V1 Production Launch

.env.example

@@ -2,7 +2,7 @@ DB_DRIVER=postgres
 
 POSTGRES_USER=admin
 POSTGRES_PASSWORD=password
-POSTGRES_DB=ocotillo
+POSTGRES_DB=ocotilloapi_dev
 POSTGRES_HOST=localhost
 POSTGRES_PORT=5432
 

.github/app.template.yaml

@@ -1,8 +1,13 @@
 service: ${SERVICE_NAME}
 runtime: python313
-entrypoint: gunicorn -w 4 -k uvicorn.workers.UvicornWorker main:app
-instance_class: F4
+entrypoint: ${ENTRYPOINT}
 service_account: "${CLOUD_SQL_USER}.gserviceaccount.com"
+instance_class: F4
+inbound_services:
+  - warmup
+automatic_scaling:
+  min_instances: ${MIN_INSTANCES}
+  max_instances: ${MAX_INSTANCES}
 handlers:
   - url: /.*
     secure: always

.github/workflows/CD_production.yml

@@ -8,7 +8,7 @@ permissions:
   contents: write
 
 jobs:
-    staging-deploy:
+    production-deploy:
 
         runs-on: ubuntu-latest
         environment: production
@@ -20,7 +20,7 @@ jobs:
             fetch-depth: 0
 
         - name: Install uv in container
-          uses: astral-sh/setup-uv@v7.3.1
+          uses: astral-sh/setup-uv@v8.0.0
           with:
             version: "latest"
 
@@ -47,16 +47,25 @@ jobs:
           run: |
             uv run alembic upgrade head
 
+        - name: Refresh materialized views on production database
+          env:
+            DB_DRIVER: "cloudsql"
+            CLOUD_SQL_INSTANCE_NAME: "${{ secrets.CLOUD_SQL_INSTANCE_NAME }}"
+            CLOUD_SQL_DATABASE: "${{ vars.CLOUD_SQL_DATABASE }}"
+            CLOUD_SQL_USER: "${{ secrets.CLOUD_SQL_USER }}"
+            CLOUD_SQL_IAM_AUTH: true
+          run: |
+            uv run python -m cli.cli refresh-pygeoapi-materialized-views
+
         - name: Ensure envsubst is available
           run: |
             if ! command -v envsubst >/dev/null 2>&1; then
               sudo apt-get update
               sudo apt-get install -y gettext-base
             fi
 
-        - name: Render app.yaml
+        - name: Render App Engine configs
           env:
-            SERVICE_NAME: "ocotillo-api"
             ENVIRONMENT: "production"
             CLOUD_SQL_INSTANCE_NAME: "${{ secrets.CLOUD_SQL_INSTANCE_NAME }}"
             CLOUD_SQL_DATABASE: "${{ vars.CLOUD_SQL_DATABASE }}"
@@ -77,25 +86,59 @@ jobs:
             SESSION_SECRET_KEY: "${{ secrets.SESSION_SECRET_KEY }}"
             APITALLY_CLIENT_ID: "${{ vars.APITALLY_CLIENT_ID }}"
           run: |
+            export MAX_INSTANCES="10"
+            export SERVICE_NAME="ocotillo-api"
+            export ENTRYPOINT="gunicorn -w 1 -k uvicorn.workers.UvicornWorker main:app"
+            export MIN_INSTANCES="0"
             envsubst < .github/app.template.yaml > app.yaml
 
         - name: Deploy to Google Cloud
           run: |
-            gcloud app deploy app.yaml --quiet --project ${{ vars.GCP_PROJECT_ID }}
+            gcloud app deploy \
+              app.yaml \
+              --quiet \
+              --project ${{ vars.GCP_PROJECT_ID }}
 
-        # Clean up old versions - delete only the oldest version, one created and one destroyed
-        - name: Clean up oldest version
+        - name: Clean up oldest versions
           run: |
-            OLDEST_VERSION=$(gcloud app versions list --service=ocotillo-api --project=${{ vars.GCP_PROJECT_ID}} --format="value(id)" --sort-by="version.createTime" | head -n 1)
-            if [ ! -z "$OLDEST_VERSION" ]; then
-              echo "Deleting oldest version: $OLDEST_VERSION"
-              gcloud app versions delete $OLDEST_VERSION --service=ocotillo-api --project=${{ vars.GCP_PROJECT_ID }} --quiet
-              echo "Deleted oldest version: $OLDEST_VERSION"
+            SERVICE="ocotillo-api"
+            VERSIONS_JSON="$(gcloud app versions list --service="$SERVICE" --project=${{ vars.GCP_PROJECT_ID }} --format=json --sort-by="version.createTime" 2>/dev/null || printf '[]')"
+            export VERSIONS_JSON
+            DELETE_VERSION="$(python - <<'PY'
+            import json
+            import os
+
+            versions = json.loads(os.environ.get("VERSIONS_JSON", "[]") or "[]")
+            if len(versions) <= 1:
+                print("")
+                raise SystemExit(0)
+
+            def traffic_split(version):
+                for key in ("traffic_split", "trafficSplit"):
+                    value = version.get(key)
+                    if value is not None:
+                        try:
+                            return float(value)
+                        except (TypeError, ValueError):
+                            return 0.0
+                return 0.0
+
+            for version in versions:
+                if traffic_split(version) == 0.0:
+                    print(version.get("id", ""))
+                    break
+            else:
+                print("")
+            PY
+            )"
+            if [ -n "$DELETE_VERSION" ]; then
+              echo "Deleting old non-serving version for $SERVICE: $DELETE_VERSION"
+              gcloud app versions delete "$DELETE_VERSION" --service="$SERVICE" --project=${{ vars.GCP_PROJECT_ID }} --quiet
             else
-              echo "No versions to delete"
+              echo "No old non-serving versions to delete for $SERVICE"
             fi
 
-        - name: Remove app.yaml
+        - name: Remove rendered configs
           run: |
             rm app.yaml
 
@@ -108,5 +151,5 @@ jobs:
         # ":" are not alloed in git tags, so replace with "-"
         - name: Tag commit
           run: |
-            git tag -a "production-deploy-$(date -u +%Y-%m-%d)T$(date -u +%H-%M-%S%z)" -m "staging gcloud deployment: $(date -u +%Y-%m-%d)T$(date -u +%H:%M:%S%z)"
+            git tag -a "production-deploy-$(date -u +%Y-%m-%d)T$(date -u +%H-%M-%S%z)" -m "production gcloud deployment: $(date -u +%Y-%m-%d)T$(date -u +%H:%M:%S%z)"
             git push origin --tags

.github/workflows/CD_staging.yml

@@ -20,7 +20,7 @@ jobs:
             fetch-depth: 0
 
         - name: Install uv in container
-          uses: astral-sh/setup-uv@v7.3.1
+          uses: astral-sh/setup-uv@v8.0.0
           with:
             version: "latest"
 
@@ -47,16 +47,25 @@ jobs:
           run: |
             uv run alembic upgrade head
 
+        - name: Refresh materialized views on staging database
+          env:
+            DB_DRIVER: "cloudsql"
+            CLOUD_SQL_INSTANCE_NAME: "${{ secrets.CLOUD_SQL_INSTANCE_NAME }}"
+            CLOUD_SQL_DATABASE: "${{ vars.CLOUD_SQL_DATABASE }}"
+            CLOUD_SQL_USER: "${{ secrets.CLOUD_SQL_USER }}"
+            CLOUD_SQL_IAM_AUTH: true
+          run: |
+            uv run python -m cli.cli refresh-pygeoapi-materialized-views
+
         - name: Ensure envsubst is available
           run: |
             if ! command -v envsubst >/dev/null 2>&1; then
               sudo apt-get update
               sudo apt-get install -y gettext-base
             fi
 
-        - name: Render app.yaml
+        - name: Render App Engine configs
           env:
-            SERVICE_NAME: "ocotillo-api-staging"
             ENVIRONMENT: "staging"
             CLOUD_SQL_INSTANCE_NAME: "${{ secrets.CLOUD_SQL_INSTANCE_NAME }}"
             CLOUD_SQL_DATABASE: "${{ vars.CLOUD_SQL_DATABASE }}"
@@ -77,25 +86,59 @@ jobs:
             SESSION_SECRET_KEY: "${{ secrets.SESSION_SECRET_KEY }}"
             APITALLY_CLIENT_ID: "${{ vars.APITALLY_CLIENT_ID }}"
           run: |
+            export MAX_INSTANCES="10"
+            export SERVICE_NAME="ocotillo-api-staging"
+            export ENTRYPOINT="gunicorn -w 1 -k uvicorn.workers.UvicornWorker main:app"
+            export MIN_INSTANCES="0"
             envsubst < .github/app.template.yaml > app.yaml
 
         - name: Deploy to Google Cloud
           run: |
-            gcloud app deploy app.yaml --quiet --project ${{ vars.GCP_PROJECT_ID }}
+            gcloud app deploy \
+              app.yaml \
+              --quiet \
+              --project ${{ vars.GCP_PROJECT_ID }}
 
-        # Clean up old versions - delete only the oldest version, one created and one destroyed
-        - name: Clean up oldest version
+        - name: Clean up oldest versions
           run: |
-            OLDEST_VERSION=$(gcloud app versions list --service=ocotillo-api-staging --project=${{ vars.GCP_PROJECT_ID}} --format="value(id)" --sort-by="version.createTime" | head -n 1)
-            if [ ! -z "$OLDEST_VERSION" ]; then
-              echo "Deleting oldest version: $OLDEST_VERSION"
-              gcloud app versions delete $OLDEST_VERSION --service=ocotillo-api-staging --project=${{ vars.GCP_PROJECT_ID }} --quiet
-              echo "Deleted oldest version: $OLDEST_VERSION"
+            SERVICE="ocotillo-api-staging"
+            VERSIONS_JSON="$(gcloud app versions list --service="$SERVICE" --project=${{ vars.GCP_PROJECT_ID }} --format=json --sort-by="version.createTime" 2>/dev/null || printf '[]')"
+            export VERSIONS_JSON
+            DELETE_VERSION="$(python - <<'PY'
+            import json
+            import os
+
+            versions = json.loads(os.environ.get("VERSIONS_JSON", "[]") or "[]")
+            if len(versions) <= 1:
+                print("")
+                raise SystemExit(0)
+
+            def traffic_split(version):
+                for key in ("traffic_split", "trafficSplit"):
+                    value = version.get(key)
+                    if value is not None:
+                        try:
+                            return float(value)
+                        except (TypeError, ValueError):
+                            return 0.0
+                return 0.0
+
+            for version in versions:
+                if traffic_split(version) == 0.0:
+                    print(version.get("id", ""))
+                    break
+            else:
+                print("")
+            PY
+            )"
+            if [ -n "$DELETE_VERSION" ]; then
+              echo "Deleting old non-serving version for $SERVICE: $DELETE_VERSION"
+              gcloud app versions delete "$DELETE_VERSION" --service="$SERVICE" --project=${{ vars.GCP_PROJECT_ID }} --quiet
             else
-              echo "No versions to delete"
+              echo "No old non-serving versions to delete for $SERVICE"
             fi
 
-        - name: Remove app.yaml
+        - name: Remove rendered configs
           run: |
             rm app.yaml
 

.github/workflows/dependabot_automerge.yml

@@ -16,14 +16,14 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       # Auto-approve (only matters if your branch protection requires reviews)
       - name: Approve PR
         if: steps.metadata.outputs.update-type != 'version-update:semver-major'
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/jira_codex_pr.yml

@@ -59,7 +59,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Set up uv (with cache)
-        uses: astral-sh/setup-uv@bd870193dd98cea382bc44a732c2e0d17379a16d # v4
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v4
         with:
           enable-cache: true
 

.github/workflows/jira_issue_on_open.yml

@@ -176,7 +176,7 @@ jobs:
           echo "jira_browse_url=${JIRA_BASE_URL}/browse/${JIRA_KEY}" >> "$GITHUB_OUTPUT"
 
       - name: Comment Jira link back on the GitHub issue
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         env:
           JIRA_KEY: ${{ steps.jira.outputs.jira_key }}
           JIRA_URL: ${{ steps.jira.outputs.jira_browse_url }}

.github/workflows/tests.yml

@@ -31,15 +31,26 @@ jobs:
       SESSION_SECRET_KEY: supersecretkeyforunittests
       AUTHENTIK_DISABLE_AUTHENTICATION: 1
 
+    services:
+      postgis:
+        image: postgis/postgis:17-3.5
+        # don't test against latest. be explicit in version being tested to avoid breaking changes
+        # image: postgis/postgis:latest
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_PORT: 5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
     steps:
       - name: Check out source repository
         uses: actions/checkout@v6.0.2
 
-      - name: Start database (PostGIS)
-        run: |
-          docker compose build db
-          docker compose up -d db
-
       - name: Wait for database readiness
         run: |
           for i in {1..60}; do
@@ -52,7 +63,7 @@ jobs:
           exit 1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7.3.1
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -86,15 +97,11 @@ jobs:
         run: uv run pytest -vv --durations=20 --cov --cov-report=xml --junitxml=junit.xml --ignore=tests/transfers
 
       - name: Upload results to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           report_type: test_results
           token: ${{ secrets.CODECOV_TOKEN }}
 
-      - name: Stop database
-        if: always()
-        run: docker compose down -v
-
   bdd-tests:
     runs-on: ubuntu-latest
 
@@ -116,15 +123,26 @@ jobs:
       AUTHENTIK_DISABLE_AUTHENTICATION: 1
       DROP_AND_REBUILD_DB: 1
 
+    services:
+      postgis:
+        image: postgis/postgis:17-3.5
+        # don't test against latest. be explicit in version being tested to avoid breaking changes
+        # image: postgis/postgis:latest
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_PORT: 5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+        ports:
+          - 5432:5432
+
     steps:
       - name: Check out source repository
         uses: actions/checkout@v6.0.2
 
-      - name: Start database (PostGIS)
-        run: |
-          docker compose build db
-          docker compose up -d db
-
       - name: Wait for database readiness
         run: |
           for i in {1..60}; do
@@ -137,7 +155,7 @@ jobs:
           exit 1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7.3.1
+        uses: astral-sh/setup-uv@v8.0.0
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
@@ -169,7 +187,3 @@ jobs:
 
       - name: Run BDD tests
         run: uv run behave tests/features --tags="@backend and @production and not @skip" --no-capture
-
-      - name: Stop database
-        if: always()
-        run: docker compose down -v