Release ZipCase

.github/workflows/deploy.yml

@@ -4,6 +4,9 @@ on:
     push:
         branches: [main, live]
 
+permissions:
+    contents: read
+
 env:
     AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
     AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -32,7 +35,7 @@ jobs:
         environment: ${{ needs.determine-environment.outputs.environment_name }}
         steps:
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@v5
               with:
                   aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
                   aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
@@ -74,15 +77,15 @@ jobs:
             run:
                 working-directory: ./infra/terraform
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
 
             - name: Setup Terraform
-              uses: hashicorp/setup-terraform@v3
+              uses: hashicorp/setup-terraform@v4
               with:
                   terraform_version: '1.11.4'
 
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@v5
               with:
                   aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
                   aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
@@ -111,10 +114,10 @@ jobs:
             run:
                 working-directory: ./serverless
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v5
               with:
                   node-version: '20'
                   cache: 'npm'
@@ -140,10 +143,10 @@ jobs:
             run:
                 working-directory: ./frontend
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v5
               with:
                   node-version: '20'
                   cache: 'npm'
@@ -153,7 +156,7 @@ jobs:
               run: npm ci
 
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@v5
               with:
                   aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
                   aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
@@ -171,6 +174,10 @@ jobs:
                   # Set API URL from environment variables
                   echo "VITE_API_URL=${{ vars.API_BASE_URL }}" >> .env.production
 
+                  # Get WebSocket API URL from CloudFormation exports
+                  WS_URL=$(aws cloudformation list-exports --query "Exports[?Name=='ws-${{ needs.determine-environment.outputs.environment_name }}-WebSocketApiEndpoint'].Value" --output text)
+                  echo "VITE_WS_URL=$WS_URL" >> .env.production
+
                   # Get Cognito User Pool ID
                   USER_POOL_ID=$(aws ssm get-parameter --name "/zipcase/cognito/user_pool_id" --with-decryption --query "Parameter.Value" --output text)
                   echo "VITE_COGNITO_USER_POOL_ID=$USER_POOL_ID" >> .env.production
@@ -204,8 +211,10 @@ jobs:
         runs-on: ubuntu-latest
         if: github.ref == 'refs/heads/live'
         needs: [deploy-frontend]
+        permissions:
+            contents: write
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
               with:
                   fetch-depth: 0
 

.github/workflows/manual-deploy.yml

@@ -27,6 +27,9 @@ on:
                 default: true
                 type: boolean
 
+permissions:
+    contents: read
+
 env:
     AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
     AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -40,7 +43,7 @@ jobs:
         environment: ${{ github.event.inputs.environment }}
         steps:
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@v5
               with:
                   aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
                   aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
@@ -81,26 +84,26 @@ jobs:
             run:
                 working-directory: ./infra/terraform
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
               with:
                   ref: ${{ github.event.inputs.branch }}
 
             - name: Setup Terraform
-              uses: hashicorp/setup-terraform@v3
+              uses: hashicorp/setup-terraform@v4
               with:
                   terraform_version: '1.11.4'
 
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@v5
               with:
                   aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
                   aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
                   aws-region: us-east-2
 
             - name: Set Terraform environment variables
               run: |
-                echo "TF_VAR_alert_email=${{ vars.ALERT_EMAIL }}" >> $GITHUB_ENV
-                echo "TF_VAR_capsolver_api_key=${{ secrets.CAPSOLVER_API_KEY }}" >> $GITHUB_ENV
+                  echo "TF_VAR_alert_email=${{ vars.ALERT_EMAIL }}" >> $GITHUB_ENV
+                  echo "TF_VAR_capsolver_api_key=${{ secrets.CAPSOLVER_API_KEY }}" >> $GITHUB_ENV
 
             - name: Terraform Init
               working-directory: ./infra/terraform/${{ github.event.inputs.environment }}
@@ -121,12 +124,12 @@ jobs:
             run:
                 working-directory: ./serverless
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
               with:
                   ref: ${{ github.event.inputs.branch }}
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v5
               with:
                   node-version: '20'
                   cache: 'npm'
@@ -153,12 +156,12 @@ jobs:
             run:
                 working-directory: ./frontend
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@v5
               with:
                   ref: ${{ github.event.inputs.branch }}
 
             - name: Use Node.js
-              uses: actions/setup-node@v4
+              uses: actions/setup-node@v5
               with:
                   node-version: '20'
                   cache: 'npm'
@@ -168,7 +171,7 @@ jobs:
               run: npm ci
 
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@v4
+              uses: aws-actions/configure-aws-credentials@v5
               with:
                   aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
                   aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
@@ -186,6 +189,10 @@ jobs:
                   # Set API URL from environment variables
                   echo "VITE_API_URL=${{ vars.API_BASE_URL }}" >> .env.production
 
+                  # Get WebSocket API URL from CloudFormation exports
+                  WS_URL=$(aws cloudformation list-exports --query "Exports[?Name=='ws-${{ github.event.inputs.environment }}-WebSocketApiEndpoint'].Value" --output text)
+                  echo "VITE_WS_URL=$WS_URL" >> .env.production
+
                   # Get Cognito User Pool ID
                   USER_POOL_ID=$(aws ssm get-parameter --name "/zipcase/cognito/user_pool_id" --with-decryption --query "Parameter.Value" --output text)
                   echo "VITE_COGNITO_USER_POOL_ID=$USER_POOL_ID" >> .env.production

.github/workflows/manual-test.yml

@@ -1,67 +1,70 @@
 name: Manual Test
 
 on:
-  workflow_dispatch:
-    inputs:
-      branch:
-        description: 'Branch to test'
-        required: true
-        default: 'main'
-        type: string
+    workflow_dispatch:
+        inputs:
+            branch:
+                description: 'Branch to test'
+                required: true
+                default: 'main'
+                type: string
+
+permissions:
+    contents: read
 
 env:
-  VITE_API_URL: https://test-api.example.com
-  VITE_PORTAL_URL: https://test-portal.example.com
-  VITE_PORTAL_CASE_URL: https://test-portal.example.com/cases
+    VITE_API_URL: https://test-api.example.com
+    VITE_PORTAL_URL: https://test-portal.example.com
+    VITE_PORTAL_CASE_URL: https://test-portal.example.com/cases
 
 jobs:
-  backend-tests:
-    name: Backend Tests
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ./serverless
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.branch }}
+    backend-tests:
+        name: Backend Tests
+        runs-on: ubuntu-latest
+        defaults:
+            run:
+                working-directory: ./serverless
+        steps:
+            - uses: actions/checkout@v5
+              with:
+                  ref: ${{ github.event.inputs.branch }}
 
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-          cache-dependency-path: './serverless/package-lock.json'
+            - name: Use Node.js
+              uses: actions/setup-node@v5
+              with:
+                  node-version: '20'
+                  cache: 'npm'
+                  cache-dependency-path: './serverless/package-lock.json'
 
-      - name: Install dependencies
-        run: npm ci
+            - name: Install dependencies
+              run: npm ci
 
-      - name: Run backend tests
-        run: npm test -- --testPathIgnorePatterns=__integration_tests__
+            - name: Run backend tests
+              run: npm test -- --testPathIgnorePatterns=__integration_tests__
 
-  frontend-tests:
-    name: Frontend Tests
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: ./frontend
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.inputs.branch }}
+    frontend-tests:
+        name: Frontend Tests
+        runs-on: ubuntu-latest
+        defaults:
+            run:
+                working-directory: ./frontend
+        steps:
+            - uses: actions/checkout@v5
+              with:
+                  ref: ${{ github.event.inputs.branch }}
 
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-          cache-dependency-path: './frontend/package-lock.json'
+            - name: Use Node.js
+              uses: actions/setup-node@v5
+              with:
+                  node-version: '20'
+                  cache: 'npm'
+                  cache-dependency-path: './frontend/package-lock.json'
 
-      - name: Install dependencies
-        run: npm ci
+            - name: Install dependencies
+              run: npm ci
 
-      - name: Run frontend tests
-        run: npm test
+            - name: Run frontend tests
+              run: npm test
 
-      - name: Lint frontend
-        run: npm run lint
+            - name: Lint frontend
+              run: npm run lint