Merge branch 'master' into backport-script

.github/dependabot.yml

@@ -0,0 +1,26 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "docker"
+    directory: "/lambdas/thumbnail"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "docker"
+    directory: "/catalog"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "docker"
+    directory: "/s3-proxy"
+    schedule:
+      interval: "daily"

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+# Description
+
+
+# TODO
+
+<!-- Remove items that are irrelevant to this PR -->
+
+- [ ] Unit tests
+- [ ] Automated tests (e.g. Preflight)
+- [ ] Confirm that this change meets security best practices and does not violate the security model
+- [ ] Documentation
+    - [ ] run `optipng` on any new PNGs
+    - [ ] [Python: Run `build.py`](../tree/master/gendocs/build.py) for new docstrings
+    - [ ] JavaScript: basic explanation and screenshot of new features
+    - [ ] Markdown somewhere in docs/**/*.md that explains the feature to end users (said .md files should be linked from SUMMARY.md so they appear on https://docs.quiltdata.com)
+    - [ ] Markdown docs for developers
+- [ ] [Changelog](../tree/master/docs/CHANGELOG.md) entry (skip if change is not significant to end users, e.g. docs only)

.github/workflows/deploy-catalog.yaml

@@ -0,0 +1,68 @@
+name: Deploy catalog to ECR
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - '.github/workflows/deploy-catalog.yaml'
+      - 'catalog/**'
+      - 'shared/**'
+
+jobs:
+  deploy-catalog-ecr:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: catalog
+    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: 'catalog/package.json'
+          cache: 'npm'
+          cache-dependency-path: 'catalog/package-lock.json'
+      - run: npm ci
+      - run: npm run build
+      - name: Configure AWS credentials from Prod account
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::730278974607:role/github/GitHub-Quilt
+          aws-region: us-east-1
+      - name: Login to Prod ECR
+        id: login-prod-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+      - name: Login to MP ECR
+        id: login-mp-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registries: 709825985650
+      - name: Configure AWS credentials from GovCloud account
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws-us-gov:iam::313325871032:role/github/GitHub-Quilt
+          aws-region: us-gov-east-1
+      - name: Login to GovCloud ECR
+        id: login-govcloud-ecr
+        uses: aws-actions/amazon-ecr-login@v2
+      - name: Build and push Docker image to Prod, MP and GovCloud ECR
+        env:
+          ECR_REGISTRY_PROD: ${{ steps.login-prod-ecr.outputs.registry }}
+          ECR_REGISTRY_GOVCLOUD: ${{ steps.login-govcloud-ecr.outputs.registry }}
+          ECR_REGISTRY_MP: ${{ steps.login-mp-ecr.outputs.registry }}
+          ECR_REPOSITORY: quiltdata/catalog
+          ECR_REPOSITORY_MP: quilt-data/quilt-payg-catalog
+          IMAGE_TAG: ${{ github.sha }}
+        run: |
+          docker buildx build \
+            -t $ECR_REGISTRY_PROD/$ECR_REPOSITORY:$IMAGE_TAG \
+            -t $ECR_REGISTRY_GOVCLOUD/$ECR_REPOSITORY:$IMAGE_TAG \
+            -t $ECR_REGISTRY_MP/$ECR_REPOSITORY_MP:$IMAGE_TAG \
+            .
+          docker push $ECR_REGISTRY_PROD/$ECR_REPOSITORY:$IMAGE_TAG
+          docker push $ECR_REGISTRY_GOVCLOUD/$ECR_REPOSITORY:$IMAGE_TAG
+          docker push $ECR_REGISTRY_MP/$ECR_REPOSITORY_MP:$IMAGE_TAG