Release/07 21 2026

.github/workflows/app_ci_pipeline.yml

@@ -27,16 +27,18 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           cache: "npm"
           cache-dependency-path: "app/package-lock.json"
+      - name: Install safe-chain
+        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.5.12/install-safe-chain.sh | sh -s -- --ci
       - name: Install Node.js dependencies
-        run: npm ci
+        run: npm ci --safe-chain-minimum-package-age-hours=168
       - name: Sandworm Audit
         run: npm run sandworm
 
@@ -77,7 +79,7 @@ jobs:
         node-version: [22.x]
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Node.js
@@ -96,7 +98,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Node.js
@@ -120,7 +122,7 @@ jobs:
         node-version: [22.x]
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Node.js
@@ -137,7 +139,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Node.js
@@ -162,7 +164,7 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup Node.js

.github/workflows/executor_ci_pipeline.yml

@@ -0,0 +1,36 @@
+name: executor-ci-pipeline
+
+on:
+  pull_request:
+    branches: [main, development]
+    paths:
+      - "executor/**"
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: ./executor 
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        python-version: ["3.12"]
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install safe-chain
+        run: curl -fsSL https://github.com/AikidoSec/safe-chain/releases/download/1.5.12/install-safe-chain.sh | sh -s -- --ci
+      - name: Install Python dependencies
+        run: pip install -r requirements.txt --safe-chain-minimum-package-age-hours=168

.github/workflows/linting.yml

@@ -17,12 +17,12 @@ jobs:
         python-version: ["3.12"]
     steps: 
     - name: Checkout Repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         ref: ${{ github.head_ref }}
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies

.github/workflows/semantic_version_compare.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout Compare Branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{github.ref}}
           persist-credentials: false
@@ -31,7 +31,7 @@ jobs:
           echo "${new_version}"
 
       - name: Checkout Base Branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{github.event.pull_request.base.ref}}
           persist-credentials: false

app/Dockerfile

@@ -1,28 +1,24 @@
 FROM public.ecr.aws/docker/library/node:22-alpine
 
-WORKDIR /usr/src/app
+RUN adduser -D -s /bin/sh app && mkdir -p /usr/src/app && chown app:app /usr/src/app
+# symlink for prisma/openssl issue on alpine: https://github.com/nodejs/docker-node/issues/2175#issuecomment-2530130523
+RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3
 
-COPY . .
+USER app
+WORKDIR /usr/src/app
 
-# RUN apk add --no-cache --virtual .build-deps python3 make g++ \
-#   && npm ci \
-#   && apk del .build-deps
+COPY --chown=app:app package.json package-lock.json ./
 RUN npm ci
 
+COPY --chown=app:app . .
 
 RUN wget https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
 
 ARG GIT_HASH=${GIT_HASH:-undefined_hash}
 
-# symlink for prisma/openssl issue on alpine: https://github.com/nodejs/docker-node/issues/2175#issuecomment-2530130523
-RUN ln -s /usr/lib/libssl.so.3 /lib/libssl.so.3 
 RUN npm run prisma:generate-client
 RUN npm run api:build
 
-RUN adduser -H -D -s /bin/sh app && \
-    chown -R app:app /usr/src/app
-USER app
-
 EXPOSE 5000
 ENTRYPOINT [ "npm" ]
 CMD ["run", "api:start-deployed"]

app/api/.env.copyme

@@ -42,3 +42,11 @@ EDU_SNOWFLAKE_ROLE=
 
 OAUTH2_ISSUER=http://localhost:8080/realms/example
 OAUTH2_AUDIENCE=runway-local
+
+ # for tenant sync
+UM_SYNC_CRON="0 0 * * *" 
+UM_URL=https://api.admin.internal-dev.edanalytics.app
+# UM_AUTH0_DOMAIN=ea-apps-internal-dev.us.auth0.com
+# UM_CLIENT_ID=<get from keeper>
+# UM_CLIENT_SECRET=<get from keeper>
+# UM_AUDIENCE=https://admin.internal-dev.edanalytics.app

app/api/buildspec.yml

@@ -1,5 +1,8 @@
 version: 0.2
 phases:
+  install:
+    commands:
+      - docker buildx create --name containerd --driver=docker-container --driver-opt default-load=true --use
   pre_build:
     commands:
       - pwd
@@ -9,16 +12,23 @@ phases:
       - export ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
       - export ECR_REPO=$ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/$ECR_REPO_NAME
       - export DOCKER_TAG=$ECR_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION
-      - export DOCKER_CACHE=$ECR_REPO:latest
+      - export DOCKER_LATEST=$ECR_REPO:latest
       - aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $ECR_REPO
       - env
   build:
     commands:
-      - docker pull $DOCKER_CACHE || true
-      - docker build --cache-from $DOCKER_CACHE --build-arg GIT_HASH=${CODEBUILD_RESOLVED_SOURCE_VERSION} -t $DOCKER_TAG .
-      - docker tag $DOCKER_TAG $DOCKER_CACHE
+      - >-
+        docker buildx build
+        --cache-to type=inline,ref=${DOCKER_LATEST},mode=min
+        --cache-from type=registry,ref=${DOCKER_LATEST}
+        --tag ${DOCKER_TAG}
+        --builder=containerd
+        --build-arg GIT_HASH=${CODEBUILD_RESOLVED_SOURCE_VERSION}
+        --progress=plain
+        .
+      - docker tag $DOCKER_TAG $DOCKER_LATEST
       - docker push $DOCKER_TAG
-      - docker push $DOCKER_CACHE
+      - docker push $DOCKER_LATEST
   post_build:
     commands:
       - envsubst < Dockerrun.aws.template.json > Dockerrun.aws.json
@@ -27,4 +37,4 @@ artifacts:
   files:
     - .ebextensions/**/*
     - .platform/**/*
-    - Dockerrun.aws.json
+    - Dockerrun.aws.json

app/api/integration/factories/partner-user-tenant.ts

@@ -14,11 +14,15 @@ export const makePartnerUserTenantContext = (tag: string) => {
     idpId: idp.id,
     descriptorNamespace: null,
     crossYearMatchingEnabled: false,
+    managedBy: null,
+    deletedOn: null,
   };
 
   const tenant: WithoutAudit<Tenant> = {
     code: `tenant-${tag}`,
     partnerId: partner.id,
+    isGlobal: false,
+    deletedOn: null,
   };
 
   const user: WithoutAudit<Omit<User, 'id'>> = {
@@ -74,4 +78,3 @@ export const seedContext = async (
     user,
   };
 };
-

app/api/integration/fixtures/context-fixtures/partner-fixtures.ts

@@ -8,6 +8,8 @@ export const partnerA: WithoutAudit<Partner> = {
   idpId: idpA.id,
   descriptorNamespace: 'partner-a',
   crossYearMatchingEnabled: false,
+  managedBy: null,
+  deletedOn: null,
 };
 
 export const partnerC: WithoutAudit<Partner> = {
@@ -16,6 +18,8 @@ export const partnerC: WithoutAudit<Partner> = {
   idpId: idpA.id, // shares idp with partner A
   descriptorNamespace: 'partner-c',
   crossYearMatchingEnabled: false,
+  managedBy: null,
+  deletedOn: null,
 };
 
 export const partnerX: WithoutAudit<Partner> = {
@@ -24,4 +28,6 @@ export const partnerX: WithoutAudit<Partner> = {
   idpId: idpX.id,
   descriptorNamespace: null,
   crossYearMatchingEnabled: false,
+  managedBy: null,
+  deletedOn: null,
 };