Deploy Release version v2026.06.15.01 to Prod

.github/workflows/draft-new-release.yml

@@ -6,6 +6,9 @@ on:
       version:
         description: "The version you want to release."
         required: true
+permissions:
+  id-token: write  # required for OIDC token exchange
+  contents: read
 
 jobs:
   draft-new-release:
@@ -15,9 +18,25 @@ jobs:
     outputs:
           commitSha: ${{ steps.make-commit.outputs.commit }}
     steps:
+      - name: Configure AWS Credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::730335206644:role/delegatedadmin/developer/qppa-github-actions-role
+          aws-region: us-east-1
+
+      - name: Retrieve GitHub service account token from secops account
+        id: get-token
+        run: |
+          SECRET_VALUE=$(aws secretsmanager get-secret-value \
+            --secret-id "arn:aws:secretsmanager:us-east-1:863249929524:secret:qpp/qppa/github/token/automation-bhLO2e" \
+            --query SecretString \
+            --output text | jq -r ".GITHUB_TOKEN")
+          echo "::add-mask::$SECRET_VALUE"
+          echo "GITHUB_TOKEN=$SECRET_VALUE" >> $GITHUB_OUTPUT
+
       - uses: actions/checkout@v4
         with:
-          token: ${{ secrets.ACTIONS_NICHOLAS_PAT }}
+          token: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
 
       - name: Create release branch
         run: |
@@ -33,7 +52,7 @@ jobs:
           prerelease: false
           publish: false
         env:
-          GITHUB_TOKEN: ${{ secrets.ACTIONS_NICHOLAS_PAT }}
+          GITHUB_TOKEN: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
 
       - name: Set up JDK 21
         uses: actions/setup-java@v4
@@ -44,11 +63,11 @@ jobs:
 
       - name: Bump version in pom.xml files
         run: |
-          
+
           # Update parent and child module pom.xml files
           echo "Updating version in parent and module pom.xml files to ${{ github.event.inputs.version }}-RELEASE..."
           mvn versions:set -DnewVersion=${{ github.event.inputs.version }}-RELEASE -DgenerateBackupPoms=false
-          
+
           # Update standalone module pom.xml files
           echo "Updating standalone module versions..."
           mvn versions:set -DnewVersion=${{ github.event.inputs.version }}-RELEASE -DgenerateBackupPoms=false -f acceptance-tests/pom.xml
@@ -79,7 +98,7 @@ jobs:
       - name: Create pull request to master branch
         uses: thomaseizinger/create-pull-request@1.4.0
         env:
-          GITHUB_TOKEN: ${{ secrets.ACTIONS_NICHOLAS_PAT }} # MUST use a PAT here in order to trigger the next workflow: CodeBuild Trigger; see https://docs.github.com/en/actions/using-workflows/triggering-a-workflow
+          GITHUB_TOKEN: ${{ steps.get-token.outputs.GITHUB_TOKEN }} # MUST use a PAT here in order to trigger the next workflow: CodeBuild Trigger; see https://docs.github.com/en/actions/using-workflows/triggering-a-workflow
         with:
           head: release/v${{ github.event.inputs.version }}
           base: master

.github/workflows/publish-release.yml

@@ -5,16 +5,36 @@ on:
     branches:
       - master
 
+permissions:
+  id-token: write  # required for OIDC token exchange
+  contents: read
+
 jobs:
   publish_and_backfill:
     name: Publish GitHub release and create backfill PR
     runs-on: ubuntu-latest
     steps:
-
+      - name: Configure AWS Credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::730335206644:role/delegatedadmin/developer/qppa-github-actions-role
+          aws-region: us-east-1
+
+      - name: Retrieve GitHub service account token from secops account
+        id: get-token
+        run: |
+          SECRET_VALUE=$(aws secretsmanager get-secret-value \
+            --secret-id "arn:aws:secretsmanager:us-east-1:863249929524:secret:qpp/qppa/github/token/automation-bhLO2e" \
+            --query SecretString \
+            --output text | jq -r ".GITHUB_TOKEN")
+          echo "::add-mask::$SECRET_VALUE"
+          echo "GITHUB_TOKEN=$SECRET_VALUE" >> $GITHUB_OUTPUT
+
       - name: Checkout codebase
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
 
       - name: Get latest draft release
         id: get_release
@@ -23,24 +43,40 @@ jobs:
           RELEASE_DATA=$(gh release list --limit 1 --json isDraft,tagName,name | jq -r '.[0]')
           IS_DRAFT=$(echo "$RELEASE_DATA" | jq -r '.isDraft')
           TAG_NAME=$(echo "$RELEASE_DATA" | jq -r '.tagName')
-          
+
           echo "is_draft=${IS_DRAFT}" >> $GITHUB_OUTPUT
           echo "tag_name=${TAG_NAME}" >> $GITHUB_OUTPUT
           echo "Found release: ${TAG_NAME} (draft: ${IS_DRAFT})"
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
 
       - name: Publish draft release
         if: steps.get_release.outputs.is_draft == 'true'
         run: |
           gh release edit ${{ steps.get_release.outputs.tag_name }} --draft=false --latest
           echo "Published release ${{ steps.get_release.outputs.tag_name }} as latest"
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
   backfill:
     name: Backfill master to develop branch
     runs-on: ubuntu-latest
     steps:
+      - name: Configure AWS Credentials via OIDC
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: arn:aws:iam::730335206644:role/delegatedadmin/developer/qppa-github-actions-role
+          aws-region: us-east-1
+
+      - name: Retrieve GitHub service account token from secops account
+        id: get-token
+        run: |
+          SECRET_VALUE=$(aws secretsmanager get-secret-value \
+            --secret-id "arn:aws:secretsmanager:us-east-1:863249929524:secret:qpp/qppa/github/token/automation-bhLO2e" \
+            --query SecretString \
+            --output text | jq -r ".GITHUB_TOKEN")
+          echo "::add-mask::$SECRET_VALUE"
+          echo "GITHUB_TOKEN=$SECRET_VALUE" >> $GITHUB_OUTPUT
+
       - name: Check params
         run: |
           echo "head.ref = ${{github.event.pull_request.head.ref}}"
@@ -49,7 +85,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: master
-          token: ${{ secrets.ACTIONS_NICHOLAS_PAT }}
+          token: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
 
       - name: Create backfill branch
         run: git checkout -b backfill/master;
@@ -62,14 +98,14 @@ jobs:
 
       - name: Push backfill branch
         env:
-          GITHUB_TOKEN: ${{ secrets.ACTIONS_NICHOLAS_PAT }}
+          GITHUB_TOKEN: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
         run: |
           git push origin backfill/master
 
       - name: Create backfill pull request to develop branch
         uses: thomaseizinger/create-pull-request@1.4.0
         with:
-          github_token: ${{ secrets.ACTIONS_NICHOLAS_PAT }}
+          github_token: ${{ steps.get-token.outputs.GITHUB_TOKEN }}
           head: backfill/master
           base: develop
           draft: true

DockerfileTest

@@ -38,6 +38,10 @@ COPY --from=builder /usr/src/app/rest-api/target/rest-api.jar /usr/src/run/rest-
 # Copy test runtime artifacts, including qppConverterTest.sh.
 COPY --from=builder /usr/src/app/tools/docker/docker-test-artifacts/ /usr/src/run/
 
+# Copy test profile config and SSL keystore so Spring Boot can load external test settings.
+COPY --from=builder /usr/src/app/rest-api/src/test/resources/application.properties /usr/src/run/application-test.properties
+COPY --from=builder /usr/src/app/rest-api/src/test/resources/test-keystore.p12 /usr/src/run/
+
 # Fix the startup script for Alpine runtime:
 # 1. Remove Windows CRLF line endings if present.
 # 2. Replace #!/bin/bash with #!/bin/sh because Alpine does not include bash by default.

SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+We always recommend users to upgrade to the latest revision. All security vulnerability fixes will be addressed as quickly as possible using a patch release.
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| >= 2026.03.31.01-RELEASE | ✅ |
+| < 2026.03.31.01-RELEASE  | ❌ |
+
+## Reporting a Vulnerability
+
+If you believe that you've found a security vulnerability in the codebase
+or one of the libraries maintained in this repository, please create an issue and provide details of the bug. For guidelines refer [SUPPORT.md](./.github/SUPPORT.md)

acceptance-tests/pom.xml

@@ -3,7 +3,7 @@
     <modelVersion>4.0.0</modelVersion>
 	<artifactId>acceptance-tests</artifactId>
 	<groupId>gov.cms.qpp.conversion</groupId>
-	<version>2026.05.01.01-RELEASE</version>
+	<version>2026.06.15.01-RELEASE</version>
 	<name>conversion-tests</name>
 	<packaging>jar</packaging>
 	<properties>
@@ -12,6 +12,17 @@
 		<cucumber.version>4.2.5</cucumber.version>
 	</properties>
 
+	<dependencyManagement>
+		<dependencies>
+			<!-- Override Selenium's vulnerable transitive OpenTelemetry API version. -->
+			<dependency>
+				<groupId>io.opentelemetry</groupId>
+				<artifactId>opentelemetry-api</artifactId>
+				<version>1.62.0</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
@@ -49,7 +60,7 @@
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-web</artifactId>
-            <version>6.2.18</version>
+			<version>6.2.19</version>
         </dependency>
 
         <dependency>

buildspec/build_deploy.yaml

@@ -14,12 +14,14 @@ env:
     DOCKERHUB_TOKEN: "/global/dockerhub_token"
     DOCKERHUB_USER: "/global/dockerhub_user"
     AWS_ACCOUNT : "/global/aws_account"
-    REPO_PAT: "/global/scoring_api_repo_pat"
     BRANCH_STATUS_URL: "/global/ct_branch_status_url"
     PART_FILE: "/qppar-sf/conversion-tool/CPC_PLUS_FILE_NAME"
     PART_FILE_BUCKET: "/qppar-sf/$ENV/conversion-tool/CPC_PLUS_BUCKET_NAME"
     OUTPUT_PART_FILE: "/qppar-sf/$ENV/conversion-tool/CPC_PLUS_VALIDATION_FILE"
 
+  secrets-manager:
+    REPO_PAT: "arn:aws:secretsmanager:us-east-1:863249929524:secret:qpp/qppa/github/token/automation-bhLO2e:GITHUB_TOKEN"
+
 phases:
   install:
     runtime-versions:

buildspec/pr_build.yaml

@@ -9,7 +9,9 @@ env:
   parameter-store:
     DOCKERHUB_TOKEN: "/global/dockerhub_token"
     DOCKERHUB_USER: "/global/dockerhub_user"
-    SCORING_REPO_PAT: "/global/scoring_api_repo_pat"
+
+  secrets-manager:
+    REPO_PAT: "arn:aws:secretsmanager:us-east-1:863249929524:secret:qpp/qppa/github/token/automation-bhLO2e:GITHUB_TOKEN"
 
 phases:
   install:
@@ -27,7 +29,7 @@ phases:
           curl \
             -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${SCORING_REPO_PAT}" \
+            -H "Authorization: Bearer ${REPO_PAT}" \
             ${BRANCH_STATUSES_URL} \
             -d "${CURL_PAYLOAD}"
       - node -v
@@ -69,6 +71,6 @@ phases:
           curl \
             -X POST \
             -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${SCORING_REPO_PAT}" \
+            -H "Authorization: Bearer ${REPO_PAT}" \
             ${BRANCH_STATUSES_URL} \
             -d "${CURL_PAYLOAD}"

commandline/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>gov.cms.qpp.conversion</groupId>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
-		<version>2026.05.01.01-RELEASE</version>
+		<version>2026.06.15.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

commons/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>gov.cms.qpp.conversion</groupId>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
-		<version>2026.05.01.01-RELEASE</version>
+		<version>2026.06.15.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

converter/pom.xml

@@ -6,7 +6,7 @@
 	<parent>
 		<groupId>gov.cms.qpp.conversion</groupId>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
-		<version>2026.05.01.01-RELEASE</version>
+		<version>2026.06.15.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 

generate-race-cpcplus/pom.xml

@@ -6,7 +6,7 @@
 
 	<groupId>gov.cms.qpp.conversion</groupId>
 	<artifactId>generateRaceCpcPlus</artifactId>
-	<version>2026.05.01.01-RELEASE</version>
+	<version>2026.06.15.01-RELEASE</version>
 	<name>generate-race-cpcplus</name>
 	<packaging>jar</packaging>
 

generate/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<artifactId>qpp-conversion-tool-parent</artifactId>
 		<groupId>gov.cms.qpp.conversion</groupId>
-		<version>2026.05.01.01-RELEASE</version>
+		<version>2026.06.15.01-RELEASE</version>
 		<relativePath>../pom.xml</relativePath>
 	</parent>
 	<modelVersion>4.0.0</modelVersion>

pom.xml

@@ -6,7 +6,7 @@
 	<groupId>gov.cms.qpp.conversion</groupId>
 	<artifactId>qpp-conversion-tool-parent</artifactId>
 	<packaging>pom</packaging>
-	<version>2026.05.01.01-RELEASE</version>
+	<version>2026.06.15.01-RELEASE</version>
 	<name>QPP Conversion Tool</name>
 
 	<properties>
@@ -15,6 +15,9 @@
 		<junit.version>5.11.4</junit.version>
 		<junit.platform.version>1.11.4</junit.platform.version>
 		<jjwt.version>0.10.7</jjwt.version>
+		<spring.framework.version>6.2.19</spring.framework.version>
+		<spring.security.version>6.5.11</spring.security.version>
+		<tomcat.embed.version>10.1.55</tomcat.embed.version>
 
 		<requiredCodeCoverage>0.90</requiredCodeCoverage>
 		<verificationsPhase>verify</verificationsPhase>
@@ -511,25 +514,25 @@
 			<dependency>
 				<groupId>org.springframework.security</groupId>
 				<artifactId>spring-security-web</artifactId>
-				<version>6.5.9</version>
+				<version>${spring.security.version}</version>
 			</dependency>
 
 			<dependency>
 				<groupId>org.springframework</groupId>
 				<artifactId>spring-webmvc</artifactId>
-				<version>6.2.18</version>
+				<version>${spring.framework.version}</version>
 			</dependency>
 
 			<dependency>
 				<groupId>org.springframework</groupId>
 				<artifactId>spring-web</artifactId>
-				<version>6.2.18</version>
+				<version>${spring.framework.version}</version>
 			</dependency>
 
 			<dependency>
 				<groupId>org.springframework</groupId>
 				<artifactId>spring-framework-bom</artifactId>
-				<version>6.2.18</version>
+				<version>${spring.framework.version}</version>
 				<type>pom</type>
 				<scope>import</scope>
 			</dependency>
@@ -555,17 +558,17 @@
 			<dependency>
 				<groupId>org.apache.tomcat.embed</groupId>
 				<artifactId>tomcat-embed-core</artifactId>
-				<version>10.1.54</version>
+				<version>${tomcat.embed.version}</version>
 			</dependency>
 			<dependency>
 				<groupId>org.apache.tomcat.embed</groupId>
 				<artifactId>tomcat-embed-el</artifactId>
-				<version>10.1.54</version>
+				<version>${tomcat.embed.version}</version>
 			</dependency>
 			<dependency>
 				<groupId>org.apache.tomcat.embed</groupId>
 				<artifactId>tomcat-embed-websocket</artifactId>
-				<version>10.1.54</version>
+				<version>${tomcat.embed.version}</version>
 			</dependency>
 
 			<dependency>