DataBiosphere · dsotirho-ucsc · Oct 4, 2025 · Jul 28, 2025 · Jul 30, 2025 · Aug 2, 2025
@@ -1,10 +1,10 @@
 ---
-name: Annual review of the rule set for audited events
+name: Review rule set for audited events
 about: Issue template for annual review of the rule set for audited events
 title: Review rule set for audited events
 labels: -,compliance,doc,no demo,orange
 assignees: nolunwa-ucsc,bvizzier-ucsc
-type: Task
+type: Chore
 _start: 2025-01-10T10:00
 _period: 1 year
 ---

@@ -1,5 +1,5 @@
 ---
-name: A New Issue
+name: A new blank issue
 about: Template for new issues
 title: ''
 labels: orange

@@ -1,10 +1,10 @@
 ---
-name: Review FedRAMP inventory
-about: Issue template for the current operator to perform a Port and Protocol review with system administrator
-title: Monthly inventory review
-labels: +,compliance,infra,no demo,operator,orange
+name: Monthly FedRAMP inventory review
+about: Issue template for the monthly creation and review of the FedRAMP cloud infrastructure inventory   
+title: Monthly FedRAMP inventory review
+labels: -,compliance,infra,no demo,operator,orange
 assignees: hannes-ucsc
-type: Task
+type: Chore
 _repository: DataBiosphere/azul-private
 _start: 2024-03-01T09:00
 _period: 1 month

@@ -1,9 +1,9 @@
 ---
-name: OpenSearch service software update
-about: Issue template for operator tasks to update OpenSearch instances software
-title: Apply Amazon OpenSearch (ES) Software Update
+name: Apply Amazon OpenSearch software updates
+about: Issue template for operator to update the service software version on all OpenSearch domains 
+title: Apply Amazon OpenSearch software updates
 labels: -,infra,no demo,operator,orange
-type: Task
+type: Chore
 _start: 2024-02-26T09:00
 _period: 14 days
 ---

@@ -1,9 +1,9 @@
 ---
-name: Promotion pull request
-about: Issue template for promoting changes to stable deployments
+name: Promotion
+about: Issue template for promoting changes to stable deployments on a weekly basis
 title: Promotion
 labels: -,infra,no demo,operator,orange
-type: Feature
+type: Chore
 _start: 2024-02-27T09:00
 _period: 7 days
 ---

@@ -3,7 +3,7 @@ name: Prune GitLab data volume backups
 about: Issue template for the quarterly pruning of GitLab data volume snapshots
 title: Prune GitLab data volume backups
 labels: -,infra,operator,orange
-type: Task
+type: Chore
 _start: 2025-04-01T09:00
 _period: 3 months
 ---

@@ -1,10 +1,10 @@
 ---
-name: Review publicly accessible content
-about: Issue template for the system administrator to perform a review of publicly accessible content.
+name: Monthly review of publicly accessible content
+about: Issue template for the system administrator to perform a review of publicly accessible content on a monthly basis
 title: Monthly review of publicly accessible content
 labels: -,compliance,infra,doc,orange
 assignees: hannes-ucsc
-type: Task
+type: Chore
 _repository: DataBiosphere/azul-private
 _start: 2024-08-01T09:00
 _period: 1 month

@@ -1,27 +1,27 @@
 ---
-name: Dependency upgrades
-about: Issue template for bi-weekly dependency upgrades
-title: Upgrade dependencies
-labels: orange,operator,infra,debt
-type: Feature
+name: Upgrade software dependencies
+about: Issue template for the bi-weekly upgrade of Azul's software dependencies
+title: Upgrade software dependencies
+labels: -,orange,operator,infra,debt
+type: Chore
 _start: 2023-11-27T09:00
 _period: 14 days
 ---
 - [ ] Update [PyCharm image](https://github.com/DataBiosphere/azul-docker-pycharm)
-  - [ ] Bump [base image](https://hub.docker.com/_/debian/tags?name=bookworm) tag (only same Debian release), if possible
+  - [ ] Bump [base image](https://hub.docker.com/_/debian/tags?name=trixie) `-slim` tag (only same Debian release), if possible
   - [ ] Bump upstream version, if possible
   - [ ] Bump internal version
   - [ ] Remove unused dependencies with high or critical CVEs
   - [ ] Push commit to GitHub (directly to `master` branch, no PR needed)
   - [ ] GH Action workflow succeeded
   - [ ] Image is available on [DockerHub](https://hub.docker.com/repository/docker/ucscgi/azul-pycharm/tags) 
 - [ ] Update [BigQuery Emulator image](https://github.com/DataBiosphere/azul-bigquery-emulator)
-  - [ ] Bump [base image](https://hub.docker.com/_/debian/tags?name=bookworm) tag, if possible
+  - [ ] Bump [base image](https://hub.docker.com/_/debian/tags?name=trixie) `-slim` tag, if possible
   - [ ] Bump internal version 
   - [ ] Push commit to GitHub (directly to `azul` branch, no PR needed)
   - [ ] GH Action workflow succeeded
   - [ ] Image is available on [DockerHub](https://hub.docker.com/repository/docker/ucscgi/azul-bigquery-emulator/tags) 
-- [ ] Create Azul PR, connected to this issue, with … 
+- [ ] Create Azul PR, linked to this issue, with … 
     - [ ] … changes to `requirements*.txt` from open Dependabot PRs, one commit per PR
     - [ ] … upgrade direct Python dependencies, [reference the operator manual](https://github.com/DataBiosphere/azul/blob/develop/OPERATOR.rst#upgrade-direct-python-dependencies) for instructions <sub>or not applicable</sub>
     - [ ] … update to [Python](https://hub.docker.com/_/python/tags) (only patch versions) <sub>or no update available</sub>
@@ -34,8 +34,8 @@ _period: 14 days
     - [ ] … update to [ClamAV image](https://hub.docker.com/r/clamav/clamav/tags) <sub>or no update available</sub>
     - [ ] … update to [GitLab AMI](https://github.com/DataBiosphere/azul/blob/develop/OPERATOR.rst#updating-the-ami-for-gitlab-instances) <sub>or no update available</sub>
     - [ ] … update to [Swagger UI](https://github.com/DataBiosphere/azul/blob/develop/OPERATOR.rst#updating-the-swagger-ui) <sub>or no update available</sub>
-- [ ] Created tickets for any deferred updates to …
-  - [ ] … to next major or minor Python version <sub>or such ticket already exists</sub>
-  - [ ] … to next major Docker version <sub>or such ticket already exists</sub>
-  - [ ] … to next major or minor Terraform version <sub>or such ticket already exists</sub>
-  - [ ] … to next major OpenSearch version <sub>or such ticket already exists</sub>
+- [ ] Created issues for any deferred updates to …
+  - [ ] … the next major or minor Python version <sub>or such an issue already exists</sub>
+  - [ ] … the next major Docker version <sub>or such an issue already exists</sub>
+  - [ ] … the next major or minor Terraform version <sub>or such an issue already exists</sub>
+  - [ ] … the next major OpenSearch version <sub>or such an issue already exists</sub>
@@ -1,15 +1,15 @@
 ---
 name: Renew server and client VPN certificates 
-about: Issue template for the quarterly renewals of VPN certificates
+about: Issue template for the quarterly renewal of all VPN certificates
 title: Renew VPN server and client certificates 
 labels: -,infra,orange
-type: Task
+type: Chore
 _start: 2025-08-01T09:00
 _period: 3 months
 ---
 
 - [ ] Deploy `tempdev.gitlab`
-- [ ] Assign this ticket to the system administrator
+- [ ] Assign this issue to the system administrator
 - [ ] Renew server certificate on `tempdev`
 - [ ] Renew client certificates on `tempdev`
 - [ ] Hibernate `tempdev`

@@ -1,9 +1,9 @@
 ---
-name: Run the web app vulnerability scans
-about: Issue template for the monthly scanning and triaging of web app vulnerabilities
+name: Monthly web app vulnerability scans
+about: Issue template for the monthly scanning and triaging of web application vulnerabilities
 title: Monthly web app vulnerability scans
-labels: +,compliance,infra,no demo,orange
-type: Task
+labels: -,compliance,infra,no demo,orange
+type: Chore
 _repository: DataBiosphere/azul-private
 _start: 2025-06-01T09:00
 _period: 1 month

@@ -2,20 +2,21 @@
 This is the PR template for hotfix PRs against `anvilprod`.
 -->
 
-Connected issue: #0000
+Linked issue: #0000
 
 
 ## Checklist
 
 
 ### Author
 
+- [ ] PR is assigned to the author
 - [ ] Target branch is `anvilprod`
 - [ ] Name of PR branch matches `hotfixes/<GitHub handle of author>/<issue#>-<slug>-anvilprod`
-- [ ] On ZenHub, PR is connected to the issue it hotfixes
+- [ ] PR is linked to the issue it hotfixes
 - [ ] PR description links to connected issue
-- [ ] PR title is `Hotfix anvilprod: ` followed by title of connected issue
-- [ ] PR title references the connected issue
+- [ ] PR title is `Hotfix anvilprod: ` followed by title of linked issue
+- [ ] PR title references the linked issue
 
 
 ### Author (hotfixes)
@@ -29,9 +30,13 @@ Connected issue: #0000
 ### Author (before every review)
 
 - [ ] Rebased PR branch on `anvilprod`, squashed fixups from prior reviews
-- [ ] Ran `make requirements_update` <sub>or this PR does not modify `requirements*.txt`, `common.mk`, `Makefile` and `Dockerfile`</sub>
+- [ ] Ran `make requirements_update` <sub>or this PR does not modify `requirements*.txt`, `common.mk`, `Makefile`, `Dockerfile` or `environment.boot`</sub>
 - [ ] Added `R` tag to commit title <sub>or this PR does not modify `requirements*.txt`</sub>
 - [ ] This PR is labeled `reqs` <sub>or does not modify `requirements*.txt`</sub>
+- [ ] PR is not a draft
+- [ ] PR is awaiting requested review from system administrator
+- [ ] Status of PR is *Review requested*
+- [ ] PR is assigned to only the system administrator
 
 
 ### System administrator (after approval)
@@ -40,34 +45,48 @@ Connected issue: #0000
 - [ ] Decided if PR can be labeled `no sandbox`
 - [ ] A comment to this PR details the completed security design review
 - [ ] PR title is appropriate as title of merge commit
-- [ ] Moved connected issue to *Approved* column
+- [ ] Status of PR is *Approved*
 - [ ] PR is assigned to only the operator
 
 
-### Operator (before pushing merge the commit)
+### Operator
 
 - [ ] Squashed PR branch and rebased onto `anvilprod`
 - [ ] Sanity-checked history
 - [ ] Pushed PR branch to GitHub
+
+
+### Operator (deploy runner image)
+
+- [ ] Ran `_select anvilprod.gitlab && make -C terraform/gitlab/runner` <sub>or this PR is not labeled `deploy:runner`</sub>
+
+
+### Operator (sandbox build)
+
 - [ ] Added `sandbox` label <sub>or PR is labeled `no sandbox`</sub>
 - [ ] Pushed PR branch to GitLab `anvilprod` <sub>or PR is labeled `no sandbox`</sub>
 - [ ] Build passes in `hammerbox` deployment <sub>or PR is labeled `no sandbox`</sub>
 - [ ] Reviewed build logs for anomalies in `hammerbox` deployment <sub>or PR is labeled `no sandbox`</sub>
+
+
+### Operator (merge the branch)
+
 - [ ] All status checks passed and the PR is mergeable
 - [ ] The title of the merge commit starts with the title of this PR
 - [ ] Added PR # reference to merge commit title
 - [ ] Collected commit title tags in merge commit title <sub>but excluded any `p` tags</sub>
-- [ ] Moved connected issue to *Merged stable* column in ZenHub
 - [ ] Pushed merge commit to GitHub
+- [ ] Status of PR is *Merged stable*
 
 
-### Operator (after pushing the merge commit)
+### Operator (main build)
 
 - [ ] Pushed merge commit to GitLab `anvilprod`
 - [ ] Build passes on GitLab `anvilprod`
 - [ ] Reviewed build logs for anomalies on GitLab `anvilprod`
 - [ ] Deleted PR branch from GitHub
 - [ ] Deleted PR branch from GitLab `anvilprod`
+- [ ] Status of linked issue is *Stable*
 
 
 ### Operator (reindex)

@@ -2,25 +2,25 @@
 This is the PR template for a promotion PR against `anvilprod`.
 -->
 
-Connected issue: #0000
+Linked issue: #0000
 
 
 ## Checklist
 
 
 ### Author
 
+- [ ] PR is assigned to the author
 - [ ] Target branch is `anvilprod`
 - [ ] Name of PR branch matches `promotions/yyyy-mm-dd-anvilprod`
-- [ ] On ZenHub, PR is connected to the promotion issue it resolves
+- [ ] PR is linked to the promotion issue it resolves
 - [ ] PR description links to connected issue
-- [ ] Title of connected issue matches `Promotion yyyy-mm-dd`
-- [ ] PR title starts with title of connected issue followed by ` anvilprod`
-- [ ] PR title references the connected issue
-- [ ] The promoted issues are part of the same sprint as the connected issue
+- [ ] Title of linked issue matches `Promotion yyyy-mm-dd`
+- [ ] PR title starts with title of linked issue followed by ` anvilprod`
+- [ ] PR title references the linked issue
 
 
-### Author (reindex, API changes)
+### Author (reindex)
 
 - [ ] This PR is labeled `reindex:anvilprod` <sub>or the changes introduced by it will not require reindexing of `anvilprod`</sub>
 - [ ] This PR is labeled `reindex:partial` and its description documents the specific reindexing procedure for `anvilprod` <sub>or requires a full reindex or is not labeled`reindex:anvilprod`</sub>
@@ -37,57 +37,79 @@ Connected issue: #0000
 ### Author (before every review)
 
 - [ ] PR branch is up to date (if not, merge `anvilprod` into PR branch to integrate upstream changes)
+- [ ] PR is not a draft
+- [ ] PR is awaiting requested review from system administrator
+- [ ] Status of PR is *Review requested*
+- [ ] PR is assigned to only the system administrator
 
 
 ### System administrator (after approval)
 
 - [ ] Actually approved the PR
 - [ ] Decided if PR can be labeled `no sandbox`
-- [ ] Moved connected issue to *Approved* column
+- [ ] Status of PR is *Approved*
 - [ ] PR is assigned to only the operator
 
 
-### Operator (before pushing merge the commit)
+### Operator
 
 - [ ] Pushed PR branch to GitHub
+
+
+### Operator (deploy `.shared` and `.gitlab` components)
+
 - [ ] Ran `_select anvilprod.shared && CI_COMMIT_REF_NAME=anvilprod make -C terraform/shared apply_keep_unused` <sub>or this PR is not labeled `deploy:shared`</sub>
 - [ ] Ran `_select anvilprod.gitlab && python scripts/create_gitlab_snapshot.py --no-restart` (see [operator manual](../blob/develop/OPERATOR.rst#backup-gitlab-volumes) for details) <sub>or this PR is not labeled `backup:gitlab`</sub>
 - [ ] Ran `_select anvilprod.gitlab && CI_COMMIT_REF_NAME=anvilprod make -C terraform/gitlab apply` <sub>or this PR is not labeled `deploy:gitlab`</sub>
 - [ ] Checked the items in the next section <sub>or this PR is labeled `deploy:gitlab`</sub>
 - [ ] PR is assigned to only the system administrator <sub>or this PR is not labeled `deploy:gitlab`</sub>
 
 
-### System administrator
+### System administrator (post-deploy of `.gitlab` component)
 
 - [ ] Background migrations for [`anvilprod.gitlab`](https://gitlab.explore.anvilproject.org/admin/background_migrations) are complete <sub>or this PR is not labeled `deploy:gitlab`</sub>
 - [ ] PR is assigned to only the operator
 
 
-### Operator (before pushing merge the commit)
+### Operator (deploy runner image)
 
 - [ ] Ran `_select anvilprod.gitlab && make -C terraform/gitlab/runner` <sub>or this PR is not labeled `deploy:runner`</sub>
+
+
+### Operator (sandbox build)
+
 - [ ] Added `sandbox` label <sub>or PR is labeled `no sandbox`</sub>
 - [ ] Pushed PR branch to GitLab `anvilprod` <sub>or PR is labeled `no sandbox`</sub>
 - [ ] Build passes in `hammerbox` deployment <sub>or PR is labeled `no sandbox`</sub>
 - [ ] Reviewed build logs for anomalies in `hammerbox` deployment <sub>or PR is labeled `no sandbox`</sub>
+
+
+### Operator (merge the branch)
+
 - [ ] All status checks passed and the PR is mergeable
 - [ ] The title of the merge commit starts with the title of this PR
 - [ ] Added PR # reference to merge commit title
 - [ ] Collected commit title tags in merge commit title <sub>but excluded any `p` tags</sub>
 - [ ] Pushed merge commit to GitHub
+- [ ] Status of PR is *Merged stable*
 
 
-### Operator (after pushing the merge commit)
+### Operator (main build)
 
 - [ ] Pushed merge commit to GitLab `anvilprod`
 - [ ] Build passes on GitLab `anvilprod`
 - [ ] Reviewed build logs for anomalies on GitLab `anvilprod`
 - [ ] Ran `_select anvilprod.shared && make -C terraform/shared apply` <sub>or this PR is not labeled `deploy:shared`</sub>
 - [ ] Deleted PR branch from GitHub
 - [ ] Deleted PR branch from GitLab `anvilprod`
-- [ ] Moved connected issue to *Merged stable* column on ZenHub
-- [ ] Moved promoted issues from *Merged lower* to *Merged stable* column on ZenHub
-- [ ] Moved promoted issues from *Lower* to *Stable* column on ZenHub
+- [ ] Status of linked issue is *Stable*
+- [ ] Status of promoted<sup>1</sup> PRs is *Merged stable*
+- [ ] Status of promoted<sup>1</sup> issues is *Stable*
+
+<sup>1</sup> Promoted issues and PRs are referenced in the titles of the commits
+that the promotion branch introduces to the stable branch. Prior to the
+promotion, the status of promoted issues (PRs) is *Lower* (*Merged lower*).
+Promoted PRs in status *Done* do not need to be moved.
 
 
 ### Operator (reindex)