USEPA · asif-rashid · Aug 25, 2025 · Mar 1, 2023 · Mar 6, 2023 · Mar 20, 2023
diff --git a/.github/workflows/deploy-prod.yml b/.github/workflows/deploy-prod.yml
@@ -0,0 +1,84 @@
+name: deploy-prod
+
+on:
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: 'Log level'
+        required: true
+        default: 'warning'
+        type: choice
+        options:
+        - info
+        - warning
+        - debug
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: main
+    - uses: actions/setup-java@v4
+      with:
+        java-version: '17'
+        distribution: 'corretto'
+
+    - name: Run the Maven clean package
+      run: mvn clean package -DskipTests
+
+    - uses: actions/upload-artifact@master
+      with:
+        name: bioactivity-jar
+        path: ./target
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          ref: main
+      - uses: actions/download-artifact@master
+        with:
+          name: bioactivity-jar
+          path: ./target
+      - name: Deploy to cloud.gov
+        uses: cloud-gov/cg-cli-tools@main
+        with:
+          cf_username: ${{ secrets.CF_SERVICE_USERNAME }}
+          cf_password: ${{ secrets.CF_SERVICE_KEY }}
+          cf_org: epa-ord
+          cf_space: ccte-prod
+          cf_command: push -f manifest-prod.yml --no-start
+
+  bind-db-service:
+    runs-on: ubuntu-latest
+    needs: deploy
+
+    steps:
+      - name: Bind app to DB service
+        uses: cloud-gov/cg-cli-tools@main
+        with:
+          cf_username: ${{ secrets.CF_SERVICE_USERNAME }}
+          cf_password: ${{ secrets.CF_SERVICE_KEY }}
+          cf_org: epa-ord
+          cf_space: ccte-prod
+          cf_command: bind-service ccte-bioactivity-prod db-prod
+
+  restage:
+    runs-on: ubuntu-latest
+    needs: bind-db-service
+
+    steps:
+      - name: Restage app
+        uses: cloud-gov/cg-cli-tools@main
+        with:
+          cf_username: ${{ secrets.CF_SERVICE_USERNAME }}
+          cf_password: ${{ secrets.CF_SERVICE_KEY }}
+          cf_org: epa-ord
+          cf_space: ccte-prod
+          cf_command: restage ccte-bioactivity-prod
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
@@ -0,0 +1,84 @@
+name: deploy-staging
+
+on:
+  workflow_dispatch:
+    inputs:
+      logLevel:
+        description: 'Log level'
+        required: true
+        default: 'warning'
+        type: choice
+        options:
+        - info
+        - warning
+        - debug
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: staging
+    - uses: actions/setup-java@v4
+      with:
+        java-version: '17'
+        distribution: 'corretto'
+
+    - name: Run the Maven clean package
+      run: mvn clean package -DskipTests
+
+    - uses: actions/upload-artifact@master
+      with:
+        name: bioactivity-jar
+        path: ./target
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: staging
+      - uses: actions/download-artifact@master
+        with:
+          name: bioactivity-jar
+          path: ./target
+      - name: Deploy to cloud.gov
+        uses: cloud-gov/cg-cli-tools@main
+        with:
+          cf_username: ${{ secrets.CF_STAGING_SERVICE_USERNAME }}
+          cf_password: ${{ secrets.CF_STAGING_SERVICE_KEY }}
+          cf_org: epa-ord
+          cf_space: ccte-stg
+          cf_command: push -f manifest-stg.yml --no-start
+
+  bind-db-service:
+    runs-on: ubuntu-latest
+    needs: deploy
+
+    steps:
+      - name: Bind app to DB service
+        uses: cloud-gov/cg-cli-tools@main
+        with:
+          cf_username: ${{ secrets.CF_STAGING_SERVICE_USERNAME }}
+          cf_password: ${{ secrets.CF_STAGING_SERVICE_KEY }}
+          cf_org: epa-ord
+          cf_space: ccte-stg
+          cf_command: bind-service ccte-bioactivity-stg db-prod
+
+  restage:
+    runs-on: ubuntu-latest
+    needs: bind-db-service
+
+    steps:
+      - name: Restage app
+        uses: cloud-gov/cg-cli-tools@main
+        with:
+          cf_username: ${{ secrets.CF_STAGING_SERVICE_USERNAME }}
+          cf_password: ${{ secrets.CF_STAGING_SERVICE_KEY }}
+          cf_org: epa-ord
+          cf_space: ccte-stg
+          cf_command: restage ccte-bioactivity-stg
diff --git a/.github/workflows/docker-build-push-ghcr.yml b/.github/workflows/docker-build-push-ghcr.yml
@@ -0,0 +1,34 @@
+name: Docker-ghcr
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on:
+  push:
+    branches: [ "dev", "staging", "main" ]
+    # Publish semver tags as releases.
+    tags: [ 'v*.*.*' ]
+
+
+jobs:
+  build-push:
+
+    runs-on: ubuntu-latest
+    environment: ${{ github.head_ref || github.ref_name }}
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+    steps:
+    - name: Checkout code
+      uses: USEPA/ccte-docker-build@main
+      with:
+        username: USEPA
+        password: ${{ secrets.GITHUB_TOKEN }}
+        image_name: ${{ github.repository }}-${{ github.head_ref || github.ref_name }}
+        build_args: APP_SERVER_ENVIRONMENT=${{ github.head_ref || github.ref_name }}
diff --git a/.github/workflows/email-report.yml b/.github/workflows/email-report.yml
@@ -0,0 +1,17 @@
+name: email 
+
+on:
+  schedule:
+    - cron: '00 9 * * 1,4'
+
+jobs:
+  send-email:
+    runs-on: "th878" 
+    steps:  
+    - name: Checkout repository
+      uses: actions/checkout@v4
+    - name:  send email every monday and thursday
+      run: |
+           cd /data/watchtower/ctx-API/container-results/api-bioactivity
+           ls -la
+           python3 email.py 
diff --git a/.github/workflows/gh-packages-deployment.yml b/.github/workflows/gh-packages-deployment.yml
@@ -0,0 +1,38 @@
+name: GH Packages Deployment
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on:
+  push:
+    branches: [ "main" ]
+
+jobs:
+  maven-build-deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v1
+      - name: Set up JDK 1.17
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'corretto'
+          java-version: '17'
+          cache: 'maven'
+          server-id: github # value of repository/id field of the pom.xml
+          server-username: GITHUB_USER_REF  # env variable name for username
+          server-password: GITHUB_TOKEN_REF # env variable name for GitHub Pers
+      - name: Maven Package
+        env:
+          GITHUB_USER_REF: USEPA
+          GITHUB_TOKEN_REF: ${{ secrets.GH_PACKAGE_REPO_PASSWORD }}
+        run: |
+          mvn clean package -DskipTests
+      - name: Deploy to Github Package Registry
+        env:
+          GITHUB_USER_REF: USEPA
+          GITHUB_TOKEN_REF: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mvn deploy -DskipTests
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -0,0 +1,71 @@
+name: Security Workflows
+
+on:
+  push:
+    branches: [ dev, staging ]
+    tags: [ 'v*.*.*' ]
+  #schedule:
+  # - cron: '00 9 * * 1,3,5' 
+
+jobs:
+  container-scan:
+    runs-on: th878
+    environment: ${{ github.head_ref || github.ref_name }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run Container Security Scan Action
+        uses: USEPA/ccte-container-scan@main
+        with:
+          image_name: api-bioactivity-security-cs
+          dockerfile: Dockerfile
+          output_path: ./output/bioactivity-report.html
+          cleanup_path: /data/watchtower/ctx-API/container-results/api-bioactivity/bioactivity-report.html
+          watchtower_path: /data/watchtower/ctx-API/container-results/api-bioactivity/bioactivity-report.html
+
+  trufflehog:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Run Scan
+      uses: USEPA/ccte-secret-scan@main
+      with:
+        base_branch: ${{ github.event.repository.default_branch }}
+
+  build-and-upload-sbom:
+    runs-on: th878
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Generate and Upload SBOM
+        uses: USEPA/ccte-sbom-generator-java@main
+        with:
+          java_version: '17'
+          jira_url: ${{ secrets.JIRA_URL }}
+          jira_token: ${{ secrets.JIRA_TOKEN }}
+          server_hostname: 'ccte-api-dependency-track.epa.gov'
+          api_key: ${{ secrets.SECRET_OWASP_DT_KEY }}
+          project_name: 'ccte-api-bioactivity'
+          project_version: ${{ github.ref_name }}
+
+  Zap-scan:
+    runs-on: "th878" 
+    #if: github.event_name == 'schedule'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run Application Security Scan
+        uses: USEPA/ccte-Zap-Scan@main 
+        with:
+          zap_token: ${{ secrets.GITHUB_TOKEN }}
+          zap_target: 'https://api-ccte-stg.epa.gov/docs/bioactivity.json'
+          zap_format: 'openapi'
+          zap_cmd_options: '-a'
+          x_api_key: ${{ secrets.X_API_KEY }}
diff --git a/.gitignore b/.gitignore
@@ -31,4 +31,4 @@ build/
 
 ### VS Code ###
 .vscode/
-/src/main/resources/config/application-dev.yml
+/src/main/resources/config/application-local.yml