Skip to content

Commit 04a92d3

Browse files
whi-twwhi-tw
committed
Add reusable workflows for review app C_UD operations
These will be called from the application repositories' PR workflows. It's easier to maintain these in one place in the deploy repo, since they contain a lot of AWS-specific logic that is common across all applications.
1 parent 27c5f3d commit 04a92d3

2 files changed

Lines changed: 157 additions & 0 deletions

File tree

‎.github/workflows/reusable-review_apps_on_pr_change.yml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: "Review apps: on PR change"
2+
on:
3+
workflow_call:
4+
inputs:
5+
aws-account-number:
6+
type: string
7+
default: "842676007477"
8+
aws-region:
9+
type: string
10+
default: "eu-west-2"
11+
app-name:
12+
type: string
13+
description: "The name of the application, used for the ECR repository and CodeBuild project. eg. forms-product-page"
14+
15+
jobs:
16+
update-review-app:
17+
runs-on: ubuntu-24.04-arm
18+
permissions:
19+
id-token: write
20+
contents: read
21+
pull-requests: write
22+
23+
steps:
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
26+
with:
27+
role-to-assume: arn:aws:iam::${{ inputs.aws-account-number }}:role/review-github-actions-${{ inputs.app-name }}
28+
aws-region: ${{ inputs.aws-region }}
29+
30+
- name: Checkout code
31+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
32+
33+
- name: Generate container image URI
34+
id: generate_image_uri
35+
env:
36+
ECR_REPO: ${{ inputs.aws-account-number }}.dkr.ecr.${{ inputs.aws-region }}.amazonaws.com/${{ inputs.app-name }}
37+
PR_NUMBER: ${{ github.event.pull_request.number }}
38+
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
39+
run: |
40+
echo "ECR_REPO=${ECR_REPO}" >> "$GITHUB_OUTPUT"
41+
BASE_URI="${ECR_REPO}:pr-${PR_NUMBER}"
42+
echo "BASE_URI=${BASE_URI}" >> "$GITHUB_OUTPUT"
43+
echo "URI=${BASE_URI}-${HEAD_SHA}-$(date +%s)" >> "$GITHUB_OUTPUT"
44+
45+
- name: Log in to Amazon ECR
46+
uses: aws-actions/amazon-ecr-login@5a88a04c91d5c6f97aae0d9be790e64d9b1d47b7 # v1.7.1
47+
48+
- name: Set up Docker Buildx
49+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
50+
51+
- name: Build
52+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
53+
with:
54+
push: true
55+
tags: ${{ steps.generate_image_uri.outputs.URI }}
56+
cache-from: type=gha
57+
cache-to: type=gha,mode=max
58+
59+
- name: Deploy review app via CodeBuild
60+
id: codebuild
61+
uses: aws-actions/aws-codebuild-run-build@4d15a47425739ac2296ba5e7eee3bdd4bfbdd767 # v1.0.18
62+
with:
63+
project-name: review-${{ inputs.app-name }}-deploy
64+
env-vars-for-codebuild: |
65+
PR_NUMBER,
66+
CONTAINER_IMAGE
67+
env:
68+
PR_NUMBER: ${{ github.event.pull_request.number }}
69+
CONTAINER_IMAGE: ${{ steps.generate_image_uri.outputs.URI }}
70+
71+
- name: Fetch terraform outputs
72+
id: outputs
73+
env:
74+
BUILD_ID: ${{ steps.codebuild.outputs.aws-build-id }}
75+
run: |
76+
# Extract build UUID from ARN (format: arn:aws:codebuild:region:account:build/project:uuid)
77+
# shellcheck disable=SC2153 # BUILD_ID is set in env, but shellcheck doesn't recognize it
78+
BUILD_UUID="${BUILD_ID##*:}"
79+
80+
# Download artifact
81+
aws s3 cp "s3://forms-review-codebuild-artifacts/${BUILD_UUID}/review-${{ inputs.app-name }}-deploy/outputs.json" outputs.json
82+
83+
# Parse outputs
84+
{
85+
echo "REVIEW_APP_URL=$(jq -r '.review_app_url.value' outputs.json)"
86+
echo "ECS_CLUSTER_ID=$(jq -r '.review_app_ecs_cluster_id.value' outputs.json)"
87+
echo "ECS_SERVICE_NAME=$(jq -r '.review_app_ecs_service_name.value' outputs.json)"
88+
} >> "$GITHUB_OUTPUT"
89+
90+
# Clean up artifact
91+
aws s3 rm "s3://forms-review-codebuild-artifacts/${BUILD_UUID}/review-${{ inputs.app-name }}-deploy/outputs.json"
92+
93+
- name: Wait for AWS ECS deployments to finish
94+
run: |
95+
aws ecs wait services-stable \
96+
--cluster "${{ steps.outputs.outputs.ECS_CLUSTER_ID }}" \
97+
--services "${{ steps.outputs.outputs.ECS_SERVICE_NAME }}"
98+
99+
- name: Comment on PR
100+
env:
101+
COMMENT_MARKER: <!-- review apps on pr change -->
102+
GH_TOKEN: ${{ github.token }}
103+
run: |
104+
cat <<EOF > "${{runner.temp}}/pr-comment.md"
105+
:tada: A review copy of this PR has been deployed! You can reach it at: ${{steps.outputs.outputs.REVIEW_APP_URL}}
106+
107+
It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
108+
after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
109+
to debug, or otherwise ask an infrastructure person.
110+
111+
For the sign in details and more information, [see the review apps wiki page](https://github.com/alphagov/forms-team/wiki/Review-apps).
112+
113+
$COMMENT_MARKER
114+
EOF
115+
116+
old_comment_ids=$(gh api "repos/{owner}/{repo}/issues/${{github.event.pull_request.number}}/comments" --jq "map(select((.user.login == \"github-actions[bot]\") and (.body | endswith(\$ENV.COMMENT_MARKER + \"\n\")))) | .[].id")
117+
for comment_id in $old_comment_ids; do
118+
gh api -X DELETE "repos/{owner}/{repo}/issues/comments/${comment_id}"
119+
done
120+
121+
gh pr comment "${{github.event.pull_request.html_url}}" --body-file "${{runner.temp}}/pr-comment.md"

‎.github/workflows/reusable-review_apps_on_pr_close.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: "Review apps: on PR close"
2+
on:
3+
workflow_call:
4+
inputs:
5+
aws-account-number:
6+
type: string
7+
default: "842676007477"
8+
aws-region:
9+
type: string
10+
default: "eu-west-2"
11+
app-name:
12+
type: string
13+
description: "The name of the application, used for the ECR repository and CodeBuild project. eg. forms-product-page"
14+
15+
jobs:
16+
delete-review-app:
17+
runs-on: ubuntu-24.04-arm
18+
permissions:
19+
id-token: write
20+
contents: read
21+
22+
steps:
23+
- name: Configure AWS credentials
24+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
25+
with:
26+
role-to-assume: arn:aws:iam::${{ inputs.aws-account-number }}:role/review-github-actions-${{ inputs.app-name }}
27+
aws-region: ${{ inputs.aws-region }}
28+
29+
- name: Destroy review app via CodeBuild
30+
uses: aws-actions/aws-codebuild-run-build@4d15a47425739ac2296ba5e7eee3bdd4bfbdd767 # v1.0.18
31+
env:
32+
PR_NUMBER: ${{ github.event.pull_request.number }}
33+
with:
34+
project-name: review-${{ inputs.app-name }}-destroy
35+
env-vars-for-codebuild: |
36+
PR_NUMBER

0 commit comments

Comments
 (0)