Merge branch 'master' into dependabot/npm_and_yarn/ui/webpack-dev-server-5.2.1

Author: JohnGarbutt

.codespellignore

@@ -0,0 +1 @@
+rackit

.github/workflows/helm-lint.yaml

@@ -0,0 +1,50 @@
+# NOTE: This workflow can be run locally using https://github.com/nektos/act with:
+# act -W .github/workflows/helm-lint.yaml workflow_call -s GITHUB_TOKEN=$(gh auth token)
+name: Helm Lint
+on:
+  # For manual testing
+  workflow_dispatch:
+
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        description: The Git ref under test.
+        required: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.15.3
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2
+
+      - name: Run chart-testing (lint)
+        run: |-
+          ct lint \
+            --print-config \
+            --lint-conf lintconf.yaml \
+            --target-branch ${{ github.event.repository.default_branch }} \
+            --charts chart/ \
+            --validate-maintainers=false
+
+      - name: Run template validation
+        run: |-
+          helm template foo chart \
+            -f chart/tests/values_test_overrides.yaml \
+            | docker run -i --rm ghcr.io/yannh/kubeconform:latest \
+            --strict --summary
+
+      - name: Run manifest snapshot test
+        run: docker run -i --rm -v $(pwd):/apps helmunittest/helm-unittest chart

.github/workflows/test-pr.yaml

@@ -18,6 +18,18 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Run the unit tests on every PR, even from external repos
+  unit_tests:
+    uses: ./.github/workflows/tox.yaml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+
+  # Run the chart linting on every PR, even from external repos
+  lint:
+    uses: ./.github/workflows/helm-lint.yaml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+
   # This job exists so that PRs from outside the main repo are rejected
   fail_on_remote:
     runs-on: ubuntu-latest
@@ -26,7 +38,7 @@ jobs:
         run: exit ${{ github.event.pull_request.head.repo.full_name == 'azimuth-cloud/azimuth' && '0' || '1' }}
 
   publish_artifacts:
-    needs: [fail_on_remote]
+    needs: [unit_tests, lint, fail_on_remote]
     uses: ./.github/workflows/build-push-artifacts.yaml
     with:
       ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/tox.yaml

@@ -0,0 +1,45 @@
+name: Tox unit tests
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        description: The ref to build.
+        required: true
+
+jobs:
+  build:
+    name: Tox unit tests and linting
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.12']
+
+    steps:
+    - name: Check out the repository
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+
+    - name: Set up Python ${{ matrix.python-version }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ matrix.python-version }}
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install tox
+
+    - name: Test with tox
+      run: tox
+
+    - name: Generate coverage reports
+      run: tox -e cover
+
+    - name: Archive code coverage results
+      uses: actions/upload-artifact@v4
+      with:
+        name: "code-coverage-report-${{ matrix.python-version }}"
+        path: cover/

.stestr.conf

@@ -0,0 +1,3 @@
+[DEFAULT]
+test_path=./api/tests
+top_dir=./

CODEOWNERS

@@ -1 +1,2 @@
-*  @azimuth-cloud/azimuth-core-developers
+# Default owner for all files unless otherwise specified
+*  @azimuth-cloud/azimuth-release-managers

CONTRIBUTING.md

@@ -0,0 +1,22 @@
+# Contributing
+
+We welcome contributions and suggestions for improvements to this code base.
+Please check for relevant issues and PRs before opening a new one of your own.
+
+## Making a contribution
+
+### Helm template snapshots
+
+The CI in this repository uses the Helm
+[unittest](https://github.com/helm-unittest/helm-unittest) plugin's
+snapshotting functionality to check PRs for changes to the templated manifests.
+Therefore, if your PR makes changes to the manifest templates or values, you
+will need to update the saved snapshots to allow your changes to pass the
+automated tests. The easiest way to do this is to run the helm unittest command
+inside a docker container from the repo root.
+
+```
+docker run -i --rm -v $(pwd):/apps helmunittest/helm-unittest chart -u
+```
+
+where the `-u` option is used to update the existing snapshots.

api/Dockerfile

@@ -1,4 +1,4 @@
-FROM ubuntu:jammy AS python-builder
+FROM ubuntu:24.04 AS python-builder
 
 RUN apt-get update && \
     apt-get install -y git python3 python3-venv && \
@@ -16,7 +16,7 @@ COPY . /app
 RUN /venv/bin/pip install -e /app
 
 
-FROM ubuntu:jammy
+FROM ubuntu:24.04
 
 # Don't buffer stdout and stderr as it breaks realtime logging
 ENV PYTHONUNBUFFERED 1

api/azimuth/acls/__init__.py

@@ -1 +1 @@
-from .acls import allowed_by_acls
+from .acls import allowed_by_acls  # noqa: F401

api/azimuth/acls/acls.py

@@ -1,5 +1,5 @@
-import re
 import logging
+import re
 
 LOG = logging.getLogger(__name__)
 
@@ -61,6 +61,5 @@ def allowed_by_acls(raw, tenancy):
 
     # If either 'allow' annotation is present and non-empty then default to deny
     return not (
-        annotations.get(ACL_ALLOW_IDS_KEY) or
-        annotations.get(ACL_ALLOW_PATTERN_KEY)
+        annotations.get(ACL_ALLOW_IDS_KEY) or annotations.get(ACL_ALLOW_PATTERN_KEY)
     )