Deploy to prod

.github/actions/setup-helmfile/action.yaml

@@ -5,7 +5,7 @@ runs:
   steps:
     - name: install helmfile
       run: |
-        curl -L https://github.com/helmfile/helmfile/releases/download/v1.1.3/helmfile_1.1.3_linux_amd64.tar.gz -o helmfile.tar.gz
+        curl -L https://github.com/helmfile/helmfile/releases/download/v1.2.2/helmfile_1.2.2_linux_amd64.tar.gz -o helmfile.tar.gz
         tar -xvf /tmp/helmfile.tar.gz
         mv helmfile /usr/local/bin
         chmod +x /usr/local/bin/helmfile

.github/workflows/continuous-integration-optional.yml

@@ -45,7 +45,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -75,7 +75,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -123,7 +123,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}

.github/workflows/continuous-integration.yml

@@ -100,7 +100,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -126,7 +126,7 @@ jobs:
         with:
           node-version: '24.12.0'
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -155,7 +155,7 @@ jobs:
         with:
           node-version: '24.12.0'
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -184,7 +184,7 @@ jobs:
         with:
           node-version: '24.12.0'
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -216,7 +216,7 @@ jobs:
         with:
           node-version: '24.12.0'
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -274,7 +274,7 @@ jobs:
         run: 'echo "dir=$(composer config cache-files-dir)" | tr -d "\n" >> $GITHUB_OUTPUT'
         working-directory: api
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -355,7 +355,7 @@ jobs:
         with:
           node-version: '24.12.0'
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -398,7 +398,7 @@ jobs:
         with:
           node-version: '24.12.0'
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -437,7 +437,7 @@ jobs:
         with:
           node-version: '24.12.0'
 
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      - uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

.github/workflows/deploy-ops-dashboard.yml

@@ -53,6 +53,19 @@ jobs:
           jq '.' env.yaml
         working-directory: .ops/ops-dashboard
 
+      - name: pin helm to correct version
+        run: |
+          helm version
+
+          curl -o /tmp/helm.tar.gz -sL https://get.helm.sh/helm-v4.0.1-linux-amd64.tar.gz
+          echo "e0365548f01ed52a58a1181ad310b604a3244f59257425bb1739499372bdff60 /tmp/helm.tar.gz" | sha256sum --check
+
+          tar -xzf /tmp/helm.tar.gz -C /tmp/
+          mv /tmp/linux-amd64/helm /usr/local/bin/helm
+
+          chmod +x /usr/local/bin/helm
+          helm version
+
       - name: Setup helm
         run: |
           mkdir ~/.kube && echo '${{ secrets.KUBECONFIG }}' > ~/.kube/config && chmod go-r ~/.kube/config

.github/workflows/reusable-e2e-tests-build.yml

@@ -30,7 +30,7 @@ jobs:
           cache-to: type=gha,scope=api,mode=max
           outputs: type=docker,dest=/tmp/ecamp3-dev-api.tar
 
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v6
         with:
           name: e2e-tests-images
           path: /tmp/ecamp3-dev-*.tar

.github/workflows/reusable-e2e-tests-run.yml

@@ -31,7 +31,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Restore tmp folder
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: e2e-tests-images
           path: /tmp
@@ -42,7 +42,7 @@ jobs:
           docker image ls -a --digests
 
       - name: Restore cache volumes (npm, composer)
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5
         with:
           path: .cache
           key: docker-compose-${{ hashFiles('frontend/package-lock.json', 'print/package-lock.json', 'api/composer.lock') }}-${{ matrix.browser }}
@@ -79,7 +79,7 @@ jobs:
         if: always()
 
       # store screenshots and videos on GitHub as artifacts, for downloading and debugging in case of problems
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v6
         if: always()
         with:
           name: cypress-output-${{ matrix.browser }}${{ inputs.run-identifier != null && format('-{0}', inputs.run-identifier) }}

.helm/ecamp3/env.example.yaml

@@ -1,4 +1,5 @@
 {
+  "API_AUTHENTICATION_TOKEN_TTL": null,
   "API_CACHE_ENABLED": true,
   "API_DATA_MIGRATIONS_DIR": "dev-data",
   "API_NUM_THREADS": null,

.helm/ecamp3/templates/api_configmap.yaml

@@ -7,7 +7,7 @@ metadata:
     {{- include "app.commonLabels" . | nindent 4 }}
 data:
   ADDITIONAL_TRUSTED_HOSTS: {{ .Values.domain | quote }}
-  {{- if not (.Values.api.authenticationTokenTtl | empty) }}
+  {{- if and (.Values.api.authenticationTokenTtl) (ne (.Values.api.authenticationTokenTtl | toString) "<no value>") }}
   AUTHENTICATION_TOKEN_TTL: {{ .Values.api.authenticationTokenTtl | quote }}
   {{- end }}
   COOKIE_PREFIX: {{ include "api.cookiePrefix" . | quote }}

.helm/ecamp3/values.yaml.gotmpl

@@ -25,6 +25,7 @@ featureToggle:
   checklist: {{ .Environment.Values | getOrNil "FEATURE_CHECKLIST" | default false }}
 
 api:
+  authenticationTokenTtl: {{ .Environment.Values | getOrNil "API_AUTHENTICATION_TOKEN_TTL" }}
   dataMigrationsDir: {{ .Environment.Values | getOrNil "API_DATA_MIGRATIONS_DIR" | default "prod-data" }}
   subpath: "/api"
   image:
@@ -126,10 +127,10 @@ browserless:
   enabled: true
   domain:
   image:
-    repository: "ghcr.io/browserless/chrome"
+    repository: "ghcr.io/browserless/chromium"
     pullPolicy: IfNotPresent
-    # renovate: datasource=docker depName=ghcr.io/browserless/chrome
-    tag: "v2.34.1"
+    # renovate: datasource=docker depName=ghcr.io/browserless/chromium
+    tag: "v2.38.2"
   service:
     type: ClusterIP
     port: 3000

.ops/aws-setup/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   aws-setup:
-    image: pulumi/pulumi-nodejs:3.212.0
+    image: pulumi/pulumi-nodejs:3.213.0
     container_name: 'ecamp3-aws-setup'
     volumes:
       - ../../.prettierrc:/.prettierrc:delegated
@@ -13,7 +13,7 @@ services:
       - AWS_DEFAULT_REGION=eu-west-3
 
   aws-cli:
-    image: amazon/aws-cli:2.32.16
+    image: amazon/aws-cli:2.32.22
     container_name: 'ecamp3-aws-cli'
     volumes:
       - ./.aws:/root/.aws:delegated