Release 20260508 hotfix

[chrisdoehring]

@marianobrc this is a hotfix I pushed to rectify a bug I introduced in my last PR (re: adding a uniqueness constraint on IntegrationConfiguration).

...and here is Claude's explanation below:

This pull request improves the validation logic for integration configuration updates, ensuring more user-friendly error handling and preventing duplicate or conflicting configurations. It also adds targeted tests to cover these scenarios and disables redundant validation that conflicted with the intended API design.

Validation improvements:

• Disabled the auto-generated UniqueTogetherValidator in IntegrationConfigurationCreateUpdateSerializer.Meta to prevent it from incorrectly requiring the integration field, since this field is implied by the URL and handled elsewhere.
• Enhanced the validate method in IntegrationCreateUpdateSerializer to:
  • Return a clear 400 error if a PATCH request tries to add a new configuration for an action that already exists, avoiding a database-level 500 error.
  • Return a 400 error if the request payload contains duplicate configurations for the same action.
• Hardened update() so an action echoed back alongside an id cannot silently repoint an existing configuration row — it's popped before reaching update_or_create. Pairs with the validation above so a row's (integration, action) identity is effectively immutable once created.

Test coverage:

• Added tests to verify:
  • The API accepts payloads that omit the integration field in configuration items, matching the expected portal behavior.
  • The API returns a 400 error for attempts to add a new configuration for an action that already exists.
  • The API returns a 400 error for duplicate actions in the same payload.
  • PATCH with a config id that belongs to a different integration returns 400 (rather than silently repointing the row).
  • PATCH with id + a different action is accepted, but the row's action is NOT repointed — only data updates.

CI/CD pipeline migration (DASOPS-2057)

Beyond the serializer hotfix, this release branch also picks up the operational work tracked under DASOPS-2057. Splitting it out at this point isn't practical — the release-20260508 branch is the cutoff for this release and the CI/CD migration needs to ride along — so calling it out here explicitly:

• Container registry: build/push targets the new serca-artifact-registry (single regional registry) instead of the legacy registry path.
• Deploy jobs: stage and prod deploys flip from the legacy GKE-credentialed workflow to the ArgoCD image-bump reusable workflow.
• Approval gate: a manual approve_prod job now guards production deploys (previously implicit via branch protections).
• deploy_prod_legacy retained as a fallback path with direct GKE credentials in case the ArgoCD-driven prod deploy needs to be bypassed during the cutover window.

Operational prerequisites already in place: the serca-artifact-registry GCP project + IAM bindings for the workflow's service account, and the GitHub environment(s) referenced by approve_prod. No new application secrets are required by this PR.

[Copilot]

Pull request overview

This PR adjusts the integrations v2 update/create validation flow to better match the portal’s payload shape (configuration items omitting integration) and to proactively reject conflicting configuration updates with clearer 400-level validation errors.

Changes:

• Disabled DRF’s auto-generated UniqueTogetherValidator for IntegrationConfigurationCreateUpdateSerializer to avoid incorrectly requiring integration in nested configuration payloads.
• Added request-level validation in IntegrationCreateUpdateSerializer.validate() to reject (a) adding a new configuration for an action that already has one and (b) duplicate actions in the same request payload.
• Added targeted API tests for the above scenarios.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
cdip_admin/api/v2/serializers.py	Disables nested unique-together validator and adds additional validation for PATCH/create payloads (duplicate actions, conflicting new configs).
cdip_admin/api/v2/tests/test_integrations_api.py	Adds regression and validation tests for portal-shaped payloads and duplicate/conflicting configuration updates.

Comments suppressed due to low confidence (1)

cdip_admin/api/v2/serializers.py:532

• When an item includes an id, the code does IntegrationConfiguration.objects.get(id=...) without scoping to self.instance (the integration being patched). This allows a client to reference a configuration from a different integration (and potentially reassign it in update_or_create), and a nonexistent id will raise DoesNotExist and surface as a 500. Prefer fetching with IntegrationConfiguration.objects.get(id=..., integration=self.instance) (when self.instance is set) and raising a ValidationError if not found/belongs to a different integration.

            if self.instance and "id" in configuration:  # Integration Update
                action = IntegrationConfiguration.objects.get(id=configuration["id"]).action
            else:  # Create a new integration or new config

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chrisdoehring]

Addressing the three review comments here: #413 (into release-20260508, will flow into this PR on merge).

Summary of fixes:

1. Scoped id lookup — IntegrationConfiguration.objects.get(id=...) now uses self.instance.configurations.get(id=...), so a bogus id surfaces as a 400 instead of a 500, and an id from a different integration is rejected rather than being repointed by update_or_create's defaults.

2. Freeze action on id-updates — update() now pops action from defaults when id is present. The portal sometimes echoes back action alongside id for client convenience; it's now correctly ignored instead of (silently) trying to repoint the row's action.

3. Tighter test assertions — switched from str(response.json()) to response.json()["non_field_errors"][0].

Three new regression tests added: unknown id, cross-integration id, and action-repointing attempt.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.