release: 2026-01-06

.eslintrc.js

@@ -56,6 +56,7 @@ module.exports = {
     "**/.eslintrc.js",
     "sentry-example-page.js",
     "sentry-example-api.js",
+    "next-env.d.ts",
     "*.csv",
   ],
 }

.github/workflows/cypress_partners.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 env:
   PORT: 3100
   EMAIL_API_KEY: 'SOME-LONG-SECRET-KEY'
@@ -55,7 +57,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in root dir
         run: yarn
@@ -91,4 +93,4 @@ jobs:
           record: false # set this value to true to record videos in cypress cloud for debugging purposes - skip passing tests
         env:
           CYPRESS_RECORD_KEY: ${{ secrets.PARTNERS_CYPRESS_RECORD_KEY }}
-
+

.github/workflows/cypress_partners_listingapproval.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 env:
   PORT: 3100
   EMAIL_API_KEY: 'SOME-LONG-SECRET-KEY'
@@ -48,7 +50,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in root dir
         run: yarn
@@ -84,4 +86,4 @@ jobs:
           record: false # set this value to true to record videos in cypress cloud for debugging purposes - skip passing tests
         env:
           CYPRESS_RECORD_KEY: ${{ secrets.PARTNERS_CYPRESS_RECORD_KEY }}
-
+

.github/workflows/cypress_public.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 env:
   PORT: 3100
   EMAIL_API_KEY: 'SOME-LONG-SECRET-KEY'
@@ -56,7 +58,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in root dir
         run: yarn
@@ -92,4 +94,4 @@ jobs:
         env:
           CYPRESS_RECORD_KEY: ${{ secrets.PUBLIC_CYPRESS_RECORD_KEY }}
 
-
+

.github/workflows/docker_image_build.yml

@@ -26,12 +26,27 @@ jobs:
           - container: api
             docker_context: "{{defaultContext}}:api"
             dockerfile: Dockerfile
+            platforms: linux/amd64
+          - container: dbseed
+            docker_context: "{{defaultContext}}:api"
+            dockerfile: Dockerfile.dbseed
+            platforms: linux/amd64
           - container: partners
             docker_context: "{{defaultContext}}"
             dockerfile: Dockerfile.sites.partners
+            platforms: linux/amd64
           - container: public
             docker_context: "{{defaultContext}}"
             dockerfile: Dockerfile.sites.public
+            platforms: linux/amd64
+          - container: infra
+            docker_context: "{{defaultContext}}:infra"
+            dockerfile: Dockerfile
+            platforms: linux/amd64,linux/arm64
+          - container: infra-dev
+            docker_context: "{{defaultContext}}:infra"
+            dockerfile: Dockerfile.dev
+            platforms: linux/amd64,linux/arm64
     runs-on: ubuntu-latest
     steps:
       - name: Log in to GitHub Container Registry
@@ -41,6 +56,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # Required to build multi-arch images.
+      - name: Setup Docker QEMU
+        uses: docker/[email protected]
+
       # Required to use image layer cache.
       - name: Setup Docker Buildx
         uses: docker/[email protected]
@@ -53,8 +72,9 @@ jobs:
           cache-from: type=registry,ref=${{ env.image_base }}/${{ matrix.container }}/container-layer-cache:latest
           context: ${{ matrix.docker_context }}
           file: ${{ matrix.dockerfile }}
+          platforms: ${{ matrix.platforms }}
           tags: |
-            ${{ env.image_base }}/${{ matrix.container }}:latest
+            ${{ env.image_base }}/${{ matrix.container }}:gitbranch-${{ github.ref_name }}-latest
             ${{ env.image_base }}/${{ matrix.container }}:gitsha-${{ github.sha }}
           # Connects the image to the repository: https://docs.github.com/en/packages/learn-github-packages/connecting-a-repository-to-a-package.
           labels: org.opencontainers.image.source=https://github.com/${{ github.repository }}

.github/workflows/infra_ci.yml

@@ -0,0 +1,87 @@
+name: Infra CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/infra_ci.yml'
+      - 'infra/**'
+
+permissions:
+  contents: read
+
+jobs:
+  check-tofu-fmt:
+    if: ${{ false }} # This condition ensures the workflow is skipped
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v6
+
+      - name: Check tofu fmt
+        shell: bash
+        run: |
+          if ! docker container run --rm \
+               -v ./infra:/infra \
+               --workdir /infra \
+               --entrypoint tofu \
+               ghcr.io/${{ github.repository }}/infra-dev:gitbranch-main-latest \
+               fmt -check -diff -recursive
+          then
+            echo 'ERROR: not all tofu files are correctly formatted'
+            exit 1
+          fi
+
+  check-tofu-provider-lock:
+    if: ${{ false }} # This condition ensures the workflow is skipped
+    strategy:
+      matrix:
+        root_module:
+          - bloom_dev
+          - bloom_dev_deployer_permission_set_policy
+          # TODO: add once root mod is added: bloom_prod
+          - bloom_prod_deployer_permission_set_policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v6
+
+      - name: Check tofu providers lock
+        shell: bash
+        run: |
+          if ! docker container run --rm \
+               -v ./infra:/infra \
+               --workdir /infra/tofu_root_modules/${{ matrix.root_module }} \
+               --entrypoint bash \
+               ghcr.io/${{ github.repository }}/infra-dev:gitbranch-main-latest \
+               -c 'sha256sum .terraform.lock.hcl > hash'
+          then
+            echo 'ERROR: recording sha256 of .terraform.lock.hcl failed'
+            exit 1
+          fi
+
+          if ! docker container run --rm \
+               -v ./infra:/infra \
+               --workdir /infra/tofu_root_modules/${{ matrix.root_module }} \
+               --entrypoint bash \
+               ghcr.io/${{ github.repository }}/infra-dev:gitbranch-main-latest \
+               -c 'tofu init -backend=false && tofu providers lock -platform=linux_amd64 -platform=linux_arm64 -platform=darwin_amd64 -platform=darwin_arm64'
+          then
+            echo 'ERROR: tofu providers lock did not run successfully'
+            exit 1
+          fi
+
+          if ! docker container run --rm \
+               -v ./infra:/infra \
+               --workdir /infra/tofu_root_modules/${{ matrix.root_module }} \
+               --entrypoint bash \
+               ghcr.io/${{ github.repository }}/infra-dev:gitbranch-main-latest \
+               -c 'sha256sum -c hash'
+          then
+            echo 'ERROR: .terraform.lock.hcl changed after running tofu providers lock'
+            exit 1
+          fi

.github/workflows/integration_tests_api.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 env:
   PORT: 3100
   EMAIL_API_KEY: 'SG.SOME-LONG-SECRET-KEY'
@@ -52,7 +54,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in api dir
         working-directory: ./api

.github/workflows/lint.yml

@@ -6,6 +6,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 
 jobs:
   run-linters:
@@ -14,12 +16,12 @@ jobs:
 
     steps:
       - name: Check out Git repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       # ESLint and Prettier must be in `package.json`
       - name: Install Node.js dependencies

.github/workflows/missing-translations.yml

@@ -0,0 +1,41 @@
+name: Missing Translations
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths-ignore:
+      - 'infra/**'
+
+jobs:
+  shared-helpers-unit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v1
+        with:
+          node-version: 22
+
+      - name: yarn in root dir
+        run: yarn
+
+      # Rerun yarn in each app.
+      # It may seem unnecessary but there are some complex yarn package 
+      # versioning dependencies here, so best to run to be safe.
+      # See https://github.com/bloom-housing/bloom/issues/3217#issuecomment-1430301029 
+      # for more context.
+      - name: yarn in sites/public dir
+        working-directory: ./sites/public
+        run: yarn
+
+      - name: yarn in sites/partners dir
+        working-directory: ./sites/partners
+        run: yarn
+
+      # Tests
+      - name: yarn translations test shared/helpers
+        run: yarn test:shared-helpers:missing-translations

.github/workflows/unit_tests_api.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 env:
   APP_SECRET: 'SOME-LONG-SECRET-KEY'
   DATABASE_URL: postgres://bloom-dev:[email protected]:5432/bloom
@@ -25,6 +27,7 @@ env:
   RECAPTCHA_KEY: "secret-key"
   GOOGLE_CLOUD_PROJECT_ID: "secret-key"
   LOTTERY_DAYS_TILL_EXPIRY: 45
+  CLOUDINARY_CLOUD_NAME: "exygy"
 
 jobs:
   backend-unit:
@@ -37,7 +40,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in api
         working-directory: ./api

.github/workflows/unit_tests_shared_helpers.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 
 jobs:
   shared-helpers-unit:
@@ -16,7 +18,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in root dir
         run: yarn

.github/workflows/unit_tests_sites_partners.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 
 jobs:
   partners-unit:
@@ -16,7 +18,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in root dir
         run: yarn

.github/workflows/unit_tests_sites_public.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - 'infra/**'
 
 jobs:
   public-unit:
@@ -16,7 +18,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v1
         with:
-          node-version: 18
+          node-version: 22
 
       - name: yarn in root dir
         run: yarn

.gitignore

@@ -102,3 +102,4 @@ memory-bank/
 
 # Terraform providers
 .terraform
+*.tfstate