Merge main and address CI runtime review feedback

Author: krowvin

.github/workflows/CDA-testing.yml

@@ -9,10 +9,39 @@ on:
 
 jobs:
   integration-tests:
+    name: integration-tests (Python ${{ matrix.python-version }}, CDA ${{ matrix.cda.name }},
+      schema ${{ matrix.schema.name }})
     runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    strategy:
+      fail-fast: false
+      max-parallel: 6
+      matrix:
+        python-version: ['3.9', '3.13']
+        # Keep the release pins in sync with the environments (see CONTRIBUTING.md).
+        cda:
+          - name: latest
+            image: ghcr.io/usace/cwms-data-api:develop-nightly
+          - name: production
+            image: ghcr.io/usace/cwms-data-api:2026.05.12-i
+          - name: test
+            image: ghcr.io/usace/cwms-data-api:2026.08.31-testd
+        schema:
+          - name: latest
+            tag: latest-dev
+          - name: production
+            tag: '26.02.17'
+          - name: test
+            tag: 26.07.16-RC02
+
+    env:
+      CWMS_DATA_API_IMAGE: ${{ matrix.cda.image }}
+      CWMS_DATABASE_IMAGE: ghcr.io/hydrologicengineeringcenter/cwms-database/cwms/database-ready-ora-23.5:${{ matrix.schema.tag }}
+      CWMS_SCHEMA_INSTALLER_IMAGE: ghcr.io/hydrologicengineeringcenter/cwms-database/cwms/schema_installer:${{ matrix.schema.tag }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Clean up disk space, so we don't run out.
         if: runner.os == 'Linux'
@@ -24,12 +53,13 @@ jobs:
       - name: Set up backend
         run: |
           docker compose pull
-          docker compose up -d
+          docker compose up -d --wait --wait-timeout 2400
 
       - name: Set Up Python
+        id: setup-python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.9.X'
+          python-version: ${{ matrix.python-version }}
 
       # Use actions-poetry to handle installation
       - name: Install Poetry and Dependencies
@@ -41,11 +71,12 @@ jobs:
 
           # Poetry will handle installation and caching
       - name: Cache Python dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         id: cache-poetry-venv
         with:
           path: .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
+          key: ${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-poetry-${{
+            hashFiles('poetry.lock') }}
 
       # Install dependencies only if cache is missed
       - name: Install dependencies
@@ -72,3 +103,11 @@ jobs:
           file: ./code-coverage-results.md
           vars: |-
             empty: empty
+
+      - name: Show backend logs on failure
+        if: failure()
+        run: docker compose logs --no-color --tail 200
+
+      - name: Stop test backend
+        if: always()
+        run: docker compose down --volumes

.github/workflows/code-check.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       # Verify that python files are formatted using black and isort. Both of the actions
       # below simply check the source code and fail if they find any files that need to be

.github/workflows/codeql.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/pypi-deploy.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set Up Python
         uses: actions/setup-python@v6
@@ -23,7 +23,7 @@ jobs:
         uses: abatilo/actions-poetry@v4
 
       - name: Cache Virtual Environment
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ./.venv
           key: venv-${{ hashFiles('poetry.lock') }}
@@ -92,7 +92,7 @@ jobs:
           path: dist/
 
       - name: Sign Distribution
-        uses: sigstore/gh-action-sigstore-python@v3.3.0
+        uses: sigstore/gh-action-sigstore-python@v3.4.0
         with:
           inputs: |
             ./dist/*.tar.gz

.github/workflows/test-deploy.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set Up Python
         uses: actions/setup-python@v6
@@ -30,7 +30,7 @@ jobs:
         uses: abatilo/actions-poetry@v4
 
       - name: Cache Virtual Environment
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ./.venv
           key: venv-${{ hashFiles('poetry.lock') }}

.github/workflows/testing.yml

@@ -9,23 +9,25 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set Up Python
+        id: setup-python
         uses: actions/setup-python@v6
         with:
-          python-version: '3.12'
+          python-version: '3.13'
 
       # Unlike the code-check workflow, this job requires the dev dependencies to be
       # installed to make sure we have the necessary, tools, stub files, etc.
       - name: Install Poetry
         uses: abatilo/actions-poetry@v4
 
       - name: Cache Virtual Environment
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: ./.venv
-          key: ${{ runner.os }}-py3.12-venv-${{ hashFiles('poetry.lock') }}
+          key: ${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-venv-${{
+            hashFiles('poetry.lock') }}
 
       - name: Install Dependencies
         run: poetry install

CONTRIBUTING.md

@@ -79,6 +79,46 @@ passed, bearer token auth takes precedence.
 
     > **Note:** If you are running other instances of CDA or Oracle on your machine, they may use different ports. Always verify which ports are in use and update your configuration files accordingly to avoid conflicts.
 
+    #### Selecting CDA and Database Versions
+
+    Local Compose defaults to CDA `develop-nightly` and database/schema-installer
+    `latest-dev`. Override the image references in a local, uncommitted `.env`
+    file when reproducing a particular environment, for example:
+
+    ```dotenv
+    CWMS_DATA_API_IMAGE=ghcr.io/usace/cwms-data-api:2026.05.12-i
+    CWMS_DATABASE_IMAGE=ghcr.io/hydrologicengineeringcenter/cwms-database/cwms/database-ready-ora-23.5:26.02.17
+    CWMS_SCHEMA_INSTALLER_IMAGE=ghcr.io/hydrologicengineeringcenter/cwms-database/cwms/schema_installer:26.02.17
+    ```
+
+    Keep the database and schema-installer tags together. Use a separate Compose
+    project for each database version, so the test data and containers are isolated:
+
+    ```sh
+    docker compose -p cwms-python-release pull
+    docker compose -p cwms-python-release up -d --wait --wait-timeout 2400
+    ```
+
+    Use the same project name for subsequent `ps`, `logs`, and `down` commands.
+    Stop the previous stack before starting another one using the same host ports.
+
+    The integration workflow in `.github/workflows/CDA-testing.yml` tests every
+    combination of three CDA images and three database versions on Python 3.9
+    and 3.13 (18 jobs):
+
+    | Lane | CDA tag | Database and schema-installer tag |
+    | --- | --- | --- |
+    | latest | `develop-nightly` | `latest-dev` |
+    | production | `2026.05.12-i` | `26.02.17` |
+    | test | `2026.08.31-testd` | `26.07.16-RC02` |
+
+    These release pins are maintained in the workflow; update them when the
+    target environments change. CDA and database are independent matrix axes,
+    so testing includes mixed versions, not only the three same-lane pairs.
+    Each job starts a disposable local stack, waits for backend health, and
+    uses the hashed test keys seeded by `compose_files/sql/users.sql`. CI never
+    runs these destructive integration tests against the deployed environments.
+
 3. **Run Tests Against CDA**  
     Once the services are running, execute the tests:
     ```sh

compose_files/sql/users.sql

@@ -1,58 +1,56 @@
 set define on
 define OFFICE_EROC=&1
+declare
+    type office_list_t is table of varchar2(16);
+
+    procedure add_full_admin(p_user varchar2, p_offices office_list_t) is
+    begin
+        for i in 1 .. p_offices.count loop
+            cwms_sec.add_cwms_user(p_user, NULL, p_offices(i));
+            cwms_sec.add_user_to_group(p_user, 'All Users',        p_offices(i));
+            cwms_sec.add_user_to_group(p_user, 'CWMS Users',       p_offices(i));
+            cwms_sec.add_user_to_group(p_user, 'TS ID Creator',    p_offices(i));
+            cwms_sec.add_user_to_group(p_user, 'CWMS User Admins', p_offices(i));
+            cwms_sec.add_user_to_group(p_user, 'CWMS PD Users',    p_offices(i));
+        end loop;
+    end;
 begin
     cwms_sec.add_user_to_group('&&OFFICE_EROC.webtest','All Users', 'HQ');
     cwms_sec.add_user_to_group('&&OFFICE_EROC.webtest','All Users', 'SPK');
+    cwms_sec.add_user_to_group('&&OFFICE_EROC.webtest','All Users', 'MVP');
+    cwms_sec.add_user_to_group('&&OFFICE_EROC.webtest','All Users', 'LRL');
     cwms_sec.add_user_to_group('&&OFFICE_EROC.webtest','CWMS Users', 'HQ');
     cwms_sec.add_user_to_group('&&OFFICE_EROC.webtest','CWMS User Admins', 'HQ');
-    
+    cwms_sec.add_user_to_group('&&OFFICE_EROC.webtest','CWMS PD Users', 'HQ');
 
-    cwms_sec.add_cwms_user('l2hectest',NULL,'SPK');
-    cwms_sec.update_edipi('l2hectest',1234567890);
-    cwms_sec.add_user_to_group('l2hectest','All Users', 'SPK');
-    cwms_sec.add_user_to_group('l2hectest','CWMS Users', 'SPK');
-    cwms_sec.add_user_to_group('l2hectest','TS ID Creator','SPK');
-    cwms_sec.add_user_to_group('l2hectest','CWMS User Admins', 'SPK');
+    add_full_admin('l2hectest', office_list_t('SPK'));
+    cwms_sec.update_edipi('l2hectest', 1234567890);
 
-    cwms_sec.add_cwms_user('l1hectest',NULL,'SPL');
+    cwms_sec.add_cwms_user('l1hectest', NULL, 'SPL');
     -- intentionally no extra permissions.
-    --cwms_sec.add_user_to_group('l2hectest','CWMS Users', 'SPL');
 
-    cwms_sec.add_cwms_user('m5hectest',NULL,'SWT');
+    cwms_sec.add_cwms_user('m5hectest', NULL, 'SWT');
     cwms_sec.add_user_to_group('m5hectest','All Users', 'SWT');
     cwms_sec.add_user_to_group('m5hectest','CWMS Users', 'SWT');
     execute immediate 'grant execute on cwms_20.cwms_upass to web_user';
 
-
     cwms_sec.add_cwms_user('m5testadmin', NULL, 'LRL');
     cwms_sec.add_user_to_group('m5testadmin','All Users', 'LRL');
     cwms_sec.add_user_to_group('m5testadmin','CWMS Users', 'LRL');
     cwms_sec.add_user_to_group('m5testadmin','CWMS User Admins', 'LRL');
+    cwms_sec.add_user_to_group('m5testadmin','CWMS PD Users', 'LRL');
+
+    add_full_admin('q0hectest', office_list_t('LRL', 'SPK', 'MVP'));
 
-    cwms_sec.add_cwms_user('q0hectest', NULL, 'LRL');
-    cwms_sec.add_user_to_group('q0hectest','All Users', 'LRL');
-    cwms_sec.add_user_to_group('q0hectest','CWMS Users', 'LRL');
-    cwms_sec.add_user_to_group('q0hectest','TS ID Creator','LRL');
-    cwms_sec.add_user_to_group('q0hectest','CWMS User Admins', 'LRL');
-
-    cwms_sec.add_cwms_user('q0hectest', NULL, 'SPK');
-    cwms_sec.add_user_to_group('q0hectest','All Users', 'SPK');
-    cwms_sec.add_user_to_group('q0hectest','CWMS Users', 'SPK');
-    cwms_sec.add_user_to_group('q0hectest','TS ID Creator','SPK');
-    cwms_sec.add_user_to_group('q0hectest','CWMS User Admins', 'SPK');
-
-    cwms_sec.add_cwms_user('q0hectest', NULL, 'MVP');
-    cwms_sec.add_user_to_group('q0hectest','All Users', 'MVP');
-    cwms_sec.add_user_to_group('q0hectest','CWMS Users', 'MVP');
-    cwms_sec.add_user_to_group('q0hectest','TS ID Creator','MVP');
-    cwms_sec.add_user_to_group('q0hectest','CWMS User Admins', 'MVP');
-
-    insert into cwms_20.at_api_keys (userid, key_name, apikey) values ('Q0HECTEST', 'testkey', '0123456789abcdef0123456789abcdef');
-    insert into cwms_20.at_api_keys (userid, key_name, apikey) values ('L2HECTEST', 'testkey2', '1234567890abcdef1234567890abcdef');
+    insert into cwms_20.at_api_keys (userid, key_name, apikey, created, expires) values ('Q0HECTEST', 'testkey', 'ak1_CYflBX6c$argon2id$v=19$m=19456,t=2,p=1$8Wh8X9m+O81UvrbCJ/eOFQ$+E0Rp3jhjduIHxaqmzx+OLR43B3HdcMuDyn8cO5/69s', sysdate, sysdate + 365);
+    -- key is  ak1_CYflBX6cQOHlJkkcsA6NPvJ7npm1kynzfUsa45ncIPcGNewkcvK2ounQN8MaDj8Wkc8o0HiZvLkETpGrGkl3OvJD9Nt0vQCIPLBeqQiLGBQHsPDZmk1gEkVCzubSyfKy31bagcf0jrajn6zCcRAv1tpMpnucFCkUwCpTYwNCfCnPkqukNVpOyTv7I2II8NIxBQmQOZPc09yOrKPkQpj1sHM4NNxIcUfTZrPpidT1QGjhfVaaWW1AiqodkxXPxlTqvuRLz9bL
+
+    insert into cwms_20.at_api_keys (userid, key_name, apikey, created, expires) values ('L2HECTEST', 'testkey2', 'ak1_3rF3RXlB$argon2id$v=19$m=19456,t=2,p=1$xxL2ItUkn3gC1LT5F8Wb0g$2az8A0GpJVVhbaccD4ICVWvnM2uoKzU652r9jemE9qg', sysdate, sysdate + 365);
+    -- key is   ak1_3rF3RXlBRpWiWNdBhrX5LwNnbwyPX7J9MDro8b3aoRVp2bM4FRZPsOZOoFtjVuwt9bNnniWqzIaCfTzKNUqdp43ItSk7oFLdqf05gVhM5UtaLZa2BN7KNdb7hSxYu6FQJkt8haSQK3swUaC9qlRFLIPMerbjxxIF8UnuQ7Oe54uyiN7JJaaHErI0m7qo7ir2bkxHvC0aWw9UkT9Z8RKfWeaQBIizqZnicqmXgsekLvqwkZ2jJrLUw180aFr5g7rCEsRtVtRE
     -- Non-admin API key for the L1 with reduced permissions
     -- Used by CDA user-management tests that verify 403 handling
-    insert into cwms_20.at_api_keys (userid, key_name, apikey) values ('L1HECTEST', 'non_admin_test_key', 'fedcba9876543210fedcba9876543210');
-
+    insert into cwms_20.at_api_keys (userid, key_name, apikey, created, expires) values ('L1HECTEST', 'non_admin_test_key', 'ak1_SZUNxN3n$argon2id$v=19$m=19456,t=2,p=1$KAlZGdgEboEHvEVcpNGD0g$pPCCkQfOx8v5HNpwPadJNUHGI0I40a7HgcZ7JsTE6T0', sysdate, sysdate + 365);
+    -- key is  ak1_SZUNxN3nDx0NpUfOJxpOuGqbqRKdYjbx86x6YVISLb9DiBi3Io5o6T6UFvkHknjIRnRO6oQfA1q6rP4XRDYMH9Hlr4ndffL6NjxPUaBZLSnqukV0uGuZKOUWBB04L5SyloJniOHkFe6ymvB9tzeziGYwzrDv3k6lzacG9vftHkCHB1QbjwwCC0sDkFvuwCe9qnyx5us11qL0YAfKXhe0fBCA2TmNDz8WXfw1HfBnAKx6WD7KqHngplWu4miOvkNverxFmAdJ
 end;
 /
 quit;

compose_files/togglz/features.properties

@@ -10,6 +10,7 @@
 from cwms.levels.specified_levels import *
 from cwms.locations.gate_changes import *
 from cwms.locations.location_groups import *
+from cwms.locations.lookups import *
 from cwms.locations.physical_locations import *
 from cwms.measurements.measurements import *
 from cwms.outlets.outlets import *
@@ -18,6 +19,7 @@
 from cwms.projects.project_locks import *
 from cwms.projects.projects import *
 from cwms.projects.water_supply.accounting import *
+from cwms.properties.properties import *
 from cwms.ratings.ratings import *
 from cwms.ratings.ratings_spec import *
 from cwms.ratings.ratings_template import *