Mostly version bumps (#5)

ghga-de · Nov 29, 2023 · a8bf7da · a8bf7da
1 parent 430f98f
commit a8bf7da
Show file tree

Hide file tree

Showing 15 changed files with 765 additions and 775 deletions.
diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml
@@ -17,7 +17,9 @@ services:
         USER_GID: 1000
 
     init: true
-    privileged: true
+
+    extra_hosts:
+      - host.docker.internal:host-gateway
 
     volumes:
       - ..:/workspace:cached

diff --git a/.github/workflows/ci_release.yaml b/.github/workflows/ci_release.yaml
@@ -0,0 +1,15 @@
+name: CI on release
+
+on:
+  release:
+      types: [published]
+
+jobs:
+  push_to_docker_hub:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ghga-de/gh-action-ci@v1
+        with:
+          tag: ${{ github.event.release.tag_name }}
+          dockerhub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.github/workflows/ci_workflow_dispatch.yaml b/.github/workflows/ci_workflow_dispatch.yaml
@@ -0,0 +1,30 @@
+name: Build on PR or dispatch
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - labeled
+
+jobs:
+  fetch-tag:
+    runs-on: ubuntu-latest
+    if: ( github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'build') ) || ( github.event.action == 'labeled' && github.event.label.name == 'build' )
+    steps:
+      - id: fetch-tag
+        uses: ghga-de/gh-action-fetch-tag@v1
+    outputs:
+      latest_tag: ${{ steps.fetch-tag.outputs.latest_tag }}
+
+  push_to_docker_hub:
+    needs: fetch-tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ghga-de/gh-action-ci@v1
+        with:
+          tag: ${{ needs.fetch-tag.outputs.latest_tag }}-${{ github.sha }}
+          dockerhub_username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub_token: ${{ secrets.DOCKERHUB_TOKEN }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -51,16 +51,16 @@ repos:
       - id: debug-statements
       - id: debug-statements
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.1.4
+    rev: v0.1.6
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
   - repo: https://github.com/psf/black
-    rev: 23.10.1
+    rev: 23.11.0
     hooks:
       - id: black
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.6.1
+    rev: v1.7.0
     hooks:
       - id: mypy
         args: [--no-warn-unused-ignores]
diff --git a/.static_files b/.static_files
@@ -30,12 +30,13 @@ scripts/list_outdated_dependencies.py
 scripts/README.md
 
 .github/workflows/check_config_docs.yaml
+.github/workflows/check_openapi_spec.yaml
+.github/workflows/check_readme.yaml
 .github/workflows/check_template_files.yaml
+.github/workflows/ci_release.yaml
+.github/workflows/ci_workflow_dispatch.yaml
 .github/workflows/static_code_analysis.yaml
 .github/workflows/tests.yaml
-.github/workflows/check_openapi_spec.yaml
-.github/workflows/check_readme.yaml
-.github/workflows/cd.yaml
 
 example_data/README.md
 

diff --git a/README.md b/README.md
@@ -32,21 +32,21 @@ We recommend using the provided Docker container.
 
 A pre-build version is available at [docker hub](https://hub.docker.com/repository/docker/ghga/purge-controller-service):
 ```bash
-docker pull ghga/purge-controller-service:1.0.0
+docker pull ghga/purge-controller-service:1.1.0
 ```
 
 Or you can build the container yourself from the [`./Dockerfile`](./Dockerfile):
 ```bash
 # Execute in the repo's root dir:
-docker build -t ghga/purge-controller-service:1.0.0 .
+docker build -t ghga/purge-controller-service:1.1.0 .
 ```
 
 For production-ready deployment, we recommend using Kubernetes, however,
 for simple use cases, you could execute the service using docker
 on a single server:
 ```bash
 # The entrypoint is preconfigured:
-docker run -p 8080:8080 ghga/purge-controller-service:1.0.0 --help
+docker run -p 8080:8080 ghga/purge-controller-service:1.1.0 --help
 ```
 
 If you prefer not to use containers, you may install the service from source:
@@ -113,6 +113,16 @@ The service requires the following configuration parameters:
   ```
 
 
+- **`kafka_security_protocol`** *(string)*: Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL. Must be one of: `["PLAINTEXT", "SSL"]`. Default: `"PLAINTEXT"`.
+
+- **`kafka_ssl_cafile`** *(string)*: Certificate Authority file path containing certificates used to sign broker certificates. If a CA not specified, the default system CA will be used if found by OpenSSL. Default: `""`.
+
+- **`kafka_ssl_certfile`** *(string)*: Optional filename of client certificate, as well as any CA certificates needed to establish the certificate's authenticity. Default: `""`.
+
+- **`kafka_ssl_keyfile`** *(string)*: Optional filename containing the client private key. Default: `""`.
+
+- **`kafka_ssl_password`** *(string)*: Optional password to be used for the client private key. Default: `""`.
+
 - **`host`** *(string)*: IP of the host. Default: `"127.0.0.1"`.
 
 - **`port`** *(integer)*: Port to expose the server on the specified host. Default: `8080`.

diff --git a/config_schema.json b/config_schema.json
@@ -52,6 +52,40 @@
       "title": "Kafka Servers",
       "type": "array"
     },
+    "kafka_security_protocol": {
+      "default": "PLAINTEXT",
+      "description": "Protocol used to communicate with brokers. Valid values are: PLAINTEXT, SSL.",
+      "enum": [
+        "PLAINTEXT",
+        "SSL"
+      ],
+      "title": "Kafka Security Protocol",
+      "type": "string"
+    },
+    "kafka_ssl_cafile": {
+      "default": "",
+      "description": "Certificate Authority file path containing certificates used to sign broker certificates. If a CA not specified, the default system CA will be used if found by OpenSSL.",
+      "title": "Kafka Ssl Cafile",
+      "type": "string"
+    },
+    "kafka_ssl_certfile": {
+      "default": "",
+      "description": "Optional filename of client certificate, as well as any CA certificates needed to establish the certificate's authenticity.",
+      "title": "Kafka Ssl Certfile",
+      "type": "string"
+    },
+    "kafka_ssl_keyfile": {
+      "default": "",
+      "description": "Optional filename containing the client private key.",
+      "title": "Kafka Ssl Keyfile",
+      "type": "string"
+    },
+    "kafka_ssl_password": {
+      "default": "",
+      "description": "Optional password to be used for the client private key.",
+      "title": "Kafka Ssl Password",
+      "type": "string"
+    },
     "host": {
       "default": "127.0.0.1",
       "description": "IP of the host.",

diff --git a/example_config.yaml b/example_config.yaml
@@ -8,8 +8,13 @@ docs_url: /docs
 files_to_delete_topic: file_deletions
 files_to_delete_type: file_deletion_requested
 host: 127.0.0.1
+kafka_security_protocol: PLAINTEXT
 kafka_servers:
 - kafka:9092
+kafka_ssl_cafile: ''
+kafka_ssl_certfile: ''
+kafka_ssl_keyfile: ''
+kafka_ssl_password: ''
 log_level: info
 openapi_url: /openapi.json
 port: 8080

diff --git a/openapi.yaml b/openapi.yaml
@@ -9,30 +9,6 @@ components:
           type: array
       title: HTTPValidationError
       type: object
-    HttpAuthorizationFailedError:
-      additionalProperties: false
-      properties:
-        data:
-          $ref: '#/components/schemas/HttpAuthorizationFailedErrorData'
-        description:
-          description: A human readable message to the client explaining the cause
-            of the exception.
-          title: Description
-          type: string
-        exception_id:
-          const: authorizationFailedError
-          title: Exception Id
-      required:
-      - data
-      - description
-      - exception_id
-      title: HttpAuthorizationFailedError
-      type: object
-    HttpAuthorizationFailedErrorData:
-      additionalProperties: true
-      properties: {}
-      title: HttpAuthorizationFailedErrorData
-      type: object
     ValidationError:
       properties:
         loc:
@@ -62,7 +38,7 @@ info:
   description: A service exposing an external API to commission file deletionsfrom
     the wholefile backend.
   title: Purge Controller Service
-  version: 1.0.0
+  version: 1.1.0
 openapi: 3.1.0
 paths:
   /files/{file_id}:
@@ -82,16 +58,6 @@ paths:
             application/json:
               schema: {}
           description: Commissioned file deletion
-        '403':
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/HttpAuthorizationFailedError'
-          description: 'Bearer token could not be validated.
-
-            Exceptions by ID:
-
-            - authorizationFailedError: Bearer token could not be validated.'
         '422':
           content:
             application/json:

diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pcs"
-version = "1.0.0"
+version = "1.1.0"
 description = "Purge Controller Service - a service to commission file deletions"
 readme = "README.md"
 authors = [
@@ -23,9 +23,9 @@ classifiers = [
     "Intended Audience :: Developers",
 ]
 dependencies = [
-    "ghga-service-commons[api]>=1.1.0",
-    "ghga-event-schemas~=1.0.0",
-    "hexkit[akafka]>=0.11.0",
+    "ghga-service-commons[api]>=1.2.0",
+    "ghga-event-schemas==1.0.0",
+    "hexkit[akafka]>=1.0.0",
     "typer>=0.6.0",
 ]