feat:[PAGOPA-2362] Manage schema v1

.github/workflows/code_review.yml

@@ -40,8 +40,8 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           sonar_token: ${{ secrets.SONAR_TOKEN }}
           project_key: ${{env.PROJECT_KEY}}
-          coverage_exclusions: "**/config/*,**/*Mock*,**/model/**,**/entity/*"
-          cpd_exclusions: "**/model/**,**/entity/*"
+          coverage_exclusions: "**/config/*,**/*Mock*,**/model/**,**/entity/*,**/mapper/**"
+          cpd_exclusions: "**/model/**,**/entity/*,**/mapper/**"
           java_version: '17'
 
 #  smoke-test:

.github/workflows/deploy_with_github_runner.yml

@@ -11,6 +11,28 @@ on:
         required: true
         description: The environment target of the job
         type: string
+      pagopa_release:
+        required: true
+        type: string
+        description: release version to deploy for PagoPA microservice
+      pagopa_force:
+        required: false
+        type: boolean
+        description: force re-deploy PagoPA microservice
+        default: false
+      nexi_release:
+        required: true
+        type: string
+        description: release version to deploy for Nexi microservice
+      nexi_force:
+        required: false
+        type: boolean
+        description: force re-deploy Nexi microservice
+        default: false
+      current_release:
+        required: true
+        type: string
+        description: release version of the current deploy
 
 env:
   APP_NAME: cache
@@ -26,26 +48,33 @@ jobs:
     if: ${{ inputs.target == inputs.environment }}
     outputs:
       environment: ${{ steps.get_env.outputs.environment }}
+      pagopa_rel: ${{ steps.get_releases.outputs.pagopa_rel }}
+      nexi_rel: ${{ steps.get_releases.outputs.nexi_rel }}
     steps:
       - name: Get Environment
         id: get_env
         shell: bash
+        run: |         
+          current_env="${{ inputs.environment }}"
+          echo "environment=$current_env" >> $GITHUB_OUTPUT
+
+      - name: Get Releases
+        id: get_releases
+        shell: bash
         run: |
-          current_env="dev"
-          if [[ "${{ inputs.environment }}" == *"nexi"* ]]; then
-            if [[ "${{ inputs.environment }}" == *"dev"* ]]; then
-              current_env="dev"
-            elif [[ "${{ inputs.environment }}" == *"sit"* ]]; then
-              current_env="dev"
-            else
-              current_env="uat"
-            fi
-          elif [[ "${{ inputs.environment }}" == "prf" ]]; then
-            current_env="uat"
-          else
-            current_env="${{ inputs.environment }}"
+          pagopa_version=${{ inputs.current_release }}
+          nexi_version=${{ inputs.current_release }}
+
+          if [[ "${{ inputs.nexi_release }}" != "" ]]; then            
+            nexi_version=${{ inputs.nexi_release }}
           fi
-          echo "environment=$current_env" >> $GITHUB_OUTPUT
+
+          if [[ "${{ inputs.pagopa_release }}" != "" ]]; then            
+            pagopa_version=${{ inputs.pagopa_release }}
+          fi
+
+          echo "pagopa_rel=$pagopa_version" >> $GITHUB_OUTPUT
+          echo "nexi_rel=$nexi_version" >> $GITHUB_OUTPUT
 
   create_runner:
     needs: [ setting_env ]
@@ -67,7 +96,7 @@ jobs:
           subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
           container_app_environment_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_NAME }}
           resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }} # RG of the runner
-          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          pat_token: ${{ secrets.CD_BOT_TOKEN_GITHUB }}
           self_hosted_runner_image_tag: "latest"
 
   deploy:
@@ -78,7 +107,7 @@ jobs:
     environment: ${{ needs.setting_env.outputs.environment }}
     steps:
 
-      - name: Deploy DEV for PagoPA (Oracle or Postgres)
+      - name: Deploy DEV
         uses: pagopa/github-actions-template/aks-deploy@5db4c9108164a07d96527978da1c3febec934f22 #v1.11.1
         if: ${{ inputs.environment == 'dev' }}
         with:
@@ -91,9 +120,9 @@ jobs:
           cluster_name: ${{ vars.CLUSTER_NAME }}
           resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
           app_name: ${{ env.APP_NAME }}
-          helm_upgrade_options: ' --debug --set postgresql.enabled=true --set postgresql.forceRedeploy=true --set postgresql-replica.forceRedeploy=false --set postgresql-nexi.forceRedeploy=false --set oracle.enabled=true --set oracle.forceRedeploy=true --set oracledev.enabled=true --set oracledev.forceRedeploy=false --set oracleprod.enabled=true --set oracleprod.forceRedeploy=false'
+          helm_upgrade_options: ' --debug --set postgresql.forceRedeploy=${{ inputs.pagopa_force }} --set postgresql.image.tag=${{ needs.setting_env.outputs.pagopa_rel }} --set postgresql-nexi.forceRedeploy=${{ inputs.nexi_force }} --set postgresql-nexi.image.tag=${{ needs.setting_env.outputs.nexi_rel }}'
 
-      - name: Deploy UAT for PagoPA (Oracle or Postgres)
+      - name: Deploy UAT
         uses: pagopa/github-actions-template/aks-deploy@5db4c9108164a07d96527978da1c3febec934f22 #v1.11.1
         if: ${{ inputs.environment == 'uat' }}
         with:
@@ -106,24 +135,9 @@ jobs:
           cluster_name: ${{ vars.CLUSTER_NAME }}
           resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
           app_name: ${{ env.APP_NAME }}
-          helm_upgrade_options: ' --debug --set postgresql.enabled=true --set oracle.enabled=true'
-
-      - name: Deploy PRF for PagoPA (Oracle or Postgres)
-        uses: pagopa/github-actions-template/aks-deploy@5db4c9108164a07d96527978da1c3febec934f22 #v1.11.1
-        if: ${{ inputs.environment == 'prf' }}
-        with:
-          branch: ${{ github.ref_name }}
-          client_id: ${{ secrets.CD_CLIENT_ID }}
-          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.TENANT_ID }}
-          env: ${{ needs.setting_env.outputs.environment }}
-          namespace: ${{ vars.NAMESPACE }}
-          cluster_name: ${{ vars.CLUSTER_NAME }}
-          resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
-          app_name: ${{ env.APP_NAME }}
-          helm_upgrade_options: ' --debug --set postgresql-replica.enabled=true --set oracledev.enabled=true '
+          helm_upgrade_options: ' --debug --set postgresql.forceRedeploy=${{ inputs.pagopa_force }} --set postgresql.image.tag=${{ needs.setting_env.outputs.pagopa_rel }} --set postgresql-replica.forceRedeploy=${{ inputs.pagopa_force }} --set postgresql-replica.image.tag=${{ needs.setting_env.outputs.pagopa_rel }} --set postgresql-nexi.forceRedeploy=${{ inputs.nexi_force }} --set postgresql-nexi.image.tag=${{ needs.setting_env.outputs.nexi_rel }} --set postgresql-replica-nexi.forceRedeploy=${{ inputs.nexi_force }} --set postgresql-replica-nexi.image.tag=${{ needs.setting_env.outputs.nexi_rel }}'
 
-      - name: Deploy PROD for PagoPA (Oracle or Postgres)
+      - name: Deploy PROD
         uses: pagopa/github-actions-template/aks-deploy@5db4c9108164a07d96527978da1c3febec934f22 #v1.11.1
         if: ${{ inputs.environment == 'prod' }}
         with:
@@ -136,22 +150,7 @@ jobs:
           cluster_name: ${{ vars.CLUSTER_NAME }}
           resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
           app_name: ${{ env.APP_NAME }}
-          helm_upgrade_options: ' --debug --set postgresql.enabled=true --set oracle.enabled=true --set postgresql-nexi.enabled=false'
-
-      - name: Deploy for Nexi
-        uses: pagopa/github-actions-template/aks-deploy@main
-        if: ${{ inputs.environment == 'dev_nexi' || inputs.environment == 'sit_nexi' || inputs.environment == 'uat_nexi' || inputs.environment == 'prf_nexi' }}
-        with:
-          branch: ${{ github.ref_name }}
-          client_id: ${{ secrets.CD_CLIENT_ID }}
-          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
-          tenant_id: ${{ secrets.TENANT_ID }}
-          env: ${{ needs.setting_env.outputs.environment }}
-          namespace: ${{ vars.NAMESPACE }}
-          cluster_name: ${{ vars.CLUSTER_NAME }}
-          resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
-          app_name: ${{ env.APP_NAME }}
-          helm_upgrade_options: ${{ (inputs.environment == 'dev_nexi') && ' --debug --set oracledev.enabled=true --set oracledev.forceRedeploy=true --set oracleprod.enabled=true --set oracleprod.forceRedeploy=false' || (inputs.environment == 'sit_nexi' || inputs.environment == 'uat_nexi') && ' --debug --set postgresql-nexi.enabled=true --set postgresql-nexi.forceRedeploy=true' || inputs.environment == 'prf_nexi' && ' --debug --set postgresql-replica-nexi.enabled=true --set postgresql-replica-nexi.forceRedeploy=true' }}
+          helm_upgrade_options: '--debug --set postgresql.forceRedeploy=${{ inputs.pagopa_force }} --set postgresql.image.tag=${{ needs.setting_env.outputs.pagopa_rel }}'
 
   cleanup_runner:
     name: Cleanup Runner
@@ -170,7 +169,7 @@ jobs:
           subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
           resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }}
           runner_name: ${{ needs.create_runner.outputs.runner_name }}
-          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          pat_token: ${{ secrets.CD_BOT_TOKEN_GITHUB }}
 
   update_openapi:
     needs: [ setting_env, deploy ]

.github/workflows/release_deploy.yml

@@ -15,12 +15,7 @@ on:
         options:
           - dev
           - uat
-          - prf
           - prod
-          - dev_nexi
-          - sit_nexi
-          - uat_nexi
-          - prf_nexi
       beta:
         required: false
         type: boolean
@@ -31,6 +26,26 @@ on:
         type: boolean
         description: skip the release. Only deploy
         default: false
+      pagopa_release:
+        required: false
+        type: string
+        default: ""
+        description: release version to deploy for PagoPA microservice (if empty then last)
+      pagopa_force:
+        required: false
+        type: boolean
+        description: force re-deploy PagoPA microservice
+        default: false
+      nexi_release:
+        required: false
+        type: string
+        default: "0.9.17"
+        description: release version to deploy for Nexi microservice (if empty then last)
+      nexi_force:
+        required: false
+        type: boolean
+        description: force re-deploy Nexi microservice
+        default: false
 
 
 permissions:
@@ -101,24 +116,16 @@ jobs:
         uses: pagopa/github-actions-template/maven-release@d91a1fd0b913c9830589be5d86cdb71c90813fae # v1.5.4
         with:
           semver: ${{ needs.setup.outputs.semver }}
-          github_token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          github_token: ${{ secrets.CD_BOT_TOKEN_GITHUB }}
           beta: ${{ inputs.beta }}
           skip_ci: false
 
   image:
     needs: [ setup, release ]
     name: Build and Push Docker Image
     runs-on: ubuntu-latest
-#    if: ${{ inputs.semver != 'skip' }}
     if: ${{ needs.setup.outputs.semver != 'skip' }}
     steps:
-      #      - name: Build and Push
-      #        id: semver
-      #        uses: pagopa/github-actions-template/[email protected]
-      #        with:
-      #          branch: ${{ github.ref_name}}
-      #          github_token: ${{ secrets.GITHUB_TOKEN }}
-      #          tag: ${{ needs.release.outputs.version }}
       - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b #v4.1.4
         with:
           ref: ${{ github.ref_name }}
@@ -158,11 +165,16 @@ jobs:
     if: ${{ always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
     strategy:
       matrix:
-        environment: [ dev, uat, prf, prod, dev_nexi, sit_nexi, uat_nexi, prf_nexi ]
+        environment: [ dev, uat, prod ]
     uses: ./.github/workflows/deploy_with_github_runner.yml
     with:
       environment: ${{ matrix.environment }}
       target: ${{ needs.setup.outputs.environment }}
+      pagopa_release: ${{ inputs.pagopa_release }}
+      pagopa_force: ${{ inputs.pagopa_force }}
+      nexi_release: ${{ inputs.nexi_release }}
+      nexi_force: ${{ inputs.nexi_force }}
+      current_release: ${{ needs.release.outputs.version }}
     secrets: inherit
 
   notify:

.github/workflows/update_code.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
-          token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          token: ${{ secrets.CD_BOT_TOKEN_GITHUB }}
 
       - name: Checkout Pull Request
         run: hub pr checkout ${{ github.event.issue.number }}

.gitignore

@@ -40,4 +40,5 @@ helm/Chart.lock
 .cache
 /docker/.env
 
-.terraform
+.terraform
+/.identity/private_output.txt

.identity/00_data.tf

@@ -36,9 +36,14 @@ data "azurerm_key_vault_secret" "key_vault_sonar" {
   key_vault_id = data.azurerm_key_vault.key_vault.id
 }
 
-data "azurerm_key_vault_secret" "key_vault_bot_token" {
-  name         = "bot-token-github"
-  key_vault_id = data.azurerm_key_vault.key_vault.id
+data "azurerm_key_vault_secret" "key_vault_bot_cd_token" {
+  name         = "pagopa-platform-domain-github-bot-cd-pat"
+  key_vault_id = data.azurerm_key_vault.domain_key_vault.id
+}
+
+data "azurerm_key_vault_secret" "key_vault_read_packages_token" {
+  name         = "pagopa-platform-domain-github-bot-ci-pat"
+  key_vault_id = data.azurerm_key_vault.domain_key_vault.id
 }
 
 data "azurerm_key_vault_secret" "key_vault_cucumber_token" {
@@ -56,13 +61,32 @@ data "azurerm_key_vault_secret" "key_vault_slack_webhook_url" {
   key_vault_id = data.azurerm_key_vault.domain_key_vault.id
 }
 
-data "azurerm_key_vault_secret" "key_vault_read_package_token" {
-#  name = "github-token-read-packages-bot"
-  name = "gh-read-pkg-test-francesco"
-  key_vault_id = data.azurerm_key_vault.key_vault.id
-}
-
 data "azurerm_user_assigned_identity" "identity_cd" {
   name = "${local.product}-${local.domain}-01-github-cd-identity"
   resource_group_name = "${local.product}-identity-rg"
+}
+
+resource "null_resource" "encrypt_key_vault_bot_token" {
+
+  triggers = {
+    always_run = "${timestamp()}"
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      python3 encrypt_github_pat.py $PAT $REPO > private_output.txt
+    EOT
+    working_dir = "${path.module}"
+    environment = {
+      PAT = data.azurerm_key_vault_secret.key_vault_read_packages_token.value
+      REPO = local.github.repository
+    }
+  }
+
+  depends_on = [data.azurerm_key_vault_secret.key_vault_read_packages_token]
+}
+
+
+data "local_file" "encrypted_key_vault_read_packages_token" {
+  filename = "${path.module}/private_output.txt"
 }

.identity/03_github_environment.tf

@@ -71,8 +71,8 @@ resource "github_actions_secret" "secret_sonar_token" {
 #tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret
 resource "github_actions_secret" "secret_bot_token" {
   repository       = local.github.repository
-  secret_name      = "BOT_TOKEN_GITHUB"
-  plaintext_value  = data.azurerm_key_vault_secret.key_vault_bot_token.value
+  secret_name      = "CD_BOT_TOKEN_GITHUB"
+  plaintext_value  = data.azurerm_key_vault_secret.key_vault_bot_cd_token.value
 }
 
 #tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret
@@ -85,7 +85,7 @@ resource "github_actions_secret" "secret_bot_token" {
 resource "github_actions_secret" "secret_read_package_token" {
   repository       = local.github.repository
   secret_name      = "READ_PACKAGES_TOKEN"
-  encrypted_value  = data.azurerm_key_vault_secret.key_vault_read_package_token.value
+  encrypted_value  = trimspace(data.local_file.encrypted_key_vault_read_packages_token.content)
 }
 
 ############

.identity/encrypt_github_pat.py

@@ -0,0 +1,37 @@
+from base64 import b64encode
+from nacl import encoding, public
+import requests, sys
+
+
+def encrypt(public_key: str, secret_value: str) -> str:
+    """Encrypt a Unicode string using the public key."""
+    public_key = public.PublicKey(public_key.encode("utf-8"), encoding.Base64Encoder())
+    sealed_box = public.SealedBox(public_key)
+    encrypted = sealed_box.encrypt(secret_value.encode("utf-8"))
+    return b64encode(encrypted).decode("utf-8")
+
+
+def public_key(token: str, repo: str) -> str:
+    """Retrieve public key from token and repository."""
+    headers = {
+        "Authorization": f"token {token}"
+    }
+    response = requests.get(f'https://api.github.com/repos/pagopa/{repo}/actions/secrets/public-key', headers=headers)
+    try:
+        return response.json()["key"]
+    except:
+        print(token)
+        print(response)
+        print(response.text)
+
+
+
+if len(sys.argv) != 3:
+    print("how-to: python3 encrypt_github_pat.py <pat> <repo>")
+
+token = sys.argv[1]
+repo = sys.argv[2]
+public_key = public_key(token, repo)
+enc_key = encrypt(public_key, token)
+
+print(enc_key)

.identity/requirements.txt

@@ -0,0 +1,2 @@
+requests
+pynacl