updated security.md to latest version as per HHS#1579
Open
purnesh-cit wants to merge 334 commits into
Open
Conversation
Add workflow to create ACR image.
fix quoting for id field
Update staging_create_acr_image.yml
…ents Devoptimusprime branding enhancements
Devoptimusprime azure bus emails
Update main_nihgithubportal.yml
Create main_create_acr_image.yaml
Removes dynamic env-orgs.json creation so that staging always uses a smaller set of orgs
Initial email styling changes
Styled Email CSS for NIH
Update package.json to address Dependabot High alerts
Add GitHub Actions workflows to deploy/recreate ACI container groups for both staging and production environments, and infra reference YAMLs. Workflows: - staging_nihdevgithubportalfh.yml (firehose, daily 01:00 UTC + manual) - staging_nihdevgithubportalcb.yml (cache builder, every 6h + manual) - main_nihgithubportalfh.yml (prod firehose, manual) - main_nihgithubportalcb.yml (prod cache builder, manual) Fixes: - Correct job command paths (jobs/firehose.js, jobs/refreshQueryCache.js) - Correct env var assignment: GITHUB_APP_OPERATIONS_KEY carries the PEM - All credentials sourced from GitHub Secrets (no hardcoded values) Infra reference configs in infra/aci/ document the container structure.
…ntain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ntain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ntain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…ntain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
feat: ACI container deployment workflows and infra reference configs
Replace service principal client secret with OIDC federated credential (client-id + tenant-id + subscription-id). Evergreen — no secret expiry.
fix: switch ACI workflows to OIDC federated auth
Fix az container create command flags
Fix --tags flag handling in az container create command
fix: remove --tags, not supported by az container create
feat: Terraform workflow and dev infra for log analytics workspace
…Is on image push - staging_create_acr_image.yml: replace docker/login-action (user/pass) with azure/login OIDC + az acr login; add permissions block - main_create_acr_image.yml: new workflow mirroring staging for main→prod ACR - staging/main ACI workflows: remove schedule triggers; add workflow_run trigger so ACI redeploys on new image push; add success guard; replace DEV/PROD_REGISTRY_USER/PASS secrets with az acr credential show at runtime - staging_nihdevgithubportal.yml + main_nihgithubportal.yml: replace publish-profile secrets with azure/login OIDC in deploy job - PLAN.md: add GitHub Actions Secret Reduction section; record decisions Secrets that can now be deleted: DEV_REGISTRY_USER, DEV_REGISTRY_PASS, PROD_REGISTRY_USER, PROD_REGISTRY_PASS, AZUREAPPSERVICE_PUBLISHPROFILE_34824FEBDA0F4C8CACF5CB97111CBFFB, AZUREAPPSERVICE_PUBLISHPROFILE_990190F22A5149AC859307273BAE196C
Was generating Problems tab noise; all its steps were commented out or guarded to microsoft/opensource-management-portal only. Replaced by staging_create_acr_image.yml and main_create_acr_image.yml.
…reds ACI deploy workflows now query Log Analytics workspace ID and key directly from Azure at deploy time via the existing OIDC session. No PAT required.
…VICEBUS_CONNECTIONSTRING - servicebus.ts: accept fullyQualifiedNamespace (managed identity) or connectionString - config/github.webhooks.json: map GITHUB_WEBHOOKS_SERVICEBUS_ENDPOINT to fullyQualifiedNamespace - config/github.webhooks.types.ts: make connectionString optional, add fullyQualifiedNamespace - firehose workflows: assign managed identity to ACI, use GITHUB_WEBHOOKS_SERVICEBUS_ENDPOINT instead of GITHUB_WEBHOOKS_SERVICEBUS_CONNECTIONSTRING; lookup identity at deploy time - staging_terraform_dev.yml: pass DEV_SERVICEBUS_NAMESPACE var - infra/terraform/dev: add user-assigned identity + Service Bus Data Receiver role assignment - infra/terraform/prod/: new prod Terraform (mirrors dev) - .github/workflows/main_terraform_prod.yml: new prod Terraform workflow
Reverts application/config/infra changes that should only live on staging: - lib/queues/servicebus.ts (restored to pre-managed-identity version) - config/github.webhooks.json + .types.ts - infra/terraform/dev/ (managed identity additions) - infra/terraform/prod/ (new prod Terraform) Keeps: - .github/workflows/ changes (intended for main) - eslint.config.mjs migration (required by ESLint 10; .eslintrc.js removed) Also fixes pre-existing ESLint error: #service private field was write-only
|
@purnesh-cit please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.