Promote develop to master for production

.circleci/config.yml

@@ -1,190 +1,181 @@
 version: 2.1
-
-parameters:
-  run_automatedtesting:
-    default: false
-    type: boolean
-  run_basedeployment:
-    default: true
-    type: boolean
-
-defaults: &defaults
-  docker:
-    - image: cimg/python:3.12.2-browsers
-
-install_dependency: &install_dependency
-  name: Installation of build and deployment dependencies.
-  command: |
-    # The image already contains Chrome and the Docker client. Their optional
-    # repositories can retain obsolete signing-key configuration and block or
-    # warn during otherwise unrelated package installation.
-    sudo rm -f /etc/apt/sources.list.d/google-chrome.list
-    sudo rm -f /etc/apt/sources.list.d/archive_uri-https_download_docker_com_linux_ubuntu-jammy.list
-    sudo apt-get update
-    sudo apt-get install --yes jq python3-pip
-    sudo pip3 install awscli --upgrade
-
-install_deploysuite: &install_deploysuite
-  name: Installation of install_deploysuite.
-  command: |
-    git clone --branch v1.4.17 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript
-    cp ./../buildscript/master_deploy.sh .
-    cp ./../buildscript/buildenv.sh .
-    cp ./../buildscript/awsconfiguration.sh .
-    cp ./../buildscript/psvar-processor.sh .
-
-finger_print_add: &finger_print_add
-  fingerprints:
-    - SHA256:KJYSvQh9CxkY9yRXxp+Geo6cllnfSiiKAH3LFQ/X9f4
-
-builddeploy_steps: &builddeploy_steps
-  - add_ssh_keys: *finger_print_add
-  - checkout
-  - setup_remote_docker
-  - run: *install_dependency
-  - run: *install_deploysuite
-  - run:
-      name: Build docker image
-      command: |
-        ./awsconfiguration.sh "${DEPLOY_ENV}"
-        source awsenvconf
-        ./psvar-processor.sh -t appenv -p "/config/${APPNAME}/buildvar"
-        source buildvar_env
-        rm -f awsenvconf
-        ./build.sh "${APPNAME}"
-  - deploy:
-      name: Running MasterScript.
-      command: |
-        ./awsconfiguration.sh "$DEPLOY_ENV"
-        source awsenvconf
-        ./psvar-processor.sh -t appenv -p "/config/${APPNAME}/deployvar"
-        source deployvar_env
-        ./master_deploy.sh \
-          -d ECS \
-          -e "$DEPLOY_ENV" \
-          -t latest \
-          -j "/config/common/global-appvar,/config/${APPNAME}/appvar" \
-          -i "$APPNAME" \
-          -p FARGATE
-
-        ./psvar-processor.sh -t appenv -p /config/common/qa-appvar
-        source qa-appvar_env
-        curl --request POST \
-          --url "https://circleci.com/api/v2/project/github/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME/pipeline" \
-          --header "Circle-Token: ${QA_USER_TOKEN}" \
-          --header 'content-type: application/json' \
-          --data '{"branch":"'"$CIRCLE_BRANCH"'","parameters":{"run_automatedtesting":true,"run_basedeployment":false}}'
-
+executors:
+  reviewed:
+    docker:
+    - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5
+commands:
+  checkout-source:
+    steps:
+    - run:
+        name: Check out the exact public source commit over HTTPS
+        command: |
+          set -euo pipefail
+          [[ "$CIRCLE_SHA1" =~ ^[0-9a-f]{40}$ ]]
+          export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0
+          git init --quiet .
+          git remote add origin https://github.com/topcoder-platform/resource-api-v6.git
+          git -c credential.helper= fetch --quiet --depth 1 origin "$CIRCLE_SHA1"
+          git checkout --quiet --detach FETCH_HEAD
+          test "$(git rev-parse HEAD)" = "$CIRCLE_SHA1"
+  checkout-suite:
+    steps:
+    - run:
+        name: Verify deployment suite v2.0.6
+        command: |
+          set -euo pipefail
+          git init --quiet /tmp/tc-deploy-scripts
+          git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git
+          git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.6
+          git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD
+          test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 26aaf607463d4a271c0099854c1731214215a9c5
 jobs:
-  build-dev:
-    <<: *defaults
-    environment:
-      DEPLOY_ENV: DEV
-      LOGICAL_ENV: dev
-      APPNAME: resources-api-v6
-    steps: *builddeploy_steps
-
-  build-prod:
-    <<: *defaults
+  build:
+    executor: reviewed
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - run:
+        name: Build committed source without AWS or broker credentials
+        command: |
+          set -euo pipefail
+          python3 -I /tmp/tc-deploy-scripts/build_image.py --dockerfile docker/Dockerfile --image resource-api-v6:candidate
+          mkdir -p /tmp/release
+          docker save --output /tmp/release/image.tar resource-api-v6:candidate
+        no_output_timeout: 30m
+    - persist_to_workspace:
+        root: /tmp/release
+        paths:
+        - image.tar
+  deploy:
+    executor: reviewed
+    parameters:
+      environment:
+        type: enum
+        enum:
+        - dev
+        - prod
     environment:
-      DEPLOY_ENV: PROD
-      LOGICAL_ENV: prod
-      APPNAME: resources-api-v6
-    steps: *builddeploy_steps
-
-  Run-Newman-Test:
+      DEPLOY_ENV: << parameters.environment >>
+    steps:
+    - checkout-source
+    - setup_remote_docker
+    - checkout-suite
+    - attach_workspace:
+        at: /tmp/release
+    - run:
+        name: Promote a scanned digest with repository-bound OIDC
+        command: |
+          set +x
+          set -euo pipefail
+          test -f "deploy/${DEPLOY_ENV}.json"
+          docker load --input /tmp/release/image.tar
+          python3 -I deploy/release.py "deploy/${DEPLOY_ENV}.json"
+        no_output_timeout: 45m
+  qa:
     docker:
-      - image: cimg/node:26.5.0
-        environment:
-          DEPLOY_ENV: DEV
-          LOGICAL_ENV: dev
-          APPNAME: resources-api-v6
+    - image: cimg/node@sha256:2c1320ee6a256628f698938038700911276310d40cc9887cfc8f66ec0daa4343
+      environment:
+        DEPLOY_ENV: DEV
+        LOGICAL_ENV: dev
+        APPNAME: resources-api-v6
     steps:
-      - checkout
-      - run: *install_dependency
-      - run: *install_deploysuite
-      - restore_cache:
-          keys:
-            - pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }}
-            - pnpm-store-v1-
-      - run:
-          name: Install pnpm dependencies
-          command: |
-            sudo npm install --global pnpm@11.15.1
-            pnpm install --frozen-lockfile
-            pnpm build
-      - save_cache:
-          key: pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }}
-          paths:
-            - ~/.local/share/pnpm/store
-      - run:
-          name: Newman test
-          command: |
-            ./awsconfiguration.sh "$DEPLOY_ENV"
-            source awsenvconf
-            ./psvar-processor.sh -t appenv -p /config/resources-api-v6/qaappvar
-            source qaappvar_env
-            ./psvar-processor.sh -t appenv -p /config/common/global-appvar
-            source global-appvar_env
+    - checkout-source
+    - restore_cache:
+        keys:
+        - pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }}
+        - pnpm-store-v1-
+    - run:
+        name: Install pnpm dependencies
+        command: |
+          sudo npm install --global pnpm@11.15.1
+          pnpm install --frozen-lockfile
+          pnpm build
+    - save_cache:
+        key: pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }}
+        paths:
+        - ~/.local/share/pnpm/store
+    - run:
+        name: Newman test
+        command: |
+          set +x
+          set -euo pipefail
+          : "${DATABASE_URL:?Set isolated QA database settings in the restricted QA context}"
+          : "${AUTH0_CLIENT_SECRET:?Set test-only Auth0 settings in the restricted QA context}"
+          pnpm run mock-challenge-api > /tmp/mock-challenge-api.log 2>&1 &
+          mock_pid=$!
+          NODE_ENV=test pnpm start > /tmp/resource-api.log 2>&1 &
+          app_pid=$!
+          trap 'kill "$mock_pid" "$app_pid" 2>/dev/null || true' EXIT
 
-            pnpm run mock-challenge-api > /tmp/mock-challenge-api.log 2>&1 &
-            mock_pid=$!
-            NODE_ENV=test pnpm start > /tmp/resource-api.log 2>&1 &
-            app_pid=$!
-            trap 'kill "$mock_pid" "$app_pid" 2>/dev/null || true' EXIT
-
-            health_url="http://localhost:${PORT:-3000}/${API_VERSION:-v6}/resources/health"
-            for attempt in $(seq 1 30); do
-              if curl --fail --silent "$health_url" > /dev/null; then
-                break
-              fi
-              if [[ "$attempt" == 30 ]]; then
-                cat /tmp/mock-challenge-api.log
-                cat /tmp/resource-api.log
-                exit 1
-              fi
-              sleep 1
-            done
-
-            pnpm run test:newman:clear
-            pnpm run test:newman
-            pnpm run test:newman:clear
-      - store_artifacts:
-          path: ./newman
+          health_url="http://localhost:${PORT:-3000}/${API_VERSION:-v6}/resources/health"
+          for attempt in $(seq 1 30); do
+            if curl --fail --silent "$health_url" > /dev/null; then
+              break
+            fi
+            if [[ "$attempt" == 30 ]]; then
+              exit 1
+            fi
+            sleep 1
+          done
 
+          pnpm run test:newman:clear
+          pnpm run test:newman
+          pnpm run test:newman:clear
+    - store_artifacts:
+        path: ./newman
 workflows:
-  version: 2
-  build:
-    when: << pipeline.parameters.run_basedeployment >>
-    jobs:
-      - build-dev:
-          context: org-global
-          filters:
-            branches:
-              only:
-                - develop
-                - security_july_2026
-                - hotfix/deploy
-                - PM-3458
-                - PM-5919
-      - build-prod:
-          context: org-global
-          filters:
-            branches:
-              only:
-                - master
-
-  testingflow:
-    when: << pipeline.parameters.run_automatedtesting >>
+  release:
     jobs:
-      - Hold [Performance-Testing]:
-          type: approval
-      - Run-Newman-Test:
-          context: org-global
-          requires:
-            - Hold [Performance-Testing]
-          filters:
-            branches:
-              only:
-                - develop
-                - dev-circleci
+    - build
+    - deploy:
+        name: deploy-dev
+        environment: dev
+        requires:
+        - build
+        context: resource-api-v6-dev-deploy
+        serial-group: << pipeline.project.slug >>/deploy-dev
+        filters:
+          branches:
+            only: develop
+          tags:
+            ignore: /.*/
+    - approve-prod:
+        type: approval
+        requires:
+        - build
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/
+    - deploy:
+        name: deploy-prod
+        environment: prod
+        requires:
+        - approve-prod
+        context: resource-api-v6-prod-deploy
+        serial-group: << pipeline.project.slug >>/deploy-prod
+        filters:
+          branches:
+            only: master
+          tags:
+            ignore: /.*/
+    - approve-qa:
+        type: approval
+        requires:
+        - deploy-dev
+        filters:
+          branches:
+            only: develop
+          tags:
+            ignore: /.*/
+    - qa:
+        requires:
+        - approve-qa
+        context: resource-api-v6-qa
+        filters:
+          branches:
+            only: develop
+          tags:
+            ignore: /.*/

.gitignore

@@ -72,3 +72,7 @@ src/generated/
 
 # NestJS build output.
 dist/
+
+# Infrastructure definitions and detailed AWS inventories are maintained privately.
+/deploy/iam/
+/deploy/*-baseline.json