Merge branch 'main' of https://github.com/NASA-PDS/registry

Author: thomas loubrieu

.github/workflows/automated-testing.yaml

@@ -14,10 +14,10 @@ jobs:
         steps:
             -
                 name: Checkout Repository
-                uses: actions/checkout@v4
+                uses: actions/checkout@v5
             -
                 name: ☕️ Set up OpenJDK
-                uses: actions/setup-java@v4
+                uses: actions/setup-java@v5
                 with:
                     distribution: 'adopt'
                     java-version: '11'

.github/workflows/branch-cicd.yaml

@@ -33,16 +33,16 @@ jobs:
         steps:
             -
                 name: 💳 Checkout
-                uses: actions/checkout@v4
+                uses: actions/checkout@v5
                 with:
                     lfs: true
                     fetch-depth: 0
                     token: ${{secrets.ADMIN_GITHUB_TOKEN || github.token}}
             -
                 name: Set up Python 3
-                uses: actions/setup-python@v5
+                uses: actions/setup-python@v6
                 with:
-                    python-version: '3.9'
+                    python-version: '3.13'
             -
                 name: 💵 Python Cache
                 uses: actions/cache@v4

.github/workflows/codeql-analysis.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
@@ -73,7 +73,7 @@ jobs:
 
 
     - name: Upload CodeQL Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: codeql-artifacts
         path: ${{ env.RESULTS_DIR }}
@@ -85,7 +85,7 @@ jobs:
       steps:
           -
               name: 💳 Checkout
-              uses: actions/checkout@v4
+              uses: actions/checkout@v5
               with:
                   lfs: true
                   fetch-depth: 0
@@ -100,7 +100,7 @@ jobs:
 
           -
             name: Upload SLOC
-            uses: actions/upload-artifact@v4
+            uses: actions/upload-artifact@v5
             with:
               name: sloc-count
               path: ${{ github.workspace }}/cloc.md

.github/workflows/issue-project-automation.yml

@@ -0,0 +1,35 @@
+name: Issue Project Automation
+
+on:
+  issues:
+    types: [opened, labeled, unlabeled]
+
+jobs:
+  # When an issue is opened, add it to default project(s)
+  add-new-issue-to-project:
+    if: github.event.action == 'opened'
+    uses: NASA-PDS/.github/.github/workflows/add-issue-to-project.yml@main
+    with:
+      issue_number: ${{ github.event.issue.number }}
+      repository: ${{ github.repository }}
+      # Update project_numbers below based on your needs
+      # Single project: project_numbers: "6"
+      # Multiple projects: project_numbers: "6,22"
+      project_numbers: "6"
+    secrets:
+      # IMPORTANT: GITHUB_TOKEN does not have permission for org projects
+      # You must create a PAT with 'project' scope and add it as ORG_PROJECT_PAT
+      # See workflow-templates/README.md for setup instructions
+      gh_token: ${{ secrets.ORG_PROJECT_PAT }}
+
+  # When a label is added or removed, handle build labels and sprint-backlog automation
+  handle-label:
+    if: github.event.action == 'labeled' || github.event.action == 'unlabeled'
+    uses: NASA-PDS/.github/.github/workflows/label-to-project.yml@main
+    with:
+      issue_number: ${{ github.event.issue.number }}
+      repository: ${{ github.repository }}
+      label_name: ${{ github.event.label.name }}
+      action: ${{ github.event.action }}
+    secrets:
+      gh_token: ${{ secrets.ORG_PROJECT_PAT }}

.github/workflows/stable-cicd.yaml

@@ -48,7 +48,7 @@ jobs:
         steps:
             -
                 name: 💳 Checkout
-                uses: actions/checkout@v4
+                uses: actions/checkout@v5
                 with:
                     lfs: true
                     token: ${{secrets.ADMIN_GITHUB_TOKEN}}

.github/workflows/unstable-cicd.yaml

@@ -49,7 +49,7 @@ jobs:
         steps:
             -
                 name: 💳 Checkout
-                uses: actions/checkout@v4
+                uses: actions/checkout@v5
                 with:
                     lfs: true
                     fetch-depth: 0
@@ -76,6 +76,11 @@ jobs:
                     ossrh_password: ${{secrets.OSSRH_PASSWORD}}
                     CODE_SIGNING_KEY: ${{secrets.CODE_SIGNING_KEY}}
                     ADMIN_GITHUB_TOKEN: ${{secrets.ADMIN_GITHUB_TOKEN}}
+            -
+                name: 🛏️ Upload Coverage
+                uses: SonarSource/sonarqube-scan-action@v6
+                env:
+                    SONAR_TOKEN: ${{secrets.SONAR_TOKEN}}
 
 ...
 

.gitignore

@@ -78,6 +78,7 @@ typescript
 .gwt/
 target/
 build/
+*.vscode/
 
 # macOS specific stuff
 .DS_Store
@@ -87,9 +88,12 @@ build/
 test-data/
 .venv
 *.egg-info
+.coverage
+coverage.xml
 
 # Python virtual environment
 venv/
+.tox/
 
 # Certificate files
 *.pem

CHANGELOG.md

@@ -1,21 +1,51 @@
 # Changelog
 
-## [«unknown»](https://github.com/NASA-PDS/registry/tree/«unknown») (2025-02-13)
+## [«unknown»](https://github.com/NASA-PDS/registry/tree/«unknown») (2025-11-06)
 
-[Full Changelog](https://github.com/NASA-PDS/registry/compare/v1.3.1...«unknown»)
+[Full Changelog](https://github.com/NASA-PDS/registry/compare/v1.4.0...«unknown»)
 
 **Requirements:**
 
+- As a user, I want to receive an alert when my registry credentials are readable by someone else than myself [\#424](https://github.com/NASA-PDS/registry/issues/424)
+- As a node operator, I want the the registry schema to update autonomously / dynamically when new data is ingested. [\#113](https://github.com/NASA-PDS/registry/issues/113)
+
+**Defects:**
+
+- Some of product urn:nasa:pds:lro\_diviner\_derived2::1.0's fields are not indexed [\#422](https://github.com/NASA-PDS/registry/issues/422) [[s.high](https://github.com/NASA-PDS/registry/labels/s.high)]
+- Error `FIPS mode: only SunJSSE TrustManagers may be used` [\#440](https://github.com/NASA-PDS/registry/issues/440) [[s.high](https://github.com/NASA-PDS/registry/labels/s.high)]
+- Registry is not accepting date time with leap second, e.g. `2015-06-30T23:59:60.862Z` [\#404](https://github.com/NASA-PDS/registry/issues/404) [[s.high](https://github.com/NASA-PDS/registry/labels/s.high)]
+- members of GEO bundle/collection collection not found [\#403](https://github.com/NASA-PDS/registry/issues/403) [[s.high](https://github.com/NASA-PDS/registry/labels/s.high)]
+- CSV response not returning the values associated with `fields` argument [\#380](https://github.com/NASA-PDS/registry/issues/380) [[s.medium](https://github.com/NASA-PDS/registry/labels/s.medium)]
+- product has date for sweeper index but is listed as not indexed [\#375](https://github.com/NASA-PDS/registry/issues/375) [[s.medium](https://github.com/NASA-PDS/registry/labels/s.medium)]
+
+**Other closed issues:**
+
+- Troubleshoot SBN 403 Error [\#414](https://github.com/NASA-PDS/registry/issues/414)
+- Add the --legacy-sync command option to the EN sweeper in production [\#390](https://github.com/NASA-PDS/registry/issues/390)
+
+## [v1.4.0](https://github.com/NASA-PDS/registry/tree/v1.4.0) (2025-07-16)
+
+[Full Changelog](https://github.com/NASA-PDS/registry/compare/v1.3.1...v1.4.0)
+
+**Requirements:**
+
+- As a node user, I want to have multiple cognito groups and still have the main cognito node group to be effective [\#396](https://github.com/NASA-PDS/registry/issues/396)
+- As a user, I want to have read-only access to all registry indexes [\#350](https://github.com/NASA-PDS/registry/issues/350)
 - As a data manager, I want to query OpenSearch Serverless from the command-line [\#273](https://github.com/NASA-PDS/registry/issues/273) [[s.critical](https://github.com/NASA-PDS/registry/labels/s.critical)]
 
 **Improvements:**
 
+- Document the refresh rate of OpenSearch [\#361](https://github.com/NASA-PDS/registry/issues/361)
+- Fix GEO node products which ops:Harvest\_Info/ops:node\_name: geo [\#360](https://github.com/NASA-PDS/registry/issues/360)
 - Recreate PDS EN Registry from scratch and load only necessary data [\#352](https://github.com/NASA-PDS/registry/issues/352)
 - Migrate registry-harvest-service documentation [\#78](https://github.com/NASA-PDS/registry/issues/78)
 
 **Defects:**
 
+- Registry return authorization error for ATM node [\#369](https://github.com/NASA-PDS/registry/issues/369) [[s.critical](https://github.com/NASA-PDS/registry/labels/s.critical)]
+- Update terraform to use port 443 not port 80 [\#365](https://github.com/NASA-PDS/registry/issues/365) [[s.critical](https://github.com/NASA-PDS/registry/labels/s.critical)]
 - Data products duplicated across en-registry and other node registries [\#351](https://github.com/NASA-PDS/registry/issues/351) [[s.high](https://github.com/NASA-PDS/registry/labels/s.high)]
+- Getting "blocked by: maximum OCU capacity reached" errors when harvesting [\#340](https://github.com/NASA-PDS/registry/issues/340) [[s.critical](https://github.com/NASA-PDS/registry/labels/s.critical)]
 - SBN user no longer able to access test registry [\#336](https://github.com/NASA-PDS/registry/issues/336) [[s.critical](https://github.com/NASA-PDS/registry/labels/s.critical)]
 - GEO index does not work, appears to be corrupted [\#331](https://github.com/NASA-PDS/registry/issues/331) [[s.critical](https://github.com/NASA-PDS/registry/labels/s.critical)]
 - AOSS 500/502 responses repeatedly observed under heavy load [\#329](https://github.com/NASA-PDS/registry/issues/329) [[s.high](https://github.com/NASA-PDS/registry/labels/s.high)]
@@ -25,7 +55,12 @@
 
 **Other closed issues:**
 
+- Investigate the opensearch serverless scale out/down parameters [\#397](https://github.com/NASA-PDS/registry/issues/397)
+- Clean test suite to un-skip test skipped after multitenant migration [\#378](https://github.com/NASA-PDS/registry/issues/378)
+- Respond to Registry SIA review from SAs [\#364](https://github.com/NASA-PDS/registry/issues/364)
+- Complete security vulnerability assessment for registry [\#356](https://github.com/NASA-PDS/registry/issues/356)
 - Update Registry configuration to support issues with IMG user\(s\) [\#337](https://github.com/NASA-PDS/registry/issues/337) [[s.critical](https://github.com/NASA-PDS/registry/labels/s.critical)]
+- Document in the wiki how the authorization on opensearch are managed [\#334](https://github.com/NASA-PDS/registry/issues/334)
 - Reindex MCP Prod ATM registry index with corrected mappings [\#339](https://github.com/NASA-PDS/registry/issues/339)
 - Investigate what the number of property per discipline node was at migration time [\#332](https://github.com/NASA-PDS/registry/issues/332)
 - Onboard Irma from ATM node [\#325](https://github.com/NASA-PDS/registry/issues/325)
@@ -211,7 +246,6 @@
 
 **Requirements:**
 
-- As a node operator, I want the the registry schema to update autonomously when new data is ingested. [\#113](https://github.com/NASA-PDS/registry/issues/113)
 - As a developer, I want to include supplemental file data sizes in the registry [\#112](https://github.com/NASA-PDS/registry/issues/112)
 - As a node operator, I want to ingest metadata regarding secondary collections that belong to a bundle. [\#109](https://github.com/NASA-PDS/registry/issues/109)
 - As a node operator, I want to ingest metadata regarding secondary products that belong to a collection. [\#108](https://github.com/NASA-PDS/registry/issues/108)

README.md

@@ -18,6 +18,7 @@ This repository specifically contains these PDS registry application resources:
 
 - the source for the user/administrator documentation, see `docs` folder
 - docker compose script to start/test the full application with its required components, see https://github.com/NASA-PDS/registry/blob/main/docker/README.md for details. This also includes integration tests (in `docker/postman`). The integration test datasets are maintained in NASA-PDS/registry-ref-data repository.
+- **For developers:** See [Integration Testing Guide](https://nasa-pds.github.io/registry/developer/integration-testing.html) for instructions on adding and running integration tests.
 
 
 ## Code of Conduct
@@ -59,6 +60,48 @@ To develop this project, use your favorite text editor, or an integrated develop
 For information on how to contribute to NASA-PDS codebases please take a look at our [Contributing guidelines](https://github.com/NASA-PDS/.github/blob/main/CONTRIBUTING.md).
 
 
+### Installation
+
+Install in editable mode and with extra developer dependencies into your virtual environment of choice:
+
+    pip install --editable '.[dev]'
+
+Make a baseline for any secrets (email addresses, passwords, API keys, etc.) in the repository:
+
+    detect-secrets scan . \
+        --all-files \
+        --disable-plugin AbsolutePathDetectorExperimental \
+        --exclude-files '\.secrets..*' \
+        --exclude-files '\.git.*' \
+        --exclude-files '\.mypy_cache' \
+        --exclude-files '\.pytest_cache' \
+        --exclude-files '\.tox' \
+        --exclude-files '\.venv' \
+        --exclude-files 'venv' \
+        --exclude-files 'dist' \
+        --exclude-files 'build' \
+        --exclude-files '.*\.egg-info' > .secrets.baseline
+
+Review the secrets to determine which should be allowed and which are false positives:
+
+    detect-secrets audit .secrets.baseline
+
+Please remove any secrets that should not be seen by the public. You can then add the baseline file to the commit:
+
+    git add .secrets.baseline
+
+Then, configure the `pre-commit` hooks:
+
+    pre-commit install
+    pre-commit install -t pre-push
+    pre-commit install -t prepare-commit-msg
+    pre-commit install -t commit-msg
+
+These hooks then will check for any future commits that might contain secrets. They also check code formatting, PEP8 compliance, type hints, etc.
+
+👉 **Note:** A one time setup is required both to support `detect-secrets` and in your global Git configuration. See [the wiki entry on Secrets](https://github.com/NASA-PDS/nasa-pds.github.io/wiki/Git-and-Github-Guide#detect-secrets) to learn how.
+
+
 ### Documentation
 
 The project uses [Sphinx](https://www.sphinx-doc.org/en/master/) to build its documentation. PDS' documentation template is already configured as part of the default build. You can build your projects docs with:

diagrams/README.md

@@ -10,9 +10,9 @@ This is an attempt to use [Diagram as Code](https://diagrams.mingrammer.com/) to
 
 - Brew (for MacOS/Linux users)
 - Chocolatey (for Windows users)
-- Python 3.9.0 or higher
+- Python 3.13.0 or higher
 
-> At the time of writing this document, Python 3.9 is the required version for everyone on PDS. Please confirm with project leads to ensure you're using the latest Python version.
+> At the time of writing this document, Python 3.13 is the latest stable version and is recommended for PDS development. Please confirm with project leads to ensure you're using the latest Python version.
 
 ## Providers