Merge branch 'main' into new-filter-schema

19 files changed, 648 insertions, 47 deletions

diff --git a/pydis_site/apps/api/__init__.py b/pydis_site/apps/api/__init__.py
index afa5b4d5..e69de29b 100644
--- a/pydis_site/apps/api/__init__.py
+++ b/pydis_site/apps/api/__init__.py
@@ -1 +0,0 @@
-default_app_config = 'pydis_site.apps.api.apps.ApiConfig'
diff --git a/pydis_site/apps/api/github_utils.py b/pydis_site/apps/api/github_utils.py
new file mode 100644
index 00000000..986c64e1
--- /dev/null
+++ b/pydis_site/apps/api/github_utils.py
@@ -0,0 +1,209 @@
+"""Utilities for working with the GitHub API."""
+import dataclasses
+import datetime
+import math
+import typing
+
+import httpx
+import jwt
+
+from pydis_site import settings
+
+MAX_RUN_TIME = datetime.timedelta(minutes=10)
+"""The maximum time allowed before an action is declared timed out."""
+ISO_FORMAT_STRING = "%Y-%m-%dT%H:%M:%SZ"
+"""The datetime string format GitHub uses."""
+
+
+class ArtifactProcessingError(Exception):
+    """Base exception for other errors related to processing a GitHub artifact."""
+
+    status: int
+
+
+class UnauthorizedError(ArtifactProcessingError):
+    """The application does not have permission to access the requested repo."""
+
+    status = 401
+
+
+class NotFoundError(ArtifactProcessingError):
+    """The requested resource could not be found."""
+
+    status = 404
+
+
+class ActionFailedError(ArtifactProcessingError):
+    """The requested workflow did not conclude successfully."""
+
+    status = 400
+
+
+class RunTimeoutError(ArtifactProcessingError):
+    """The requested workflow run was not ready in time."""
+
+    status = 408
+
+
+class RunPendingError(ArtifactProcessingError):
+    """The requested workflow run is still pending, try again later."""
+
+    status = 202
+
+
[email protected](frozen=True)
+class WorkflowRun:
+    """
+    A workflow run from the GitHub API.
+
+    https://docs.github.com/en/rest/actions/workflow-runs#get-a-workflow-run
+    """
+
+    name: str
+    head_sha: str
+    created_at: str
+    status: str
+    conclusion: str
+    artifacts_url: str
+
+    @classmethod
+    def from_raw(cls, data: dict[str, typing.Any]):
+        """Create an instance using the raw data from the API, discarding unused fields."""
+        return cls(**{
+            key.name: data[key.name] for key in dataclasses.fields(cls)
+        })
+
+
+def generate_token() -> str:
+    """
+    Generate a JWT token to access the GitHub API.
+
+    The token is valid for roughly 10 minutes after generation, before the API starts
+    returning 401s.
+
+    Refer to:
+    https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-a-github-app
+    """
+    now = datetime.datetime.now()
+    return jwt.encode(
+        {
+            "iat": math.floor((now - datetime.timedelta(seconds=60)).timestamp()),  # Issued at
+            "exp": math.floor((now + datetime.timedelta(minutes=9)).timestamp()),  # Expires at
+            "iss": settings.GITHUB_APP_ID,
+        },
+        settings.GITHUB_APP_KEY,
+        algorithm="RS256"
+    )
+
+
+def authorize(owner: str, repo: str) -> httpx.Client:
+    """
+    Get an access token for the requested repository.
+
+    The process is roughly:
+        - GET app/installations to get a list of all app installations
+        - POST <app_access_token> to get a token to access the given app
+        - GET installation/repositories and check if the requested one is part of those
+    """
+    client = httpx.Client(
+        base_url=settings.GITHUB_API,
+        headers={"Authorization": f"bearer {generate_token()}"},
+        timeout=10,
+    )
+
+    try:
+        # Get a list of app installations we have access to
+        apps = client.get("app/installations")
+        apps.raise_for_status()
+
+        for app in apps.json():
+            # Look for an installation with the right owner
+            if app["account"]["login"] != owner:
+                continue
+
+            # Get the repositories of the specified owner
+            app_token = client.post(app["access_tokens_url"])
+            app_token.raise_for_status()
+            client.headers["Authorization"] = f"bearer {app_token.json()['token']}"
+
+            repos = client.get("installation/repositories")
+            repos.raise_for_status()
+
+            # Search for the request repository
+            for accessible_repo in repos.json()["repositories"]:
+                if accessible_repo["name"] == repo:
+                    # We've found the correct repository, and it's accessible with the current auth
+                    return client
+
+        raise NotFoundError(
+            "Could not find the requested repository. Make sure the application can access it."
+        )
+
+    except BaseException as e:
+        # Close the client if we encountered an unexpected exception
+        client.close()
+        raise e
+
+
+def check_run_status(run: WorkflowRun) -> str:
+    """Check if the provided run has been completed, otherwise raise an exception."""
+    created_at = datetime.datetime.strptime(run.created_at, ISO_FORMAT_STRING)
+    run_time = datetime.datetime.utcnow() - created_at
+
+    if run.status != "completed":
+        if run_time <= MAX_RUN_TIME:
+            raise RunPendingError(
+                f"The requested run is still pending. It was created "
+                f"{run_time.seconds // 60}:{run_time.seconds % 60 :>02} minutes ago."
+            )
+        else:
+            raise RunTimeoutError("The requested workflow was not ready in time.")
+
+    if run.conclusion != "success":
+        # The action failed, or did not run
+        raise ActionFailedError(f"The requested workflow ended with: {run.conclusion}")
+
+    # The requested action is ready
+    return run.artifacts_url
+
+
+def get_artifact(owner: str, repo: str, sha: str, action_name: str, artifact_name: str) -> str:
+    """Get a download URL for a build artifact."""
+    client = authorize(owner, repo)
+
+    try:
+        # Get the workflow runs for this repository
+        runs = client.get(f"/repos/{owner}/{repo}/actions/runs", params={"per_page": 100})
+        runs.raise_for_status()
+        runs = runs.json()
+
+        # Filter the runs for the one associated with the given SHA
+        for run in runs["workflow_runs"]:
+            run = WorkflowRun.from_raw(run)
+            if run.name == action_name and sha == run.head_sha:
+                break
+        else:
+            raise NotFoundError(
+                "Could not find a run matching the provided settings in the previous hundred runs."
+            )
+
+        # Check the workflow status
+        url = check_run_status(run)
+
+        # Filter the artifacts, and return the download URL
+        artifacts = client.get(url)
+        artifacts.raise_for_status()
+
+        for artifact in artifacts.json()["artifacts"]:
+            if artifact["name"] == artifact_name:
+                data = client.get(artifact["archive_download_url"])
+                if data.status_code == 302:
+                    return str(data.next_request.url)
+
+                # The following line is left untested since it should in theory be impossible
+                data.raise_for_status()  # pragma: no cover
+
+        raise NotFoundError("Could not find an artifact matching the provided name.")
+
+    finally:
+        client.close()
diff --git a/pydis_site/apps/api/migrations/0013_specialsnake_image.py b/pydis_site/apps/api/migrations/0013_specialsnake_image.py
index a0d0d318..8ba3432f 100644
--- a/pydis_site/apps/api/migrations/0013_specialsnake_image.py
+++ b/pydis_site/apps/api/migrations/0013_specialsnake_image.py
@@ -2,7 +2,6 @@
 
 import datetime
 from django.db import migrations, models
-from django.utils.timezone import utc
 
 
 class Migration(migrations.Migration):
@@ -15,7 +14,7 @@ class Migration(migrations.Migration):
         migrations.AddField(
             model_name='specialsnake',
             name='image',
-            field=models.URLField(default=datetime.datetime(2018, 10, 23, 11, 51, 23, 703868, tzinfo=utc)),
+            field=models.URLField(default=datetime.datetime(2018, 10, 23, 11, 51, 23, 703868, tzinfo=datetime.timezone.utc)),
             preserve_default=False,
         ),
     ]
diff --git a/pydis_site/apps/api/migrations/0084_infraction_last_applied.py b/pydis_site/apps/api/migrations/0084_infraction_last_applied.py
new file mode 100644
index 00000000..7704ddb8
--- /dev/null
+++ b/pydis_site/apps/api/migrations/0084_infraction_last_applied.py
@@ -0,0 +1,26 @@
+# Generated by Django 4.0.6 on 2022-07-27 20:32
+
+import django.utils.timezone
+from django.db import migrations, models
+from django.apps.registry import Apps
+
+
+def set_last_applied_to_inserted_at(apps: Apps, schema_editor):
+    Infractions = apps.get_model("api", "infraction")
+    Infractions.objects.all().update(last_applied=models.F("inserted_at"))
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0083_remove_embed_validation'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='infraction',
+            name='last_applied',
+            field=models.DateTimeField(default=django.utils.timezone.now, help_text='The date and time of when this infraction was last applied.'),
+        ),
+        migrations.RunPython(set_last_applied_to_inserted_at)
+    ]
diff --git a/pydis_site/apps/api/migrations/0084_new_filter_schema.py b/pydis_site/apps/api/migrations/0085_new_filter_schema.py
index 74e1f009..d16c26ac 100644
--- a/pydis_site/apps/api/migrations/0084_new_filter_schema.py
+++ b/pydis_site/apps/api/migrations/0085_new_filter_schema.py
@@ -84,7 +84,7 @@ def forward(apps: Apps, schema_editor: BaseDatabaseSchemaEditor) -> None:
 class Migration(migrations.Migration):
 
     dependencies = [
-        ('api', '0083_remove_embed_validation'),
+        ('api', '0084_infraction_last_applied'),
     ]
 
     operations = [
diff --git a/pydis_site/apps/api/migrations/0085_unique_constraint_filters.py b/pydis_site/apps/api/migrations/0086_unique_constraint_filters.py
index 55ede901..8072ed2e 100644
--- a/pydis_site/apps/api/migrations/0085_unique_constraint_filters.py
+++ b/pydis_site/apps/api/migrations/0086_unique_constraint_filters.py
@@ -6,7 +6,7 @@ from django.db import migrations, models
 class Migration(migrations.Migration):
 
     dependencies = [
-        ('api', '0084_new_filter_schema'),
+        ('api', '0085_new_filter_schema'),
     ]
 
     operations = [
diff --git a/pydis_site/apps/api/models/bot/infraction.py b/pydis_site/apps/api/models/bot/infraction.py
index c9303024..218ee5ec 100644
--- a/pydis_site/apps/api/models/bot/infraction.py
+++ b/pydis_site/apps/api/models/bot/infraction.py
@@ -23,6 +23,12 @@ class Infraction(ModelReprMixin, models.Model):
         default=timezone.now,
         help_text="The date and time of the creation of this infraction."
     )
+    last_applied = models.DateTimeField(
+        # This default is for backwards compatibility with bot versions
+        # that don't explicitly give a value.
+        default=timezone.now,
+        help_text="The date and time of when this infraction was last applied."
+    )
     expires_at = models.DateTimeField(
         null=True,
         help_text=(
diff --git a/pydis_site/apps/api/models/bot/message.py b/pydis_site/apps/api/models/bot/message.py
index bfa54721..89ae27e4 100644
--- a/pydis_site/apps/api/models/bot/message.py
+++ b/pydis_site/apps/api/models/bot/message.py
@@ -1,9 +1,8 @@
-from datetime import datetime
+import datetime
 
 from django.contrib.postgres import fields as pgfields
 from django.core.validators import MinValueValidator
 from django.db import models
-from django.utils import timezone
 
 from pydis_site.apps.api.models.bot.user import User
 from pydis_site.apps.api.models.mixins import ModelReprMixin
@@ -60,11 +59,11 @@ class Message(ModelReprMixin, models.Model):
     )
 
     @property
-    def timestamp(self) -> datetime:
+    def timestamp(self) -> datetime.datetime:
         """Attribute that represents the message timestamp as derived from the snowflake id."""
-        tz_naive_datetime = datetime.utcfromtimestamp(((self.id >> 22) + 1420070400000) / 1000)
-        tz_aware_datetime = timezone.make_aware(tz_naive_datetime, timezone=timezone.utc)
-        return tz_aware_datetime
+        return datetime.datetime.utcfromtimestamp(
+            ((self.id >> 22) + 1420070400000) / 1000
+        ).replace(tzinfo=datetime.timezone.utc)
 
     class Meta:
         """Metadata provided for Django's ORM."""
diff --git a/pydis_site/apps/api/serializers.py b/pydis_site/apps/api/serializers.py
index 26bda035..7c1c107a 100644
--- a/pydis_site/apps/api/serializers.py
+++ b/pydis_site/apps/api/serializers.py
@@ -363,6 +363,7 @@ class InfractionSerializer(ModelSerializer):
         fields = (
             'id',
             'inserted_at',
+            'last_applied',
             'expires_at',
             'active',
             'user',
diff --git a/pydis_site/apps/api/tests/test_github_utils.py b/pydis_site/apps/api/tests/test_github_utils.py
new file mode 100644
index 00000000..2eaf48d9
--- /dev/null
+++ b/pydis_site/apps/api/tests/test_github_utils.py
@@ -0,0 +1,285 @@
+import dataclasses
+import datetime
+import typing
+import unittest
+from unittest import mock
+
+import django.test
+import httpx
+import jwt
+import rest_framework.response
+import rest_framework.test
+from django.urls import reverse
+
+from .. import github_utils
+
+
+class GeneralUtilityTests(unittest.TestCase):
+    """Test the utility methods which do not fit in another class."""
+
+    def test_token_generation(self):
+        """Test that the a valid JWT token is generated."""
+        def encode(payload: dict, _: str, algorithm: str, *args, **kwargs) -> str:
+            """
+            Intercept the encode method.
+
+            The result is encoded with an algorithm which does not require a PEM key, as it may
+            not be available in testing environments.
+            """
+            self.assertEqual("RS256", algorithm, "The GitHub App JWT must be signed using RS256.")
+            return original_encode(
+                payload, "secret-encoding-key", *args, algorithm="HS256", **kwargs
+            )
+
+        original_encode = jwt.encode
+        with mock.patch("jwt.encode", new=encode):
+            token = github_utils.generate_token()
+        decoded = jwt.decode(token, "secret-encoding-key", algorithms=["HS256"])
+
+        delta = datetime.timedelta(minutes=10)
+        self.assertAlmostEqual(decoded["exp"] - decoded["iat"], delta.total_seconds())
+        self.assertLess(decoded["exp"], (datetime.datetime.now() + delta).timestamp())
+
+
+class CheckRunTests(unittest.TestCase):
+    """Tests the check_run_status utility."""
+
+    run_kwargs: typing.Mapping = {
+        "name": "run_name",
+        "head_sha": "sha",
+        "status": "completed",
+        "conclusion": "success",
+        "created_at": datetime.datetime.utcnow().strftime(github_utils.ISO_FORMAT_STRING),
+        "artifacts_url": "url",
+    }
+
+    def test_completed_run(self):
+        """Test that an already completed run returns the correct URL."""
+        final_url = "some_url_string_1234"
+
+        kwargs = dict(self.run_kwargs, artifacts_url=final_url)
+        result = github_utils.check_run_status(github_utils.WorkflowRun(**kwargs))
+        self.assertEqual(final_url, result)
+
+    def test_pending_run(self):
+        """Test that a pending run raises the proper exception."""
+        kwargs = dict(self.run_kwargs, status="pending")
+        with self.assertRaises(github_utils.RunPendingError):
+            github_utils.check_run_status(github_utils.WorkflowRun(**kwargs))
+
+    def test_timeout_error(self):
+        """Test that a timeout is declared after a certain duration."""
+        kwargs = dict(self.run_kwargs, status="pending")
+        # Set the creation time to well before the MAX_RUN_TIME
+        # to guarantee the right conclusion
+        kwargs["created_at"] = (
+            datetime.datetime.utcnow() - github_utils.MAX_RUN_TIME - datetime.timedelta(minutes=10)
+        ).strftime(github_utils.ISO_FORMAT_STRING)
+
+        with self.assertRaises(github_utils.RunTimeoutError):
+            github_utils.check_run_status(github_utils.WorkflowRun(**kwargs))
+
+    def test_failed_run(self):
+        """Test that a failed run raises the proper exception."""
+        kwargs = dict(self.run_kwargs, conclusion="failed")
+        with self.assertRaises(github_utils.ActionFailedError):
+            github_utils.check_run_status(github_utils.WorkflowRun(**kwargs))
+
+
+def get_response_authorize(_: httpx.Client, request: httpx.Request, **__) -> httpx.Response:
+    """
+    Helper method for the authorize tests.
+
+    Requests are intercepted before being sent out, and the appropriate responses are returned.
+    """
+    path = request.url.path
+    auth = request.headers.get("Authorization")
+
+    if request.method == "GET":
+        if path == "/app/installations":
+            if auth == "bearer JWT initial token":
+                return httpx.Response(200, request=request, json=[{
+                    "account": {"login": "VALID_OWNER"},
+                    "access_tokens_url": "https://example.com/ACCESS_TOKEN_URL"
+                }])
+            else:
+                return httpx.Response(
+                    401, json={"error": "auth app/installations"}, request=request
+                )
+
+        elif path == "/installation/repositories":
+            if auth == "bearer app access token":
+                return httpx.Response(200, request=request, json={
+                    "repositories": [{
+                        "name": "VALID_REPO"
+                    }]
+                })
+            else:  # pragma: no cover
+                return httpx.Response(
+                    401, json={"error": "auth installation/repositories"}, request=request
+                )
+
+    elif request.method == "POST":
+        if path == "/ACCESS_TOKEN_URL":
+            if auth == "bearer JWT initial token":
+                return httpx.Response(200, request=request, json={"token": "app access token"})
+            else:  # pragma: no cover
+                return httpx.Response(401, json={"error": "auth access_token"}, request=request)
+
+    # Reaching this point means something has gone wrong
+    return httpx.Response(500, request=request)  # pragma: no cover
+
+
[email protected]("httpx.Client.send", new=get_response_authorize)
[email protected](github_utils, "generate_token", new=mock.Mock(return_value="JWT initial token"))
+class AuthorizeTests(unittest.TestCase):
+    """Test the authorize utility."""
+
+    def test_invalid_apps_auth(self):
+        """Test that an exception is raised if authorization was attempted with an invalid token."""
+        with mock.patch.object(github_utils, "generate_token", return_value="Invalid token"):
+            with self.assertRaises(httpx.HTTPStatusError) as error:
+                github_utils.authorize("VALID_OWNER", "VALID_REPO")
+
+        exception: httpx.HTTPStatusError = error.exception
+        self.assertEqual(401, exception.response.status_code)
+        self.assertEqual("auth app/installations", exception.response.json()["error"])
+
+    def test_missing_repo(self):
+        """Test that an exception is raised when the selected owner or repo are not available."""
+        with self.assertRaises(github_utils.NotFoundError):
+            github_utils.authorize("INVALID_OWNER", "VALID_REPO")
+        with self.assertRaises(github_utils.NotFoundError):
+            github_utils.authorize("VALID_OWNER", "INVALID_REPO")
+
+    def test_valid_authorization(self):
+        """Test that an accessible repository can be accessed."""
+        client = github_utils.authorize("VALID_OWNER", "VALID_REPO")
+        self.assertEqual("bearer app access token", client.headers.get("Authorization"))
+
+
+class ArtifactFetcherTests(unittest.TestCase):
+    """Test the get_artifact utility."""
+
+    @staticmethod
+    def get_response_get_artifact(request: httpx.Request, **_) -> httpx.Response:
+        """
+        Helper method for the get_artifact tests.
+
+        Requests are intercepted before being sent out, and the appropriate responses are returned.
+        """
+        path = request.url.path
+
+        if "force_error" in path:
+            return httpx.Response(404, request=request)
+
+        if request.method == "GET":
+            if path == "/repos/owner/repo/actions/runs":
+                run = github_utils.WorkflowRun(
+                    name="action_name",
+                    head_sha="action_sha",
+                    created_at=datetime.datetime.now().strftime(github_utils.ISO_FORMAT_STRING),
+                    status="completed",
+                    conclusion="success",
+                    artifacts_url="artifacts_url"
+                )
+                return httpx.Response(
+                    200, request=request, json={"workflow_runs": [dataclasses.asdict(run)]}
+                )
+            elif path == "/artifact_url":
+                return httpx.Response(
+                    200, request=request, json={"artifacts": [{
+                        "name": "artifact_name",
+                        "archive_download_url": "artifact_download_url"
+                    }]}
+                )
+            elif path == "/artifact_download_url":
+                response = httpx.Response(302, request=request)
+                response.next_request = httpx.Request(
+                    "GET",
+                    httpx.URL("https://final_download.url")
+                )
+                return response
+
+        # Reaching this point means something has gone wrong
+        return httpx.Response(500, request=request)  # pragma: no cover
+
+    def setUp(self) -> None:
+        self.call_args = ["owner", "repo", "action_sha", "action_name", "artifact_name"]
+        self.client = httpx.Client(base_url="https://example.com")
+
+        self.patchers = [
+            mock.patch.object(self.client, "send", new=self.get_response_get_artifact),
+            mock.patch.object(github_utils, "authorize", return_value=self.client),
+            mock.patch.object(github_utils, "check_run_status", return_value="artifact_url"),
+        ]
+
+        for patcher in self.patchers:
+            patcher.start()
+
+    def tearDown(self) -> None:
+        for patcher in self.patchers:
+            patcher.stop()
+
+    def test_client_closed_on_errors(self):
+        """Test that the client is terminated even if an error occurs at some point."""
+        self.call_args[0] = "force_error"
+        with self.assertRaises(httpx.HTTPStatusError):
+            github_utils.get_artifact(*self.call_args)
+        self.assertTrue(self.client.is_closed)
+
+    def test_missing(self):
+        """Test that an exception is raised if the requested artifact was not found."""
+        cases = (
+            "invalid sha",
+            "invalid action name",
+            "invalid artifact name",
+        )
+        for i, name in enumerate(cases, 2):
+            with self.subTest(f"Test {name} raises an error"):
+                new_args = self.call_args.copy()
+                new_args[i] = name
+
+                with self.assertRaises(github_utils.NotFoundError):
+                    github_utils.get_artifact(*new_args)
+
+    def test_valid(self):
+        """Test that the correct download URL is returned for valid requests."""
+        url = github_utils.get_artifact(*self.call_args)
+        self.assertEqual("https://final_download.url", url)
+        self.assertTrue(self.client.is_closed)
+
+
[email protected](github_utils, "get_artifact")
+class GitHubArtifactViewTests(django.test.TestCase):
+    """Test the GitHub artifact fetch API view."""
+
+    def setUp(self):
+        self.kwargs = {
+            "owner": "test_owner",
+            "repo": "test_repo",
+            "sha": "test_sha",
+            "action_name": "test_action",
+            "artifact_name": "test_artifact",
+        }
+        self.url = reverse("api:github-artifacts", kwargs=self.kwargs)
+
+    def test_correct_artifact(self, artifact_mock: mock.Mock):
+        """Test a proper response is returned with proper input."""
+        artifact_mock.return_value = "final download url"
+        result = self.client.get(self.url)
+
+        self.assertIsInstance(result, rest_framework.response.Response)
+        self.assertEqual({"url": artifact_mock.return_value}, result.data)
+
+    def test_failed_fetch(self, artifact_mock: mock.Mock):
+        """Test that a proper error is returned when the request fails."""
+        artifact_mock.side_effect = github_utils.NotFoundError("Test error message")
+        result = self.client.get(self.url)
+
+        self.assertIsInstance(result, rest_framework.response.Response)
+        self.assertEqual({
+            "error_type": github_utils.NotFoundError.__name__,
+            "error": "Test error message",
+            "requested_resource": "/".join(self.kwargs.values())
+        }, result.data)
diff --git a/pydis_site/apps/api/tests/test_infractions.py b/pydis_site/apps/api/tests/test_infractions.py
index f1107734..89ee4e23 100644
--- a/pydis_site/apps/api/tests/test_infractions.py
+++ b/pydis_site/apps/api/tests/test_infractions.py
@@ -56,15 +56,17 @@ class InfractionTests(AuthenticatedAPITestCase):
             type='ban',
             reason='He terk my jerb!',
             hidden=True,
+            inserted_at=dt(2020, 10, 10, 0, 0, 0, tzinfo=timezone.utc),
             expires_at=dt(5018, 11, 20, 15, 52, tzinfo=timezone.utc),
-            active=True
+            active=True,
         )
         cls.ban_inactive = Infraction.objects.create(
             user_id=cls.user.id,
             actor_id=cls.user.id,
             type='ban',
             reason='James is an ass, and we won\'t be working with him again.',
-            active=False
+            active=False,
+            inserted_at=dt(2020, 10, 10, 0, 1, 0, tzinfo=timezone.utc),
         )
         cls.mute_permanent = Infraction.objects.create(
             user_id=cls.user.id,
@@ -72,7 +74,8 @@ class InfractionTests(AuthenticatedAPITestCase):
             type='mute',
             reason='He has a filthy mouth and I am his soap.',
             active=True,
-            expires_at=None
+            inserted_at=dt(2020, 10, 10, 0, 2, 0, tzinfo=timezone.utc),
+            expires_at=None,
         )
         cls.superstar_expires_soon = Infraction.objects.create(
             user_id=cls.user.id,
@@ -80,7 +83,8 @@ class InfractionTests(AuthenticatedAPITestCase):
             type='superstar',
             reason='This one doesn\'t matter anymore.',
             active=True,
-            expires_at=dt.now(timezone.utc) + datetime.timedelta(hours=5)
+            inserted_at=dt(2020, 10, 10, 0, 3, 0, tzinfo=timezone.utc),
+            expires_at=dt.now(timezone.utc) + datetime.timedelta(hours=5),
         )
         cls.voiceban_expires_later = Infraction.objects.create(
             user_id=cls.user.id,
@@ -88,7 +92,8 @@ class InfractionTests(AuthenticatedAPITestCase):
             type='voice_ban',
             reason='Jet engine mic',
             active=True,
-            expires_at=dt.now(timezone.utc) + datetime.timedelta(days=5)
+            inserted_at=dt(2020, 10, 10, 0, 4, 0, tzinfo=timezone.utc),
+            expires_at=dt.now(timezone.utc) + datetime.timedelta(days=5),
         )
 
     def test_list_all(self):
diff --git a/pydis_site/apps/api/urls.py b/pydis_site/apps/api/urls.py
index d5f6bc56..f872ba92 100644
--- a/pydis_site/apps/api/urls.py
+++ b/pydis_site/apps/api/urls.py
@@ -1,7 +1,7 @@
 from django.urls import include, path
 from rest_framework.routers import DefaultRouter
 
-from .views import HealthcheckView, RulesView
+from .views import GitHubArtifactsView, HealthcheckView, RulesView
 from .viewsets import (
     AocAccountLinkViewSet,
     AocCompletionistBlockViewSet,
@@ -95,5 +95,10 @@ urlpatterns = (
     # from django_hosts.resolvers import reverse
     path('bot/', include((bot_router.urls, 'api'), namespace='bot')),
     path('healthcheck', HealthcheckView.as_view(), name='healthcheck'),
-    path('rules', RulesView.as_view(), name='rules')
+    path('rules', RulesView.as_view(), name='rules'),
+    path(
+        'github/artifact/<str:owner>/<str:repo>/<str:sha>/<str:action_name>/<str:artifact_name>',
+        GitHubArtifactsView.as_view(),
+        name="github-artifacts"
+    ),
 )
diff --git a/pydis_site/apps/api/views.py b/pydis_site/apps/api/views.py
index 816463f6..34167a38 100644
--- a/pydis_site/apps/api/views.py
+++ b/pydis_site/apps/api/views.py
@@ -1,7 +1,10 @@
 from rest_framework.exceptions import ParseError
+from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
+from . import github_utils
+
 
 class HealthcheckView(APIView):
     """
@@ -34,12 +37,14 @@ class RulesView(APIView):
 
     ## Routes
     ### GET /rules
-    Returns a JSON array containing the server's rules:
+    Returns a JSON array containing the server's rules
+    and keywords relating to each rule.
+    Example response:
 
     >>> [
-    ...     "Eat candy.",
-    ...     "Wake up at 4 AM.",
-    ...     "Take your medicine."
+    ...     ["Eat candy.", ["candy", "sweets"]],
+    ...     ["Wake up at 4 AM.", ["wake_up", "early", "early_bird"]],
+    ...     ["Take your medicine.", ["medicine", "health"]]
     ... ]
 
     Since some of the the rules require links, this view
@@ -97,6 +102,12 @@ class RulesView(APIView):
 
     # `format` here is the result format, we have a link format here instead.
     def get(self, request, format=None):  # noqa: D102,ANN001,ANN201
+        """
+        Returns a list of our community rules coupled with their keywords.
+
+        Each item in the returned list is a tuple with the rule as first item
+        and a list of keywords that match that rules as second item.
+        """
         link_format = request.query_params.get('link_format', 'md')
         if link_format not in ('html', 'md'):
             raise ParseError(
@@ -121,34 +132,93 @@ class RulesView(APIView):
 
         return Response([
             (
-                f"Follow the {pydis_coc}."
+                f"Follow the {pydis_coc}.",
+                ["coc", "conduct", "code"]
             ),
             (
-                f"Follow the {discord_community_guidelines} and {discord_tos}."
+                f"Follow the {discord_community_guidelines} and {discord_tos}.",
+                ["discord", "guidelines", "discord_tos"]
             ),
             (
-                "Respect staff members and listen to their instructions."
+                "Respect staff members and listen to their instructions.",
+                ["respect", "staff", "instructions"]
             ),
             (
                 "Use English to the best of your ability. "
-                "Be polite if someone speaks English imperfectly."
+                "Be polite if someone speaks English imperfectly.",
+                ["english", "language"]
             ),
             (
                 "Do not provide or request help on projects that may break laws, "
-                "breach terms of services, or are malicious or inappropriate."
+                "breach terms of services, or are malicious or inappropriate.",
+                ["infraction", "tos", "breach", "malicious", "inappropriate"]
             ),
             (
-                "Do not post unapproved advertising."
+                "Do not post unapproved advertising.",
+                ["ad", "ads", "advert", "advertising"]
             ),
             (
                 "Keep discussions relevant to the channel topic. "
-                "Each channel's description tells you the topic."
+                "Each channel's description tells you the topic.",
+                ["off-topic", "topic", "relevance"]
             ),
             (
                 "Do not help with ongoing exams. When helping with homework, "
-                "help people learn how to do the assignment without doing it for them."
+                "help people learn how to do the assignment without doing it for them.",
+                ["exam", "exams", "assignment", "assignments", "homework"]
             ),
             (
-                "Do not offer or ask for paid work of any kind."
+                "Do not offer or ask for paid work of any kind.",
+                ["paid", "work", "money"]
             ),
         ])
+
+
+class GitHubArtifactsView(APIView):
+    """
+    Provides utilities for interacting with the GitHub API and obtaining action artifacts.
+
+    ## Routes
+    ### GET /github/artifacts
+    Returns a download URL for the artifact requested.
+
+        {
+            'url': 'https://pipelines.actions.githubusercontent.com/...'
+        }
+
+    ### Exceptions
+    In case of an error, the following body will be returned:
+
+        {
+            "error_type": "<error class name>",
+            "error": "<error description>",
+            "requested_resource": "<owner>/<repo>/<sha>/<artifact_name>"
+        }
+
+    ## Authentication
+    Does not require any authentication nor permissions.
+    """
+
+    authentication_classes = ()
+    permission_classes = ()
+
+    def get(
+        self,
+        request: Request,
+        *,
+        owner: str,
+        repo: str,
+        sha: str,
+        action_name: str,
+        artifact_name: str
+    ) -> Response:
+        """Return a download URL for the requested artifact."""
+        try:
+            url = github_utils.get_artifact(owner, repo, sha, action_name, artifact_name)
+            return Response({"url": url})
+        except github_utils.ArtifactProcessingError as e:
+            return Response({
+                "error_type": e.__class__.__name__,
+                "error": str(e),
+                "requested_resource": f"{owner}/{repo}/{sha}/{action_name}/{artifact_name}"
+            }, status=e.status)
diff --git a/pydis_site/apps/api/viewsets/bot/aoc_completionist_block.py b/pydis_site/apps/api/viewsets/bot/aoc_completionist_block.py
index 3a4cec60..97efb63c 100644
--- a/pydis_site/apps/api/viewsets/bot/aoc_completionist_block.py
+++ b/pydis_site/apps/api/viewsets/bot/aoc_completionist_block.py
@@ -70,4 +70,4 @@ class AocCompletionistBlockViewSet(
     serializer_class = AocCompletionistBlockSerializer
     queryset = AocCompletionistBlock.objects.all()
     filter_backends = (DjangoFilterBackend,)
-    filter_fields = ("user__id", "is_blocked")
+    filterset_fields = ("user__id", "is_blocked")
diff --git a/pydis_site/apps/api/viewsets/bot/aoc_link.py b/pydis_site/apps/api/viewsets/bot/aoc_link.py
index c7a96629..3cdc342d 100644
--- a/pydis_site/apps/api/viewsets/bot/aoc_link.py
+++ b/pydis_site/apps/api/viewsets/bot/aoc_link.py
@@ -68,4 +68,4 @@ class AocAccountLinkViewSet(
     serializer_class = AocAccountLinkSerializer
     queryset = AocAccountLink.objects.all()
     filter_backends = (DjangoFilterBackend,)
-    filter_fields = ("user__id", "aoc_username")
+    filterset_fields = ("user__id", "aoc_username")
diff --git a/pydis_site/apps/api/viewsets/bot/infraction.py b/pydis_site/apps/api/viewsets/bot/infraction.py
index 7f31292f..93d29391 100644
--- a/pydis_site/apps/api/viewsets/bot/infraction.py
+++ b/pydis_site/apps/api/viewsets/bot/infraction.py
@@ -1,9 +1,8 @@
-from datetime import datetime
+import datetime
 
 from django.db import IntegrityError
 from django.db.models import QuerySet
 from django.http.request import HttpRequest
-from django.utils import timezone
 from django_filters.rest_framework import DjangoFilterBackend
 from rest_framework.decorators import action
 from rest_framework.exceptions import ValidationError
@@ -154,7 +153,7 @@ class InfractionViewSet(
     queryset = Infraction.objects.all()
     pagination_class = LimitOffsetPaginationExtended
     filter_backends = (DjangoFilterBackend, SearchFilter, OrderingFilter)
-    filter_fields = ('user__id', 'actor__id', 'active', 'hidden', 'type')
+    filterset_fields = ('user__id', 'actor__id', 'active', 'hidden', 'type')
     search_fields = ('$reason',)
     frozen_fields = ('id', 'inserted_at', 'type', 'user', 'actor', 'hidden')
 
@@ -185,23 +184,21 @@ class InfractionViewSet(
         filter_expires_after = self.request.query_params.get('expires_after')
         if filter_expires_after:
             try:
-                expires_after_parsed = datetime.fromisoformat(filter_expires_after)
+                expires_after_parsed = datetime.datetime.fromisoformat(filter_expires_after)
             except ValueError:
                 raise ValidationError({'expires_after': ['failed to convert to datetime']})
-            additional_filters['expires_at__gte'] = timezone.make_aware(
-                expires_after_parsed,
-                timezone=timezone.utc,
+            additional_filters['expires_at__gte'] = expires_after_parsed.replace(
+                tzinfo=datetime.timezone.utc
             )
 
         filter_expires_before = self.request.query_params.get('expires_before')
         if filter_expires_before:
             try:
-                expires_before_parsed = datetime.fromisoformat(filter_expires_before)
+                expires_before_parsed = datetime.datetime.fromisoformat(filter_expires_before)
             except ValueError:
                 raise ValidationError({'expires_before': ['failed to convert to datetime']})
-            additional_filters['expires_at__lte'] = timezone.make_aware(
-                expires_before_parsed,
-                timezone=timezone.utc,
+            additional_filters['expires_at__lte'] = expires_before_parsed.replace(
+                tzinfo=datetime.timezone.utc
             )
 
         if 'expires_at__lte' in additional_filters and 'expires_at__gte' in additional_filters:
diff --git a/pydis_site/apps/api/viewsets/bot/nomination.py b/pydis_site/apps/api/viewsets/bot/nomination.py
index 144daab0..6af42bcb 100644
--- a/pydis_site/apps/api/viewsets/bot/nomination.py
+++ b/pydis_site/apps/api/viewsets/bot/nomination.py
@@ -172,7 +172,7 @@ class NominationViewSet(CreateModelMixin, RetrieveModelMixin, ListModelMixin, Ge
     serializer_class = NominationSerializer
     queryset = Nomination.objects.all()
     filter_backends = (DjangoFilterBackend, SearchFilter, OrderingFilter)
-    filter_fields = ('user__id', 'active')
+    filterset_fields = ('user__id', 'active')
     frozen_fields = ('id', 'inserted_at', 'user', 'ended_at')
     frozen_on_create = ('ended_at', 'end_reason', 'active', 'inserted_at', 'reviewed')
 
diff --git a/pydis_site/apps/api/viewsets/bot/reminder.py b/pydis_site/apps/api/viewsets/bot/reminder.py
index 78d7cb3b..5f997052 100644
--- a/pydis_site/apps/api/viewsets/bot/reminder.py
+++ b/pydis_site/apps/api/viewsets/bot/reminder.py
@@ -125,4 +125,4 @@ class ReminderViewSet(
     serializer_class = ReminderSerializer
     queryset = Reminder.objects.prefetch_related('author')
     filter_backends = (DjangoFilterBackend, SearchFilter)
-    filter_fields = ('active', 'author__id')
+    filterset_fields = ('active', 'author__id')
diff --git a/pydis_site/apps/api/viewsets/bot/user.py b/pydis_site/apps/api/viewsets/bot/user.py
index 3318b2b9..ba1bcd9d 100644
--- a/pydis_site/apps/api/viewsets/bot/user.py
+++ b/pydis_site/apps/api/viewsets/bot/user.py
@@ -237,7 +237,7 @@ class UserViewSet(ModelViewSet):
     queryset = User.objects.all().order_by("id")
     pagination_class = UserListPagination
     filter_backends = (DjangoFilterBackend,)
-    filter_fields = ('name', 'discriminator')
+    filterset_fields = ('name', 'discriminator')
 
     def get_serializer(self, *args, **kwargs) -> ModelSerializer:
         """Set Serializer many attribute to True if request body contains a list."""