Skip to content

Commit f932fbc

Browse files
jeafreezyjeafreezy
authored
Merge branch 'hotosm:develop' into develop
2 parents 1fc4d3b + 7fa8143 commit f932fbc

70 files changed

Lines changed: 9272 additions & 418 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env.dev.example‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,16 @@ OSM_SCOPE=read_prefs
2222
OSM_LOGIN_REDIRECT_URI=http://127.0.0.1:3500/authenticate/
2323
OSM_SECRET_KEY=dev-osm-secret-key
2424

25+
# Authentication: "legacy" or "hanko"
26+
AUTH_PROVIDER=legacy
27+
# HANKO_API_URL=https://dev.login.hotosm.org
28+
# COOKIE_SECRET=your-cookie-secret
29+
# COOKIE_DOMAIN=.hotosm.org
30+
# COOKIE_SECURE=true
31+
# JWT_AUDIENCE=
32+
# LOGIN_URL=https://dev.login.hotosm.org
33+
# OSM_REDIRECT_URI=http://127.0.0.1:8000/api/v1/auth/osm/callback/
34+
2535
ALLOWED_ORIGINS=http://127.0.0.1:3500
2636
FRONTEND_URL=http://127.0.0.1:3500
2737

@@ -34,8 +44,9 @@ EMAIL_USE_TLS=False
3444

3545
ENABLE_FAIR_PREDICTOR=True
3646

37-
## Frontend
38-
47+
## Frontend
3948

4049
VITE_BASE_API_URL="http://localhost:8200/api/v1/"
4150
VITE_FAIR_PREDICTOR_API_URL="http://localhost:8200/api/v1/fairpredictor/predict/"
51+
VITE_AUTH_PROVIDER="legacy"
52+
# VITE_HANKO_URL="https://dev.login.hotosm.org"

‎.github/workflows/docker_build.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
sudo rm -rf /usr/share/dotnet
3333
sudo rm -rf "$AGENT_TOOLSDIRECTORY"
3434
35-
- uses: actions/checkout@v4
35+
- uses: actions/checkout@v5
3636

3737
- name: Log in to the Container registry
3838
uses: docker/login-action@v3
@@ -53,13 +53,16 @@ jobs:
5353
type=semver,pattern={{major}}.{{minor}}
5454
5555
- name: Set up Docker Buildx
56-
uses: docker/setup-buildx-action@v2
56+
uses: docker/setup-buildx-action@v3
5757

5858
- name: Build and push API Docker image
5959
uses: docker/build-push-action@v6
6060
with:
6161
context: backend/
6262
file: backend/Dockerfile.API
63+
platforms: linux/amd64
64+
provenance: false
65+
sbom: false
6366
push: false
6467
tags: ${{ steps.meta_api.outputs.tags }}
6568
labels: ${{ steps.meta_api.outputs.labels }}
@@ -82,7 +85,7 @@ jobs:
8285
sudo rm -rf /usr/share/dotnet
8386
sudo rm -rf "$AGENT_TOOLSDIRECTORY"
8487
85-
- uses: actions/checkout@v4
88+
- uses: actions/checkout@v5
8689

8790
- name: Log in to the Container registry
8891
uses: docker/login-action@v3
@@ -103,13 +106,16 @@ jobs:
103106
type=semver,pattern={{major}}.{{minor}},suffix=-${{ matrix.build_type }}
104107
105108
- name: Set up Docker Buildx
106-
uses: docker/setup-buildx-action@v2
109+
uses: docker/setup-buildx-action@v3
107110

108111
- name: Build and push Worker Docker image (${{ matrix.build_type }})
109112
uses: docker/build-push-action@v6
110113
with:
111114
context: backend/
112115
file: backend/Dockerfile.workers
116+
platforms: linux/amd64
117+
provenance: false
118+
sbom: false
113119
push: false
114120
build-args: |
115121
BUILD_TYPE=${{ matrix.build_type }}
@@ -131,7 +137,7 @@ jobs:
131137
sudo rm -rf /usr/share/dotnet
132138
sudo rm -rf "$AGENT_TOOLSDIRECTORY"
133139
134-
- uses: actions/checkout@v4
140+
- uses: actions/checkout@v5
135141

136142
- name: Log in to the Container registry
137143
uses: docker/login-action@v3
@@ -152,13 +158,16 @@ jobs:
152158
type=semver,pattern={{major}}.{{minor}}
153159
154160
- name: Set up Docker Buildx
155-
uses: docker/setup-buildx-action@v2
161+
uses: docker/setup-buildx-action@v3
156162

157163
- name: Build and push Offline Predictor Docker image
158164
uses: docker/build-push-action@v6
159165
with:
160166
context: backend/
161167
file: backend/Dockerfile.API
168+
platforms: linux/amd64
169+
provenance: false
170+
sbom: false
162171
push: false
163172
build-args: |
164173
BUILD_TARGET=predictor

‎.github/workflows/docker_publish_image.yml‎

Lines changed: 67 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ on:
1414
workflow_dispatch:
1515
inputs:
1616
use_cache:
17-
description: 'Use Docker build cache'
17+
description: "Use Docker build cache"
1818
required: false
19-
default: 'true'
19+
default: "true"
2020
type: choice
2121
options:
22-
- 'true'
23-
- 'false'
22+
- "true"
23+
- "false"
2424

2525
env:
2626
REGISTRY: ghcr.io
@@ -38,7 +38,7 @@ jobs:
3838
sudo rm -rf /usr/share/dotnet
3939
sudo rm -rf "$AGENT_TOOLSDIRECTORY"
4040
41-
- uses: actions/checkout@v4
41+
- uses: actions/checkout@v5
4242

4343
- name: Log in to the Container registry
4444
uses: docker/login-action@v3
@@ -59,20 +59,39 @@ jobs:
5959
type=semver,pattern={{major}}.{{minor}}
6060
6161
- name: Set up Docker Buildx
62-
uses: docker/setup-buildx-action@v2
62+
uses: docker/setup-buildx-action@v3
6363

6464
- name: Build and push API Docker image
65+
id: build_api
6566
uses: docker/build-push-action@v6
6667
with:
6768
context: backend/
6869
file: backend/Dockerfile.API
70+
platforms: linux/amd64
71+
provenance: false
72+
sbom: false
6973
push: true
7074
tags: ${{ steps.meta_api.outputs.tags }}
7175
labels: ${{ steps.meta_api.outputs.labels }}
7276
cache-from: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.use_cache == 'false') && '' || 'type=gha,scope=api,timeout=20m' }}
7377
cache-to: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.use_cache == 'false') && '' || 'type=gha,mode=max,scope=api,timeout=20m,ignore-error=true' }}
7478
github-token: ${{ secrets.GITHUB_TOKEN }}
7579

80+
- name: Validate API manifest
81+
env:
82+
IMAGE_REF: ${{ env.REGISTRY }}/${{ github.repository_owner }}/fair-api@${{ steps.build_api.outputs.digest }}
83+
run: |
84+
json=$(docker buildx imagetools inspect --format '{{json .}}' "$IMAGE_REF")
85+
echo "$json" | jq -e '
86+
if (.manifest.manifests? | type) == "array" then
87+
(any(.manifest.manifests[]?; .platform.os == "linux" and .platform.architecture == "amd64"))
88+
and
89+
(all(.manifest.manifests[]?; (.platform.os != "unknown" and .platform.architecture != "unknown")))
90+
else
91+
(.image.os == "linux" and .image.architecture == "amd64")
92+
end
93+
' >/dev/null
94+
7695
build-and-push-worker-image:
7796
needs: build-and-push-api-image
7897
runs-on: ubuntu-24.04
@@ -88,7 +107,7 @@ jobs:
88107
sudo rm -rf /usr/share/dotnet
89108
sudo rm -rf "$AGENT_TOOLSDIRECTORY"
90109
91-
- uses: actions/checkout@v4
110+
- uses: actions/checkout@v5
92111

93112
- name: Log in to the Container registry
94113
uses: docker/login-action@v3
@@ -109,13 +128,17 @@ jobs:
109128
type=semver,pattern={{major}}.{{minor}},suffix=-${{ matrix.build_type }}
110129
111130
- name: Set up Docker Buildx
112-
uses: docker/setup-buildx-action@v2
131+
uses: docker/setup-buildx-action@v3
113132

114133
- name: Build and push Worker Docker image (${{ matrix.build_type }})
134+
id: build_worker
115135
uses: docker/build-push-action@v6
116136
with:
117137
context: backend/
118138
file: backend/Dockerfile.workers
139+
platforms: linux/amd64
140+
provenance: false
141+
sbom: false
119142
push: true
120143
build-args: |
121144
BUILD_TYPE=${{ matrix.build_type }}
@@ -125,6 +148,21 @@ jobs:
125148
cache-to: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.use_cache == 'false') && '' || format('type=gha,mode=min,scope=docker-worker-{0},timeout=20m,ignore-error=true', matrix.build_type) }}
126149
github-token: ${{ secrets.GITHUB_TOKEN }}
127150

151+
- name: Validate Worker manifest
152+
env:
153+
IMAGE_REF: ${{ env.REGISTRY }}/${{ github.repository_owner }}/fair-worker@${{ steps.build_worker.outputs.digest }}
154+
run: |
155+
json=$(docker buildx imagetools inspect --format '{{json .}}' "$IMAGE_REF")
156+
echo "$json" | jq -e '
157+
if (.manifest.manifests? | type) == "array" then
158+
(any(.manifest.manifests[]?; .platform.os == "linux" and .platform.architecture == "amd64"))
159+
and
160+
(all(.manifest.manifests[]?; (.platform.os != "unknown" and .platform.architecture != "unknown")))
161+
else
162+
(.image.os == "linux" and .image.architecture == "amd64")
163+
end
164+
' >/dev/null
165+
128166
build-and-push-offline-predictor-image:
129167
runs-on: ubuntu-24.04
130168
needs: build-and-push-api-image
@@ -137,7 +175,7 @@ jobs:
137175
sudo rm -rf /usr/share/dotnet
138176
sudo rm -rf "$AGENT_TOOLSDIRECTORY"
139177
140-
- uses: actions/checkout@v4
178+
- uses: actions/checkout@v5
141179

142180
- name: Log in to the Container registry
143181
uses: docker/login-action@v3
@@ -158,13 +196,17 @@ jobs:
158196
type=semver,pattern={{major}}.{{minor}}
159197
160198
- name: Set up Docker Buildx
161-
uses: docker/setup-buildx-action@v2
199+
uses: docker/setup-buildx-action@v3
162200

163201
- name: Build and push Offline Predictor Docker image
202+
id: build_offline_predictor
164203
uses: docker/build-push-action@v6
165204
with:
166205
context: backend/
167206
file: backend/Dockerfile.API
207+
platforms: linux/amd64
208+
provenance: false
209+
sbom: false
168210
push: true
169211
build-args: |
170212
BUILD_TARGET=predictor
@@ -173,3 +215,18 @@ jobs:
173215
cache-from: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.use_cache == 'false') && '' || 'type=gha,scope=offline-predictor,timeout=20m' }}
174216
cache-to: ${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.use_cache == 'false') && '' || 'type=gha,mode=max,scope=offline-predictor,timeout=20m,ignore-error=true' }}
175217
github-token: ${{ secrets.GITHUB_TOKEN }}
218+
219+
- name: Validate Offline Predictor manifest
220+
env:
221+
IMAGE_REF: ${{ env.REGISTRY }}/${{ github.repository_owner }}/fair-offline-predictor@${{ steps.build_offline_predictor.outputs.digest }}
222+
run: |
223+
json=$(docker buildx imagetools inspect --format '{{json .}}' "$IMAGE_REF")
224+
echo "$json" | jq -e '
225+
if (.manifest.manifests? | type) == "array" then
226+
(any(.manifest.manifests[]?; .platform.os == "linux" and .platform.architecture == "amd64"))
227+
and
228+
(all(.manifest.manifests[]?; (.platform.os != "unknown" and .platform.architecture != "unknown")))
229+
else
230+
(.image.os == "linux" and .image.architecture == "amd64")
231+
end
232+
' >/dev/null

‎.github/workflows/frontend_build.yml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,14 @@ jobs:
2323
env:
2424
CI: false
2525

26-
strategy:
27-
matrix:
28-
node-version: [18, 20, 22]
29-
3026
steps:
3127
- name: Checkout repository
32-
uses: actions/checkout@v4
28+
uses: actions/checkout@v5
3329

34-
- name: Set up Node.js ${{ matrix.node-version }}
30+
- name: Set up Node.js
3531
uses: actions/setup-node@v4
3632
with:
37-
node-version: ${{ matrix.node-version }}
33+
node-version: 22
3834

3935
- name: Install pnpm
4036
run: npm install -g pnpm

‎.github/workflows/frontend_build_push.yml‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ permissions:
1212
jobs:
1313
frontend-unit-test:
1414
uses: hotosm/gh-workflows/.github/workflows/test_pnpm.yml@3.2.0
15-
15+
1616
with:
1717
working_dir: frontend
1818
build_and_upload:
@@ -23,18 +23,14 @@ jobs:
2323
env:
2424
CI: false
2525

26-
strategy:
27-
matrix:
28-
node-version: [20]
29-
3026
steps:
3127
- name: Check out Git repository
32-
uses: actions/checkout@v4
28+
uses: actions/checkout@v5
3329

3430
- name: Set up Node.js
3531
uses: actions/setup-node@v4
3632
with:
37-
node-version: ${{ matrix.node-version }}
33+
node-version: 22
3834

3935
- name: Install pnpm
4036
run: npm install -g pnpm

‎.github/workflows/test_backend_build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646

4747
steps:
4848
- name: Check out code
49-
uses: actions/checkout@v4
49+
uses: actions/checkout@v5
5050

5151
- name: Set up Python ${{ matrix.python-version }} and uv
5252
uses: astral-sh/setup-uv@v6

‎.github/workflows/zenml_postgres_build.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Build ZenML Postgres Image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
zenml_version:
7+
description: "ZenML version to build"
8+
required: true
9+
type: string
10+
11+
jobs:
12+
server-image:
13+
uses: hotosm/gh-workflows/.github/workflows/image_build.yml@3.6.0
14+
with:
15+
context: infra/zenml
16+
# This remains hotosm/zenml-postgres for legacy reasons
17+
# Ideally it would be hotosm/fair/zenml-postgres
18+
image_name: ghcr.io/${{ github.repository_owner }}/zenml-postgres
19+
build_target: runtime
20+
dockerfile: Dockerfile.postgres
21+
extra_build_args: ZENML_VERSION=${{ inputs.zenml_version }}
22+
image_tags: ghcr.io/${{ github.repository_owner }}/zenml-postgres:${{ inputs.zenml_version }}
23+
# Workaround until CVE-2026-27143 fixed in ZenML upstream image...
24+
scan_image: false
25+
26+
cli-image:
27+
needs: server-image
28+
uses: hotosm/gh-workflows/.github/workflows/image_build.yml@3.6.0
29+
with:
30+
context: infra/zenml
31+
image_name: ghcr.io/${{ github.repository_owner }}/fair/cli
32+
build_target: cli
33+
dockerfile: Dockerfile.cli
34+
extra_build_args: ZENML_VERSION=${{ inputs.zenml_version }}
35+
image_tags: ghcr.io/${{ github.repository_owner }}/fair/cli:${{ inputs.zenml_version }}
36+
# Disable dockerfile_scan else it flags usage of :latest image
37+
scan_dockerfile: false
38+
# It's a CLI, so we don't care about vulnerabilities
39+
scan_image: false

‎.gitignore‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,13 @@ frontend/package-lock*
3434

3535
frontend/.env
3636

37-
# for backend
37+
# for backend
38+
**/__pycache__
3839
backend/static
3940
backend/api_static
4041
backend/env
4142
backend/temp
4243
backend/postgres-data
43-
backend/**/__pycache__/**
4444
backend/media
4545
backend/data/*
4646
backend/log/*

0 commit comments

Comments
 (0)