Schedule monthly review of publicly accessible content (#6051) #6440

achave11-ucsc · 2024-07-23T17:03:59Z

Connected issues: #6051

Checklist

Author

PR is a draft
Target branch is develop
Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
On ZenHub, PR is connected to all issues it (partially) resolves
PR description links to connected issues
PR title matches¹ that of a connected issue _{or comment in PR explains why they're different}
PR title references all connected issues
For each connected issue, there is at least one commit whose title references that issue

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

Added p tag to titles of partial commits
This PR is labeled partial _{or completely resolves all connected issues}
This PR partially resolves each of the connected issues _{or does not have the partial label}

Author (chains)

This PR is blocked by previous PR in the chain _{or is not chained to another PR}
The blocking PR is labeled base _{or this PR is not chained to another PR}
This PR is labeled chained _{or is not chained to another PR}

Author (reindex, API changes)

Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}
This PR and its connected issues are labeled API _{or this PR does not modify a REST API}
Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

Ran make image_manifests.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
Added u tag to commit title _{or this PR does not require upgrading deployments}
This PR is labeled upgrade _{or does not require upgrading deployments}
This PR is labeled deploy:shared _{or does not modify image_manifests.json, and does not require deploying the shared component for any other reason}
This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
Reverted the temporary hotfixes for any connected issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR}

Author (before every review)

Rebased PR branch on develop, squashed old fixups
Ran make requirements_update _{or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile}
Added R tag to commit title _{or this PR does not modify requirements*.txt}
This PR is labeled reqs _{or does not modify requirements*.txt}
make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}

Peer reviewer (after approval)

PR is not a draft
Ticket is in Review requested column
PR is awaiting requested review from system administrator
PR is assigned to only the system administrator

System administrator (after approval)

Actually approved the PR
Labeled connected issues as demo or no demo
Commented on connected issues about demo expectations _{or all connected issues are labeled no demo}
Decided if PR can be labeled no sandbox
A comment to this PR details the completed security design review
PR title is appropriate as title of merge commit
N reviews label is accurate
Moved ticket to Approved column
PR is assigned to only the operator

Operator (before pushing merge the commit)

System administrator

Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
PR is assigned to only the operator

Operator (before pushing merge the commit)

Operator (chain shortening)

Changed the target branch of the blocked PR to develop _{or this PR is not labeled base}
Removed the chained label from the blocked PR _{or this PR is not labeled base}
Removed the blocking relationship from the blocked PR _{or this PR is not labeled base}
Removed the base label from this PR _{or this PR is not labeled base}

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs _{or this PR carries none of these labels}
Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs _{or this PR carries none of these labels}
PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

coveralls · 2024-07-23T17:26:38Z

coverage: 85.434%. remained the same
when pulling 6b57740 on issues/achave11-ucsc/6051-review-public-acc-content
into b1fd8e6 on develop.

codecov · 2024-07-23T17:27:03Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.41%. Comparing base (b1fd8e6) to head (6b57740).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #6440   +/-   ##
========================================
  Coverage    85.41%   85.41%           
========================================
  Files          156      156           
  Lines        20682    20682           
========================================
  Hits         17666    17666           
  Misses        3016     3016

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

dsotirho-ucsc

Approved.

hannes-ucsc

How was this tested?

hannes-ucsc · 2024-07-31T00:52:50Z

.github/ISSUE_TEMPLATE/public_access_content_review.md

@@ -0,0 +1,11 @@
+---
+name: Review publicly accessible content
+about: 'Issue template for the system administrator to perform a review of publicly accessible content.'


Why is this quoted?

Convention. Since all the other issue templates use quotes for this property, I figured that was the standard.

I can't think of a reason as to why we would have that convention. I think this is just incidental.

Please remove all unnecessary quotes from these templates in a separate commit.

achave11-ucsc · 2024-08-01T04:18:34Z

I validated this by verifying the 'Would run' logs when running …

python .github/workflows/schedule.py --dry-run
envhook.py: Warning: GITHUB_TOKEN is 'REDACTED' but should be 'REDACTED', you must run `source environment`
2024-07-31 13:24:42,273    INFO azul.github.schedule: Running ['gh', 'issue', 'list', '--search=in:title "Review rule set for audited events 2024-07-31"', '--json=number', '--limit=10']
2024-07-31 13:24:43,032    INFO azul.github.schedule: Would run ['gh', 'issue', 'create', '--assignee=nolunwa-ucsc,bvizzier-ucsc', '--title=Review rule set for audited events 2024-07-31', '--label=-,compliance,doc,no demo,orange,task', '--body=- [ ] PM (@bvizzier-ucsc) and @nolunwa-ucsc, scheduled a meeting for the annual review of the rule set for audited events\n']
2024-07-31 13:24:43,034    INFO azul.github.schedule: Ignoring issue template .github/ISSUE_TEMPLATE/blank.md since it defines no schedule.
2024-07-31 13:24:43,035    INFO azul.github.schedule: Running ['gh', 'issue', 'list', '--repo=DataBiosphere/azul-private', '--search=in:title "Monthly review of publicly accessible content 2024-07-31"', '--json=number', '--limit=10']
2024-07-31 13:24:43,506    INFO azul.github.schedule: Would run ['gh', 'issue', 'create', '--repo=DataBiosphere/azul-private', '--assignee=hannes-ucsc', '--title=Monthly review of publicly accessible content 2024-07-31', '--label=-,compliance,infra,doc,orange,task', '--body=It is time for the system administrator to review publicly accessible content in all deployments.\n']
…
2024-07-31 13:24:44,019    INFO azul.github.schedule: Running ['gh', 'issue', 'list', '--search=in:title "Promotion 2024-07-31"', '--json=number', '--limit=10']
2024-07-31 13:24:44,480    INFO azul.github.schedule: Would run ['gh', 'issue', 'create', '--title=Promotion 2024-07-31', '--label=-,infra,no demo,operator,orange,task', '--body=- [ ] The title of this issue matches `Promotion yyyy-mm-dd`\n- [ ] For `prod`\n  - [ ] System administrator and operator determined the commit to be promoted\n  - [ ] Operator created the promotion PR\n- [ ] For `anvilprod`\n  - [ ] System administrator and operator determined the commit to be promoted\n  - [ ] Operator created the promotion PR\n']
2024-07-31 13:24:44,482    INFO azul.github.schedule: Running ['gh', 'issue', 'list', '--repo=DataBiosphere/azul-private', '--search=in:title "Monthly inventory review 2024-07-31"', '--json=number', '--limit=10']
2024-07-31 13:24:44,961    INFO azul.github.schedule: Would run ['gh', 'issue', 'create', '--repo=DataBiosphere/azul-private', '--assignee=hannes-ucsc', '--title=Monthly inventory review 2024-07-31', '--label=+,compliance,infra,no demo,operator,orange,task', '--body=It is time for the system administrator to review the FedRAMP inventory and perform a Port and Protocol review in all deployments\n\n\n- [ ] Collect most recent `dev` inventories and attach them to this issue\n- [ ] Collect most recent `anvildev` inventories and attach them to this issue\n- [ ] Collect most recent `anvilprod` inventories and attach them to this issue\n- [ ] Collect most recent `prod` inventories and attach them to this issue\n\n- [ ] Reviewed `dev` inventory\n- [ ] Reviewed `anvildev` inventory\n- [ ] Reviewed `anvilprod` inventory\n- [ ] Reviewed `prod` inventory\n']

… of this new issue template …

Would run ['gh', 'issue', 'create', '--repo=DataBiosphere/azul-private', '--assignee=hannes-ucsc', '--title=Monthly review of publicly accessible content 2024-07-31', '--label=-,compliance,infra,doc,orange,task', '--body=It is time for the system administrator to review publicly accessible content in all deployments.\n']

… and a preexisting template, for the same azul-private repository, and that we are certain works …

Would run ['gh', 'issue', 'create', '--repo=DataBiosphere/azul-private', '--assignee=hannes-ucsc', '--title=Monthly inventory review 2024-07-31', '--label=+,compliance,infra,no demo,operator,orange,task', '--body=It is time for the system administrator to review the FedRAMP inventory and perform a Port and Protocol review in all deployments\n\n\n- [ ] Collect most recent dev inventories and attach them to this issue\n- [ ] Collect most recent anvildev inventories and attach them to this issue\n- [ ] Collect most recent anvilprod inventories and attach them to this issue\n- [ ] Collect most recent prod inventories and attach them to this issue\n\n- [ ] Reviewed dev inventory\n- [ ] Reviewed anvildev inventory\n- [ ] Reviewed anvilprod inventory\n- [ ] Reviewed prod inventory\n']

… and confirmed the similarity in the structure of the gh issue create command in both instances.

hannes-ucsc · 2024-08-03T03:42:57Z

.github/ISSUE_TEMPLATE/public_access_content_review.md

@@ -0,0 +1,11 @@
+---
+name: Review publicly accessible content
+about: 'Issue template for the system administrator to perform a review of publicly accessible content.'


I can't think of a reason as to why we would have that convention. I think this is just incidental.

Please remove all unnecessary quotes from these templates in a separate commit.

nadove-ucsc · 2024-08-10T00:13:29Z

Security design review

github-actions bot added the orange [process] Done by the Azul team label Jul 23, 2024

achave11-ucsc requested a review from dsotirho-ucsc July 23, 2024 17:37

achave11-ucsc assigned dsotirho-ucsc Jul 23, 2024

dsotirho-ucsc previously approved these changes Jul 23, 2024

View reviewed changes

dsotirho-ucsc marked this pull request as ready for review July 23, 2024 18:11

dsotirho-ucsc requested a review from hannes-ucsc as a code owner July 23, 2024 18:11

dsotirho-ucsc assigned hannes-ucsc and unassigned dsotirho-ucsc Jul 23, 2024

hannes-ucsc reviewed Jul 31, 2024

View reviewed changes

hannes-ucsc removed their assignment Jul 31, 2024

hannes-ucsc added the 0 reviews [process] Lead didn't request any changes label Jul 31, 2024

achave11-ucsc force-pushed the issues/achave11-ucsc/6051-review-public-acc-content branch from 5dc4d4d to a04e205 Compare August 1, 2024 04:20

achave11-ucsc assigned hannes-ucsc Aug 1, 2024

achave11-ucsc requested a review from hannes-ucsc August 1, 2024 15:36

achave11-ucsc unassigned hannes-ucsc Aug 1, 2024

achave11-ucsc requested review from hannes-ucsc and removed request for hannes-ucsc August 1, 2024 20:42

achave11-ucsc assigned hannes-ucsc Aug 2, 2024

hannes-ucsc requested changes Aug 3, 2024

View reviewed changes

hannes-ucsc removed their assignment Aug 3, 2024

achave11-ucsc dismissed dsotirho-ucsc’s stale review via 88880ee August 5, 2024 18:06

achave11-ucsc force-pushed the issues/achave11-ucsc/6051-review-public-acc-content branch from a04e205 to 88880ee Compare August 5, 2024 18:06

achave11-ucsc requested a review from nadove-ucsc as a code owner August 5, 2024 18:06

achave11-ucsc assigned nadove-ucsc Aug 5, 2024

nadove-ucsc approved these changes Aug 10, 2024

View reviewed changes

nadove-ucsc added the no sandbox [process] PR will not be tested in the sandbox label Aug 10, 2024

nadove-ucsc assigned achave11-ucsc and unassigned nadove-ucsc Aug 10, 2024

achave11-ucsc added 2 commits August 12, 2024 14:18

Make template format consistent for scheduled issues

ab97a3c

Schedule monthly review of publicly accessible content (#6051)

6b57740

achave11-ucsc force-pushed the issues/achave11-ucsc/6051-review-public-acc-content branch from 88880ee to 6b57740 Compare August 12, 2024 21:18

hannes-ucsc merged commit c6699c0 into develop Aug 12, 2024
9 checks passed

achave11-ucsc deleted the issues/achave11-ucsc/6051-review-public-acc-content branch August 12, 2024 23:12

achave11-ucsc removed their assignment Aug 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Schedule monthly review of publicly accessible content (#6051) #6440

Schedule monthly review of publicly accessible content (#6051) #6440

achave11-ucsc commented Jul 23, 2024 •

edited

Loading

coveralls commented Jul 23, 2024 •

edited

Loading

codecov bot commented Jul 23, 2024 •

edited

Loading

dsotirho-ucsc left a comment

hannes-ucsc left a comment

hannes-ucsc Jul 31, 2024

achave11-ucsc Aug 1, 2024

hannes-ucsc Aug 3, 2024

achave11-ucsc commented Aug 1, 2024

hannes-ucsc Aug 3, 2024

nadove-ucsc commented Aug 10, 2024

Schedule monthly review of publicly accessible content (#6051) #6440

Schedule monthly review of publicly accessible content (#6051) #6440

Conversation

achave11-ucsc commented Jul 23, 2024 • edited Loading

Checklist

Author

Author (partiality)

Author (chains)

Author (reindex, API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator (before pushing merge the commit)

System administrator

Operator (before pushing merge the commit)

Operator (chain shortening)

Operator (after pushing the merge commit)

Operator (reindex)

Operator

Shorthand for review comments

coveralls commented Jul 23, 2024 • edited Loading

codecov bot commented Jul 23, 2024 • edited Loading

Codecov Report

dsotirho-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc left a comment

Choose a reason for hiding this comment

hannes-ucsc Jul 31, 2024

Choose a reason for hiding this comment

achave11-ucsc Aug 1, 2024

Choose a reason for hiding this comment

hannes-ucsc Aug 3, 2024

Choose a reason for hiding this comment

achave11-ucsc commented Aug 1, 2024

hannes-ucsc Aug 3, 2024

Choose a reason for hiding this comment

nadove-ucsc commented Aug 10, 2024

Security design review

achave11-ucsc commented Jul 23, 2024 •

edited

Loading

coveralls commented Jul 23, 2024 •

edited

Loading

codecov bot commented Jul 23, 2024 •

edited

Loading