Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade GHA usages of actions/upload-artifact and actions/download-artifact #2539

Merged
merged 4 commits into from
Feb 2, 2024

Conversation

jeffsmohan
Copy link
Contributor

@jeffsmohan jeffsmohan commented Jan 30, 2024

Ticket #2528

Description

Upgrades Github workflows to use v4 of actions/upload-artifact and actions/download-artifact. These have a few performance improvements, but primarily have longer-term support since they're running on node v20.

I've configured all artifact uploads with overwrite: true since v4 makes artifacts immutable. In general use, I don't think this would be an issue for our setup (all artifacts have the git commit hash in their filename), but I believe it would break if you manually re-ran a workflow, which would cause the same filename to get uploaded again. In this case, I believe the overwrite behavior of removing the file, then re-uploading it, should work for us.

Screenshots / Demo Video

Testing

I've so far been unable to test these changes. Maybe someone with a deeper understanding of GH workflows can help point me in the right direction?

image

This stack overflow points to some options, but I wasn't able to get any working well here:

  • Push your code and create a PR. (I see folks suggesting this, but so far on this draft PR I'm not able to get it working. It seems to be running the un-updated workflows from main branch. I did see some mentions that this is for security reasons, since it would allow arbitrary code execution...)
  • Trigger the workflow via the GitHub CLI. (I haven't been able to get this to work either.)
  • Use nektos/act to run the workflows locally — this seems real heavy-handed and I'd like to avoid the setup

Automated and Unit Tests

Not tested

Manual tests for Reviewer

  • Added steps to test feature/functionality manually

Checklist

  • Provided ticket and description
  • Provided screenshots/demo
  • Provided testing information
  • Provided adequate test coverage for all new code
  • Added PR reviewers

Copy link

github-actions bot commented Jan 30, 2024

QA Summary

QA Check Result
🌐 Client Tests
🔗 Server Tests
🤝 E2E Tests
📏 ESLint
🧹 TFLint

Test Coverage

Coverage report for `packages/client`
St File % Stmts % Branch % Funcs % Lines Uncovered Line #s
🔴 All files 15.94 14.18 20.67 16.2
🟡  ...nents/src/arpa_reporter/components 50.9 26.66 62.16 50.9
🔴   AlertBox.vue 0 0 0 0 20-21
🟡   DownloadButton.vue 50 50 50 50 39,56-59
🟢   DownloadFileButton.vue 100 100 100 100
🟢   DownloadTemplateBtn.vue 100 100 100 100
🟡   Navigation.vue 63.15 100 62.5 63.15 137-143,152-159
🔴   StandardForm.vue 34.78 20 55.55 34.78 86-90,97-119
🟢  arpa_reporter/helpers 84.61 79.48 87.5 84.61
🟢   form-helpers.js 84.21 79.48 85.71 84.21 7,16,25,81-83
🟢   short-uuid.js 100 100 100 100
🔴  arpa_reporter/store 4.85 0 2.17 5.1
🔴   index.js 4.85 0 2.17 5.1 13-16,34-263
🔴  ...rter/views/src/arpa_reporter/views 41.71 39.21 70.58 41.71
🟢   Agencies.vue 100 100 100 100
🔴   Home.vue 26.66 25 60 26.66 ...05-130,137-166
🔴   Upload.vue 48.21 50 78.94 48.21 ...39,345-346,356
🔴   Uploads.vue 43.18 38.88 66.66 43.18 ...65,181,232-256
🔴   User.vue 38.7 28.57 68.75 38.7 73-118
🔴  ...nents/Modals/src/components/Modals 3.93 2.17 10.16 3.95
🔴   AddOrganization.vue 7.69 0 25 7.69 136-171
🔴   AddTeam.vue 37.5 33.33 60 37.5 178,184-212
🔴   EditOrganization.vue 11.11 0 28.57 11.11 50-76
🔴   EditTeam.vue 2.5 0 16.66 2.5 151-260
🔴   GrantDetailsLegacy.vue 0 0 0 0 108-285
🔴   ImportTeams.vue 0 0 0 0 44-79
🔴   ProfileSettings.vue 0 0 0 0 49-128
🔴   SavedSearchPanel.vue 0 0 0 0 98-208
🔴   SearchPanel.vue 1.72 0 0 1.75 267-456
🔴  components/src/components 4.11 5.55 10.29 4.11
🔴   GrantsTable.vue 0 0 0 0 104-398
🟡   Layout.vue 50 66.66 53.84 50 133-148
🔴   SearchFilter.vue 0 0 0 0 26-68
🔴   Uploader.vue 0 0 0 0 47-100
🔴   UserAvatar.vue 0 0 0 0 44-90
🔴  helpers 8.91 8.43 9.37 9.18
🟢   constants.js 100 100 100 100
🔴   fetchApi.js 5.55 12.5 5.55 5.55 10-102
🔴   filters.js 4 0 0 4.54 19-51
🔴   form-helpers.js 0 0 0 0 5-82
🟢   gtag.js 100 100 100 100
🟢  helpers/featureFlags 91.66 100 83.33 91.66
🟡   index.js 75 100 75 75 20
🟢   utils.js 100 100 100 100
🔴  mixin 23.8 0 28.57 23.8
🔴   resizableTable.js 23.8 0 28.57 23.8 16-31,36-37,42
🔴  router 21.87 12.5 18.75 21.87
🔴   index.js 21.87 12.5 18.75 21.87 ...62-163,167-186
🟢  store 100 100 100 100
🟢   index.js 100 100 100 100
🔴  store/modules 6.14 0 4.94 6.42
🔴   agencies.js 10 100 8.33 10.52 13-70
🔴   alerts.js 20 100 20 20 10-24
🔴   dashboard.js 4.65 0 4.54 4.65 22-96
🔴   grants.js 2.66 0 1.04 2.79 59-358
🔴   keywords.js 14.28 0 9.09 16.66 13-33
🔴   organization.js 33.33 100 33.33 33.33 21-25
🔴   roles.js 33.33 100 20 40 13-22
🔴   tenants.js 20 100 14.28 22.22 13-32
🔴   users.js 4.76 0 4.76 4.87 17-100
🟡  views 50 100 0 50
🟡   NotFound.vue 50 100 0 50 2-4
🔴  views/src/views 11.68 0 23.43 11.76
🔴   ArpaAnnualPerformanceReporter.vue 0 0 0 0 81-134
🔴   Dashboard.vue 11.68 0 26.08 11.84 ...52-266,283-356
🔴   Grants.vue 0 100 0 0 11-18
🔴   Login.vue 0 0 0 0 63-115
🔴   Organizations.vue 40 100 40 40 64,74-77,88-92
🟡   Teams.vue 50 100 50 50 108,119-126
Coverage report for `packages/server`
St File % Stmts % Branch % Funcs % Lines Uncovered Line #s
🟡 All files 55.61 46.63 50.13 55.94
🟢  src 82.35 33.33 60 82.35
🟢   configure.js 82.35 33.33 60 82.35 44,63-70,99-101
🟢  src/arpa_reporter 98.75 66.66 100 98.75
🟢   configure.js 97.36 40 100 97.36 36
🟢   environment.js 100 100 100 100
🟢   use-request.js 100 100 100 100
🔴  src/arpa_reporter/db 38.4 32.5 44.44 40
🔴   arpa-subrecipients.js 13.15 4.34 15.38 14.28 23-92
🔴   reporting-periods.js 36.58 46.66 40 37.5 74-153
🟢   settings.js 100 83.33 100 100 13
🟡   uploads.js 50 28.57 52.38 51.42 18-29,83,98-123,140-149
🔴  src/arpa_reporter/lib 30.02 24.76 29.68 30.39
🟢   arpa-ec-codes.js 100 100 100 100
🔴   audit-report.js 28.31 26.86 32.6 27.73 ...96-397,439-522,568-587
🟡   ensure-async-context.js 75 100 50 100
🔴   format.js 13.79 0 0 19.04 28-82
🟡   log.js 75 50 50 75 13,25
🟡   preconditions.js 66.66 33.33 100 66.66 3
🔴   spreadsheet.js 9.09 0 0 9.09 15-32
🟢   validation-error.js 85.71 100 50 85.71 16
🔴  src/arpa_reporter/routes 39.47 11.9 14.28 40.08
🔴   agencies.js 22.58 0 0 23.33 13-21,26-53
🟡   application_settings.js 75 100 0 75 10-11
🟡   audit-report.js 69.23 66.66 100 69.23 55-69,90-105
🟢   exports.js 81.42 80 100 81.42 61-75,98-99
🔴   reporting-periods.js 20 0 0 20.43 ...25-137,143-149,154-180
🔴   subrecipients.js 23.8 0 0 23.8 12-13,17-27,31-48,52-63
🔴   uploads.js 28.28 7.89 9.09 29.16 ...33-154,164-166,173-180
🔴   users.js 19.6 0 0 20 15-35,39-44,48-81
🔴  src/arpa_reporter/services 43.48 30.63 46.37 43.83
🔴   generate-arpa-report.js 37.62 2.79 50 38.02 ...-944,953-966,1040-1099
🔴   get-template.js 21.62 0 0 21.62 18-79
🟡   persist-upload.js 68.6 90 69.56 68.67 ...58-200,221-235,273-295
🔴   records.js 23.4 0 13.33 23.65 38-197,214-253
🔴   revalidate-uploads.js 37.5 100 0 37.5 5-14
🔴   validate-upload.js 37.93 49.41 32.14 38.83 ...10,329,351,369-657,672
🟢   validation-rules.js 98.18 90 90.9 100 157,173
🟡  src/db 75.41 71.98 69.94 75.51
🟢   connection.js 100 50 100 100 6
🟢   constants.js 100 100 100 100
🟢   helpers.js 83.33 100 50 83.33 21-22
🟢   index.js 83.18 78.34 82.87 83.17 ...08-1574,1756-1757,1764
🟢   saved_search_migration.js 92 88.23 71.42 93.61 5,69,134
🔴   tenant_creation.js 10.58 2.7 0 11.11 15-40,48-210,220
🔴  src/db/arpa_reporter_db_shims 23.68 0 0 23.68
🔴   agencies.js 22.22 100 0 22.22 11-51
🔴   users.js 25 0 0 25 12-62
🟡  src/lib 63.66 60.07 58.06 64.43
🟢   access-helpers.js 93.44 89.18 100 93.44 91-92,97-98
🟢   agencyImporter.js 90.38 88.46 100 90.19 26,29,35,93-94
🔴   batchProcessor.js 2.94 0 0 3.03 35-104
🟢   email.js 95 72.5 100 94.82 53,59,80,92,244-245
🔴   gost-aws.js 22.22 12.5 20 20.58 13-58,65-113
🟢   grants-ingest.js 83.05 97.36 90 83.05 ...27-130,137-139,154-158
🔴   grantsgov.js 6.25 6.52 0 6.97 12-220
🟡   logging.js 77.77 85.71 100 77.77 11,13
🔴   pdf.js 21.42 0 0 21.42 9-13,18-42
🟢   redirect_validation.js 100 100 100 100
🟢   userImporter.js 82.27 58.33 88.88 81.57 32,47,53,62,73-81,143-152
🔴  src/lib/annualReports 27.38 0 0 27.38
🔴   doc-builder.js 7.69 0 0 7.69 19-352
🟡   index.js 80 100 0 80 6
🟢   placeholderTextStrings.js 100 100 100 100
🔴   reportBuilder.js 17.24 0 0 17.24 21-33,50-62,86-103
🟢  src/lib/arpa_reporter_shims 100 100 100 100
🟢   email.js 100 100 100 100
🟢  src/lib/email 96.15 100 100 95.83
🟢   constants.js 100 100 100 100
🟢   email-nodemailer.js 93.33 100 100 92.3 33
🟢   service-email.js 100 100 100 100
🟢  src/lib/fieldConfigs 100 100 100 100
🟢   fundingActivityCategories.js 100 100 100 100
🔴  src/lib/grantscraper 11.86 0 0 12.96
🔴   index.js 11.86 0 0 12.96 11-92,98-122
🟡  src/routes 68.42 57.01 62.02 68.38
🔴   agencies.js 45.54 30 40 45.54 ...32-140,144-165,173-179
🔴   annualReports.js 47.05 100 0 47.05 15-27
🔴   dashboard.js 21.42 0 0 21.42 8-53
🟢   eligibilityCodes.js 100 100 100 100
🟢   grants.js 80.76 69.72 78.12 81.14 ...73-376,389-390,443-456
🟡   grantsSavedSearch.js 80 83.33 100 80 38-39,56-57,70-72,78
🟢   health.js 100 100 100 100
🟡   interestedCodes.js 71.42 100 0 71.42 7-8
🟢   keywords.js 86.95 50 100 86.95 26-27,34
🟡   refresh.js 71.42 100 0 71.42 7-8
🟡   roles.js 75 100 0 75 8-9
🟡   searchConfig.js 58.33 100 0 58.33 9-14
🟡   sessions.js 63.93 39.39 50 63.93 ...-73,79-80,84-85,98-104
🔴   tenants.js 39.13 0 0 39.13 11-12,16-27,32-35
🟢   users.js 80.41 74.19 85.71 80.41 ...17,134-136,160,169-177

Pusher: @jeffsmohan, Action: pull_request_target, Workflow: Continuous Integration

Copy link

github-actions bot commented Jan 30, 2024

Terraform Summary

Step Result
🖌 Terraform Format & Style
⚙️ Terraform Initialization
🤖 Terraform Validation
📖 Terraform Plan

Hint: If "Terraform Format & Style" failed, run terraform fmt -recursive from the terraform/ directory and commit the results.

Output

Validation Output
Success! The configuration is valid.


Plan Output
Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.api.aws_ecs_task_definition.default[0] has changed
  ~ resource "aws_ecs_task_definition" "default" {
        id                       = "gost-staging-api"
+       tags                     = {}
        # (13 unchanged attributes hidden)

+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id          = "fs-08f95063c1cdbe191"
+               root_directory          = "/"
+               transit_encryption      = "ENABLED"
+               transit_encryption_port = 0

+               authorization_config {
+                   access_point_id = "fsap-03bc0296928aade4f"
                }
            }
        }
-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id     = "fs-08f95063c1cdbe191" -> null
-               root_directory     = "/" -> null
-               transit_encryption = "ENABLED" -> null

-               authorization_config {
-                   access_point_id = "fsap-03bc0296928aade4f" -> null
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.api.aws_iam_role.execution[0] has changed
  ~ resource "aws_iam_role" "execution" {
        id                    = "gost-staging-api-ECSTaskExecution-20230217010414321500000009"
        name                  = "gost-staging-api-ECSTaskExecution-20230217010414321500000009"
      ~ role_last_used        = [
          ~ {
              ~ last_used_date = "2024-02-01T17:08:06Z" -> "2024-02-02T17:43:06Z"
                # (1 unchanged element hidden)
            },
        ]
        tags                  = {}
        # (11 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

  # module.api.aws_iam_role.task[0] has changed
  ~ resource "aws_iam_role" "task" {
        id                    = "gost-staging-api-ECSTask-2023021701041477300000000a"
        name                  = "gost-staging-api-ECSTask-2023021701041477300000000a"
      ~ role_last_used        = [
          ~ {
              ~ last_used_date = "2024-02-01T17:08:05Z" -> "2024-02-02T17:43:02Z"
                # (1 unchanged element hidden)
            },
        ]
        tags                  = {}
        # (11 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
  ~ update in-place
-   destroy
+/- create replacement and then destroy

Terraform will perform the following actions:

  # module.api.aws_ecs_service.default[0] will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:357150818708:service/gost-staging/gost-staging-api"
        name                               = "gost-staging-api"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-api:123" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

  # module.api.aws_ecs_task_definition.default[0] must be replaced
+/- resource "aws_ecs_task_definition" "default" {
      ~ arn                      = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-api:123" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-api" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [ # forces replacement
              ~ {
                  ~ dockerLabels           = {
                      ~ "com.datadoghq.tags.version" = "62140920ba24e1b727b08bb7699959e5726eb27e" -> "84ab0c121353a8679620ce2a6f221b8a58be7bac"
                        # (2 unchanged elements hidden)
                    }
                  ~ environment            = [
                        # (7 unchanged elements hidden)
                        {
                            name  = "DD_SERVICE"
                            value = "gost"
                        },
                      ~ {
                            name  = "DD_VERSION"
                          ~ value = "62140920ba24e1b727b08bb7699959e5726eb27e" -> "84ab0c121353a8679620ce2a6f221b8a58be7bac"
                        },
                        {
                            name  = "ENABLE_GRANTS_DIGEST"
                            value = "false"
                        },
                        # (11 unchanged elements hidden)
                    ]
                  ~ image                  = "ghcr.io/usdigitalresponse/usdr-gost-api:62140920ba24e1b727b08bb7699959e5726eb27e@sha256:01f776e843e1c6f7289398996d7041dddc21d6d7053e6e673d69cdd51009ec9d" -> "ghcr.io/usdigitalresponse/usdr-gost-api:84ab0c121353a8679620ce2a6f221b8a58be7bac@sha256:8d42adea00acd123b550b763ae9c50526345f1885b04c373af5a4e6b96e72a8a"
                    name                   = "api"
-                   volumesFrom            = [] -> null
                    # (9 unchanged elements hidden)
                } # forces replacement,
              ~ {
                  ~ dockerLabels           = {
                      ~ "com.datadoghq.tags.version" = "62140920ba24e1b727b08bb7699959e5726eb27e" -> "84ab0c121353a8679620ce2a6f221b8a58be7bac"
                        # (2 unchanged elements hidden)
                    }
                  ~ environment            = [
                        # (3 unchanged elements hidden)
                        {
                            name  = "DD_SERVICE"
                            value = "gost"
                        },
                      ~ {
                            name  = "DD_VERSION"
                          ~ value = "62140920ba24e1b727b08bb7699959e5726eb27e" -> "84ab0c121353a8679620ce2a6f221b8a58be7bac"
                        },
                        {
                            name  = "ECS_FARGATE"
                            value = "true"
                        },
                    ]
-                   mountPoints            = [] -> null
                    name                   = "datadog"
-                   portMappings           = [] -> null
-                   volumesFrom            = [] -> null
                    # (6 unchanged elements hidden)
                } # forces replacement,
            ]
        )
      ~ id                       = "gost-staging-api" -> (known after apply)
      ~ revision                 = 123 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id          = "fs-08f95063c1cdbe191" -> null
-               root_directory          = "/" -> null
-               transit_encryption      = "ENABLED" -> null
-               transit_encryption_port = 0 -> null

-               authorization_config {
-                   access_point_id = "fsap-03bc0296928aade4f" -> null
                }
            }
        }
+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id     = "fs-08f95063c1cdbe191"
+               root_directory     = "/"
+               transit_encryption = "ENABLED"

+               authorization_config {
+                   access_point_id = "fsap-03bc0296928aade4f"
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.arpa_audit_report.aws_ecs_service.default will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:357150818708:service/gost-staging/gost-staging-arpa_audit_report"
        name                               = "gost-staging-arpa_audit_report"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-arpa_audit_report:92" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.arpa_audit_report.aws_ecs_task_definition.consumer must be replaced
+/- resource "aws_ecs_task_definition" "consumer" {
      ~ arn                      = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-arpa_audit_report:92" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-arpa_audit_report" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "gost-staging-arpa_audit_report" -> (known after apply)
-       ipc_mode                 = "" -> null
-       pid_mode                 = "" -> null
      ~ revision                 = 92 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id          = "fs-08f95063c1cdbe191" -> null
-               root_directory          = "/" -> null
-               transit_encryption      = "ENABLED" -> null
-               transit_encryption_port = 0 -> null

-               authorization_config {
-                   access_point_id = "fsap-03bc0296928aade4f" -> null
                }
            }
        }
+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id     = "fs-08f95063c1cdbe191"
+               root_directory     = "/"
+               transit_encryption = "ENABLED"

+               authorization_config {
+                   access_point_id = "fsap-03bc0296928aade4f"
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.arpa_treasury_report.aws_ecs_service.default will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:357150818708:service/gost-staging/gost-staging-treasury_report"
        name                               = "gost-staging-treasury_report"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-treasury_report:81" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.arpa_treasury_report.aws_ecs_task_definition.consumer must be replaced
+/- resource "aws_ecs_task_definition" "consumer" {
      ~ arn                      = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-treasury_report:81" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-treasury_report" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "gost-staging-treasury_report" -> (known after apply)
-       ipc_mode                 = "" -> null
-       pid_mode                 = "" -> null
      ~ revision                 = 81 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

-       volume {
-           name = "data" -> null

-           efs_volume_configuration {
-               file_system_id          = "fs-08f95063c1cdbe191" -> null
-               root_directory          = "/" -> null
-               transit_encryption      = "ENABLED" -> null
-               transit_encryption_port = 0 -> null

-               authorization_config {
-                   access_point_id = "fsap-03bc0296928aade4f" -> null
                }
            }
        }
+       volume {
+           name = "data"

+           efs_volume_configuration {
+               file_system_id     = "fs-08f95063c1cdbe191"
+               root_directory     = "/"
+               transit_encryption = "ENABLED"

+               authorization_config {
+                   access_point_id = "fsap-03bc0296928aade4f"
                }
            }
        }

        # (1 unchanged block hidden)
    }

  # module.consume_grants.aws_ecs_service.default will be updated in-place
  ~ resource "aws_ecs_service" "default" {
        id                                 = "arn:aws:ecs:us-west-2:357150818708:service/gost-staging/gost-staging-consume_grants"
        name                               = "gost-staging-consume_grants"
        tags                               = {}
      ~ task_definition                    = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-consume_grants:108" -> (known after apply)
        # (15 unchanged attributes hidden)

        # (3 unchanged blocks hidden)
    }

  # module.consume_grants.aws_ecs_task_definition.consume_grants must be replaced
+/- resource "aws_ecs_task_definition" "consume_grants" {
      ~ arn                      = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-consume_grants:108" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-west-2:357150818708:task-definition/gost-staging-consume_grants" -> (known after apply)
      ~ container_definitions    = (sensitive value) # forces replacement
      ~ id                       = "gost-staging-consume_grants" -> (known after apply)
-       ipc_mode                 = "" -> null
-       pid_mode                 = "" -> null
      ~ revision                 = 108 -> (known after apply)
-       tags                     = {} -> null
        # (9 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.website.aws_s3_object.deploy-config[0] will be updated in-place
  ~ resource "aws_s3_object" "deploy-config" {
      ~ content                = <<-EOT
            window.APP_CONFIG = window.APP_CONFIG || {};
            window.APP_CONFIG.apiURLForGOST = 'https://api.staging.grants.usdr.dev/';
            window.apiURLForGOST = window.APP_CONFIG.apiURLForGOST; // Legacy
            
            window.APP_CONFIG.DD_RUM_ENABLED = true;
-           window.APP_CONFIG.DD_RUM_CONFIG = {"allowedTracingUrls":["https://api.staging.grants.usdr.dev"],"applicationId":"15db471e-2ccb-4d3c-a6bf-99b750d748f5","clientToken":"pub50834fcc1999d53e546519b1a0f03934","defaultPrivacyLevel":"mask","env":"staging","service":"gost","sessionReplaySampleRate":1,"sessionSampleRate":10,"site":"datadoghq.com","trackLongTasks":true,"trackResources":true,"trackUserInteractions":true,"version":"62140920ba24e1b727b08bb7699959e5726eb27e"};
+           window.APP_CONFIG.DD_RUM_CONFIG = {"allowedTracingUrls":["https://api.staging.grants.usdr.dev"],"applicationId":"15db471e-2ccb-4d3c-a6bf-99b750d748f5","clientToken":"pub50834fcc1999d53e546519b1a0f03934","defaultPrivacyLevel":"mask","env":"staging","service":"gost","sessionReplaySampleRate":1,"sessionSampleRate":10,"site":"datadoghq.com","trackLongTasks":true,"trackResources":true,"trackUserInteractions":true,"version":"84ab0c121353a8679620ce2a6f221b8a58be7bac"};
            
            window.APP_CONFIG.GOOGLE_TAG_ID = '';
            
            window.APP_CONFIG.featureFlags = {"categoryOfFundingActivitySearchFieldEnabled":true,"myProfileEnabled":true,"newGrantsDetailPageEnabled":false,"newTerminologyEnabled":true};
            
            window.APP_CONFIG.overrideFeatureFlag = (flagName, overrideValue) => {
              const storageKey = 'featureFlags';
              let overrides = {};
              try {
                overrides = JSON.parse(window.sessionStorage.getItem(storageKey)) || {};
              } catch (e) {
                console.error(`Error parsing window.sessionStorage.${storageKey} as JSON:`, e);
                console.warn(`window.sessionStorage.${storageKey} will be replaced.`);
              }
              overrides[flagName] = overrideValue;
              window.sessionStorage.setItem(storageKey, JSON.stringify(overrides));
              console.log('New feature flag overrides in page session:',
                window.sessionStorage.getItem(storageKey));
            };
        EOT
      ~ etag                   = "4eea445b43128f3ed79caf8dd869983f" -> "19e0a76ad18c95c82c8c67ae60f4ddaf"
        id                     = "/config/deploy-config.js"
        tags                   = {}
      ~ version_id             = "w4lshnGoiL7v4oC.MhgO_vcO4UaKyJDm" -> (known after apply)
        # (10 unchanged attributes hidden)
    }

  # module.website.aws_s3_object.origin_dist_artifact["arpa_reporter/index.html"] will be updated in-place
  ~ resource "aws_s3_object" "origin_dist_artifact" {
      ~ etag                   = "adac2e7f5de5a7c20c4e88bade078ae2" -> "537d64db6c28d2fbba0ea4870dd0d714"
        id                     = "dist/arpa_reporter/index.html"
      ~ source_hash            = "adac2e7f5de5a7c20c4e88bade078ae2" -> "537d64db6c28d2fbba0ea4870dd0d714"
        tags                   = {}
      ~ version_id             = "pldM8UIgUfd8zw_sT7MhM18ymD2k3Bqj" -> (known after apply)
        # (11 unchanged attributes hidden)
    }

  # module.website.aws_s3_object.origin_dist_artifact["index.html"] will be updated in-place
  ~ resource "aws_s3_object" "origin_dist_artifact" {
      ~ etag                   = "782838c51f62ba5ee03e208b26e39776" -> "d945ace2143a6e2aa4430338c2eb6507"
        id                     = "dist/index.html"
      ~ source_hash            = "782838c51f62ba5ee03e208b26e39776" -> "d945ace2143a6e2aa4430338c2eb6507"
        tags                   = {}
      ~ version_id             = "X79m.pVll8ZMMbb9Jov.j8B8nZw4.y50" -> (known after apply)
        # (11 unchanged attributes hidden)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/120.7b613c03.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "c4cecd08bc63fb8d907411f3d5561cd1"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/120.7b613c03.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/120.7b613c03.js"
+       source_hash            = "c4cecd08bc63fb8d907411f3d5561cd1"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/120.7b613c03.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "f72d584ee39a72d3f583ce80a4b2d6b9"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/120.7b613c03.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/120.7b613c03.js.map"
+       source_hash            = "f72d584ee39a72d3f583ce80a4b2d6b9"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/120.fa8d250e.js"] will be destroyed
  # (because key ["js/120.fa8d250e.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "943f81186871cfc35a399e7b5dd0779f" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/120.fa8d250e.js" -> null
-       key                    = "dist/js/120.fa8d250e.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/120.fa8d250e.js" -> null
-       source_hash            = "943f81186871cfc35a399e7b5dd0779f" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "tD0lHX8e7wB5laZ7PcfY46dC_KVk5_9M" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/120.fa8d250e.js.map"] will be destroyed
  # (because key ["js/120.fa8d250e.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "e8a1e618fca328786c397237a9a6d6ac" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/120.fa8d250e.js.map" -> null
-       key                    = "dist/js/120.fa8d250e.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/120.fa8d250e.js.map" -> null
-       source_hash            = "e8a1e618fca328786c397237a9a6d6ac" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "Ttoa_witiTnLtr2Cq5PkzAMqRfCUcSFh" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/185.692adb2f.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "a36b11f5c2cb3a7c6295b30687860037"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/185.692adb2f.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/185.692adb2f.js"
+       source_hash            = "a36b11f5c2cb3a7c6295b30687860037"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/185.692adb2f.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "4a779bcee1928325ba91da0fd598f191"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/185.692adb2f.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/185.692adb2f.js.map"
+       source_hash            = "4a779bcee1928325ba91da0fd598f191"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/185.95f7d2dc.js"] will be destroyed
  # (because key ["js/185.95f7d2dc.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "9fb0418300613506f00dce6055a15808" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/185.95f7d2dc.js" -> null
-       key                    = "dist/js/185.95f7d2dc.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/185.95f7d2dc.js" -> null
-       source_hash            = "9fb0418300613506f00dce6055a15808" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "rrINtp1_a5kEitbJRqmcANTQ_IIWZ0bl" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/185.95f7d2dc.js.map"] will be destroyed
  # (because key ["js/185.95f7d2dc.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "8b1a965bed68f820d185b7f19cc3cd9d" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/185.95f7d2dc.js.map" -> null
-       key                    = "dist/js/185.95f7d2dc.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/185.95f7d2dc.js.map" -> null
-       source_hash            = "8b1a965bed68f820d185b7f19cc3cd9d" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "gMYni0jJi74k0TvNqDXAiRePDMtOCzfo" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/223.280dc9b4.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "ff17742641f7cee29a8908eb104177fd"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/223.280dc9b4.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/223.280dc9b4.js"
+       source_hash            = "ff17742641f7cee29a8908eb104177fd"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/223.280dc9b4.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "7382a6dd50985d6295e95d007c762e93"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/223.280dc9b4.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/223.280dc9b4.js.map"
+       source_hash            = "7382a6dd50985d6295e95d007c762e93"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/223.f94286e0.js"] will be destroyed
  # (because key ["js/223.f94286e0.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "28ed9071bc3740c69335f18bb533c7eb" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/223.f94286e0.js" -> null
-       key                    = "dist/js/223.f94286e0.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/223.f94286e0.js" -> null
-       source_hash            = "28ed9071bc3740c69335f18bb533c7eb" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "4dmeX..WMfqPZD2BYtNn6FxYI30Kohh5" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/223.f94286e0.js.map"] will be destroyed
  # (because key ["js/223.f94286e0.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "7665fb26f4031cbed269fed4059058a9" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/223.f94286e0.js.map" -> null
-       key                    = "dist/js/223.f94286e0.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/223.f94286e0.js.map" -> null
-       source_hash            = "7665fb26f4031cbed269fed4059058a9" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "5_96B8CLl_UvPtatOGTnfLL.FAgPN8bG" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/230.2950744a.js"] will be destroyed
  # (because key ["js/230.2950744a.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "3fec3489951bba446b04b6df742969d7" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/230.2950744a.js" -> null
-       key                    = "dist/js/230.2950744a.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/230.2950744a.js" -> null
-       source_hash            = "3fec3489951bba446b04b6df742969d7" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "A7CS_Qw_Be0JmUrGe4N.ptTRo3JJGh_d" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/230.2950744a.js.map"] will be destroyed
  # (because key ["js/230.2950744a.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "c746f2b68a61b1577bd9e7be9ddf1d54" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/230.2950744a.js.map" -> null
-       key                    = "dist/js/230.2950744a.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/230.2950744a.js.map" -> null
-       source_hash            = "c746f2b68a61b1577bd9e7be9ddf1d54" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "FvZ1U7NjP1s4LdGCfLgmxDdRiy.hkzkf" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/230.63414588.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "9012e59a36d59d8dc2f7773acb701ba7"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/230.63414588.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/230.63414588.js"
+       source_hash            = "9012e59a36d59d8dc2f7773acb701ba7"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/230.63414588.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "c66a1399d67d21ef3c7c08262cdd104d"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/230.63414588.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/230.63414588.js.map"
+       source_hash            = "c66a1399d67d21ef3c7c08262cdd104d"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/409.ba3f139a.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "cd4e5307722eabdcf8fe1bcdba3ba3da"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/409.ba3f139a.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/409.ba3f139a.js"
+       source_hash            = "cd4e5307722eabdcf8fe1bcdba3ba3da"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/409.ba3f139a.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "4d816f3e69f8023bf355a0741ce93db8"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/409.ba3f139a.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/409.ba3f139a.js.map"
+       source_hash            = "4d816f3e69f8023bf355a0741ce93db8"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/409.d7bcdab5.js"] will be destroyed
  # (because key ["js/409.d7bcdab5.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "3ede00c93879eb49f5b5dcc827c7c645" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/409.d7bcdab5.js" -> null
-       key                    = "dist/js/409.d7bcdab5.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/409.d7bcdab5.js" -> null
-       source_hash            = "3ede00c93879eb49f5b5dcc827c7c645" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "oPhLeSppY4Z5nlYT47LOOCl7CeKCfE7Z" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/409.d7bcdab5.js.map"] will be destroyed
  # (because key ["js/409.d7bcdab5.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "471cc3c375b1771056cfcffde7f0fe13" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/409.d7bcdab5.js.map" -> null
-       key                    = "dist/js/409.d7bcdab5.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/409.d7bcdab5.js.map" -> null
-       source_hash            = "471cc3c375b1771056cfcffde7f0fe13" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "2N70Mgn1KjzK.RDxLjRcczRy9hrvCr_Q" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/474.05eeec12.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "419f689c49840f66e54dc73e2ae1a387"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/474.05eeec12.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/474.05eeec12.js"
+       source_hash            = "419f689c49840f66e54dc73e2ae1a387"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/474.05eeec12.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "4c0cfd3879772a090295e42ec98205c2"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/474.05eeec12.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/474.05eeec12.js.map"
+       source_hash            = "4c0cfd3879772a090295e42ec98205c2"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/474.d864840e.js"] will be destroyed
  # (because key ["js/474.d864840e.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "11a687f1da73da2e57ebe0ccb371db63" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/474.d864840e.js" -> null
-       key                    = "dist/js/474.d864840e.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/474.d864840e.js" -> null
-       source_hash            = "11a687f1da73da2e57ebe0ccb371db63" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "cqEbtOioKoM7kpHxeAuianGE_KYR3hH7" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/474.d864840e.js.map"] will be destroyed
  # (because key ["js/474.d864840e.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "4c923404486b926cff4d04d979b4a09b" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/474.d864840e.js.map" -> null
-       key                    = "dist/js/474.d864840e.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/474.d864840e.js.map" -> null
-       source_hash            = "4c923404486b926cff4d04d979b4a09b" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "T8e4A9.Hj5bTdZeCWvCv09VWrm3CAqx5" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/619.84d59438.js"] will be destroyed
  # (because key ["js/619.84d59438.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "adfd09a535ffe92bc78cde37e06a72e7" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/619.84d59438.js" -> null
-       key                    = "dist/js/619.84d59438.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/619.84d59438.js" -> null
-       source_hash            = "adfd09a535ffe92bc78cde37e06a72e7" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "HLvFE3Sd4U_agFT5DXpakNhmThixF3XA" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/619.84d59438.js.map"] will be destroyed
  # (because key ["js/619.84d59438.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "fe07e1f5ce6bfe895f12d684e8f6f666" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/619.84d59438.js.map" -> null
-       key                    = "dist/js/619.84d59438.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/619.84d59438.js.map" -> null
-       source_hash            = "fe07e1f5ce6bfe895f12d684e8f6f666" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "FudsUXC6URPrzzEUX3X7cEFKBqF3Uqtz" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/619.8d27d8c7.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "842d85a4bf7ffe603373ae4f5e7e77b1"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/619.8d27d8c7.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/619.8d27d8c7.js"
+       source_hash            = "842d85a4bf7ffe603373ae4f5e7e77b1"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/619.8d27d8c7.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "8bc89075c5e2efbe00522489e7f24cab"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/619.8d27d8c7.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/619.8d27d8c7.js.map"
+       source_hash            = "8bc89075c5e2efbe00522489e7f24cab"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/645.5db8ecb3.js"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "text/javascript"
+       etag                   = "0c6530c0f8b0637247f963eebcd6be69"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/645.5db8ecb3.js"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/645.5db8ecb3.js"
+       source_hash            = "0c6530c0f8b0637247f963eebcd6be69"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/645.5db8ecb3.js.map"] will be created
+   resource "aws_s3_object" "origin_dist_artifact" {
+       acl                    = "private"
+       bucket                 = "gost-staging-origin-357150818708-us-west-2-website"
+       bucket_key_enabled     = (known after apply)
+       content_type           = "application/json"
+       etag                   = "f27559603a308ce8bb0ffda664c51570"
+       force_destroy          = false
+       id                     = (known after apply)
+       key                    = "dist/js/645.5db8ecb3.js.map"
+       kms_key_id             = (known after apply)
+       server_side_encryption = "AES256"
+       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/645.5db8ecb3.js.map"
+       source_hash            = "f27559603a308ce8bb0ffda664c51570"
+       storage_class          = (known after apply)
+       tags_all               = {
+           "env"        = "staging"
+           "management" = "terraform"
+           "owner"      = "grants"
+           "repo"       = "usdr-gost"
+           "service"    = "gost"
+           "usage"      = "workload"
        }
+       version_id             = (known after apply)
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/645.9a1e6553.js"] will be destroyed
  # (because key ["js/645.9a1e6553.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "9ca6ebcd08dc3dde57f7c5ed48702f27" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/645.9a1e6553.js" -> null
-       key                    = "dist/js/645.9a1e6553.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/645.9a1e6553.js" -> null
-       source_hash            = "9ca6ebcd08dc3dde57f7c5ed48702f27" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "CGxJ2HCTMgKWnPJKvj6vrfHzHD3A3hpp" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/645.9a1e6553.js.map"] will be destroyed
  # (because key ["js/645.9a1e6553.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "6979b2bc4372d12d8a173ee68902babd" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/645.9a1e6553.js.map" -> null
-       key                    = "dist/js/645.9a1e6553.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/645.9a1e6553.js.map" -> null
-       source_hash            = "6979b2bc4372d12d8a173ee68902babd" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "gaWpo4pNLXPFvuhB7C.IycRk.lPvbuxz" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/757.c6e74e6b.js"] will be destroyed
  # (because key ["js/757.c6e74e6b.js"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "text/javascript" -> null
-       etag                   = "90ca1dd32ad2cc01d32504d218a0854d" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/757.c6e74e6b.js" -> null
-       key                    = "dist/js/757.c6e74e6b.js" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/757.c6e74e6b.js" -> null
-       source_hash            = "90ca1dd32ad2cc01d32504d218a0854d" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        } -> null
-       version_id             = "nvMfu9PAnwp4..UiLwzlSaZXeLTlzhIi" -> null
    }

  # module.website.aws_s3_object.origin_dist_artifact["js/757.c6e74e6b.js.map"] will be destroyed
  # (because key ["js/757.c6e74e6b.js.map"] is not in for_each map)
-   resource "aws_s3_object" "origin_dist_artifact" {
-       acl                    = "private" -> null
-       bucket                 = "gost-staging-origin-357150818708-us-west-2-website" -> null
-       bucket_key_enabled     = false -> null
-       content_type           = "application/json" -> null
-       etag                   = "cf3294a46256f29a5287cfc4531dfc5b" -> null
-       force_destroy          = false -> null
-       id                     = "dist/js/757.c6e74e6b.js.map" -> null
-       key                    = "dist/js/757.c6e74e6b.js.map" -> null
-       metadata               = {} -> null
-       server_side_encryption = "AES256" -> null
-       source                 = "/home/runner/work/usdr-gost/usdr-gost/packages/client/dist/js/757.c6e74e6b.js.map" -> null
-       source_hash            = "cf3294a46256f29a5287cfc4531dfc5b" -> null
-       storage_class          = "STANDARD" -> null
-       tags                   = {} -> null
-       tags_all               = {
-           "env"        = "staging"
-           "management" = "terraform"
-           "owner"      = "grants"
-           "repo"       = "usdr-gost"
-           "service"    = "gost"
-           "usage"      = "workload"
        }...*[Comment body truncated]*

@jeffsmohan jeffsmohan marked this pull request as ready for review January 30, 2024 19:25
@jeffsmohan jeffsmohan requested a review from a team as a code owner January 30, 2024 19:25
@TylerHendrickson
Copy link
Member

@jeffsmohan To address the questions in the OP:

  • Push your code and create a PR. (I see folks suggesting this, but so far on this draft PR I'm not able to get it working. It seems to be running the un-updated workflows from main branch. I did see some mentions that this is for security reasons, since it would allow arbitrary code execution...)

Yes, we require that GHA workflows run against the base branch, which is necessary to support fork-based contributor workflows while maintaining good security posture.

  • Use nektos/act to run the workflows locally — this seems real heavy-handed and I'd like to avoid the setup

Agreed. I do have act configured and it is cumbersome to the point of not being terribly useful, especially given the amount of mocking that is necessary to test certain workflows.


FWIW, I think the most straightforward way to test this would be to first merge this into the main branch on the (i.e. your) forked repository, and then create a second, test branch and PR on the upstream repository. The test PR should then execute pull_request and pull_request_target workflows that run against the forked repo's base branch (i.e. your main). I can't 100% guarantee this will work, but I think it should.

PS- Once finished, you may want/need to rebase your main branch from the upstream usdigitalresponse/usdr-gost repo in order to get your fork back in-sync.

@jeffsmohan
Copy link
Contributor Author

Ah yeah, fork the repo, great idea! Honestly forget that even existed on GitHub. I'll work on getting this tested in a forked repo and report back.

@jeffsmohan
Copy link
Contributor Author

jeffsmohan commented Feb 1, 2024

I've managed to get some of the basic workflows running and passing on my forked repo. (See e.g. the checks on this PR: jeffsmohan#2) But @TylerHendrickson I'd love your opinion on how to fully test the rest.

The issue I run into is my fork doesn't have AWS secrets set up, so it can't run downstream actions like terraform plan or terraform apply. I might be tempted to say it's alright, as long as we've tested at least some representative actions with artifact uploads/downloads, that might give us enough confidence to land this PR. But I'm not actually able to run any of the workflows that use the download-artifact action, which I'd really like to find a way to do.

The only workflows that utilize the download-artifact action are:

  • terraform-plan.yml
  • terraform-apply.yml
  • deploy-production.yml

I assume we don't want to set up my fork to really deploy to production, but I'd love to be able to test terraform-plan and terraform-apply. You've got a lot more context than me... would it be safe to run terraform-plan/apply using our real AWS secrets? Would it be relatively easy/safe to use some staging or dev-specific AWS secrets we have lying around? Are there other easy workarounds to still be able to test download-artifact?

@TylerHendrickson
Copy link
Member

I've managed to get some of the basic workflows running and passing on my forked repo. (See e.g. the checks on this PR: jeffsmohan#2) But @TylerHendrickson I'd love your opinion on how to fully test the rest.

The issue I run into is my fork doesn't have AWS secrets set up, so it can't run downstream actions like terraform plan or terraform apply. I might be tempted to say it's alright, as long as we've tested at least some representative actions with artifact uploads/downloads, that might give us enough confidence to land this PR. But I'm not actually able to run any of the workflows that use the download-artifact action, which I'd really like to find a way to do.

The only workflows that utilize the download-artifact action are:

  • terraform-plan.yml
  • terraform-apply.yml
  • deploy-production.yml

I assume we don't want to set up my fork to really deploy to production, but I'd love to be able to test terraform-plan and terraform-apply. You've got a lot more context than me... would it be safe to run terraform-plan/apply using our real AWS secrets? Would it be relatively easy/safe to use some staging or dev-specific AWS secrets we have lying around? Are there other easy workarounds to still be able to test download-artifact?

@jeffsmohan I should've seen this snag – It didn't occur to me that the only time we actually download an artifact is when ship to Prod and then add the artifacts to the release following deployment.

Regarding this PR:

  • Given that the upload-artifact changes appear to be working in your test, I feel reasonably confident in these changes.
  • We'll be able to confirm these changes are working pretty quickly after merging when the CD pipeline deploys to Staging. If something does fail during that run, it should be straightforward enough to roll back.

With that in mind, I think this PR should be good to merge and will approve.

More long-term: we don't currently have any AWS dev environments that we can share out credentials for, but this is a good use-case that highlights of some of the limitations in testing our workflows with limited access to secrets. I've considered adding throw-away deployments to disposable environments as a CI step before, because it would be useful to test that Terraform changes can actually run rather than just relying on the ability to generate a plan as we do now. The caveat here is that the time it takes to provision the entire stack from-scratch seems like it would be a burden to developers. There are probably some ways we can address some of the slower aspects of this process though. I'll do some thinking on this and see if I can come up with some useful ideas around this problem.

@jeffsmohan jeffsmohan merged commit 3a93831 into main Feb 2, 2024
19 checks passed
@jeffsmohan jeffsmohan deleted the jmo-github-actions-upgrade branch February 2, 2024 20:04
@TylerHendrickson TylerHendrickson added the dependencies Pull requests that update a dependency file label Feb 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file github
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants