ci(audit): point audit validator at our HTS terminology server (#183)

[mauripunzueta]

Summary

Part of #183 — migrate CI off the public HL7 test terminology server tx.fhir.org toward our own server.

The audit-events workflow validates extracted AuditEvent codes ($validate-code) against a terminology server. It used tx.fhir.org/r5, which is rate-limited, occasionally unreachable, and not under our control. This points that validation backend at our own terminology server, https://hts.heliossoftware.com.

Changes

• .github/workflows/audit-events.yml: --tx-base-url → https://hts.heliossoftware.com
• crates/hfs/tests/audit/validate_report.py:
  • DEFAULT_TX_BASE_URL → https://hts.heliossoftware.com
  • rename source id tx-r5-live-validation → hts-live-validation
  • generalize the report heading (### Terminology Server Validation); the actual base URL is already printed dynamically beneath it

Notes

• HTS serves terminology ops at the root — no /r4 or /r5 path segment (those 404), and no auth required. hfs.heliossoftware.com is the FHIR server (hfs binary, no terminology ops); the terminology server is hts.heliossoftware.com (hts binary).
• Verified live: $validate-code returns result: true for every code system the validator exercises — audit-event-type, restful-interaction, audit-event-action, audit-event-outcome.
• Scope guardrail: the hts.yml comparison oracle is intentionally left on tx.fhir.org/r4 + /r5 as the source of truth. The fhirpath evaluator.rs defaults (which feed test_r5_test_suite) are also left on tx.fhir.org since those test expectations are oracle-derived.

[claude]

Code review

1 issue found.

---

Bug: stale source name in build_terminology_context() lookup

File: crates/hfs/tests/audit/validate_report.py, line 597

The source entry was renamed from "tx-r5-live-validation" to "hts-live-validation" at line 98, but the corresponding lookup in build_terminology_context() was not updated:

hfs/crates/hfs/tests/audit/validate_report.py

Lines 595 to 599 in f1bf87d

	if tx_validation is not None:
	for source in sources:
	if source.get("name") == "tx-r5-live-validation":
	source["url"] = tx_validation.get("tx_base_url", source["url"])

Because no source has the name "tx-r5-live-validation" anymore, the source["url"] override at line 598 is now dead code. Its purpose is to replace the displayed URL in the report with the actual tx_base_url used at runtime. In the default CI path this is harmless (the URL constants match), but when --tx-base-url is supplied the report will show the stale default https://hts.heliossoftware.com instead of the URL actually validated against.

Fix: Change line 597 to:

if source.get("name") == "hts-live-validation":

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[smunini]

@mauripunzueta When I ran this GitHub action on this branch, I'm seeing errors: https://github.com/HeliosSoftware/hfs/actions/runs/28484701168

[smunini]

I'm seeing errors: https://github.com/HeliosSoftware/hfs/actions/runs/28484701168