Identify and Remove VA.gov email addresses are used in CMS and Content Build repos

[gracekretschmer-metrostar]

User Story or Problem Statement

As a member of the CMS team, I need to identify all the areas where an email address is referenced in the CMS and content build repos, so that I can remove those email addresses.

Description or Additional Context

Per Lindsay Insco:

here is an upcoming change to VA’s GitHub policy (more info here). In 30 days (November 14, 2024) the use of va.gov email addresses in public repositories will be banned. Platform teams are aware that this may have an impact on workflows and more, so we want to ensure every team is made aware ASAP.

Link to Github policy: https://github.com/orgs/department-of-veterans-affairs/discussions/13

Reference Links

• https://dsva.slack.com/archives/C03R5SBELQM/p1729103161775739
• https://github.com/search?q=repo%3Adepartment-of-veterans-affairs%2Fva.gov-cms%20%22%40va.gov%22&type=code
• https://github.com/search?q=repo%3Adepartment-of-veterans-affairs%2Fcontent-build%20%22%40va.gov%22&type=code
• https://github.com/orgs/department-of-veterans-affairs/discussions/13

Steps for Implementation

• Scan VA.gov email addresses in the cms repo and document where they need to be removed.
• Scan VA.gov email addresses in the content build repo and document where need to be removed.
• Remove all of the identified areas where there's VA.gov email addresses.

Acceptance Criteria

• [ ] All instances of where an VA.gov email address has been referenced in the cms and content build repos has been identified, documented, and removed.

[timcosgrove]

Please see this Slack Canvas for va.gov PII addresses that need handling: https://dsva.slack.com/docs/T03FECE8V/F07T0P02082

Most of these are tests that need reworking. In many cases it should be enough to change the mock data for the test so that the email is no longer a real one.

In the few cases where the tests might be relying on live data from the Database, there may need to be some rework of the test mechanism.

[gracekretschmer-metrostar]

Will need to revisit the policy versus the announcement are out of alignment. Looping in @timcosgrove to support.

[gracekretschmer-metrostar]

Per Edmund: other flag is that sitewide developers use email addresses in their tests, so this scrub would have consequences to their testing.

[timcosgrove]

Reading the discussion posted by @pwideman here: https://github.com/orgs/department-of-veterans-affairs/discussions/13

It specifically says this is about commit messages, not source code:

To support that requirement, the admin team will be rolling out a restriction that prevents new code from being pushed to public repositories if a new commit contains an “@va.gov” email address in the author, creator, or commit message field.

It also says that there is not any requirement to do this retroactively:

We are only requiring that net-new commits have this change implemented and repository maintainers will not be required to rewrite existing commits to remove already exposed email addresses.

Now, it is possible that OCTO has decided to go further than what the discussion requires, and so the acceptance criteria in this ticket could still be valid. But, the directive given by Lindsay:

In 30 days (November 14, 2024) the use of va.gov email addresses in public repositories will be banned.

is not supported by the linked discussion.

[gracekretschmer-metrostar]

Per clarification in this thread: https://dsva.slack.com/archives/C03R5SBELQM/p1729103161775739

We do not need to move forward with this work, right now. Jonathan Kemens did preview that the work in this ticket will likely be a requirement in the future, so moving to the Ice box. Edmund has flagged that we will need to collaborate with Sitewide to get this work completed.