Merge branch 'main' into fix-columbia-merger

.env.example

@@ -42,3 +42,6 @@ IA_ACCESS_KEY=""
 IA_SECRET_KEY=""
 
 FTM_KEY=""
+
+# CL API key for cloning data
+CL_API_TOKEN=""

.github/workflows/codeql-analysis.yml

@@ -24,15 +24,14 @@ jobs:
     # `github/codeql-action/init`)
     - uses: actions/setup-python@v5
       with:
-        python-version: '3.12'
+        python-version: '3.13'
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3
       with:
         languages: python
         config-file: ./.github/codeql-config.yml
-        setup-python-dependencies: true
 
     - name: Perform CodeQL Analysis
       uses: github/codeql-action/analyze@v3

.github/workflows/docker-build.yml

@@ -121,11 +121,21 @@ jobs:
       - name: Watch cl-retry-webhooks rollout status
         run: kubectl rollout status -n ${{ env.EKS_NAMESPACE }} deployment/cl-retry-webhooks
 
+      - name: Rollout cl-send-rt-percolator-alerts
+        run: kubectl set image -n ${{ env.EKS_NAMESPACE }} deployment/cl-send-rt-percolator-alerts cl-send-rt-percolator-alerts=freelawproject/courtlistener:${{ steps.vars.outputs.sha_short }}-prod
+      - name: Watch cl-send-rt-percolator-alerts rollout status
+        run: kubectl rollout status -n ${{ env.EKS_NAMESPACE }} deployment/cl-send-rt-percolator-alerts
+
       - name: Rollout cl-es-sweep-indexer
         run: kubectl set image -n ${{ env.EKS_NAMESPACE }} deployment/cl-es-sweep-indexer sweep-indexer=freelawproject/courtlistener:${{ steps.vars.outputs.sha_short }}-prod
       - name: Watch cl-es-sweep-indexer rollout status
         run: kubectl rollout status -n ${{ env.EKS_NAMESPACE }} deployment/cl-es-sweep-indexer
 
+      - name: Rollout cl-iquery-probe
+        run: kubectl set image -n ${{ env.EKS_NAMESPACE }} deployment/cl-iquery-probe cl-iquery-probe=freelawproject/courtlistener:${{ steps.vars.outputs.sha_short }}-prod
+      - name: Watch cl-iquery-probe rollout status
+        run: kubectl rollout status -n ${{ env.EKS_NAMESPACE }} deployment/cl-iquery-probe
+
 
       # Watch "cronjobs" in k9s
       - name: Update cronjobs

.github/workflows/flp-dependencies-pr.yml

@@ -13,7 +13,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.x'
+          python-version: '>= 3.13'
 
       - name: Install Poetry
         run: |

.github/workflows/lint.yml

@@ -17,12 +17,12 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           # Once codebase is updated, this can easily be changed to any specific version.
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install Poetry
         uses: snok/install-poetry@v1
         with:
-          version: 1.8.3
+          version: 1.8.4
           virtualenvs-create: true
           virtualenvs-in-project: true
 

.github/workflows/tests.yml

@@ -11,6 +11,39 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    steps:
+      - name: Check out CourtListener
+        uses: actions/checkout@v4
+        with:
+          path: courtlistener
+
+      # Build docker image
+      - name: Set up docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Build docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./courtlistener
+          file: ./courtlistener/docker/django/Dockerfile
+          push: false # This image is for testing only
+          tags: courtlistener:latest
+          outputs: type=docker,dest=/tmp/courtlistener.tar
+          build-args: |
+            BUILD_ENV=dev
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: courtlistener
+          path: /tmp/courtlistener.tar
+          compression-level: 0
+          retention-days: 1
+
+  test:
+    runs-on: ubuntu-latest
+    needs: build
     strategy:
       fail-fast: false
       matrix:
@@ -50,30 +83,25 @@ jobs:
       - name: Echo github actor name for debugging
         run: echo ${{ github.actor }}
 
-      # Build and cache docker images so tests are always run on the latest
-      # dependencies
       - name: Set up docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver-opts: network=host
-      - name: Prebuild docker images
-        uses: docker/build-push-action@v5
-        with:
-          context: ./courtlistener
-          file: ./courtlistener/docker/django/Dockerfile
-          load: true
-          build-args: |
-            BUILD_ENV=dev
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
 
       # Prepare Docker images
       - name: Pull docker images
         working-directory: courtlistener/docker/courtlistener
         run: docker compose pull --quiet --ignore-buildable
-      - name: Build docker images
+      - name: Download courtlistener image
+        uses: actions/download-artifact@v4
+        with:
+          name: courtlistener
+          path: /tmp
+      - name: Load courtlistener image
+        run: docker load --input /tmp/courtlistener.tar
+      - name: Build cl-postgresql images # TODO: replace with an off-the-shelf image. Until then, build now for later steps.
         working-directory: courtlistener/docker/courtlistener
-        run: docker compose build
+        run: docker compose build cl-postgresql
       - name: List docker images
         run: docker image ls -a --no-trunc
 
@@ -82,7 +110,8 @@ jobs:
         run: docker network create -d bridge --attachable cl_net_overlay
       - name: Start docker containers
         working-directory: courtlistener/docker/courtlistener
-        run: docker compose -f docker-compose.yml -f docker-compose.tmpfs.yml up -d --no-build --pull=never
+        run: > # don't build, rather use loaded image from build step, specified by merging overriding config
+          docker compose -f docker-compose.yml -f docker-compose.tmpfs.yml -f <(echo 'services: { cl-django: { image: "courtlistener" }, cl-celery: { image: "courtlistener" } }') up -d --no-build --pull=never
       - name: List docker containers
         run: docker ps -a --no-trunc
       - name: Show the docker startup logs
@@ -97,21 +126,22 @@ jobs:
           docker exec -e SELENIUM_DEBUG=1 -e SELENIUM_TIMEOUT=30 cl-django
           python /opt/courtlistener/manage.py test
           cl --verbosity=2 ${{ matrix.tag_flags }} --parallel
-      - name: cp selenium results from docker to host
+      - name: Export selenium results from docker to host
         if: failure()
         run: |
           # This is annoying b/c docker cp doesn't support globs. See:
           # https://stackoverflow.com/q/35806102/
           # https://github.com/moby/moby/issues/7710
           mkdir selenium-screenshots
-          docker exec cl-django bash -c "mkdir /extract && mv /tmp/*-selenium.png /extract"
+          docker exec cl-django bash -c "mkdir /extract && mv /tmp/*-selenium.png /extract ||:"
           docker cp 'cl-django:/extract' selenium-screenshots/
       - name: Save selenium screenshot as Github artifacts
         uses: actions/upload-artifact@master
         if: failure()
         with:
           name: selenium-screenshots
           path: selenium-screenshots/extract
+          if-no-files-found: ignore
 
 # Cancel the current workflow (tests) for pull requests (head_ref) only. See:
 # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-a-fallback-value

.pre-commit-config.yaml

@@ -2,7 +2,7 @@
 # See https://pre-commit.com/hooks.html for more hooks
 exclude: migrations
 default_language_version:
-  python: "python3.12"
+  python: "python3.13"
 ci:
   autoupdate_schedule: quarterly
 repos:

cl/alerts/api_views.py

@@ -7,15 +7,15 @@
 )
 from cl.alerts.filters import DocketAlertFilter, SearchAlertFilter
 from cl.alerts.models import Alert, DocketAlert
-from cl.api.api_permissions import IsOwner
+from cl.api.api_permissions import IsOwner, V3APIPermission
 from cl.api.pagination import MediumAdjustablePagination
 from cl.api.utils import LoggingMixin
 
 
 class SearchAlertViewSet(LoggingMixin, ModelViewSet):
     """A ModelViewset to handle CRUD operations for SearchAlerts."""
 
-    permission_classes = [IsOwner, IsAuthenticated]
+    permission_classes = [IsOwner, IsAuthenticated, V3APIPermission]
     serializer_class = SearchAlertSerializer
     pagination_class = MediumAdjustablePagination
     filterset_class = SearchAlertFilter
@@ -42,7 +42,7 @@ def get_queryset(self):
 class DocketAlertViewSet(LoggingMixin, ModelViewSet):
     """A ModelViewset to handle CRUD operations for DocketAlerts."""
 
-    permission_classes = [IsOwner, IsAuthenticated]
+    permission_classes = [IsOwner, IsAuthenticated, V3APIPermission]
     serializer_class = DocketAlertSerializer
     pagination_class = MediumAdjustablePagination
     filterset_class = DocketAlertFilter