Skip to content

bumped metabase image version - #6050

Open
ccampbell-fearless wants to merge 1 commit into
mainfrom
cc/trivy-scans
Open

bumped metabase image version#6050
ccampbell-fearless wants to merge 1 commit into
mainfrom
cc/trivy-scans

Conversation

@ccampbell-fearless

@ccampbell-fearless ccampbell-fearless commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Description of changes

  • update image tags to include version
  • bump metabase from v0.63.16.7 to v0.64.3
  • update docker compose to pull from ghcr instead of dockerhub

@ccampbell-fearless
ccampbell-fearless requested a review from a team as a code owner October 21, 2026 20:06
@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Terraform plan for meta

No changes. Your infrastructure matches the configuration. 
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in Pull Request Checks #1668

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Terraform plan for dev

Plan: 3 to add, 12 to change, 3 to destroy. 
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place
-/+ destroy and then create replacement
 <= read (data resources)

Terraform will perform the following actions:

  # module.dev.cloudfoundry_network_policy.app-network-policy will be updated in-place
!~  resource "cloudfoundry_network_policy" "app-network-policy" {
!~      policies = [
!~          {
!~              destination_app = "d8072c70-27f0-4a45-bd74-39009a88fa04" -> (known after apply)
#                (3 unchanged attributes hidden)
            },
!~          {
!~              destination_app = "8681e03d-155f-4904-9192-0de8e84a5947" -> (known after apply)
#                (3 unchanged attributes hidden)
            },
!~          {
!~              destination_app = "8681e03d-155f-4904-9192-0de8e84a5947" -> (known after apply)
#                (3 unchanged attributes hidden)
            },
        ]
    }

  # module.dev.cloudfoundry_network_policy.clamav-network-policy will be updated in-place
!~  resource "cloudfoundry_network_policy" "clamav-network-policy" {
!~      policies = [
!~          {
!~              destination_app = "d8072c70-27f0-4a45-bd74-39009a88fa04" -> (known after apply)
!~              source_app      = "8681e03d-155f-4904-9192-0de8e84a5947" -> (known after apply)
#                (2 unchanged attributes hidden)
            },
!~          {
!~              destination_app = "d8072c70-27f0-4a45-bd74-39009a88fa04" -> (known after apply)
!~              source_app      = "c3cc6537-e982-4242-ba9a-4339685f808b" -> (known after apply)
#                (2 unchanged attributes hidden)
            },
        ]
    }

  # module.dev.cloudfoundry_network_policy.logshipper-network-policy will be updated in-place
!~  resource "cloudfoundry_network_policy" "logshipper-network-policy" {
!~      policies = [
!~          {
!~              destination_app = "d8072c70-27f0-4a45-bd74-39009a88fa04" -> (known after apply)
!~              source_app      = "92483ac7-d368-43b0-b429-0170e3e2b2c2" -> (known after apply)
#                (2 unchanged attributes hidden)
            },
        ]
    }

  # module.dev.cloudfoundry_network_policy.scanner-network-policy will be updated in-place
!~  resource "cloudfoundry_network_policy" "scanner-network-policy" {
!~      policies = [
!~          {
!~              destination_app = "d8072c70-27f0-4a45-bd74-39009a88fa04" -> (known after apply)
!~              source_app      = "6b49003b-d4ba-4142-9bc3-2ff068124da5" -> (known after apply)
#                (2 unchanged attributes hidden)
            },
!~          {
!~              destination_app = "c3cc6537-e982-4242-ba9a-4339685f808b" -> (known after apply)
!~              source_app      = "6b49003b-d4ba-4142-9bc3-2ff068124da5" -> (known after apply)
#                (2 unchanged attributes hidden)
            },
        ]
    }

  # module.dev.cloudfoundry_service_instance.elasticache[0] will be updated in-place
!~  resource "cloudfoundry_service_instance" "elasticache" {
+       dashboard_url     = (known after apply)
        id                = "b6cc70ad-64f9-4673-8fcf-910910502290"
!~      last_operation    = {
!~          created_at  = "2026-10-13T19:43:59Z" -> (known after apply)
!~          description = "The status is ready" -> (known after apply)
!~          state       = "succeeded" -> (known after apply)
!~          type        = "create" -> (known after apply)
!~          updated_at  = "2026-10-13T19:43:59Z" -> (known after apply)
        } -> (known after apply)
!~      maintenance_info  = {
+           description = (known after apply)
+           version     = (known after apply)
        } -> (known after apply)
!~      name              = "fac-redis" -> "gsa-tts-oros-fac-redis"
!~      updated_at        = "2026-10-13T19:32:56Z" -> (known after apply)
!~      upgrade_available = false -> (known after apply)
#        (5 unchanged attributes hidden)
    }

  # module.dev.module.cg-logshipper.cloudfoundry_app.logshipper_app will be updated in-place
!~  resource "cloudfoundry_app" "logshipper_app" {
!~      created_at                  = "2025-04-21T18:47:16Z" -> (known after apply)
!~      enable_ssh                  = false -> (known after apply)
!~      id                          = "************************************" -> (known after apply)
!~      log_rate_limit_per_second   = "-1" -> (known after apply)
        name                        = "logshipper"
!~      readiness_health_check_type = "process" -> (known after apply)
!~      source_code_hash            = "5500ff413171dd76a994d46abbd02d2ea3d349e601467824eb6eb89bddec6185" -> "9d763506a94695ae0e8fc9bac4ad174771b276375e6746cbe309b1cfc4715da1"
!~      stack                       = "cflinuxfs4" -> (known after apply)
!~      updated_at                  = "2026-10-21T16:33:45Z" -> (known after apply)
#        (14 unchanged attributes hidden)
    }

  # module.dev.module.clamav.cloudfoundry_app.clamav_api will be updated in-place
!~  resource "cloudfoundry_app" "clamav_api" {
+       buildpacks                      = (known after apply)
!~      created_at                      = "2026-05-13T17:32:24Z" -> (known after apply)
!~      docker_image                    = "ghcr.io/gsa-tts/fac/clamav@sha256:ff36ebe88d5b4524451a595534dc3084bc036265418611d2805ab692bf479868" -> "ghcr.io/gsa-tts/fac/clamav@sha256:e55e6eef508f702cf89346b1ea7af306920d48bc36228c5c58843bb8379860f6"
!~      enable_ssh                      = false -> (known after apply)
!~      health_check_type               = "port" -> (known after apply)
!~      id                              = "************************************" -> (known after apply)
!~      log_rate_limit_per_second       = "-1" -> (known after apply)
        name                            = "fac-av-dev"
!~      readiness_health_check_type     = "process" -> (known after apply)
!~      routes                          = [
-           {
-               protocol = "http1" -> null
-               route    = "fac-av-dev.apps.internal" -> null
            },
        ] -> (known after apply)
!~      stack                           = null -> (known after apply)
!~      updated_at                      = "2026-10-05T16:35:15Z" -> (known after apply)
#        (9 unchanged attributes hidden)
    }

  # module.dev.module.cors.null_resource.cors_header must be replaced
-/+ resource "null_resource" "cors_header" {
!~      id       = "*******************" -> (known after apply)
!~      triggers = { # forces replacement
!~          "always_run" = "2026-10-13T19:32:53Z" -> (known after apply)
        }
    }

  # module.dev.module.fac-file-scanner.data.cloudfoundry_domain.internal will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "cloudfoundry_domain" "internal" {
+       annotations         = (known after apply)
+       created_at          = (known after apply)
+       id                  = (known after apply)
+       internal            = (known after apply)
+       labels              = (known after apply)
+       name                = "apps.internal"
+       org                 = (known after apply)
+       router_group        = (known after apply)
+       shared_orgs         = (known after apply)
+       supported_protocols = (known after apply)
+       updated_at          = (known after apply)
    }

  # module.dev.module.fac-file-scanner.data.external.scannerzip will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "external" "scannerzip" {
+       id          = (known after apply)
+       program     = [
+           "/bin/sh",
+           "prepare-scanner.sh",
        ]
+       query       = {
+           "gitref" = "refs/heads/main"
        }
+       result      = (known after apply)
+       working_dir = "../shared/modules/scanner"
    }

  # module.dev.module.fac-file-scanner.cloudfoundry_app.scanner_app will be updated in-place
!~  resource "cloudfoundry_app" "scanner_app" {
!~      created_at                  = "2026-09-21T15:43:30Z" -> (known after apply)
!~      enable_ssh                  = false -> (known after apply)
!~      id                          = "************************************" -> (known after apply)
!~      log_rate_limit_per_second   = "-1" -> (known after apply)
        name                        = "fac-file-scanner"
!~      path                        = "../shared/modules/scanner/scanner.zip" -> (known after apply)
!~      readiness_health_check_type = "process" -> (known after apply)
!~      routes                      = [
-           {
-               protocol = "http1" -> null
-               route    = "fac-file-scanner-dev.apps.internal" -> null
            },
        ] -> (known after apply)
!~      source_code_hash            = "e2717374be5c0c39718008959f7e588e653c90066dfa1c0fb02c8d1f8c3be16e" -> (known after apply)
!~      stack                       = "cflinuxfs4" -> (known after apply)
!~      updated_at                  = "2026-10-13T18:49:45Z" -> (known after apply)
#        (12 unchanged attributes hidden)
    }

  # module.dev.module.fac-file-scanner.cloudfoundry_route.scanner_route must be replaced
-/+ resource "cloudfoundry_route" "scanner_route" {
!~      created_at   = "2026-10-13T18:49:46Z" -> (known after apply)
!~      destinations = [
-           {
-               app_id           = "6b49003b-d4ba-4142-9bc3-2ff068124da5" -> null
-               app_process_type = "web" -> null
-               id               = "dde61adf-35cb-45f8-a76c-6710a75061c1" -> null
-               port             = 8080 -> null
-               protocol         = "http1" -> null
            },
+           {
+               app_id           = (known after apply)
+               app_process_type = (known after apply)
+               id               = (known after apply)
+               port             = (known after apply)
+               protocol         = (known after apply)
            },
        ]
!~      domain       = "26df58ef-0c0d-4997-b68b-8defb7b3998b" -> (known after apply) # forces replacement
!~      id           = "************************************" -> (known after apply)
!~      protocol     = "http" -> (known after apply)
!~      updated_at   = "2026-10-13T18:49:46Z" -> (known after apply)
!~      url          = "fac-file-scanner-dev.apps.internal" -> (known after apply)
#        (2 unchanged attributes hidden)
    }

  # module.dev.module.file_scanner_clamav.cloudfoundry_app.clamav_api will be updated in-place
!~  resource "cloudfoundry_app" "clamav_api" {
+       buildpacks                      = (known after apply)
!~      created_at                      = "2026-05-13T17:32:24Z" -> (known after apply)
!~      docker_image                    = "ghcr.io/gsa-tts/fac/clamav@sha256:ff36ebe88d5b4524451a595534dc3084bc036265418611d2805ab692bf479868" -> "ghcr.io/gsa-tts/fac/clamav@sha256:e55e6eef508f702cf89346b1ea7af306920d48bc36228c5c58843bb8379860f6"
!~      enable_ssh                      = false -> (known after apply)
!~      health_check_type               = "port" -> (known after apply)
!~      id                              = "************************************" -> (known after apply)
!~      log_rate_limit_per_second       = "-1" -> (known after apply)
        name                            = "fac-av-dev-fs"
!~      readiness_health_check_type     = "process" -> (known after apply)
!~      routes                          = [
-           {
-               protocol = "http1" -> null
-               route    = "fac-av-dev-fs.apps.internal" -> null
            },
        ] -> (known after apply)
!~      stack                           = null -> (known after apply)
!~      updated_at                      = "2026-10-05T16:35:15Z" -> (known after apply)
#        (9 unchanged attributes hidden)
    }

  # module.dev.module.https-proxy.cloudfoundry_app.egress_app will be updated in-place
!~  resource "cloudfoundry_app" "egress_app" {
!~      created_at                  = "2026-04-09T15:48:07Z" -> (known after apply)
!~      disk_quota                  = "2048M" -> (known after apply)
!~      health_check_type           = "port" -> (known after apply)
!~      id                          = "************************************" -> (known after apply)
!~      log_rate_limit_per_second   = "-1" -> (known after apply)
        name                        = "https-proxy"
!~      path                        = ".terraform/modules/dev.https-proxy/dist/src.zip" -> "/tmp/terraform-data-dir/modules/dev.https-proxy/dist/src.zip"
!~      readiness_health_check_type = "process" -> (known after apply)
!~      stack                       = "cflinuxfs4" -> (known after apply)
!~      updated_at                  = "2026-10-21T16:33:37Z" -> (known after apply)
#        (12 unchanged attributes hidden)
    }

  # module.dev.module.clamav.module.route.cloudfoundry_route.app_route will be updated in-place
!~  resource "cloudfoundry_route" "app_route" {
!~      destinations = [
-           {
-               app_id           = "8681e03d-155f-4904-9192-0de8e84a5947" -> null
-               app_process_type = "web" -> null
-               id               = "ef4f6262-2fbf-47a0-b208-0deb37a7101b" -> null
-               port             = 8080 -> null
-               protocol         = "http1" -> null
            },
+           {
+               app_id           = (known after apply)
+               app_process_type = (known after apply)
+               id               = (known after apply)
+               port             = (known after apply)
+               protocol         = (known after apply)
            },
        ]
        id           = "877bbc1f-e036-4a96-b7a3-70cff8c35c3c"
!~      updated_at   = "2026-05-13T17:32:32Z" -> (known after apply)
#        (6 unchanged attributes hidden)
    }

  # module.dev.module.fac-file-scanner.module.quarantine.data.cloudfoundry_service_plans.s3 will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "cloudfoundry_service_plans" "s3" {
+       name                  = "basic"
+       service_offering_name = "s3"
+       service_plans         = (known after apply)
    }

  # module.dev.module.fac-file-scanner.module.quarantine.cloudfoundry_service_instance.bucket will be updated in-place
!~  resource "cloudfoundry_service_instance" "bucket" {
+       dashboard_url     = (known after apply)
        id                = "c435cb9c-32a7-4a31-828b-48c8c6f3bf37"
!~      last_operation    = {
!~          created_at  = "2025-03-14T14:22:42Z" -> (known after apply)
+           description = (known after apply)
!~          state       = "succeeded" -> (known after apply)
!~          type        = "update" -> (known after apply)
!~          updated_at  = "2025-03-14T14:22:42Z" -> (known after apply)
        } -> (known after apply)
!~      maintenance_info  = {
+           description = (known after apply)
+           version     = (known after apply)
        } -> (known after apply)
        name              = "fac-file-scanner-quarantine"
!~      service_plan      = "021bb2a3-7e11-4fc2-b06b-d9f5938cd806" -> (known after apply)
        tags              = [
            "s3",
            "terraform-cloudgov-managed",
        ]
!~      updated_at        = "2025-03-14T14:22:42Z" -> (known after apply)
!~      upgrade_available = false -> (known after apply)
#        (3 unchanged attributes hidden)
    }

  # module.dev.module.file_scanner_clamav.module.route.data.cloudfoundry_domain.domain will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "cloudfoundry_domain" "domain" {
+       annotations         = (known after apply)
+       created_at          = (known after apply)
+       id                  = (known after apply)
+       internal            = (known after apply)
+       labels              = (known after apply)
+       name                = "apps.internal"
+       org                 = (known after apply)
+       router_group        = (known after apply)
+       shared_orgs         = (known after apply)
+       supported_protocols = (known after apply)
+       updated_at          = (known after apply)
    }

  # module.dev.module.file_scanner_clamav.module.route.data.cloudfoundry_org.org will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "cloudfoundry_org" "org" {
+       annotations = (known after apply)
+       created_at  = (known after apply)
+       id          = (known after apply)
+       labels      = (known after apply)
+       name        = "gsa-tts-oros-fac"
+       quota       = (known after apply)
+       suspended   = (known after apply)
+       updated_at  = (known after apply)
    }

  # module.dev.module.file_scanner_clamav.module.route.data.cloudfoundry_space.space will be read during apply
  # (config refers to values not yet known)
 <= data "cloudfoundry_space" "space" {
+       allow_ssh         = (known after apply)
+       annotations       = (known after apply)
+       created_at        = (known after apply)
+       id                = (known after apply)
+       isolation_segment = (known after apply)
+       labels            = (known after apply)
+       name              = "dev"
+       org               = (known after apply)
+       quota             = (known after apply)
+       updated_at        = (known after apply)
    }

  # module.dev.module.file_scanner_clamav.module.route.cloudfoundry_route.app_route must be replaced
-/+ resource "cloudfoundry_route" "app_route" {
!~      created_at   = "2026-10-13T18:49:47Z" -> (known after apply)
!~      destinations = [
-           {
-               app_id           = "c3cc6537-e982-4242-ba9a-4339685f808b" -> null
-               app_process_type = "web" -> null
-               id               = "41e59721-6e18-490f-927d-bd158d5e6e3f" -> null
-               port             = 8080 -> null
-               protocol         = "http1" -> null
            },
+           {
+               app_id           = (known after apply)
+               app_process_type = (known after apply)
+               id               = (known after apply)
+               port             = (known after apply)
+               protocol         = (known after apply)
            },
        ]
!~      domain       = "26df58ef-0c0d-4997-b68b-8defb7b3998b" -> (known after apply) # forces replacement
!~      id           = "************************************" -> (known after apply)
!~      protocol     = "http" -> (known after apply)
!~      space        = "06525ba3-19c2-451b-96e9-ea4a9134e8b9" -> (known after apply) # forces replacement
!~      updated_at   = "2026-10-13T18:49:47Z" -> (known after apply)
!~      url          = "fac-av-dev-fs.apps.internal" -> (known after apply)
#        (1 unchanged attribute hidden)
    }

Plan: 3 to add, 12 to change, 3 to destroy.

📝 Plan generated in Pull Request Checks #1668

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Code Coverage

Package Line Rate Branch Rate Health
. 100% 100% ✔
api 98% 86% ✔
api.serializers 97% 88% ✔
api.views 88% 96% ➖
audit 95% 80% ✔
audit.cross_validation 97% 87% ✔
audit.fixtures 84% 50% ❌
audit.formlib 94% 72% ✔
audit.intakelib 89% 83% ➖
audit.intakelib.checks 92% 86% ✔
audit.intakelib.common 98% 82% ✔
audit.intakelib.transforms 100% 95% ✔
audit.management.commands 78% 17% ❌
audit.migrations 100% 100% ✔
audit.models 91% 69% ✔
audit.templatetags 94% 83% ✔
audit.test_viewlib 100% 93% ✔
audit.viewlib 81% 78% ❌
audit.views 75% 54% ❌
census_historical_migration 99% 100% ✔
census_historical_migration.migrations 100% 100% ✔
census_historical_migration.sac_general_lib 92% 84% ✔
census_historical_migration.transforms 95% 90% ✔
census_historical_migration.workbooklib 70% 75% ❌
config 79% 31% ❌
curation 98% 92% ✔
curation.curationlib 91% 84% ✔
curation.management.commands 38% 31% ❌
curation.migrations 100% 100% ✔
dissemination 90% 70% ✔
dissemination.analytics 27% 0% ❌
dissemination.forms 80% 30% ❌
dissemination.migrations 98% 25% ✔
dissemination.models 100% 100% ✔
dissemination.report_generation 21% 0% ❌
dissemination.report_generation.excel 32% 0% ❌
dissemination.searchlib 61% 43% ❌
dissemination.templatetags 52% 6% ❌
dissemination.views 71% 51% ❌
djangooidc 53% 38% ❌
djangooidc.tests 100% 94% ✔
report_submission 99% 94% ✔
report_submission.migrations 100% 100% ✔
report_submission.templatetags 74% 100% ❌
report_submission.views 75% 57% ❌
support 94% 75% ✔
support.migrations 100% 100% ✔
support.models 72% 11% ❌
tools 98% 50% ✔
users 95% 86% ✔
users.fixtures 100% 83% ✔
users.management 100% 100% ✔
users.management.commands 100% 100% ✔
users.migrations 100% 100% ✔
Summary 89% (24600 / 27659) 70% (3071 / 4376) ➖

Minimum allowed line rate is 85%

This branch was successfully deployed

3 active deployments
testing — 600c1ad7 Deployed Oct 21, 2026 by ccampbell-fearless via cypress-from-container / cypress-run #1668
meta — 600c1ad7 Deployed Oct 21, 2026 by ccampbell-fearless via terraform-plan-meta / Terraform Plan on meta #1668
dev — 600c1ad7 Deployed Oct 21, 2026 by ccampbell-fearless via terraform-plan-dev / Terraform Plan on dev #1668
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ccampbell-fearless