Test

.github/workflows/cypress-e2e-runner.yml

@@ -5,16 +5,28 @@ name: Cypress E2E (runner)
 # Unlike Grants, this doesn't run Cypress on the GitHub-hosted runner directly —
 # the Unity Grant Manager Route is IP-allowlisted to the BC Gov network, which
 # GitHub-hosted runners can't reach. Instead this job launches an OpenShift Job
-# (from the unity-cypress-job Template in d18498-tools) that runs the existing
+# (from the unity-cypress-job Template in ce395f-tools) that runs the existing
 # Unity.AutoUI Cypress suite from inside the cluster, waits for it to finish,
 # and pulls the logs/screenshots back into this Actions run.
 #
+# This deliberately targets ce395f-tools on the Gold cluster, not d18498-tools
+# on Silver, even though the app environments (dev/test/uat/prod) still run on
+# Silver during the cluster migration — the Job's own baseUrl (via the
+# base_url input, or each cypress-config-*.json's default) is what it tests
+# against, independent of which cluster runs the Job itself. Building the CI
+# plumbing against the migration target now avoids redoing it later.
+#
 # Test credentials are NOT GitHub secrets — the Job pulls them from the
-# unity-cypress-config Secret in d18498-tools, synced from Vault
+# unity-cypress-config Secret in ce395f-tools, synced from Vault
 # (GH_UGM_CYPRESS_CONFIG) via External Secrets.
 #
-# OpenShift auth reuses the same oc-login pattern already used by
-# docker-build-dev.yml/docker-build-test.yml/docker-build-main.yml.
+# OpenShift auth reuses the pipeline ServiceAccount (ce395f-tools), which
+# already holds ClusterRole/edit there — covers everything this job needs
+# (templates, processedtemplates, jobs, pods/log, pods/exec), no additional
+# RBAC required. Its token is CYPRESS_OPENSHIFT_TOKEN and its cluster is
+# CYPRESS_OPENSHIFT_CLUSTER — both repo-level (not tied to a GitHub
+# Environment, and deliberately separate from the shared OPENSHIFT_CLUSTER
+# var docker-build-*.yml uses, since that one still points at Silver).
 
 on:
   workflow_call:
@@ -32,27 +44,21 @@ on:
         required: false
         type: string
         default: ""
-      gh_environment:
-        description: "GitHub Environment to source OpenShift credentials from (defaults to env_name — dev/test have their own; uat/prod reuse 'main')"
-        required: false
-        type: string
-        default: ""
 
 permissions:
   contents: read
 
 env:
-  TOOLS_NAMESPACE: d18498-tools
-  JOB_TIMEOUT: 20m
+  TOOLS_NAMESPACE: ce395f-tools
+  JOB_TIMEOUT_SECONDS: 1200
 
 jobs:
   cypress:
     name: Cypress E2E — ${{ inputs.env_name }}
     runs-on: ubuntu-latest
-    environment: ${{ inputs.gh_environment || inputs.env_name }}
     env:
-      OC_CLUSTER: ${{ vars.OPENSHIFT_CLUSTER }}
-      OC_AUTH_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
+      OC_CLUSTER: ${{ vars.CYPRESS_OPENSHIFT_CLUSTER }}
+      OC_AUTH_TOKEN: ${{ secrets.CYPRESS_OPENSHIFT_TOKEN }}
       GH_TOKEN: ${{ secrets.GH_API_TOKEN }}
 
     steps:
@@ -68,9 +74,9 @@ jobs:
       - name: Launch Cypress Job
         id: launch
         run: |
-          # The unity-cypress-job Template lives in the tenant-gitops-d18498 repo
+          # The unity-cypress-job Template lives in the tenant-gitops-ce395f repo
           # and is synced into the cluster by ArgoCD — process it by name directly
-          # from d18498-tools rather than checking out that repo here.
+          # from ce395f-tools rather than checking out that repo here.
           JOB_REF=$(oc process unity-cypress-job \
             -p ENV=${{ inputs.env_name }} \
             -p CYPRESS_CONFIG_KEY=${{ inputs.cypress_config_key }} \
@@ -85,15 +91,30 @@ jobs:
       - name: Wait for Cypress Job to finish
         id: wait
         run: |
+          # Don't use `oc wait --for=condition=complete/failed` here: a freshly
+          # created Job has no .status.conditions entries yet, and
+          # --for=condition=X (without an explicit =true) is satisfied the
+          # instant the condition is merely absent rather than false — so it
+          # can report "condition met" seconds after creation, long before the
+          # Job has actually run. Poll the numeric succeeded/failed fields
+          # instead, which are only set once a pod genuinely finishes.
           JOB_REF="${{ steps.launch.outputs.job_ref }}"
-          oc wait --for=condition=complete --timeout=$JOB_TIMEOUT "$JOB_REF" -n $TOOLS_NAMESPACE &
-          COMPLETE_PID=$!
-          oc wait --for=condition=failed --timeout=$JOB_TIMEOUT "$JOB_REF" -n $TOOLS_NAMESPACE &
-          FAILED_PID=$!
-          wait -n $COMPLETE_PID $FAILED_PID || true
-          kill $COMPLETE_PID $FAILED_PID 2>/dev/null || true
+          DEADLINE=$(( $(date +%s) + JOB_TIMEOUT_SECONDS ))
+          SUCCEEDED=0
+          FAILED=0
+          while true; do
+            SUCCEEDED=$(oc get "$JOB_REF" -n $TOOLS_NAMESPACE -o jsonpath='{.status.succeeded}')
+            FAILED=$(oc get "$JOB_REF" -n $TOOLS_NAMESPACE -o jsonpath='{.status.failed}')
+            if [ "${SUCCEEDED:-0}" -ge 1 ] 2>/dev/null || [ "${FAILED:-0}" -ge 1 ] 2>/dev/null; then
+              break
+            fi
+            if [ "$(date +%s)" -ge "$DEADLINE" ]; then
+              echo "Timed out after ${JOB_TIMEOUT_SECONDS}s waiting for $JOB_REF"
+              break
+            fi
+            sleep 10
+          done
 
-          SUCCEEDED=$(oc get "$JOB_REF" -n $TOOLS_NAMESPACE -o jsonpath='{.status.succeeded}')
           echo "succeeded=${SUCCEEDED:-0}" >> "$GITHUB_OUTPUT"
 
       - name: Show Cypress logs

.github/workflows/cypress-prod.yml

@@ -16,5 +16,4 @@ jobs:
     with:
       env_name: prod
       cypress_config_key: CYPRESS_CONFIG_PROD
-      gh_environment: main
     secrets: inherit

.github/workflows/cypress-uat.yml

@@ -5,8 +5,6 @@ name: Cypress E2E — UAT
 #
 # Unity has no separate UAT build workflow — UAT deploys off the main build,
 # so this triggers off the same workflow_run as prod's build pipeline.
-# There's also no "uat" GitHub Environment today, so oc-login reuses the
-# "main" Environment's OpenShift credentials (same cluster-wide access).
 #
 # Runs Cypress inside OpenShift (d18498-tools) — see cypress-e2e-runner.yml.
 
@@ -26,5 +24,4 @@ jobs:
     with:
       env_name: uat
       cypress_config_key: CYPRESS_CONFIG_UAT
-      gh_environment: main
     secrets: inherit

.github/workflows/docker-build-dev.yml

@@ -24,7 +24,9 @@ env:
   GH_TOKEN: ${{secrets.GH_API_TOKEN}}
   OC_CLUSTER: ${{ vars.OPENSHIFT_CLUSTER }}
   OC_REGISTRY: ${{ vars.OPENSHIFT_REGISTRY }}
-  OC_AUTH_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
+  OC_TOOLS_TOKEN: ${{ secrets.TOOLS_OPENSHIFT_TOKEN }}
+  OC_TOOLS_PROJECT: ${{ vars.TOOLS_OPENSHIFT_NAMESPACE }}
+  OC_TARGET_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
   OC_TARGET_PROJECT: ${{ vars.OPENSHIFT_NAMESPACE }}
   JFROG_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
   JFROG_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
@@ -47,7 +49,7 @@ jobs:
       run: |
         echo "Target: $TARGET_ENV"
         echo "BaseRef: $GITHUB_REF_NAME"
-        echo "Environment: $TARGET_ENV OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
+        echo "Environment: $TARGET_ENV OC_TOOLS_PROJECT=$OC_TOOLS_PROJECT OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
         echo "Environment: $TARGET_ENV JFROG_REPO_PATH=$JFROG_REPO_PATH"
         echo "..."
         env | sort
@@ -124,36 +126,46 @@ jobs:
         docker build --build-arg UNITY_BUILD_VERSION=${{env.UGM_BUILD_VERSION}} --build-arg UNITY_BUILD_REVISION=${{env.UGM_BUILD_REVISION}} -t unity-grantmanager-web -f src/Unity.GrantManager.Web/Dockerfile .
         docker build -t unity-grantmanager-dbmigrator -f src/Unity.GrantManager.DbMigrator/Dockerfile .
       working-directory: ./applications/Unity.GrantManager
-    - name: Connect to JFrog Artifactory non-interactive login using --password-stdin
-      run: |
-        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
     - name: Push application images to Artifactory container registry
+      continue-on-error: true
       run: |
+        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
         docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
         docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
         docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
-    - name: Disconnect docker from JFrog Artifactory
-      run: |
-        docker logout
+        docker logout $JFROG_SERVICE
     - name: Install OpenShift CLI
       run: |
           curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
           tar -xvf oc.tar.gz
           sudo mv oc /usr/local/bin
     - name: Verify OpenShift CLI installation
       run: oc version
-    - name: Connect to OpenShift API non-interactive login using current session token
+    - name: Push application images into ce395f-tools
       run: |
-        oc login --token=$OC_AUTH_TOKEN --server=$OC_CLUSTER
+        oc login --token=$OC_TOOLS_TOKEN --server=$OC_CLUSTER
         oc registry login
         docker login -u unused -p $(oc whoami -t) $OC_REGISTRY
-    - name: Push application images to OpenShift container registry
+        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest
+        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest
+        docker push $OC_REGISTRY/$OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest
+        docker logout $OC_REGISTRY
+    - name: Promote dbMigrator into ce395f-dev and run migrations
       run: |
-        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-dbmigrator
-        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web
-        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/unity-grantmanager-web
-    - name: Disconnect docker from OpenShift container registry
+        oc login --token=$OC_TARGET_TOKEN --server=$OC_CLUSTER
+        oc tag $OC_TOOLS_PROJECT/$TARGET_ENV-unity-dbmigrator-build:latest $OC_TARGET_PROJECT/$TARGET_ENV-unity-dbmigrator:latest
+        oc -n $OC_TARGET_PROJECT delete jobs $TARGET_ENV-unity-dbmigrator --ignore-not-found=true
+        oc -n $OC_TARGET_PROJECT process unity-grantmanager-dbmigrator-job \
+          -p APPLICATION_GROUP=$TARGET_ENV-unity-grantmanager \
+          -p DATABASE_SERVICE_NAME=$TARGET_ENV-unity-data-postgres \
+          -p APPLICATION_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGEPULL_NAMESPACE=$OC_TARGET_PROJECT \
+          -p IMAGESTREAM_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGESTREAM_TAG=latest | oc -n $OC_TARGET_PROJECT create -f -
+        oc -n $OC_TARGET_PROJECT wait jobs/$TARGET_ENV-unity-dbmigrator --for condition=complete --timeout=300s
+    - name: Promote grantmanager-web into ce395f-dev and wait
       run: |
-        docker logout
+        oc tag $OC_TOOLS_PROJECT/$TARGET_ENV-unity-grantmanager-build:latest $OC_TARGET_PROJECT/$TARGET_ENV-unity-grantmanager:latest
+        oc -n $OC_TARGET_PROJECT rollout status deployment/$TARGET_ENV-unity-grantmanager-web --timeout=180s

.github/workflows/docker-build-dev2.yml

@@ -0,0 +1,124 @@
+name: Dev2 - Build & Push docker images
+
+on:
+  push:
+    branches: [ "dev2" ]
+    paths-ignore:
+      - '.github/**'
+      - '.gitignore'
+      - 'database/**'
+      - 'documentation/**'
+      - '**/docs/**'
+      - '**/README*'
+      - 'CODE_OF_CONDUCT.md'
+      - 'COMPLIANCE.yaml'
+      - 'CONTRIBUTING.md'
+      - 'LICENSE'
+      - 'README.md'
+      - 'SECURITY.md'
+  # Allow manual workflow triggering
+  workflow_dispatch:
+
+env:
+  TARGET_ENV: dev2
+  GH_TOKEN: ${{secrets.GH_API_TOKEN}}
+  OC_CLUSTER: ${{ vars.OPENSHIFT_CLUSTER }}
+  OC_REGISTRY: ${{ vars.OPENSHIFT_REGISTRY }}
+  OC_TARGET_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
+  OC_TARGET_PROJECT: ${{ vars.OPENSHIFT_NAMESPACE }}
+  JFROG_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
+  JFROG_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
+  JFROG_REPO_PATH: ${{ vars.ARTIFACTORY_REPO }}
+  JFROG_SERVICE:  ${{ vars.ARTIFACTORY_SERVICE }}
+
+jobs:
+  Setup:
+    runs-on: ubuntu-latest
+    environment: dev2
+    permissions:
+      contents: read
+    steps:
+    - name: Get variables
+      run: |
+        echo "Target: $TARGET_ENV"
+        echo "BaseRef: $GITHUB_REF_NAME"
+        echo "Environment: $TARGET_ENV OC_TARGET_PROJECT=$OC_TARGET_PROJECT"
+        echo "Environment: $TARGET_ENV JFROG_REPO_PATH=$JFROG_REPO_PATH"
+        echo "..."
+        env | sort
+  Branch:
+    needs: [Setup]
+    runs-on: ubuntu-latest
+    environment: dev2
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+          fetch-depth: '1'
+    - name: Get short commitId
+      id: get_commit
+      run: |
+        echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+    outputs:
+      SHA_SHORT: ${{steps.get_commit.outputs.SHA_SHORT}}
+  Build:
+    needs: [Setup,Branch]
+    runs-on: ubuntu-latest
+    environment: dev2
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@v6
+    - name: Resolve build version (from dev) and revision (dev2's own commit)
+      run: |
+        echo "UGM_BUILD_VERSION=$(gh variable get UGM_BUILD_VERSION --env dev)" >> $GITHUB_ENV
+        echo "UGM_BUILD_REVISION=${{needs.Branch.outputs.SHA_SHORT}}" >> $GITHUB_ENV
+    - name: Build Docker images
+      run: |
+        rm -f ./docker-compose.override.yml
+        docker build --build-arg UNITY_BUILD_VERSION=${{env.UGM_BUILD_VERSION}} --build-arg UNITY_BUILD_REVISION=${{env.UGM_BUILD_REVISION}} -t unity-grantmanager-web -f src/Unity.GrantManager.Web/Dockerfile .
+        docker build -t unity-grantmanager-dbmigrator -f src/Unity.GrantManager.DbMigrator/Dockerfile .
+      working-directory: ./applications/Unity.GrantManager
+    - name: Push application images to Artifactory container registry
+      continue-on-error: true
+      run: |
+        echo "$JFROG_PASSWORD" | docker login -u "$JFROG_USERNAME" --password-stdin $JFROG_SERVICE
+        docker tag unity-grantmanager-dbmigrator $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-dbmigrator:latest
+        docker tag unity-grantmanager-web $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
+        docker push $JFROG_SERVICE/$JFROG_REPO_PATH/unity-grantmanager-web:latest
+        docker logout $JFROG_SERVICE
+    - name: Install OpenShift CLI
+      run: |
+          curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz
+          tar -xvf oc.tar.gz
+          sudo mv oc /usr/local/bin
+    - name: Verify OpenShift CLI installation
+      run: oc version
+    - name: Push application images into ce395f-dev (no ce395f-tools hop for dev2)
+      run: |
+        oc login --token=$OC_TARGET_TOKEN --server=$OC_CLUSTER
+        oc registry login
+        docker login -u unused -p $(oc whoami -t) $OC_REGISTRY
+        docker tag unity-grantmanager-dbmigrator $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-dbmigrator:latest
+        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-dbmigrator:latest
+        docker tag unity-grantmanager-web $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-grantmanager:latest
+        docker push $OC_REGISTRY/$OC_TARGET_PROJECT/$TARGET_ENV-unity-grantmanager:latest
+        docker logout $OC_REGISTRY
+    - name: Run dbMigrator Job
+      run: |
+        oc -n $OC_TARGET_PROJECT delete jobs $TARGET_ENV-unity-dbmigrator --ignore-not-found=true
+        oc -n $OC_TARGET_PROJECT process unity-grantmanager-dbmigrator-job \
+          -p APPLICATION_GROUP=$TARGET_ENV-unity-grantmanager \
+          -p DATABASE_SERVICE_NAME=$TARGET_ENV-unity-data-postgres \
+          -p APPLICATION_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGEPULL_NAMESPACE=$OC_TARGET_PROJECT \
+          -p IMAGESTREAM_NAME=$TARGET_ENV-unity-dbmigrator \
+          -p IMAGESTREAM_TAG=latest | oc -n $OC_TARGET_PROJECT create -f -
+        oc -n $OC_TARGET_PROJECT wait jobs/$TARGET_ENV-unity-dbmigrator --for condition=complete --timeout=300s
+    - name: Roll out grantmanager-web and wait
+      run: |
+        oc -n $OC_TARGET_PROJECT rollout restart deployment/$TARGET_ENV-unity-grantmanager-web
+        oc -n $OC_TARGET_PROJECT rollout status deployment/$TARGET_ENV-unity-grantmanager-web --timeout=180s