Merge pull request #84 from ASFHyP3/develop

Release 0.1.0

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# These owners will be requested for review when someone opens a pull request.
+*       @ASFHyP3/platform

.github/actions/deploy-stac/action.yml

@@ -0,0 +1,67 @@
+name: Deploy STAC API
+description: Deploy the STAC API
+
+inputs:
+  AWS_ACCESS_KEY_ID:
+    required: true
+  AWS_SECRET_ACCESS_KEY:
+    required: true
+  CLOUDFORMATION_ROLE_ARN:
+    required: true
+  DB_ADMIN_PASSWORD:
+    required: true
+  DB_READ_PASSWORD:
+    required: true
+  CIDR_IP:
+    required: true
+  CERTIFICATE_ARN:
+    required: true
+  STACK_NAME:
+    required: true
+  GITHUB_BRANCH:
+    required: true
+  DOMAIN_NAME:
+    required: true
+  CF_TEMPLATE_BUCKET:
+    default: cf-templates-aubvn3i9olmk-us-west-2  # For HyP3 account
+
+runs:
+  using: composite
+  steps:
+    - uses: aws-actions/configure-aws-credentials@v1
+      with:
+        aws-access-key-id: ${{ inputs.AWS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
+        aws-region: us-west-2
+    - uses: actions/setup-python@v4
+      with:
+        python-version: 3.9
+    - name: Install Lambda dependencies
+      shell: bash
+      run: make -s install-lambda-deps
+    - name: Install CodeBuild dependencies
+      shell: bash
+      run: python -m pip install -r requirements-run-codebuild.txt
+    - name: Deploy CloudFormation stack
+      shell: bash
+      run: |
+        make -s deploy \
+          stack_name=${{ inputs.STACK_NAME }} \
+          s3_bucket=${{ inputs.CF_TEMPLATE_BUCKET }} \
+          cloudformation_role_arn=${{ inputs.CLOUDFORMATION_ROLE_ARN }} \
+          db_admin_password=${{ inputs.DB_ADMIN_PASSWORD }} \
+          db_read_password=${{ inputs.DB_READ_PASSWORD }} \
+          cidr_ip=${{ inputs.CIDR_IP }} \
+          github_branch=${{ inputs.GITHUB_BRANCH }} \
+          domain_name=${{ inputs.DOMAIN_NAME }} \
+          certificate_arn=${{ inputs.CERTIFICATE_ARN }}
+    - name: Get CodeBuild project
+      shell: bash
+      run: |
+        echo "CODEBUILD_PROJECT=$(aws cloudformation describe-stacks \
+                                  --stack-name ${{ inputs.STACK_NAME }} \
+                                  --query 'Stacks[0].Outputs[?OutputKey==`BuildProject`].OutputValue' \
+                                  --output text)" >> $GITHUB_ENV
+    - name: Run CodeBuild
+      shell: bash
+      run: python run_codebuild.py

.github/dependabot.yml

@@ -0,0 +1,19 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "bumpless"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "bumpless"

.github/workflows/changelog.yml

@@ -0,0 +1,18 @@
+name: Changelog updated?
+
+on:
+  pull_request:
+    types:
+      - opened
+      - labeled
+      - unlabeled
+      - synchronize
+    branches:
+      - main
+      - develop
+
+jobs:
+  call-changelog-check-workflow:
+    uses: ASFHyP3/actions/.github/workflows/[email protected]
+    secrets:
+      USER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/deploy-stac-prod.yml

@@ -0,0 +1,34 @@
+name: Deploy STAC API prod
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy-stac-api:
+    runs-on: ubuntu-latest
+
+    environment:
+      name: asf-stac
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: ./.github/actions/deploy-stac
+        with:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          CLOUDFORMATION_ROLE_ARN: ${{ secrets.CLOUDFORMATION_ROLE_ARN }}
+          DB_ADMIN_PASSWORD: ${{ secrets.DB_ADMIN_PASSWORD }}
+          DB_READ_PASSWORD: ${{ secrets.DB_READ_PASSWORD }}
+          CIDR_IP: ${{ secrets.CIDR_IP }}
+          CERTIFICATE_ARN: ${{ secrets.CERTIFICATE_ARN }}
+          STACK_NAME: asf-stac
+          GITHUB_BRANCH: main
+          DOMAIN_NAME: stac.asf.alaska.edu
+
+  call-bump-version-workflow:
+    needs: deploy-stac-api
+    uses: ASFHyP3/actions/.github/workflows/[email protected]
+    secrets:
+      USER_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}

.github/workflows/deploy-stac-test.yml

@@ -0,0 +1,28 @@
+name: Deploy STAC API test
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  deploy-stac-api:
+    runs-on: ubuntu-latest
+
+    environment:
+      name: asf-stac-test
+
+    steps:
+      - uses: actions/checkout@v3
+      - uses: ./.github/actions/deploy-stac
+        with:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          CLOUDFORMATION_ROLE_ARN: ${{ secrets.CLOUDFORMATION_ROLE_ARN }}
+          DB_ADMIN_PASSWORD: ${{ secrets.DB_ADMIN_PASSWORD }}
+          DB_READ_PASSWORD: ${{ secrets.DB_READ_PASSWORD }}
+          CIDR_IP: ${{ secrets.CIDR_IP }}
+          CERTIFICATE_ARN: ${{ secrets.CERTIFICATE_ARN }}
+          STACK_NAME: asf-stac-test
+          GITHUB_BRANCH: develop
+          DOMAIN_NAME: stac-test.asf.alaska.edu

.github/workflows/labeled-pr.yml

@@ -0,0 +1,15 @@
+name: Is PR labeled?
+
+on:
+  pull_request:
+    types:
+      - opened
+      - labeled
+      - unlabeled
+      - synchronize
+    branches:
+      - main
+
+jobs:
+  call-labeled-pr-check-workflow:
+    uses: ASFHyP3/actions/.github/workflows/[email protected]

.github/workflows/release.yml

@@ -0,0 +1,14 @@
+name: Create Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  call-release-workflow:
+    uses: ASFHyP3/actions/.github/workflows/[email protected]
+    with:
+      release_prefix: ASF STAC
+    secrets:
+      USER_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}

.github/workflows/static-analysis.yml

@@ -0,0 +1,24 @@
+name: Static code analysis
+
+on: push
+
+jobs:
+  flake8:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+      - uses: actions/setup-python@v4
+        with:
+          python-version: 3.9
+      - run: make install
+      - run: make flake8
+
+  cfn-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+      - uses: actions/setup-python@v4
+        with:
+          python-version: 3.9
+      - run: make install
+      - run: make cfn-lint

CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0]
+### Added
+- Initial release of STAC API endpoint backed by a PostgreSQL database

LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2022, Alaska Satellite Facility
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Makefile

@@ -0,0 +1,59 @@
+install:
+	python -m pip install --upgrade pip && \
+	python -m pip install -r requirements.txt
+
+install-pypgstac:
+	python -m pip install --upgrade pip && \
+	python -m pip install $$(grep pypgstac requirements.txt)
+
+install-lambda-deps:
+	python -m pip install --upgrade pip && \
+	python -m pip install -r requirements-apps-api.txt -t apps/api/src/
+
+deploy:
+	aws cloudformation package \
+	    --template-file apps/cloudformation.yml \
+	    --s3-bucket ${s3_bucket} \
+	    --output-template-file packaged.yml \
+	&& aws cloudformation deploy \
+	    --template-file packaged.yml \
+	    --stack-name ${stack_name} \
+	    --capabilities CAPABILITY_NAMED_IAM \
+	    --role-arn ${cloudformation_role_arn} \
+	    --parameter-overrides \
+	      DatabaseAdminPassword=${db_admin_password} \
+	      DatabaseReadPassword=${db_read_password} \
+	      CidrIp=${cidr_ip} \
+	      GithubBranch=${github_branch} \
+	      DomainName=${domain_name} \
+	      CertificateArn=${certificate_arn}
+
+psql:
+	PGHOST=${db_host} PGPORT=5432 PGDATABASE=postgres PGUSER=${db_user} PGPASSWORD=${db_password} psql
+
+configure-database: install-or-upgrade-postgis pypgstac-migrate configure-database-roles
+
+install-or-upgrade-postgis:
+	PGHOST=${db_host} PGPORT=5432 PGDATABASE=postgres PGUSER=postgres PGPASSWORD=${db_admin_password} psql \
+	    -f install-or-upgrade-postgis.sql
+
+pypgstac-migrate:
+	PGHOST=${db_host} PGPORT=5432 PGDATABASE=postgres PGUSER=postgres PGPASSWORD=${db_admin_password} pypgstac migrate
+
+configure-database-roles:
+	PGHOST=${db_host} PGPORT=5432 PGDATABASE=postgres PGUSER=postgres PGPASSWORD=${db_admin_password} psql \
+	    --set=db_read_password=${db_read_password} \
+	    -f configure-database-roles.sql
+
+run-api:
+	POSTGRES_HOST_READER=${db_host} POSTGRES_HOST_WRITER=${db_host} POSTGRES_PORT=5432 \
+	    POSTGRES_DBNAME=postgres POSTGRES_USER=postgres POSTGRES_PASS=${db_admin_password} \
+	    python -m stac_fastapi.pgstac.app
+
+static: flake8 cfn-lint
+
+flake8:
+	flake8 --max-line-length=120
+
+cfn-lint:
+	cfn-lint --template `find . -name cloudformation.yml` --info --ignore-checks W3002