Promote develop to master for production

.circleci/config.yml

@@ -1,91 +1,123 @@
 version: 2.1
-
 executors:
-  build:
+  reviewed:
     docker:
-      - image: cimg/python:3.13.2-browsers
-    resource_class: medium
-
+    - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5
 commands:
-  install-dependencies:
+  checkout-source:
+    steps:
+    - run:
+        name: Check out the exact public source commit over HTTPS
+        command: |
+          set -euo pipefail
+          [[ "$CIRCLE_SHA1" =~ ^[0-9a-f]{40}$ ]]
+          export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
+          git init --quiet .
+          git remote add origin https://github.com/topcoder-platform/forms-api-v6.git
+          git -c credential.helper= fetch --quiet --depth 1 origin "$CIRCLE_SHA1"
+          git checkout --quiet --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$CIRCLE_SHA1"
+  checkout-suite:
     steps:
-      - run:
-          name: Install build and deployment dependencies
-          command: |
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq jq python3-pip
-            pip install boto3 awscli
-
+    - run:
+        name: Verify deployment suite v2.0.5
+        command: |
+          set -euo pipefail
+          git init --quiet /tmp/tc-deploy-scripts
+          git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git
+          git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.5
+          git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD
+          test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bff574ab5c0b46773e25d2af1eff76675fba2ba5
 jobs:
+  build:
+    executor: reviewed
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - run:
+        name: Build committed source without AWS or broker credentials
+        command: |
+          set -euo pipefail
+          python3 -I /tmp/tc-deploy-scripts/build_image.py --target runtime --image forms-api-v6:candidate
+          python3 -I /tmp/tc-deploy-scripts/build_image.py --target migrate --image forms-api-v6:migrate-candidate
+          mkdir -p /tmp/release
+          docker save --output /tmp/release/image.tar forms-api-v6:candidate forms-api-v6:migrate-candidate
+        no_output_timeout: 30m
+    - persist_to_workspace:
+        root: /tmp/release
+        paths:
+        - image.tar
   deploy:
-    executor: build
+    executor: reviewed
     parameters:
-      deploy_env:
-        type: enum
-        enum: [DEV, PROD]
       environment:
         type: enum
-        enum: [dev, production]
+        enum:
+        - dev
+        - prod
     environment:
-      AWS_REGION: us-east-1
-      AWS_DEFAULT_REGION: us-east-1
-      AWS_STS_REGIONAL_ENDPOINTS: regional
-      APPNAME: forms-api-v6
+      DEPLOY_ENV: << parameters.environment >>
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - attach_workspace:
+        at: /tmp/release
+    - run:
+        name: Promote a scanned digest with repository-bound OIDC
+        command: |
+          set +x
+          set -euo pipefail
+          test -f "deploy/${DEPLOY_ENV}.json"
+          docker load --input /tmp/release/image.tar
+          python3 -I deploy/release.py "deploy/${DEPLOY_ENV}.json"
+        no_output_timeout: 45m
+  deployment-checks:
+    executor: reviewed
     steps:
-      - checkout
-      - setup_remote_docker
-      - install-dependencies
-      - run:
-          name: Verify first-release activation and rollback handling
-          command: python3 -m unittest discover -s deploy/tests
-      - run:
-          name: Build runtime and one-shot migration images
-          command: |
-            docker buildx build --load --target migrate -t forms-api-v6:migrate-candidate .
-            docker buildx build --load --target runtime -t forms-api-v6:latest .
-      - run:
-          name: Migrate and deploy using the Topcoder deployment suite
-          no_output_timeout: 35m
-          command: |
-            git clone --quiet --depth 1 --branch v1.4.20 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript
-            test "$(git -C ../buildscript rev-parse HEAD)" = 5f3745c35463ce0e2475c12269aa7a2b446456e5
-            cp ../buildscript/{master_deploy,buildenv,awsconfiguration,psvar-processor}.sh .
-            ./awsconfiguration.sh << parameters.deploy_env >>
-            set +x
-            source awsenvconf
-            ./psvar-processor.sh -t appenv -p "/config/${APPNAME}/deployvar"
-            source deployvar_env
-            python3 -u deploy/release.py << parameters.environment >> "<< parameters.environment >>-${CIRCLE_SHA1}-${CIRCLE_BUILD_NUM}"
-            ./master_deploy.sh \
-              -d ECS \
-              -e << parameters.deploy_env >> \
-              -t latest \
-              -j "/config/${APPNAME}/appvar,/config/common/global-appvar" \
-              -i "$APPNAME" \
-              -p FARGATE
-            python3 -u deploy/activate.py
-      - store_artifacts:
-          path: deploy/release-<< parameters.environment >>.json
-          destination: release
-
+    - checkout-source
+    - checkout-suite
+    - run:
+        name: Test migration, activation and rollback gates
+        command: python3 -m unittest discover -s deploy/tests -q
 workflows:
-  build-and-deploy:
+  release:
     jobs:
-      - deploy:
-          name: deploy-dev
-          context: org-global
-          deploy_env: DEV
-          environment: dev
-          serial-group: << pipeline.project.slug >>/deploy-dev
-          filters:
-            branches:
-              only: develop
-      - deploy:
-          name: deploy-production
-          context: org-global
-          deploy_env: PROD
-          environment: production
-          serial-group: << pipeline.project.slug >>/deploy-production
-          filters:
-            branches:
-              only: master
+    - deployment-checks
+    - build:
+        requires:
+        - deployment-checks
+    - deploy:
+        name: deploy-dev
+        environment: dev
+        requires:
+        - build
+        context: forms-api-v6-dev-deploy
+        serial-group: << pipeline.project.slug >>/deploy-dev
+        filters:
+          branches:
+            only: develop
+          tags:
+            ignore: /.*/
+    - approve-prod:
+        type: approval
+        requires:
+        - build
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/
+    - deploy:
+        name: deploy-prod
+        environment: prod
+        requires:
+        - approve-prod
+        context: forms-api-v6-prod-deploy
+        serial-group: << pipeline.project.slug >>/deploy-prod
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/

.gitignore

@@ -10,3 +10,7 @@ src/generated/
 
 __pycache__/
 *.pyc
+
+# Infrastructure definitions and detailed AWS inventories are maintained privately.
+/deploy/iam/
+/deploy/*-baseline.json

.nvmrc

@@ -1 +1 @@
-26.8.1
+26.12.1

Dockerfile

@@ -1,31 +1,44 @@
-FROM node:26.8.1-bookworm-slim AS base
-RUN apt-get update && apt-get install -y --no-install-recommends openssl ca-certificates && rm -rf /var/lib/apt/lists/*
-RUN npm install --global pnpm@11.21.0
+ARG NODE_VERSION=26.12.1
+FROM node:${NODE_VERSION}-alpine AS dependencies
+RUN apk add --no-cache openssl ca-certificates \
+    && npm install --global pnpm@11.21.0
 WORKDIR /app
 COPY deploy/certs/us-east-1-bundle.pem /app/deploy/certs/us-east-1-bundle.pem
 ENV NODE_EXTRA_CA_CERTS=/app/deploy/certs/us-east-1-bundle.pem
-
-FROM base AS dependencies
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY tools ./tools
 RUN pnpm install --frozen-lockfile
 
 FROM dependencies AS build
 COPY . .
-RUN pnpm build
-
-# Separate one-shot migration image: runtime does not ship the Prisma CLI or CMS dev dependencies.
-FROM build AS migrate
-CMD ["pnpm", "migrate:deploy"]
+RUN pnpm lint && pnpm build && pnpm typecheck && pnpm test && pnpm test:dependency-compat
 
 FROM dependencies AS production-dependencies
 RUN pnpm prune --prod
 
-FROM base AS runtime
+FROM alpine:3.24 AS runtime-base
+ARG NODE_VERSION
 ENV NODE_ENV=production
-COPY --from=production-dependencies --chown=node:node /app/node_modules ./node_modules
-COPY --from=build --chown=node:node /app/dist/src ./dist/src
-COPY --chown=node:node package.json ./
-USER node
+WORKDIR /app
+RUN apk upgrade --no-cache \
+    && apk add --no-cache openssl ca-certificates "nodejs-current~${NODE_VERSION%%.*}" \
+    && addgroup -S -g 10001 app \
+    && adduser -S -D -u 10001 -G app app
+COPY deploy/certs/us-east-1-bundle.pem /app/deploy/certs/us-east-1-bundle.pem
+ENV NODE_EXTRA_CA_CERTS=/app/deploy/certs/us-east-1-bundle.pem
+USER app
+
+# One-shot migration image; invoke the installed CLI without shipping npm/pnpm.
+FROM runtime-base AS migrate
+COPY --from=build --chown=app:app /app/node_modules ./node_modules
+COPY --chown=app:app package.json prisma.config.ts ./
+COPY --chown=app:app prisma ./prisma
+CMD ["node", "node_modules/prisma/build/index.js", "migrate", "deploy"]
+
+FROM runtime-base AS runtime
+COPY --from=production-dependencies --chown=app:app /app/node_modules ./node_modules
+COPY --from=build --chown=app:app /app/dist/src ./dist/src
+COPY --chown=app:app package.json ./
 EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s CMD ["node", "-e", "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/v6/health/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
 CMD ["node", "dist/src/main.js"]

README.md

@@ -14,7 +14,7 @@ All tables and views live in the `forms` schema; dev uses the shared `topcoder-s
 
 ## Stack
 
-- Node **26.8.1**, pinned in `.nvmrc` and Docker; current release verified against the [Node release listing](https://nodejs.org/en/download/current) on September 9, 2026.
+- Node **26.12.1**, pinned in `.nvmrc` and the Docker build.
 - NestJS **11.1.28**, matching the other v6 services and the supported peer range of Nest Throttler.
 - TypeScript **5.9.3**, strict checking and decorator metadata.
 - Prisma **7.10.0**, generated TypeScript client and `@prisma/adapter-pg`.
@@ -106,3 +106,32 @@ Coverage includes actual PostgreSQL writes, all field types, SQL views, CSV outp
 Forms portal endpoints, inclusive UTC date filtering, and full CSV exports are
 specified in [docs/api.md](docs/api.md). The dev and production `/lets-talk` migration,
 Kafka contract, seed command, and rollout order are in [docs/lets-talk.md](docs/lets-talk.md).
+
+## Shared authentication and bus client (v6 refresh)
+
+This branch uses `tc-core-library-js` **4.0.0-rc.1**. Use its named
+`createJwtVerifier` / `createJwtAuthenticator`, `createM2MClient`, and
+`createBusApiClient` exports for shared authentication and bus API publishing.
+Service-specific roles, scopes, sessions and ownership checks remain in this service.
+The former bus wrapper dependency and local JWT cryptography must not be reintroduced.
+
+RSA verification requires an exact configured issuer and audience (`JWT_AUDIENCE`
+for client tokens, `AUTH0_AUDIENCE` for machine/API tokens, or this service's explicit
+issuer-policy settings). HMAC secrets must be at least 32 bytes; no default secret
+is supplied. Expiry is enforced. Machine identity comes from the shared verifier,
+not the presence of scopes. Supply real development credentials through the service's
+existing environment configuration before deployment.
+
+Bus publishers use `createBusApiClient(config).postEvent(event)` with the existing
+event envelope and optional key. Configure `BUSAPI_URL` for v6 and the existing
+OAuth credentials/token provider. The client uses bounded HTTPS requests and does
+not retry POSTs automatically. Application retry/outbox behavior remains local.
+
+See the [core migration guide](https://github.com/topcoder-platform/tc-core-library-js/blob/v4.0.0-rc.1/MIGRATION.md)
+for the API mapping, compatibility requirements, and rollout scope.
+
+## Security maintenance
+
+The runtime and one-shot migration images use Alpine 3.24's patched Node 26 package and run as UID 10001. The runtime contains only production dependencies and compiled code. Migration tasks invoke the installed Prisma CLI directly with Node; npm and pnpm are not shipped in either final image. The RDS CA bundle and `NODE_EXTRA_CA_CERTS` remain configured in both images.
+
+The lockfile pins patched dependencies and an immutable shared core revision. `pnpm test:dependency-compat` verifies the legacy matcher adapter. Integration fixtures use real RS256 machine tokens with an isolated JWKS endpoint, so the shared verifier's issuer, signature, audience, and machine-identity restrictions remain enabled.

deploy/MIGRATION.md

@@ -0,0 +1,44 @@
+# OIDC deployment migration
+
+This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.5](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.5), fetched by tag and verified against commit `bff574ab5c0b46773e25d2af1eff76675fba2ba5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role.
+
+## Production target
+
+The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `topcoder-infrastructure`, service `forms-api-v6`, family `forms-api-v6`, and container `forms-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. [prod-baseline.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/forms-api-v6/deploy/prod-baseline.json) records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline.
+
+## Infrastructure prerequisites, applied separately by an administrator
+
+1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated.
+2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/forms-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. The role and matching boundary include `inspector2:ListFindings` and `inspector2:ListCoverage` restricted to the deployment region; these scan-metadata APIs require `Resource: "*"`. Secret-access denies remain explicit.
+3. Configure ECR repository `forms-api-v6` with unconditional `IMMUTABLE` tags and supported scanning. Preserve existing enhanced scanning where enabled. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest.
+4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback; the Forms-specific first-activation rule is described below. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs.
+5. Create restricted `forms-api-v6-dev-deploy` and `forms-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs.
+
+## Development acceptance before merge/release
+
+Read-only inventory on 2026-11-04 verified `dev.json` against the actual development service, task/execution roles and image repositories. This PR targets `develop`. Matching IAM templates and detailed baselines remain private. **Keep this PR in draft until the service-specific prerequisites below are complete.** No AWS or CircleCI resources were provisioned by this refresh.
+
+- Install the service deployment role and matching permissions boundary.
+- Create the restricted empty CircleCI deployment context.
+- Review and install the dev container health-check proposal; preserve all other task configuration.
+- Verify one-shot migration secret/execution-role grants and migration-before-runtime promotion in dev.
+
+Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification.
+
+The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5`. Python/AWS CLI/Buildx/Git compatibility was tested with the shared offline suite. No package installation or service build runs in the deployment job. The Dockerfile retains the existing in-image quality gates. This PR does not deploy, change IAM, rotate credentials, or claim a successful live rollout.
+
+## Forms migration and first activation
+
+The adapter preserves the stable-stack/environment/bootstrap checks, runs the separate migration image as a private one-shot task, and requires exit code zero plus the exact scanned image digest before runtime promotion. Both images are built without credentials and scanned before either executes. The migration image runs as non-root. The only added permissions are the exact migration task family and read access to the existing Forms stack; the deployment role still cannot read parameter values. ECS resolves the migration database secret through the existing execution role.
+
+Unlike the default CLI, this reviewed adapter retains Forms first activation: an existing zero-capacity service is started at one replica only after the infrastructure bootstrap and migration gates pass. Existing positive capacity is preserved. Runtime read-back, concurrency, digest/health and rollback checks must pass. Migration waiting is bounded to 15 minutes and runtime observation to 20 minutes, within the one-hour STS session; a timeout fails without pretending the rollout succeeded. Test both first activation and failed migration in dev.
+
+## Infrastructure source
+
+IAM templates and detailed AWS baselines are maintained in the private [v6-services-iac service directory](https://github.com/topcoder-platform/v6-services-iac/tree/main/services/forms-api-v6). Provision infrastructure separately with an administrator identity; application CI does not fetch that repository or install IAM. Required application manifests and health-check proposals remain here.
+
+## Dev branch refresh
+
+This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Keep this PR in draft until its documented infrastructure and integration prerequisites are met. Updating these files does not provision AWS or CircleCI resources.
+
+Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts.