chore: run pre-commit (#290)

* chore: run pre-commit

* chore: ensure files are linted

* chore: verified pr workflow

* chore: rename pre-commit group

Author: jjfrench

.docs/architecture.excalidraw.svg

@@ -57,7 +57,7 @@ updates:
     schedule:
       interval: weekly
     groups:
-      github-actions:
+      pre-commit:
         patterns:
         - "*"
     commit-message:

.github/dependabot.yml

@@ -14,10 +14,6 @@ on:
         description: "Environment to deploy to"
         type: environment
 
-permissions:
-  id-token: write # Required for OIDC authentication w/ AWS
-  contents: read
-
 concurrency:
   group: ${{ inputs.environment }}
   cancel-in-progress: false
@@ -26,8 +22,11 @@ run-name: Deploy to ${{ inputs.environment }} environment by @${{ github.actor }
 
 jobs:
   deploy:
+    permissions:
+      contents: read
+      id-token: write # Required for OIDC authentication w/ AWS
     runs-on: ubuntu-latest
-    environment: 
+    environment:
       name: ${{ inputs.environment }}
       url: ${{ vars.HOSTNAME }}
 

.github/workflows/deploy.yaml

@@ -3,16 +3,33 @@ name: Diff CDK Stack
 on:
   pull_request:
 
-permissions:
-  id-token: write # Required for OIDC authentication w/ AWS
-  contents: read
-
 run-name: Diff ${{ github.ref }}
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    environment: dev
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+
+      - name: Setup UV
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+
+      - name: Install dependencies
+        run: |
+          uv sync --locked
+
+      - name: Run pre-commit
+        run: |
+          uv run pre-commit run --all-files
   diff:
     runs-on: ubuntu-latest
     environment: dev
+    needs: [lint]
     permissions:
       contents: read
       pull-requests: write

.github/workflows/diff.yaml .github/workflows/pr.yaml.github/workflows/diff.yaml renamed to .github/workflows/pr.yaml

@@ -7,13 +7,12 @@ on:
   schedule:
     - cron: "30 16 * * 1" # Monday 10:30/11:30 CT
 
-permissions: read-all # Default all to readonly
-
 jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       security-events: write # Allow upload to Security dashboard
       id-token: write # Access GitHub's OIDC token to verify authenticity of result for publish
 

.github/workflows/scorecard.yml

@@ -51,11 +51,11 @@ For a private client (ie a client that runs within the frontend, such as single
 
 The generated client secret will be stored in AWS Secrets Manager in the same account & region as the deployment. The name of this secret will follow the following convention: `veda-keycloak-$stage-client-$clientId` (eg a Grafana client in the production deployment will generate the following secret: `veda-keycloak-prod-client-grafana`).  The generated secret contains the following information:
 
-* `id`: OAuth Client ID
-* `secret`: OAuth Client Secret
-* `auth_url`: URL of the OAuth [authorization endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.1)
-* `token_url`: URL of the OAuth [token endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2)
-* `userinfo_url`: URL of the OIDC [user info endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo)
+- `id`: OAuth Client ID
+- `secret`: OAuth Client Secret
+- `auth_url`: URL of the OAuth [authorization endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.1)
+- `token_url`: URL of the OAuth [token endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2)
+- `userinfo_url`: URL of the OIDC [user info endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo)
 
 A minimum example of a private client (note `publicClient: false` and `secret`):
 
@@ -78,7 +78,6 @@ clients:
 
 <summary>Consider also using an environment variable for URLs for greater flexibility</summary>
 
-
 ```yaml
 clients:
   - clientId: grafana
@@ -458,14 +457,13 @@ VEDA Keycloak includes a custom `EmailSenderProvider` based on Keycloak’s `Def
 > [!TIP]
 > See the Service Provider Interfaces section in the [Server Developer Guide](https://www.keycloak.org/docs/latest/server_development/#_providers) for more details about how to create custom themes.
 
-
-
 ### Themes
 
 > [!TIP]
 > See the theme section in the [Server Developer Guide](https://www.keycloak.org/docs/latest/server_development/#_themes) for more details about how to create custom themes.
 
 ### SES Relay
+
 The AWS account that includes the SES `openveda.cloud` identity does not permit creating SMTP credentials for AWS SES for security reasons. However, Keycloak expects to talk to an SMTP server for sending transactional emails such as verification, password reset, and notification messages.
 
 To bridge this gap, we deploy a small SMTP relay service as an ECS Fargate service into the same VPC as Keycloak:

README.md

@@ -1,20 +1,22 @@
 #!/usr/bin/env python3
 
 """
-This script invokes a Lambda function to apply ECS configuration changes, waits for the ECS task
-to finish, and fetches its logs from CloudWatch Logs.
+This script invokes a Lambda function to apply ECS configuration changes,
+waits for the ECS task to finish, and fetches its logs from CloudWatch Logs.
 
 Usage:
     python apply_config.py <lambdaArn> <configEnvironmentJson>
 
 Example:
-    python apply_config.py arn:aws:lambda:us-east-1:123456789012:function:applyConfig '{"key":"value"}'
+    python apply_config.py \
+        arn:aws:lambda:us-east-1:123456789012:function:applyConfig '{"key":"value"}'
 """
 
-import sys
 import json
+import sys
 import time
 import traceback
+
 import boto3
 
 

bin/apply-config.py

@@ -1,16 +1,20 @@
 #!/usr/bin/env -S uv run --script
-import os
 import logging
+import os
 
 from aws_cdk import (
     App,
     DefaultStackSynthesizer,
     PermissionsBoundary,
 )
-
 from lib.keycloak import KeycloakStack
-from lib.utils import get_oauth_secrets, get_private_client_ids, get_send_email_addresses, get_application_role_arns
 from lib.settings import Settings
+from lib.utils import (
+    get_application_role_arns,
+    get_oauth_secrets,
+    get_private_client_ids,
+    get_send_email_addresses,
+)
 
 logging.basicConfig(
     level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s"
@@ -43,7 +47,7 @@
         "No private client IDs found in %s",
         settings.keycloak_config_cli_config_dir,
     )
-    
+
 send_email_addresses = get_send_email_addresses()
 if send_email_addresses:
     logging.info(
@@ -57,7 +61,9 @@
 if application_role_arns:
     logging.info(
         "Found application role ARNs in environment: %s",
-        ", ".join(f"{key}: {', '.join(arns)}" for key, arns in application_role_arns.items()),
+        ", ".join(
+            f"{key}: {', '.join(arns)}" for key, arns in application_role_arns.items()
+        ),
     )
 else:
     logging.warning("No application role ARNs found in the environment.")

cdk/app.py

@@ -2,22 +2,23 @@
 import textwrap
 
 from aws_cdk import (
-    Duration,
     CfnOutput,
+    Duration,
     Stack,
     aws_ecr_assets as ecr_assets,
     aws_ecs as ecs,
     aws_iam as iam,
-    aws_lambda as _lambda,
     aws_kms as kms,
+    aws_lambda as _lambda,
     aws_secretsmanager as secretsmanager,
 )
 from constructs import Construct
 
 
 class KeycloakConfig(Construct):
     """
-    Responsible for creating infrastructure to apply configuration to a Keycloak instance.
+    Responsible for creating infrastructure
+    to apply configuration to a Keycloak instance.
     """
 
     def __init__(
@@ -57,7 +58,7 @@ def __init__(
             secret = secretsmanager.Secret(
                 self,
                 f"{client_slug}-client-secret",
-                # WARNING: Changing this construct (name, id, template) will cause new client
+                # WARNING: Changing construct (name, id, template) will cause new client
                 # secrets to be generated!
                 secret_name=f"{Stack.of(self).stack_name}-client-{client_slug}",
                 encryption_key=kms_key,
@@ -67,9 +68,15 @@ def __init__(
                     secret_string_template=json.dumps(
                         {
                             "id": client_slug,
-                            "auth_url": f"{hostname}/realms/{realm}/protocol/openid-connect/auth",
-                            "token_url": f"{hostname}/realms/{realm}/protocol/openid-connect/token",
-                            "userinfo_url": f"{hostname}/realms/{realm}/protocol/openid-connect/userinfo",
+                            "auth_url": (
+                                f"{hostname}/realms/{realm}/protocol/openid-connect/auth",
+                            ),
+                            "token_url": (
+                                f"{hostname}/realms/{realm}/protocol/openid-connect/token"
+                            ),
+                            "userinfo_url": (
+                                f"{hostname}/realms/{realm}/protocol/openid-connect/userinfo"
+                            ),
                         },
                         separators=(",", ":"),
                     ),
@@ -81,16 +88,19 @@ def __init__(
                 secret.add_to_resource_policy(
                     iam.PolicyStatement(
                         effect=iam.Effect.ALLOW,
-                        principals=[iam.ArnPrincipal(arn) for arn in application_role_arn],
+                        principals=[
+                            iam.ArnPrincipal(arn) for arn in application_role_arn
+                        ],
                         actions=["secretsmanager:GetSecretValue"],
                         resources=["*"],
-
                     )
                 )
                 kms_key.add_to_resource_policy(
                     iam.PolicyStatement(
                         effect=iam.Effect.ALLOW,
-                        principals=[iam.ArnPrincipal(arn) for arn in application_role_arn],
+                        principals=[
+                            iam.ArnPrincipal(arn) for arn in application_role_arn
+                        ],
                         actions=["kms:Decrypt", "kms:DescribeKey"],
                         resources=["*"],
                     )
@@ -105,7 +115,8 @@ def __init__(
             )
             imported_client_secrets.append((client_slug, imported_secret))
 
-        # Create env vars from secrets for each client, e.g. GRAFANA_CLIENT_ID, GRAFANA_CLIENT_SECRET
+        # Create env vars from secrets for each client
+        # e.g. GRAFANA_CLIENT_ID, GRAFANA_CLIENT_SECRET
         task_client_secrets = {}
         for client_slug, secret in created_client_secrets + imported_client_secrets:
             for key in ["id", "secret"]:
@@ -163,10 +174,12 @@ def __init__(
                         containerOverrides: [
                             {{
                                 name: "{container_name}",
-                                environment: Object.entries(event).map(([name, value]) => ({{
-                                name,
-                                value: String(value),
-                                }})),
+                                environment: Object.entries(event).map(
+                                    ([name, value]) => ({{
+                                        name,
+                                        value: String(value),
+                                    }})
+                                ),
                             }},
                         ],
                     }},

cdk/lib/keycloak/config.py

@@ -1,13 +1,12 @@
-from constructs import Construct
 from aws_cdk import (
     RemovalPolicy,
-    aws_rds as rds,
     aws_ec2 as ec2,
+    aws_rds as rds,
 )
+from constructs import Construct
 
 
 class KeycloakDatabase(Construct):
-
     def __init__(
         self,
         scope: Construct,
@@ -27,7 +26,8 @@ def __init__(
         :param database_name: Name of the database to create
         :param instance_identifier: Optional identifier for the RDS instance
         :param is_production: Whether the database is in production
-        :param kwargs: Additional DatabaseInstanceProps (except 'engine', which is set to Postgres)
+        :param kwargs: Additional DatabaseInstanceProps
+            (except 'engine', which is set to Postgres)
         """
         super().__init__(scope, construct_id)