Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431, #8381) by hannes-ucsc · Pull Request #8372 · DataBiosphere/azul

hannes-ucsc · 2026-10-06T05:06:45Z

Linked issues: #8361, #8367, DataBiosphere/azul-private#431, #8381

Checklist

Author

¹ when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

B01 Added p tag to titles of partial commits
B02 This PR is labeled partial _{or completely resolves all linked issues}
B03 This PR partially resolves each of the linked issues _{or does not have the partial label}

Author (reindex)

C01 Added r tag to commit title _{or the changes introduced by this PR will not require reindexing of any deployment}
C02 This PR is labeled reindex:dev _{or the changes introduced by it will not require reindexing of dev}
C03 This PR is labeled reindex:anvildev _{or the changes introduced by it will not require reindexing of anvildev}
C04 This PR is labeled reindex:anvilprod _{or the changes introduced by it will not require reindexing of anvilprod}
C05 This PR is labeled reindex:prod _{or the changes introduced by it will not require reindexing of prod}
C06 This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod _{or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod}

Author (mirror)

D01 This PR is labeled mirror:dev _{or the changes introduced by it will not require mirroring of dev}
D02 This PR is labeled mirror:anvildev _{or the changes introduced by it will not require mirroring of anvildev}
D03 This PR is labeled mirror:anvilprod _{or the changes introduced by it will not require mirroring of anvilprod}
D04 This PR is labeled mirror:prod _{or the changes introduced by it will not require mirroring of prod}
D05 This PR is labeled mirror:partial and its description documents the specific mirroring procedure for dev, anvildev, anvilprod and prod _{or requires a full mirroring or carries none of the labels mirror:dev, mirror:anvildev, mirror:anvilprod and mirror:prod}

Author (API changes)

E01 This PR and its linked issues are labeled API _{or this PR does not modify a REST API}
E02 Added a (A) tag to commit title for backwards (in)compatible changes _{or this PR does not modify a REST API}
E03 Updated REST API version number in app.py _{or this PR does not modify a REST API}

Author (upgrading deployments)

F01 Ran make docker_images.json and committed the resulting changes _{or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable}
F02 Documented upgrading of deployments in UPGRADING.rst _{or this PR does not require upgrading deployments}
F03 Added u tag to commit title _{or this PR does not require upgrading deployments}
F04 This PR is labeled upgrade _{or does not require upgrading deployments}
F05 This PR is labeled deploy:shared _{or does not modify docker_images.json, and does not require deploying the shared component for any other reason}
F06 This PR is labeled deploy:gitlab _{or does not require deploying the gitlab component}
F07 This PR is labeled deploy:runner _{or does not require deploying the runner image}

Author (hotfixes)

G01 Added F tag to main commit title _{or this PR does not include permanent fix for a temporary hotfix}
G02 Reverted the temporary hotfixes for any linked issues _{or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues linked to this PR}

Author (before every review)

H01 Rebased PR branch on develop, squashed fixups from prior reviews
H02 Ran make requirements_update _{or this PR does not modify pyproject.toml}
H03 Added R tag to commit title _{or this PR does not modify uv.lock}
H04 This PR is labeled reqs _{or does not modify uv.lock}
H05 make integration_test passes in personal deployment _{or this PR does not modify functionality that could affect the IT outcome}
H06 PR is awaiting requested review from a peer
H07 Status of PR is Review requested
H08 PR is assigned to only the peer and the author

Peer reviewer (after approval)

Note that after requesting changes, the PR must be assigned to only the author.

J01 Actually approved the PR
J02 PR is not a draft
J03 PR is awaiting requested review from system administrator
J04 Status of PR is Review requested
J05 PR is assigned to only the system administrator and the author

System administrator (after approval)

K01 Actually approved the PR
K02 Labeled linked issues as demo or no demo
K03 Commented on linked issues about demo expectations _{or all linked issues are labeled no demo}
K04 Decided if PR can be labeled no sandbox
K05 A comment to this PR details the completed security design review
K06 PR title is appropriate as title of merge commit
K07 N reviews label is accurate
K08 Status of PR is Approved
K09 PR is assigned to only the operator and the author

Operator

L01 Checked reindex:… labels and r commit title tag
L02 Checked mirror:… labels
L03 Checked that demo expectations are clear _{or all linked issues are labeled no demo}
L04 Squashed PR branch and rebased onto develop
L05 Sanity-checked history
L06 Pushed PR branch to GitHub

Operator (deploy `.shared` and `.gitlab` components)

M01 Ran _select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
M02 Ran _select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply(an error from _login_docker_gitlab is benign if the instance was stopped for backup) _{or this PR is not labeled deploy:gitlab}
M03 Ran _select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused _{or this PR is not labeled deploy:shared}
M04 Ran _select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply(an error from _login_docker_gitlab is benign if the instance was stopped for backup) _{or this PR is not labeled deploy:gitlab}
M05 Checked the items in the next section _{or this PR is labeled deploy:gitlab}
M06 PR is assigned to only the system administrator and the author _{or this PR is not labeled deploy:gitlab}

System administrator (post-deploy of `.gitlab` component)

N01 Background migrations for dev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
N02 Background migrations for anvildev.gitlab are complete _{or this PR is not labeled deploy:gitlab}
N03 PR is assigned to only the operator and the author

Operator (deploy runner image)

P01 Ran _select dev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}
P02 Ran _select anvildev.gitlab && make -C terraform/gitlab/runner _{or this PR is not labeled deploy:runner}

Operator (sandbox build)

Operator (merge the branch)

R01 All status checks passed and the PR is mergeable
R02 The title of the merge commit starts with the title of this PR
R03 Added PR # reference to merge commit title
R04 Collected commit title tags in merge commit title _{but only included p if the PR is also labeled partial}
R05 Pushed merge commit to GitHub
R06 Status of PR is Merged lower
R07 Status of blocked issues is Triage _{or no issues are blocked on the linked issues}

Operator (main build)

Operator (reindex)

Operator (mirroring)

U01 Started mirroring in dev _{or this PR is not labelled mirror:dev}
U02 Started mirroring in anvildev _{or this PR is not labelled mirror:anvildev}
U03 Checked for, triaged and possibly requeued messages in mirror fail queue in dev _{or this PR is not labelled mirror:dev}
U04 Checked for, triaged and possibly requeued messages in mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}
U05 Emptied mirror fail queue in dev _{or this PR is not labelled mirror:dev}
U06 Emptied mirror fail queue in anvildev _{or this PR is not labelled mirror:anvildev}

Operator

V01 Propagated the upgrade, API, deploy:shared, deploy:gitlab, deploy:runner, reindex:partial, reindex:anvilprod, reindex:prod, mirror:partial, mirror:anvilprod and mirror:prod labels to any open promotion PRs _{or this PR carries none of these labels, or is not included in an open promotion PR}
V02 Propagated any specific instructions related to those labels, from the description of this PR to that of any open promotion PRs _{or this PR carries none of those labels, or is not included in an open promotion PR}
V03 PR is assigned to no one

Shorthand for review comments

L line is too long
W line wrapping is wrong
Q bad quotes
F other formatting problem

hannes-ucsc · 2026-10-06T05:11:01Z

(Posted by Claude Code)

The title of this PR matches neither linked issue because the PR is an omnibus resolving both #8361 and #8367, whose titles are unrelated to each other. Each linked issue is resolved by the commit whose title references it.

codecov · 2026-10-06T05:18:03Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.96%. Comparing base (d316202) to head (bed0b5d).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #8372   +/-   ##
========================================
  Coverage    84.96%   84.96%           
========================================
  Files          170      170           
  Lines        25681    25693   +12     
========================================
+ Hits         21819    21831   +12     
  Misses        3862     3862

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

coveralls · 2026-10-06T05:18:04Z

coverage: 85.041% (+0.007%) from 85.034% — issues/hannes-ucsc/8361-et-al-omnibus into develop

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ere/azul-private#431) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

A version tag, even a fully specified one, can be moved by the project that publishes the action, so a commit is the only reference that is fixed. Add a script that rewrites every pin in the workflows to the commit behind the most recent fully specified version tag, and a checklist item that runs it as part of the biweekly upgrade. The next commit is the result of running it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The result of running `python scripts/upgrade_actions.py`. Besides replacing each tag with the commit behind it, this updates `setup-uv` from v10.0.1 to v10.2.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hannes-ucsc self-assigned this Oct 6, 2026

hannes-ucsc linked an issue Oct 6, 2026 that may be closed by this pull request

Simplify switching between installed AWS CLI v2 versions #8361

Open

hannes-ucsc changed the title ~~Simplify switching between installed AWS CLI v2 versions (#8361)~~ Various fixes and improvements (#8361) Oct 6, 2026

hannes-ucsc linked an issue Oct 6, 2026 that may be closed by this pull request

Controllers not supporting APATs don't reject them early #8367

Open

hannes-ucsc changed the title ~~Various fixes and improvements (#8361)~~ Various fixes and improvements (#8361, #8367) Oct 6, 2026

hannes-ucsc changed the title ~~Various fixes and improvements (#8361, #8367)~~ Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431) Oct 6, 2026

hannes-ucsc force-pushed the issues/hannes-ucsc/8361-et-al-omnibus branch 2 times, most recently from ce523cc to 1a672f5 Compare October 8, 2026 01:25

hannes-ucsc changed the title ~~Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431)~~ Simplify switching between installed AWS CLI v2 versions (#8361, #8367, DataBiosphere/azul-private#431) Oct 8, 2026

hannes-ucsc changed the title ~~Simplify switching between installed AWS CLI v2 versions (#8361, #8367, DataBiosphere/azul-private#431)~~ Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431) Oct 8, 2026

hannes-ucsc and others added 4 commits October 7, 2026 20:55

Simplify switching between installed AWS CLI v2 versions (#8361)

192f8ab

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fix: Controllers not supporting APATs don't reject them early (#8367)

6ce30bd

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fix: FedRAMP inventory lists each OpenSearch domain twice (DataBiosph…

41b399c

…ere/azul-private#431) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Fix: GitHub Actions deprecated Node20 (#8381)

09bbd0e

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

hannes-ucsc force-pushed the issues/hannes-ucsc/8361-et-al-omnibus branch from 1a672f5 to 192f8ab Compare October 8, 2026 03:56

hannes-ucsc linked an issue Oct 8, 2026 that may be closed by this pull request

GitHub Actions deprecated Node20 #8381

Open

hannes-ucsc changed the title ~~Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431)~~ Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431, #8381) Oct 8, 2026

hannes-ucsc and others added 2 commits October 7, 2026 22:30

[2/2] Pin GitHub actions to commits

bed0b5d

The result of running `python scripts/upgrade_actions.py`. Besides replacing each tag with the commit behind it, this updates `setup-uv` from v10.0.1 to v10.2.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Navigation Menu

Repository navigation

Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431, #8381) - #8372

Various fixes and improvements (#8361, #8367, DataBiosphere/azul-private#431, #8381)#8372
hannes-ucsc wants to merge 6 commits into
developfrom
issues/hannes-ucsc/8361-et-al-omnibus

hannes-ucsc commented Oct 6, 2026 •

edited

Loading

Uh oh!

hannes-ucsc commented Oct 6, 2026

Uh oh!

codecov Bot commented Oct 6, 2026 •

edited

Loading

Uh oh!

coveralls commented Oct 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hannes-ucsc commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Author

Author (partiality)

Author (reindex)

Author (mirror)

Author (API changes)

Author (upgrading deployments)

Author (hotfixes)

Author (before every review)

Peer reviewer (after approval)

System administrator (after approval)

Operator

Operator (deploy .shared and .gitlab components)

System administrator (post-deploy of .gitlab component)

Operator (deploy runner image)

Operator (sandbox build)

Operator (merge the branch)

Operator (main build)

Operator (reindex)

Operator (mirroring)

Operator

Shorthand for review comments

Uh oh!

hannes-ucsc commented Oct 6, 2026

Uh oh!

codecov Bot commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coveralls commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hannes-ucsc commented Oct 6, 2026 •

edited

Loading

Operator (deploy `.shared` and `.gitlab` components)

System administrator (post-deploy of `.gitlab` component)

codecov Bot commented Oct 6, 2026 •

edited

Loading

coveralls commented Oct 6, 2026 •

edited

Loading