Merge branch 'main' into feat/update-license-service

.github/CODEOWNERS

@@ -170,7 +170,7 @@ codemagic.yaml
 /libs/clients/national-registry/v3/                                                                      @island-is/hugsmidjan
 /libs/clients/district-commissioners-licenses/                                                           @island-is/hugsmidjan
 /libs/clients/regulations/                                                                               @island-is/hugsmidjan
-/libs/clients/vehicles/                                                                                  @island-is/hugsmidjan
+/libs/clients/vehicles/                                                                                  @island-is/hugsmidjan @island-is/stefna
 /libs/clients/vehicles-mileage/                                                                          @island-is/hugsmidjan
 /libs/clients/user-notification/                                                                         @island-is/hugsmidjan
 /libs/clients/passports/                                                                                 @island-is/hugsmidjan
@@ -265,6 +265,7 @@ codemagic.yaml
 /libs/island-ui/                                                                                         @island-is/island-ui
 
 /apps/consultation-portal/                                                                               @island-is/advania
+/apps/services/form-system/                                                                              @island-is/advania
 /libs/clients/consultation-portal/                                                                       @island-is/advania
 /libs/api/domains/consultation-portal/                                                                   @island-is/advania
 

.github/actions/cache/action.yml

@@ -54,27 +54,27 @@ runs:
         # force-cache-save: ${{ inputs.force-cache-save }}
 
     - name: Give cache server a bit of time to recover
-      if: always() && inputs.retry > 0 && steps.cache_try_number_one.outputs.success != 'true'
+      if: ${{ !cancelled() && inputs.retry > 0 && steps.cache_try_number_one.outputs.success != 'true' }}
       shell: bash
       run: sleep 10
 
     - name: Cache try number two
       id: cache_try_number_two
-      if: always() && inputs.retry > 0 && steps.cache_try_number_one.outputs.success != 'true'
+      if: ${{ !cancelled() && inputs.retry > 0 && steps.cache_try_number_one.outputs.success != 'true' }}
       uses: island-is/cache@v0.3
       with:
         path: ${{ inputs.path }}
         key: ${{ inputs.key }}
         # force-cache-save: ${{ inputs.force-cache-save }}
 
     - name: Give cache server a bit of time to recover
-      if: always() && inputs.retry > 1 && steps.cache_try_number_one.outputs.success != 'true' && steps.cache_try_number_two.outputs.success != 'true'
+      if: ${{ !cancelled() && inputs.retry > 1 && steps.cache_try_number_one.outputs.success != 'true' && steps.cache_try_number_two.outputs.success != 'true' }}
       shell: bash
       run: sleep 10
 
     - name: Cache try number three
       id: cache_try_number_three
-      if: always() && inputs.retry > 1 && steps.cache_try_number_one.outputs.success != 'true' && steps.cache_try_number_two.outputs.success != 'true'
+      if: ${{ !cancelled() && inputs.retry > 1 && steps.cache_try_number_one.outputs.success != 'true' && steps.cache_try_number_two.outputs.success != 'true' }}
       uses: island-is/cache@v0.3
       with:
         path: ${{ inputs.path }}
@@ -83,7 +83,7 @@ runs:
 
     - name: Gather outputs
       id: computed_outputs
-      if: always()
+      if: ${{ always() }} # We want to always report status, even when cancelled
       shell: bash
       run: |
         if [[ "${{ steps.cache_try_number_one.outputs.success }}" == "true" ]] || \

.github/workflows/config-values.yaml

@@ -36,14 +36,15 @@ jobs:
       - name: Select secret envs to check
         id: select_envs
         run: |
+          set -euo pipefail
           GIT_BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF/refs\/heads\//}}"
           # ENVS=("dev" "staging")
           ENVS=("dev" "staging")
-          if [[ $GIT_BRANCH =~ ^release\/ ]]; then
+          if [[ "$GIT_BRANCH" =~ ^release\/ ]]; then
             echo "Adding prod environments to test set"
             ENVS+=("prod")
           fi
-          ENVS_JSON=$(printf '%s\n' "${ENVS[@]}" | jq -R . | jq -s . | tr -d '[:space:]')
+          ENVS_JSON="$(printf '%s\n' "${ENVS[@]}" | jq -R . | jq -s . | tr -d '[:space:]')"
           echo "ENVS={\"env\":$ENVS_JSON}" >> "$GITHUB_OUTPUT"
 
   helm-values-validation:
@@ -134,7 +135,7 @@ jobs:
           prod: arn:aws:iam::251502586493:role/list-ssm-parameters
           dev: arn:aws:iam::013313053092:role/list-ssm-parameters
           staging: arn:aws:iam::261174024191:role/list-ssm-parameters
-        run: echo "ROLE=$${{ matrix.env }}" >> $GITHUB_ENV
+        run: echo "ROLE=$${{ matrix.env }}" >> "$GITHUB_ENV"
       - name: Get local secrets
         working-directory: infra
         run: node -r esbuild-register src/secrets.ts get-all-required-secrets --env=${{ matrix.env }} >> LOCAL_SECRETS
@@ -174,8 +175,8 @@ jobs:
         working-directory: infra
         shell: /bin/bash {0}
         run: |
-          missing=$(grep -vxFf CLOUD_SECRETS LOCAL_SECRETS)
-          if [[ "$missing" != "" ]]; then
+          set -euo pipefail
+          if missing="$(grep -vxFf CLOUD_SECRETS LOCAL_SECRETS)"; then
             echo "Required secrets not available in environment ${{ matrix.env }}:"
             while IFS= read -r secret ; do echo $secret; done <<< "$missing"
             exit 1

.github/workflows/external-checks.yml

@@ -23,9 +23,10 @@ jobs:
           fetch-depth: 0
       - name: Check if codeowners file changed
         run: |
-          MERGE_BASE=$(git merge-base ${{github.event.pull_request.base.sha}} $GITHUB_SHA)
-          if ! git diff --exit-code --name-only $MERGE_BASE..$GITHUB_SHA .github/CODEOWNERS; then
-            echo "CHECK=true" >> $GITHUB_ENV
+          set -euo pipefail
+          MERGE_BASE="$(git merge-base "${{github.event.pull_request.base.sha}}" "$GITHUB_SHA")"
+          if ! git diff --exit-code --name-only "$MERGE_BASE".."$GITHUB_SHA" .github/CODEOWNERS; then
+            echo "CHECK=true" >> "$GITHUB_ENV"
             if [[ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
               echo "Changes to codeowners are not allowed on forks!"
               exit 1
@@ -34,7 +35,8 @@ jobs:
       - name: Check indentation
         if: env.CHECK == 'true'
         run: |
-          no_different_indentations=$(cat .github/CODEOWNERS | grep -v '^#' | awk NF | sed s/@.*//g | awk '{ print length }' | sort | uniq | wc -l)
+          set -euo pipefail
+          no_different_indentations="$(cat .github/CODEOWNERS | grep -v '^#' | awk NF | sed s/@.*//g | awk '{ print length }' | sort | uniq | wc -l)"
           if [[ "$no_different_indentations" != "1" ]]; then
             echo "CODEOWNERS has $no_different_indentations different indentations."
             echo "Make sure that all teams start in the same column."
@@ -44,7 +46,8 @@ jobs:
       - name: Codeowners validation
         if: env.CHECK == 'true'
         run: |
-          curl -sfL https://raw.githubusercontent.com/mszostok/codeowners-validator/main/install.sh | sh -s -- -b $HOME v0.7.4
+          set -euo pipefail
+          curl -sfL https://raw.githubusercontent.com/mszostok/codeowners-validator/main/install.sh | sh -s -- -b "$HOME" v0.7.4
           REPOSITORY_PATH="." \
           GITHUB_ACCESS_TOKEN="$GH_TOKEN" \
           EXPERIMENTAL_CHECKS="notowned" \

.github/workflows/pullrequest-close.yml

@@ -18,25 +18,28 @@ jobs:
     steps:
       - name: Get git branch
         run: |
+          set -euo pipefail
           GIT_BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF/refs\/heads\//}}"
-          echo "GIT_BRANCH=$GIT_BRANCH" >> $GITHUB_ENV
+          echo "GIT_BRANCH=$GIT_BRANCH" >> "$GITHUB_ENV"
       - name: Generate deployment branch name
         id: git-branch-deploy
         run: |
-          GIT_BRANCH_DEPLOY=$GIT_BRANCH
+          set -euo pipefail
+          GIT_BRANCH_DEPLOY="$GIT_BRANCH"
           if [[ ! ("$GIT_BRANCH_DEPLOY" =~ "feature/") ]]; then
             # If event is pull request but branch is not prefixed with feature/
             GIT_BRANCH_DEPLOY=feature/$GIT_BRANCH_DEPLOY
           fi
           # Avoid too long resource names
-          GIT_BRANCH_DEPLOY=${GIT_BRANCH_DEPLOY:0:50}
-          echo "GIT_BRANCH_DEPLOY=$GIT_BRANCH_DEPLOY" >> $GITHUB_ENV
+          GIT_BRANCH_DEPLOY="${GIT_BRANCH_DEPLOY:0:50}"
+          echo "GIT_BRANCH_DEPLOY=$GIT_BRANCH_DEPLOY" >> "$GITHUB_ENV"
       - name: Clean up feature
         env:
           SPINNAKER_WEBHOOK_TOKEN: ${{ secrets.SPINNAKER_WEBHOOK_TOKEN }}
           SPINNAKER_URL: https://spinnaker-gate.shared.devland.is
         run: |
-          curl $SPINNAKER_URL/webhooks/webhook/feature-cleanup -H "content-type: application/json" --data-binary @- <<BODY
+          set -euo pipefail
+          curl "$SPINNAKER_URL/webhooks/webhook/feature-cleanup" -H "content-type: application/json" --data-binary @- <<BODY
           {
             "token": "$SPINNAKER_WEBHOOK_TOKEN",
             "parameters": {

.github/workflows/pullrequest.yml

@@ -52,19 +52,21 @@ jobs:
 
       - name: Check node version
         run: |
+          set -euo pipefail
           node -v
           ls -l `which node`
       - name: Checking out relevant branches
         run: |
-          git checkout $GITHUB_HEAD_REF
-          git checkout $GITHUB_BASE_REF
-          git checkout $GITHUB_SHA
+          set -euo pipefail
+          git checkout "$GITHUB_HEAD_REF"
+          git checkout "$GITHUB_BASE_REF"
+          git checkout "$GITHUB_SHA"
           git config --global user.email "ci@island.is"
           git config --global user.name "CI Bot"
 
-          BASE_SHA=$(git merge-base HEAD $GITHUB_BASE_REF)
-          HEAD_SHA=$(git merge-base HEAD $GITHUB_HEAD_REF)
-          echo Current base SHA is $BASE_SHA and head SHA is $HEAD_SHA
+          BASE_SHA="$(git merge-base HEAD "$GITHUB_BASE_REF")"
+          HEAD_SHA="$(git merge-base HEAD "$GITHUB_HEAD_REF")"
+          echo "Current base SHA is '$BASE_SHA' and head SHA is '$HEAD_SHA'"
           echo "{\"base_sha\": \"$BASE_SHA\", \"head_sha\":\"$HEAD_SHA\"}" > event.json
 
       # This is to increase the retention days for our GitHub Actions run events
@@ -85,15 +87,16 @@ jobs:
           enable-cache: 'node_modules,cypress,generated-files'
 
       - run: |
-          echo "HEAD=$GITHUB_SHA" >> $GITHUB_ENV
+          set -euo pipefail
+          echo "HEAD=$GITHUB_SHA" >> "$GITHUB_ENV"
           export HEAD_REF="$GITHUB_HEAD_REF"
           export BASE_REF="$GITHUB_BASE_REF"
-          export PR_REF=$GITHUB_SHA
+          export PR_REF="$GITHUB_SHA"
           export SHELL=/usr/bin/bash
           export WORKFLOW_ID=pullrequest
-          source ./scripts/ci/00_prepare-base-tags.sh $(git merge-base HEAD $GITHUB_BASE_REF)
-          git checkout $GITHUB_SHA
-          echo "BASE=$BASE" >> $GITHUB_ENV
+          source ./scripts/ci/00_prepare-base-tags.sh "$(git merge-base HEAD "$GITHUB_BASE_REF")"
+          git checkout "$GITHUB_SHA"
+          echo "BASE=$BASE" >> "$GITHUB_ENV"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HTML_URL: ${{ github.event.pull_request.html_url }}
@@ -110,56 +113,61 @@ jobs:
       - name: Set magic env if test-everything label is set
         if: ${{ contains(github.event.pull_request.labels.*.name, 'test everything') && steps.check-permission.outputs['user-permission'] == 'admin' }}
         run: |
-          echo "AFFECTED_ALL=7913-$GITHUB_HEAD_REF" >> $GITHUB_ENV
+          echo "AFFECTED_ALL=7913-$GITHUB_HEAD_REF" >> "$GITHUB_ENV"
 
       - name: Warn if user does not have the required permissions
         if: ${{ contains(github.event.pull_request.labels.*.name, 'test everything') && steps.check-permission.outputs['user-permission'] != 'admin' }}
         run: |
           echo "## WARN permissions" >> "$GITHUB_STEP_SUMMARY"
-          echo "User $GITHUB_ACTOR does not have the required permissions to apply the 'test everything' label" >> "$GITHUB_STEP_SUMMARY"
+          echo "User '$GITHUB_ACTOR' does not have the required permissions to apply the 'test everything' label" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Prepare lint targets
         id: lint_projects
         run: |
-          CHUNKS=$(./scripts/ci/generate-chunks.sh lint)
-          if [[ $CHUNKS != "[]" ]]; then
-            echo "CHUNKS={\"projects\":$CHUNKS}" >> $GITHUB_OUTPUT
+          set -euo pipefail
+          CHUNKS="$(./scripts/ci/generate-chunks.sh lint)"
+          if [[ "$CHUNKS" != "[]" ]]; then
+            echo "CHUNKS={\"projects\":$CHUNKS}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Prepare test targets
         id: test_projects
         run: |
-          CHUNKS=$(./scripts/ci/generate-chunks.sh test)
-          if [[ $CHUNKS != "[]" ]]; then
-            echo "CHUNKS={\"projects\":$CHUNKS}" >> $GITHUB_OUTPUT
+          set -euo pipefail
+          CHUNKS="$(./scripts/ci/generate-chunks.sh test)"
+          if [[ "$CHUNKS" != "[]" ]]; then
+            echo "CHUNKS={\"projects\":$CHUNKS}" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Prepare e2e targets
         id: e2e_projects
         env:
           CHUNK_SIZE: 1
         run: |
-          CHUNKS=$(./scripts/ci/generate-chunks.sh e2e-ci)
-          if [[ $CHUNKS != "[]" ]]; then
-            echo "CHUNKS={\"projects\":$CHUNKS}" >> $GITHUB_OUTPUT
+          set -euo pipefail
+          CHUNKS="$(./scripts/ci/generate-chunks.sh e2e-ci)"
+          if [[ "$CHUNKS" != "[]" ]]; then
+            echo "CHUNKS={\"projects\":$CHUNKS}" >> "$GITHUB_OUTPUT"
           fi
-          echo "BUILD_ID=$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER-$(uuidgen)" >> $GITHUB_OUTPUT
+          echo BUILD_ID="$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER-$(uuidgen)" >> "$GITHUB_OUTPUT"
 
       - name: Prepare build targets
         id: build_projects
         env:
           CHUNK_SIZE: 4
         run: |
-          CHUNKS=$(./scripts/ci/generate-chunks.sh build)
-          if [[ $CHUNKS != "[]" ]]; then
-            echo "CHUNKS={\"projects\":$CHUNKS}" >> $GITHUB_OUTPUT
+          set -euo pipefail
+          CHUNKS="$(./scripts/ci/generate-chunks.sh build)"
+          if [[ "$CHUNKS" != "[]" ]]; then
+            echo "CHUNKS={\"projects\":$CHUNKS}" >> "$GITHUB_OUTPUT"
           fi
       - name: Check release-manager approval
         id: check-release-manager-approval
         if: ${{ contains(github.event.pull_request.labels.*.name, 'automerge') && contains(github.event.pull_request.head.ref, '/pre-release/') }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          set -euo pipefail
           node -r esbuild-register .github/actions/check-team-approval.ts release-managers
   tests:
     needs:
@@ -240,7 +248,7 @@ jobs:
           enable-cache: 'node_modules,cypress,generated-files'
 
       - name: Running e2e tests
-        run: ./scripts/ci/40_e2e.sh ${AFFECTED_PROJECT}
+        run: ./scripts/ci/40_e2e.sh "${AFFECTED_PROJECT}"
 
   linting-workspace:
     needs:
@@ -391,7 +399,7 @@ jobs:
     runs-on: ec2-runners
     container:
       image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest
-    if: always()
+    if: ${{ !cancelled() }}
     needs:
       - prepare
       - linting-workspace