Merge pull request #56 from ASFHyP3/develop

0.0.9

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# These owners will be requested for review when someone opens a pull request.
+*       @ASFHyP3/platform

.github/workflows/changelog.yml

@@ -1,4 +1,5 @@
 name: Changelog updated?
+
 on:
   pull_request:
     types:
@@ -9,16 +10,9 @@ on:
     branches:
       - main
       - develop
-jobs:
-  changelog-udated:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
 
-      - name: Changelog check
-        uses: Zomzog/[email protected]
-        with:
-          fileName: CHANGELOG.md
-          noChangelogLabel: bumpless
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+jobs:
+  call-changelog-check-workflow:
+    uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@main
+    secrets:
+      USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/deploy.yml

@@ -18,10 +18,8 @@ env:
   EVENT_MANAGER_ACCOUNT_IDS: ${{ secrets.EVENT_MANAGER_ACCOUNT_IDS }}
 
 jobs:
-
   deploy:
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v2
         with:
@@ -72,42 +70,9 @@ jobs:
                 HyP3URL="${HYP3_URL}" \
                 EventManagerAccountIds="${EVENT_MANAGER_ACCOUNT_IDS}"
 
-      - name: Get associated PR
-        if: github.ref == 'refs/heads/main'
-        uses: helaili/[email protected]
-        env:
-          GITHUB_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}
-        with:
-          query: .github/queries/asssociated-pr.query.yml
-          outputFile: pr.json
-          owner: ASFHyP3
-          name: hyp3-event-monitoring
-          sha: ${{ github.sha }}
-
-      - name: Get PR labels
-        if: github.ref == 'refs/heads/main'
-        uses: helaili/[email protected]
-        env:
-          GITHUB_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}
-        with:
-          query: .github/queries/pr-labels.query.yml
-          outputFile: labels.json
-          owner: ASFHyP3
-          name: hyp3-event-monitoring
-
-      - name: Tag version
-        if: github.ref == 'refs/heads/main'
-        run: |
-          python -m pip install bump2version
-          git fetch origin +refs/tags/*:refs/tags/*
-          git config user.email "[email protected]"
-          git config user.name "tools-bot"
-          LABEL_QUERY='.data.repository.pullRequest.labels.nodes[].name'
-          SELECT='select(. == "major" or . == "minor" or . == "patch")'
-          BUMP_PART=$(jq --raw-output  "${LABEL_QUERY} | ${SELECT}" labels.json | sort | head -1)
-          PR_QUERY='.data.repository.commit.associatedPullRequests.edges[0].node.title'
-          TAG_MSG=$(jq --raw-output "${PR_QUERY}"  pr.json)
-          bump2version --current-version $(git describe --abbrev=0) \
-              --tag --tag-message "${TAG_MSG}" "${BUMP_PART}"
-          git push --tags
-          echo "Tagged version $(git describe --abbrev=0) and pushed back to repo"
+  call-bump-version-workflow:
+    if: github.ref == 'refs/heads/main'
+    needs: deploy
+    uses: ASFHyP3/actions/.github/workflows/reusable-bump-version.yml@main
+    secrets:
+      USER_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}

.github/workflows/release.yml

@@ -3,17 +3,12 @@ name: Write release and finish
 on:
   push:
     tags:
-      - v*
+      - 'v*'
 
 jobs:
-  finish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Create Release
-        uses: docker://antonyurchenko/git-release:latest
-        env:
-          GITHUB_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}
-          ALLOW_TAG_PREFIX: "true"
-          RELEASE_NAME_PREFIX: "HyP3 Event Monitoring "
+  call-release-workflow:
+    uses: ASFHyP3/actions/.github/workflows/reusable-release.yml@main
+    with:
+      release_prefix: HyP3 Event Monitoring
+    secrets:
+      USER_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}

.github/workflows/static-analysis.yml

@@ -3,26 +3,13 @@ name: Static code analysis
 on: push
 
 jobs:
-
-  flake8:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - uses: actions/setup-python@v1
-        with:
-          python-version: 3.8
-
-      - run: |
-          python -m pip install --upgrade pip
-          python -m pip install flake8 flake8-import-order flake8-blind-except flake8-builtins
-
-      - run: flake8 --max-line-length=120 --import-order-style=pycharm --statistics --application-import-names api,database,find_new,harvest_products
+  call-flake8-workflow:
+    uses: ASFHyP3/actions/.github/workflows/reusable-flake8.yml@main
+    with:
+      local_package_names: api,database,find_new,harvest_products
 
   cfn-lint:
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v2
 

.github/workflows/test.yml

@@ -5,7 +5,6 @@ on: push
 jobs:
   pytest:
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v2
 
@@ -16,6 +15,7 @@ jobs:
       - run: |
           python -m pip install --upgrade pip
           python -m pip install -r requirements-all.txt
+
       - name: run pytest
         env:
           PYTHONPATH: find_new/src:api/src:harvest_products/src

CHANGELOG.md

@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [PEP 440](https://www.python.org/dev/peps/pep-0440/) 
 and uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.9]
+### Security
+- Set `NoEcho` for EDL password in CloudFormation stacks.
 
 ## [0.0.8](https://github.com/ASFHyP3/hyp3-event-monitoring/compare/v0.0.7...v0.0.8)
 ### Changed

cloudformation.yml

@@ -10,6 +10,7 @@ Parameters:
 
   EDLPassword:
     Type: String
+    NoEcho: true
 
   EventManagerAccountIds:
     Type: CommaDelimitedList

find_new/cloudformation.yml

@@ -15,6 +15,7 @@ Parameters:
 
   EDLPassword:
     Type: String
+    NoEcho: true
 
 Resources:
   Role:

harvest_products/cloudformation.yml

@@ -15,6 +15,7 @@ Parameters:
 
   EDLPassword:
     Type: String
+    NoEcho: true
 
 Resources:
   Role: