feat: migrate to harvest v3

[nathanclairmonte]

Done

• Replaced Harvest with a new HarvestV3 client
• Rebuilt the candidate dashboard in webapp/application.py using v3
• Rebuilt the job application form from v3 questions
• Normalised withdrawal reasons behind _resolve_withdrawal_reason, so "Other" maps to a real rejection reason id and invalid ids are rejected with a 400.
• Renamed HARVEST_API_KEY to HARVEST_V3_CLIENT_ID and HARVEST_V3_CLIENT_SECRET across .env, docs, and site vars
• Updated the greenhouse, app, and application tests, and deleted the stale job post cassette

QA

• Check out this feature branch
• Run the site using the command dotrun
• View the site locally in your web browser at: http://0.0.0.0:8002/
• Ensure GREENHOUSE_DEBUG env var is set to true
• Open an active job detail page (e.g. localhost:8002/careers/8142329) and compare it with the live prod version. Ensure no differences or gaps.
• Open an active candidate dash (e.g. localhost:8002/careers/application/gAAAAABqjbmn56GEEx6pnwXpUxpe1Oiz32z1bbdt_chvEz8ru88aBm1Edf_IYP4R_ZM0KPPQyiueL_84y7pK7he-CGerxb2zsQ==) and compare it with the live prod version. Ensure no differences or gaps. (N.B. HL description was not displaying before, but after this v3 change it shows up now so that should be expected).
• On the candidate dash, open the withdrawal modal.
• First, enter a random incorrect email, select "Other" for the reason, and click withdraw. You should see an error mentioning that the incorrect email was used.
• Then, enter the correct email (nathan.clairmonte+ly@canonical.com for this candidate), select "Other" for the reason, and click withdraw. You should now see the email that would have been sent to the candidate if debug mode were off.

[webteam-app]

Demo

Jenkins

demos.haus

[codecov]

Codecov Report

❌ Patch coverage is 82.87293% with 62 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.86%. Comparing base (2166cc8) to head (4cc544c).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
webapp/application.py	78.49%	40 Missing ⚠️
webapp/greenhouse.py	86.30%	20 Missing ⚠️
webapp/app.py	93.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2891      +/-   ##
==========================================
+ Coverage   74.14%   74.86%   +0.71%     
==========================================
  Files          19       19              
  Lines        2352     2566     +214     
==========================================
+ Hits         1744     1921     +177     
- Misses        608      645      +37     

Flag	Coverage Δ
python	74.86% <82.87%> (+0.71%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR migrates Canonical’s /careers integration from the legacy Harvest v1 API-key client to a new Harvest v3 client (OAuth2 client-credentials), updating the job details/application flow and candidate dashboard logic to consume v3 resources and question models. It also renames environment variables across local/CI/deploy configuration and updates test coverage accordingly.

Changes:

• Introduces a new HarvestV3 client with bearer-token auth + caching, and updates all call sites to use it.
• Rebuilds the job application form model from Harvest v3 questions, including multi-select submission handling.
• Updates application withdrawal handling (reason normalization + validation) and refreshes unit tests/fixtures and environment configuration.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
webapp/greenhouse.py	Adds Harvest v3 OAuth client, token cache, v3 list/pagination helpers, and multi-select payload normalization for job applications.
webapp/application.py	Reworks candidate dashboard data assembly and withdrawal flow to use Harvest v3 endpoints and normalized withdrawal reasons.
webapp/app.py	Switches job details to Harvest v3, builds the new question model for the application form, and adjusts location/is_remote handling.
templates/careers/job-detail.html	Renders the new application_questions model and updates JSON-LD location/datePosted behavior.
templates/careers/base_job-details.html	Updates location rendering to match the new job.location shape.
templates/careers/application/index.html	Adapts dashboard template to new v3 fields (source_id, applications, updated custom field keys) and withdrawal UI behavior.
templates/careers/application/_withdrawal-form.html	Adds a data attribute to drive “Other” withdrawal reason display without hardcoding the value.
templates/careers/application/_activate-email.html	Makes the hiring lead signature resilient when hiring lead data is missing.
tests/test_greenhouse.py	Replaces Harvest v1 tests with Harvest v3 auth/client tests and adds coverage for multi-select payload handling.
tests/test_application.py	Updates dashboard/withdrawal tests for v3 data shapes and withdrawal reason normalization behavior.
tests/test_app.py	Adds tests for v3 question-model building and updates location/is_remote expectations.
tests/cassettes/TestApplicationPageHelpers.test_job_post_page.yaml	Removes stale cassette tied to Harvest v1 job post fetching.
README.md	Updates local setup docs to require v3 client credentials env vars.
konf/site.yaml	Renames deployed env vars/secrets from Harvest API key to v3 client credentials.
AGENTS.md	Updates the Careers env var documentation to the v3 client credential names.
.github/workflows/pr.yaml	Updates CI env vars to provide v3 client credentials.
.github/workflows/deploy.yaml	Updates deploy workflow env vars to provide v3 client credentials.
.env	Renames the local env var placeholders to v3 client credentials.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.