    secrets:
+      USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   call-release-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-release.yml@main
+    uses: ASFHyP3/actions/.github/workflows/reusable-release.yml@v0.11.2
     with:
       release_prefix: HyP3 Event Monitoring
     secrets:

.github/workflows/static-analysis.yml

@@ -4,15 +4,19 @@ on: push
 
 jobs:
   call-flake8-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-flake8.yml@main
+    uses: ASFHyP3/actions/.github/workflows/reusable-flake8.yml@v0.11.2
     with:
       local_package_names: api,database,find_new,harvest_products
 
   cfn-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-
-      - uses: scottbrenner/cfn-lint-action@master
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
         with:
-          args: "--ignore-checks W3002 --template cloudformation.yml **/cloudformation.yml"
+          python-version: 3.12
+      - run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-all.txt
+      - run: |
+          cfn-lint --info --ignore-checks W3002 --template cloudformation.yml **/cloudformation.yml

.github/workflows/test.yml

@@ -6,11 +6,11 @@ jobs:
   pytest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v1
+      - uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: 3.12
 
       - run: |
           python -m pip install --upgrade pip

CHANGELOG.md

@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [PEP 440](https://www.python.org/dev/peps/pep-0440/) 
 and uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.0]
+### Removed
+- Support for Python 3.8 has been removed. Python 3.12 is now supported.
 
 ## [0.0.13]
 ### Changed

README.md

@@ -53,12 +53,12 @@ Review the parameters in [cloudformation.yml](cloudformation.yml) for deploy tim
 
 ### Deploy with CloudFormation
 
-- Install dependencies for each component (requires pip for python 3.8)
+- Install dependencies for each component (requires pip for python 3.12)
 
 ```sh
-python -m pip install -r find_new/requirements.txt -t find_new/src
-python -m pip install -r api/requirements.txt -t api/src
-python -m pip install -r harvest_products/requirements.txt -t harvest_products/src
+python -m pip install -r requirements-find-new.txt -t find_new/src
+python -m pip install -r requirements-api.txt -t api/src
+python -m pip install -r requirements-harvest-products.txt -t harvest_products/src
 ```
 
 - Package the CloudFormation template

api/src/api.py

@@ -1,9 +1,8 @@
 from datetime import datetime, timedelta, timezone
 from decimal import Decimal
+from json import JSONEncoder
 
 from flask import Flask, abort, jsonify
-from flask.json import JSONEncoder
-from flask_api.status import HTTP_404_NOT_FOUND
 from flask_cors import CORS
 from serverless_wsgi import handle_request
 
@@ -35,7 +34,7 @@ def get_event_by_id(event_id):
     try:
         event = database.get_event(event_id)
     except ValueError:
-        abort(HTTP_404_NOT_FOUND)
+        abort(404)
     event['products'] = database.get_products_for_event(event_id, status_code='SUCCEEDED')
     return jsonify(event)
 

cloudformation.yml

@@ -17,14 +17,39 @@ Parameters:
 
 Resources:
   LogBucket:
-    Type: AWS::S3::Bucket
+    Type: "AWS::S3::Bucket"
     Properties:
-      AccessControl: LogDeliveryWrite
       PublicAccessBlockConfiguration:
         BlockPublicAcls: True
         IgnorePublicAcls: True
         BlockPublicPolicy: True
         RestrictPublicBuckets: True
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+            BucketKeyEnabled: true
+      OwnershipControls:
+        Rules:
+          - ObjectOwnership: BucketOwnerEnforced
+
+  LogBucketPolicy:
+    Type: "AWS::S3::BucketPolicy"
+    Properties:
+      Bucket: !Ref LogBucket
+      PolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Action: "s3:PutObject"
+            Effect: Allow
+            Principal:
+              Service: logging.s3.amazonaws.com
+            Resource: !Sub "${LogBucket.Arn}/*"
+            Condition:
+              ArnLike:
+                "aws:SourceArn": !GetAtt ProductBucket.Arn
+              StringEquals:
+                "aws:SourceAccount": !Sub "${AWS::AccountId}"
 
   ProductBucket:
     Type: AWS::S3::Bucket
@@ -55,6 +80,9 @@ Resources:
               - HEAD
             AllowedOrigins:
               - "*.asf.alaska.edu"
+      OwnershipControls:
+        Rules:
+          - ObjectOwnership: BucketOwnerEnforced
 
   BucketPolicy:
     Type: AWS::S3::BucketPolicy

database/setup.py

@@ -6,7 +6,7 @@
     license='BSD',
     include_package_data=True,
 
-    python_requires='~=3.8',
+    python_requires='~=3.12',
 
     packages=find_packages(),
 )

find_new/cloudformation.yml

@@ -62,7 +62,7 @@ Resources:
       Handler: find_new.lambda_handler
       MemorySize: 128
       Role: !GetAtt Role.Arn
-      Runtime: python3.8
+      Runtime: python3.12
       Timeout: 900
 
   EventInvokeConfig:

harvest_products/cloudformation.yml

@@ -61,7 +61,7 @@ Resources:
       Handler: harvest_products.lambda_handler
       MemorySize: 2048
       Role: !GetAtt Role.Arn
-      Runtime: python3.8
+      Runtime: python3.12
       Timeout: 900
 
   EventInvokeConfig: