Initial commit

.coveragerc

@@ -0,0 +1,6 @@
+[run]
+parallel=True
+data_file=/tmp/.coverage
+omit =
+    *_test.py
+    *__init__*

.dockerignore

@@ -0,0 +1,26 @@
+.git
+**/build
+.dockerignore
+**/.env
+**/postgres-data
+**/__pycache__
+.vscode
+.gitignore
+.github/
+.pytest_cache/
+__pycache__/
+docker-compose*.yaml
+Dockerfile
+githooks/
+git*
+docs/
+helm/
+**/venv
+**/target/
+**/logs/
+*.bak
+**/.venv
+.env
+.env.example
+.github/
+Makefile

.env.example

@@ -0,0 +1,5 @@
+# This file is used to configure the environment variables used by the application.
+
+key=value
+key=value
+key=value

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Change this team to your team (who will own the repository)
+* @EvolutionIQ/devops
+# DevOps team owns all workflows. Do not delete the line below.
+.github/workflows @EvolutionIQ/devops

.github/pull_request_template.md

@@ -0,0 +1,12 @@
+## Description
+<!--- Describe your changes in detail.  Add some screenshots if applicable -->
+
+## Motivation and Context
+<!-- Why is this change required? What problem does it solve? -->
+<!-- If it fixes an open issue, please link to the issue here. -->
+See [sc-xxxx](https://app.shortcut.com/evolutioniq/story/xxxx)
+
+## Describe how you tested your code
+<!-- Describe the tests that you ran to verify your changes. -->
+<!-- Provide instructions so we can reproduce. -->
+<!-- Also list any relevant details for your test configuration -->

.github/workflows/cd.yml

@@ -0,0 +1,48 @@
+name: <name> CD
+on:
+  push:
+    branches:
+      - main
+
+env:
+  GCP_REGISTRY: null
+  AWS_REGISTRY: null
+
+jobs:
+  project-cd:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Auth
+        uses: google-github-actions/auth@v1
+        with:
+          workload_identity_provider: 'projects/136280203432/locations/global/workloadIdentityPools/eiq-gha-pool/providers/eiq-gha-provider'
+          service_account: '[email protected]'
+          access_token_lifetime: '300s' # default: '3600s' (1 hour)
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v1
+        with:
+          project_id: eiq-artifactory
+
+      - name: Setup Python
+        uses: EvolutionIQ/devops/.github/actions/setup-python-and-poetry@main
+
+      - name: Install Dev/Test Dependencies
+        run: poetry install --with dev,test
+
+      - name: Run PyTests
+        run: make test
+
+      - name: Build Docker Image
+        run: |
+          gcloud --quiet auth configure-docker us-docker.pkg.dev && \
+          docker build --build-arg BUILDKIT_INLINE_CACHE=1 --tag ${{ env.GCP_REGISTRY }}:$GITHUB_SHA .
+        env:
+          DOCKER_BUILDKIT: 1
+
+      - name: Push Docker Image
+        run: docker push ${{ env.GCP_REGISTRY }}:$GITHUB_SHA

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+on:
+  pull_request:
+    branches:
+      - main
+
+env:
+  GCP_REGISTRY: null
+  AWS_REGISTRY: null
+
+jobs:
+  project-ci:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Auth
+        uses: google-github-actions/auth@v1
+        with:
+          workload_identity_provider: 'projects/136280203432/locations/global/workloadIdentityPools/eiq-gha-pool/providers/eiq-gha-provider'
+          service_account: '[email protected]'
+          access_token_lifetime: '300s' # default: '3600s' (1 hour)
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v1
+        with:
+          project_id: eiq-artifactory
+
+      - name: Setup Python
+        uses: EvolutionIQ/devops/.github/actions/setup-python-and-poetry@main
+
+      - name: Install Dev/Test Dependencies
+        run: poetry install --with dev,test
+
+      - name: Run Pylint
+        run: make lint
+
+      - name: Run format
+        run: make format-ci
+
+      - name: Run PyTests
+        run: make test
+
+      - name: Build Dockerfile
+        run: |
+          gcloud --quiet auth configure-docker us-docker.pkg.dev && \
+          docker build --build-arg BUILDKIT_INLINE_CACHE=1 --tag ${{ env.GCP_REGISTRY }}:test .
+        env:
+          DOCKER_BUILDKIT: 1
+

.github/workflows/codeql.yml

@@ -0,0 +1,77 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '37 20 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Use only 'java' to analyze code written in Java, Kotlin or both
+        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+        queries: security-extended
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #     echo "Run, Build Application using script"
+    #     ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/pull-request-conformance.yml

@@ -0,0 +1,18 @@
+name: Pull Request Conformance
+
+on:
+  pull_request:
+    types:
+      - edited
+      - opened
+      - reopened
+      - synchronize
+
+jobs:
+  title-conforms:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: EvolutionIQ/devops/.github/actions/pr-title-conformance@main
+        with:
+          pull_request_title: ${{ github.event.pull_request.title }}

.gitignore

@@ -0,0 +1,17 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.egg-info/
+.DS_Store
+.ipynb_checkpoints/
+build/
+dist/
+.env
+*.log
+.vscode/
+.idea
+Dockerfile.tmp
+.python-version
+.pytest_cache
+.venv/
+.env
+coverage

Dockerfile

@@ -0,0 +1,51 @@
+# These two args below are required to be declared before the first FROM instruction
+ARG BASE_IMAGE=us-docker.pkg.dev/eiq-artifactory/eng-devops/python-base
+ARG BASE_IMAGE_VERSION=3.10.9-jammy
+
+FROM ${BASE_IMAGE}:${BASE_IMAGE_VERSION} AS base
+
+ENV PYTHONFAULTHANDLER=1 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONHASHSEED=random \
+    PIP_NO_CACHE_DIR=off \
+    PIP_DISABLE_PIP_VERSION_CHECK=on \
+    PIP_DEFAULT_TIMEOUT=100
+
+RUN apt-get update && apt-get install -y apt-transport-https && apt-get -y upgrade \
+    && apt-get install -y \
+    build-essential \
+    curl \
+    lsb-release \
+    locales \
+    gnupg
+
+RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && \
+    locale-gen
+
+ENV LANG en_US.UTF-8
+ENV LANGUAGE en_US:en
+ENV LC_ALL en_US.UTF-8
+
+ARG APP_PATH=/app
+WORKDIR ${APP_PATH}/
+
+# Copy only requirements to cache them in docker layer
+COPY pyproject.toml poetry.lock poetry.toml ${APP_PATH}/
+
+# Install only dependencies
+RUN poetry install --no-root --no-interaction --no-ansi
+
+# Should not run as root, so change to python
+COPY --chown=python:python . ${APP_PATH}
+
+USER python
+
+# Add venv to PATH
+ENV PATH="${APP_PATH}/.venv/bin:$PATH"
+
+# TODO: update to use the port for your service
+EXPOSE 8080
+
+# Start
+ENV APP_START=${APP_PATH}/docker-entrypoint.py
+CMD ${APP_START}