1/14/2026 Big whammy release candidate

.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Code Owners
+# Who are the points of contact in your project who are responsible/accountable for the project? This can often be an engineering or design manager or leader, who may or may not be the primary maintainers of the project. List them by GitHub Username
+
+@spopelka-dsac
+@wbprice
+
+# Repo Domains
+# The Repo Domains section of your CODEOWNERS.md file helps manage code review responsibilities efficiently. Each domain represents a different aspect of the repository, such as documentation, frontend, backend, DevOps, testing, etc. In this section, list each domain and assign the appropriate GitHub usernames or teams responsible for that domain. This ensures that pull requests (PRs) are reviewed by the right experts, maintaining high code quality and relevance
+# Not every name on the list is required to review every change, but at least one person named should be review every PR making contributions.
+
+/frontend/ @sachin-panayil @sman-dsac @spopelka-dsac
+
+/backend/ @spopelka-dsac @IsaacMilarky @sachin-panayil
+
+/infrastructure/ @wbprice
+
+/flyway/ @spopelka-dsac

.github/workflows/backend-test.yml

@@ -6,16 +6,20 @@ permissions:
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+      - uses: astral-sh/ruff-action@v3
+        with:
+          src: "./backend"
+
   test:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: backend/
 
     steps:
       - name: Checkout repo
@@ -26,25 +30,20 @@ jobs:
 
       - name: Ensure test directories have appropriate permissions for writing
         run: |
-          mkdir -p ./artifacts/test-reports
-          chmod 777 ./artifacts/test-reports
-          chmod 777 ./provider_directory/static
+          mkdir -p ./backend/artifacts/test-reports
+          chmod 777 ./backend/artifacts/test-reports
+          chmod 777 ./backend/provider_directory/static
+
+      - name: Setup test environment
+        run: |
+          make test-setup
 
-      - name: Build and run tests
+      - name: Run tests
         run: |
-          make test
+          make test-backend
 
       - name: Upload test results as artifact
         uses: actions/upload-artifact@v4
         with:
           name: test-results
           path: backend/artifacts/test-reports/*.xml
-
-      - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2
-        if: (!cancelled())
-        with:
-          check_name: "Backend Django Test Results"
-          comment_mode: changes in failures
-          files: |
-            backend/artifacts/test-reports/*.xml

.github/workflows/end-to-end-test.yml

@@ -0,0 +1,39 @@
+name: End to End Tests
+
+permissions: {}
+
+on:
+  push:
+    branches: [main, release]
+  pull_request:
+    branches: [main, release]
+
+jobs:
+  test:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: docker/setup-compose-action@v1
+      - uses: actions/setup-node@v5
+        with:
+          node-version: lts/*
+      # build service conatiners required for `make test-server`
+      - name: Build containers
+        run: docker compose build db db-migrations django-web web
+      - name: Install Playwright dependencies
+        working-directory: playwright/
+        run: npm ci
+      - name: Install Playwright browsers
+        working-directory: playwright/
+        run: npx playwright install chromium --with-deps
+      # this step starts the test web server via `make test-server`
+      - name: Run Playwright tests
+        working-directory: playwright/
+        run: npx playwright test
+      - uses: actions/upload-artifact@v4
+        if: ${{ !cancelled() }}
+        with:
+          name: playwright-report
+          path: playwright/playwright-report/
+          retention-days: 7

.github/workflows/frontend-test.yml

@@ -24,13 +24,19 @@ jobs:
         run: |
           npm ci
 
-      - name: Lint frontend
+      - name: Typecheck
         working-directory: frontend
         run: |
           npm run typecheck
+
+      - name: Lint
+        working-directory: frontend
+        run: |
           npm run lint
 
-      - name: Run tests
+      - name: Test
         working-directory: frontend
+        env:
+          VITE_API_BASE_URL: http://localhost:8000
         run: |
           npm run coverage

.github/workflows/hotfix-sync.yml

@@ -0,0 +1,46 @@
+name: Hotfix Sync
+
+on:
+  pull_request:
+    branches: [release]
+    types: [opened, closed]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  remind-label:
+    if: github.event.action == 'opened'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const labels = context.payload.pull_request.labels.map(l => l.name);
+
+            if (!labels.includes('hotfix')) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: `👋 If this is a hotfix, please add the \`hotfix\` label to automatically cherry pick and sync your changes with main via PR!`
+              });
+            }
+
+  cherry-pick:
+    if: >
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'hotfix')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: carloscastrojumo/github-cherry-pick-action@v1.0.1
+        with:
+          branch: main
+          labels: synced-cherry-pick
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/snyk.yml

@@ -0,0 +1,26 @@
+name: Scan Project with Snyk Python Workflow
+on: push
+permissions:
+  contents: read
+jobs:
+    security:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@master
+            - uses: actions/setup-python@v5
+              with: 
+                python-version: "3.11"
+            - name: Install Dependencies
+              run: |
+                python -m pip install --upgrade pip
+                pip install -r backend/requirements.txt
+                pip install -r etls/loadFIPS/requirements.txt
+            - name: Install Snyk CLI
+              run: |
+                npm install -g snyk@latest
+
+            - name: Run Snyk scan
+              env:
+                SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+              run: |
+                snyk test --all-projects

.gitignore

@@ -135,6 +135,7 @@ celerybeat.pid
 
 # Environments
 .env
+.env.test
 .venv
 env/
 venv/
@@ -185,4 +186,4 @@ scratch/
 
 # tool version management
 mise.toml
-.pre-commit-config.yaml
+

.gitleaksignore

@@ -206,3 +206,32 @@
 #False positive
 e1161fe24ddffc2afaac005126d2e21666d36dcc:db/sql/inserts/sample_data.sql:generic-api-key:27140
 20530ff1fcdaaccb9554bc511d21e09f09360750:frontend/index.html:tfstate-provider-ids:13
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/estree/package.json:tfstate-provider-ids:10
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/json-schema/package.json:tfstate-provider-ids:10
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/json-schema/package.json:tfstate-provider-ids:15
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/json-schema/package.json:tfstate-provider-ids:20
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/json-schema/package.json:tfstate-provider-ids:25
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:10
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:15
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:20
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:25
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:30
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:40
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:45
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:50
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:55
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:60
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:65
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:70
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:80
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:85
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:90
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:95
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:100
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:105
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:115
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:110
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:120
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:125
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:35
+22bb4d12d16dcdda27efc8389df470af6e576c96:playwright/node_modules/@types/node/package.json:tfstate-provider-ids:75