serve-maps-as-tiles

.github/workflows/deploy_containerapps.yml

@@ -0,0 +1,109 @@
+name: Deploy to Azure Container Apps (shapes)
+
+on:
+  push:
+    branches:
+      - live
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: deploy-aca-shapes
+  cancel-in-progress: true
+
+env:
+  AZURE_RESOURCE_GROUP: ${{ secrets.AZURE_RESOURCE_GROUP }}
+  # Update if your Container App name differs.
+  AZURE_CONTAINERAPP_NAME: rcpch-census-platform-v2
+
+  # ACR resource name (NOT login server). Example: myregistry
+  # Store as a GitHub Secret (or Variable) named ACR_NAME.
+  ACR_NAME: ${{ secrets.ACR_NAME }}
+
+  # ACR login server. Example: myregistry.azurecr.io
+  # Store as a GitHub Secret (or Variable) named ACR_LOGIN_SERVER.
+  ACR_LOGIN_SERVER: ${{ secrets.ACR_LOGIN_SERVER }}
+
+  # Image names
+  WEB_IMAGE_NAME: rcpch-census-web
+  PROXY_IMAGE_NAME: rcpch-census-proxy
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Login to ACR (OIDC)
+        shell: bash
+        run: |
+          if [ -z "${ACR_NAME}" ]; then
+            echo "Missing secrets.ACR_NAME (ACR resource name)." >&2
+            exit 1
+          fi
+          az acr login --name "${ACR_NAME}"
+
+      - name: Build and push web image
+        shell: bash
+        run: |
+          docker build -f Dockerfile.postgis -t "${ACR_LOGIN_SERVER}/${WEB_IMAGE_NAME}:${GITHUB_SHA}" .
+          docker push "${ACR_LOGIN_SERVER}/${WEB_IMAGE_NAME}:${GITHUB_SHA}"
+
+      # NOTE: This workflow no longer configures registry username/password on the Container App.
+      # For runtime pulls from ACR, configure the Container App to use managed identity + AcrPull
+      # (do once in Azure). This avoids long-lived registry passwords.
+
+      - name: Render Container App YAML
+        shell: bash
+        env:
+          ACR_LOGIN_SERVER: ${{ secrets.ACR_LOGIN_SERVER }}
+          ENV_STORAGE_NAME: ${{ secrets.ACA_ENV_STORAGE_NAME }}
+          DJANGO_ALLOWED_HOSTS: ${{ secrets.DJANGO_ALLOWED_HOSTS }}
+          DJANGO_CSRF_TRUSTED_ORIGINS: ${{ secrets.DJANGO_CSRF_TRUSTED_ORIGINS }}
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          import os
+
+          template_path = Path('infra/azure/containerapp.template.yml')
+          out_path = Path('infra/azure/containerapp.rendered.yml')
+
+          content = template_path.read_text(encoding='utf-8')
+          replacements = {
+              '__ACR_LOGIN_SERVER__': os.environ['ACR_LOGIN_SERVER'],
+              '__IMAGE_TAG__': os.environ['GITHUB_SHA'],
+              '__ENV_STORAGE_NAME__': os.environ['ENV_STORAGE_NAME'],
+              '__DJANGO_ALLOWED_HOSTS__': os.environ['DJANGO_ALLOWED_HOSTS'],
+              '__DJANGO_CSRF_TRUSTED_ORIGINS__': os.environ['DJANGO_CSRF_TRUSTED_ORIGINS'],
+          }
+
+          for k, v in replacements.items():
+              content = content.replace(k, v)
+
+          out_path.write_text(content, encoding='utf-8')
+          print(f"Wrote {out_path}")
+          PY
+
+      - name: Deploy Container App revision
+        shell: bash
+        run: |
+          az containerapp update \
+            -n "${AZURE_CONTAINERAPP_NAME}" \
+            -g "${AZURE_RESOURCE_GROUP}" \
+            --yaml infra/azure/containerapp.rendered.yml
+
+      - name: Show FQDN
+        shell: bash
+        run: |
+          az containerapp show -n "${AZURE_CONTAINERAPP_NAME}" -g "${AZURE_RESOURCE_GROUP}" --query properties.configuration.ingress.fqdn -o tsv

.github/workflows/pages.yml

@@ -0,0 +1,41 @@
+name: Deploy site/ to GitHub Pages
+
+on:
+  push:
+    branches:
+      - live
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    # Safety: only deploy Pages from the default branch.
+    if: github.ref == 'refs/heads/live'
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload Pages artifact (site/)
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: site
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/publish_postgisdb.yml

@@ -0,0 +1,78 @@
+name: Build and Publish Seeded PostGIS DB
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  IMAGE_NAME: rcpch-census-postgis
+  REGISTRY: ghcr.io
+  ORG: rcpch
+  WEB_IMAGE_NAME: rcpch-census-web
+
+jobs:
+  build-seed-push:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Log in to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+      - name: Build base PostGIS image
+        run: |
+          docker pull postgis/postgis:15-3.4
+          docker tag postgis/postgis:15-3.4 $REGISTRY/$ORG/$IMAGE_NAME:base
+
+      - name: Build DRF app image
+        run: |
+          docker build -t $REGISTRY/$ORG/$WEB_IMAGE_NAME:seed -f Dockerfile.postgis .
+
+      - name: Start PostGIS container
+        run: |
+          docker run -d --name seed-db -p 5432:5432 -e POSTGRES_USER=rcpchCensususer -e POSTGRES_PASSWORD=seedpw -e POSTGRES_DB=rcpchCensusdb $REGISTRY/$ORG/$IMAGE_NAME:base
+
+      - name: Run Django seed command
+        env:
+          # Add any secrets needed for your Django app here
+          DJANGO_SECRET_KEY: dummy
+        run: |
+          set -o pipefail
+          docker run --rm \
+            --network host \
+            -e RCPCH_CENSUS_ENGINE_POSTGRES_DB_USER=rcpchCensususer \
+            -e RCPCH_CENSUS_ENGINE_POSTGRES_DB_PASSWORD=seedpw \
+            -e RCPCH_CENSUS_ENGINE_POSTGRES_DB_NAME=rcpchCensusdb \
+            -e RCPCH_CENSUS_ENGINE_POSTGRES_DB_HOST=127.0.0.1 \
+            -e RCPCH_CENSUS_ENGINE_POSTGRES_DB_PORT=5432 \
+            -e DJANGO_SECRET_KEY=$DJANGO_SECRET_KEY \
+            -e PYTHONUNBUFFERED=1 \
+            $REGISTRY/$ORG/$WEB_IMAGE_NAME:seed \
+            sh -c "/app/s/wait-for-db.sh && python -u manage.py migrate --noinput && python -u manage.py seed --mode=__all__ && python -u manage.py seed --mode=import_bfc_boundaries" | tee seed-run.log
+
+      - name: Upload seed run logs
+        uses: actions/upload-artifact@v4
+        with:
+          name: seed-run-log
+          path: seed-run.log
+
+      - name: Commit seeded image
+        run: |
+          docker commit seed-db $REGISTRY/$ORG/$IMAGE_NAME:${{ github.ref_name }}
+
+      - name: Push seeded image to GHCR
+        run: |
+          docker push $REGISTRY/$ORG/$IMAGE_NAME:${{ github.ref_name }}
+
+      - name: Cleanup
+        if: always()
+        run: |
+          docker rm -f seed-db || true
+          docker rmi $REGISTRY/$ORG/$IMAGE_NAME:base || true
+          docker rmi $REGISTRY/$ORG/$WEB_IMAGE_NAME:seed || true

.github/workflows/test.yml

@@ -1,22 +1,20 @@
-# Runs tests on Pull Requests
-# Requires seeding the database with IMD data before running tests
-
 name: Run Tests
 
 on:
     pull_request:
-        branches:
-            - live
-            - development
+        branches: [live, development]
     workflow_dispatch:
 
 jobs:
     test:
         runs-on: ubuntu-latest
+        # This tells GitHub to run all 'steps' inside this container
+        container:
+            image: python:3.12-bookworm
 
         services:
-            postgres:
-                image: postgres:latest
+            postgis:
+                image: postgis/postgis:15-3.4
                 env:
                     POSTGRES_USER: rcpchCensususer
                     POSTGRES_PASSWORD: password
@@ -29,56 +27,48 @@ jobs:
                     --health-timeout 5s
                     --health-retries 5
 
+        # Define global env for all steps
+        env:
+            RCPCH_CENSUS_ENGINE_POSTGRES_DB_USER: rcpchCensususer
+            RCPCH_CENSUS_ENGINE_POSTGRES_DB_PASSWORD: password
+            RCPCH_CENSUS_ENGINE_POSTGRES_DB_NAME: rcpchCensusdb
+            RCPCH_CENSUS_ENGINE_POSTGRES_DB_HOST: postgis # Connect to service name
+            RCPCH_CENSUS_ENGINE_POSTGRES_DB_PORT: 5432
+            RCPCH_CENSUS_ENGINE_SECRET_KEY: test-secret-key
+            DEBUG: "True"
+            DJANGO_ALLOWED_HOSTS: localhost
+            POSTCODES_IO_API_URL: https://api.postcodes.io
+
         steps:
             - uses: actions/checkout@v4
 
-            - name: Set up Python
-              uses: actions/setup-python@v5
-              with:
-                  python-version: "3.12"
-                  cache: "pip"
+            - name: Install system packages
+              run: |
+                  apt-get update && apt-get install -y --no-install-recommends \
+                      gdal-bin libgdal-dev libgeos-dev binutils libproj-dev postgresql-client
 
             - name: Install dependencies
               run: |
                   python -m pip install --upgrade pip
+                  # Force Python GDAL bindings to match the system version
+                  export GDAL_VERSION=$(gdal-config --version)
+                  pip install "GDAL==$GDAL_VERSION.*"
+
                   pip install -r requirements.txt
                   pip install -r requirements/development-requirements.txt
 
+            - name: Enable PostGIS extension
+              run: |
+                  export PGPASSWORD=password
+                  for i in {1..15}; do
+                      psql -h postgis -U rcpchCensususer -d rcpchCensusdb -c "CREATE EXTENSION IF NOT EXISTS postgis;" && break || sleep 2
+                  done
+
             - name: Run migrations
-              env:
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_USER: rcpchCensususer
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_PASSWORD: password
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_NAME: rcpchCensusdb
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_HOST: localhost
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_PORT: 5432
-                  RCPCH_CENSUS_ENGINE_SECRET_KEY: test-secret-key
-                  DEBUG: "True"
-                  DJANGO_ALLOWED_HOSTS: localhost
-                  POSTCODES_IO_API_URL: https://api.postcodes.io
               run: python manage.py migrate
 
             - name: Seed database
-              env:
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_USER: rcpchCensususer
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_PASSWORD: password
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_NAME: rcpchCensusdb
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_HOST: localhost
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_PORT: 5432
-                  RCPCH_CENSUS_ENGINE_SECRET_KEY: test-secret-key
-                  DEBUG: "True"
-                  DJANGO_ALLOWED_HOSTS: localhost
-                  POSTCODES_IO_API_URL: https://api.postcodes.io
               run: python manage.py seed --mode='ci_test'
 
             - name: Run tests
-              env:
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_USER: rcpchCensususer
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_PASSWORD: password
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_NAME: rcpchCensusdb
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_HOST: localhost
-                  RCPCH_CENSUS_ENGINE_POSTGRES_DB_PORT: 5432
-                  RCPCH_CENSUS_ENGINE_SECRET_KEY: test-secret-key
-                  DEBUG: "True"
-                  DJANGO_ALLOWED_HOSTS: localhost
-                  POSTCODES_IO_API_URL: https://api.postcodes.io
               run: python -m pytest tests/ -v --tb=short

.gitignore

@@ -120,8 +120,14 @@ staticfiles/
 .vscode/
 .vscode/*
 
+# Docker and docker compose
+.pip_cache
+.data
 # Docker and docker compose
 .pip_cache
 .data
 
-build_info.json
+build_info.json
+# Ignore large generated/staging geojson and shapefiles
+deprivation_scores/geojson/
+deprivation_scores/shape_files/