Skip to content

Commit ad51097

Browse files
whi-twwhi-tw
committed
Deploy / destroy review apps with CodeBuild
Instead of running Terraform directly in the GitHub Actions runners, we now trigger AWS CodeBuild projects to handle the deployment and destruction of review apps. This means that the repository no longer needs extensive AWS permissions in GitHub Actions, and the actual available AWS operations are limited.
1 parent f117d37 commit ad51097

2 files changed

Lines changed: 22 additions & 139 deletions

File tree

‎.github/workflows/review_apps_on_pr_change.yml‎

Lines changed: 11 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -1,117 +1,20 @@
11
name: "Review apps: on PR change"
22
on:
33
pull_request:
4-
# being explicit about what to trigger on.
5-
# matches the docs for the default types
6-
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request
74
types: [opened, reopened, synchronize]
85

96
concurrency:
10-
group: "review-apps-forms-runner-pr-${{ github.event.pull_request.number }}"
7+
group: "review-apps-pr-${{ github.event.pull_request.number }}"
118
cancel-in-progress: false
12-
jobs:
13-
update-review-app:
14-
# this references a codebuild project configured in forms-deploy
15-
# see: https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html
16-
runs-on: codebuild-review-forms-runner-gha-runner-${{github.run_id}}-${{github.run_attempt}}
17-
18-
permissions:
19-
pull-requests: write
20-
21-
steps:
22-
- name: Generate container image URI
23-
run: |
24-
echo "CONTAINER_IMAGE_URI=842676007477.dkr.ecr.eu-west-2.amazonaws.com/forms-runner:pr-${{github.event.pull_request.number}}-${{github.event.pull_request.head.sha}}-$(date +%s)" >> "$GITHUB_ENV"
25-
26-
- name: Checkout code
27-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
28-
29-
- name: Build container
30-
run: |
31-
# Docker credentials are configured in CodeBuild
32-
# CodeBuild retrieves the credentials from ParameterStore
33-
echo "${DOCKER_PASSWORD}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
34-
docker build \
35-
--tag "${{env.CONTAINER_IMAGE_URI}}" \
36-
.
37-
38-
- name: Push container
39-
id: build-container
40-
run: |
41-
aws ecr get-login-password --region eu-west-2 \
42-
| docker login --username AWS --password-stdin 842676007477.dkr.ecr.eu-west-2.amazonaws.com
43-
44-
echo "Pushing container image"
45-
echo "${{env.CONTAINER_IMAGE_URI}}"
46-
47-
docker push "${CONTAINER_IMAGE_URI}"
48-
49-
- name: Determine Terraform version
50-
id: terraform-version
51-
run: |
52-
echo "TF_VERSION=$(< .review_apps/.terraform-version)" >> "$GITHUB_OUTPUT"
53-
54-
- uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
55-
with:
56-
terraform_version: ${{steps.terraform-version.outputs.TF_VERSION}}
57-
58-
- name: Deploy review app
59-
id: deploy
60-
run: |
61-
cd .review_apps/
629

63-
terraform init -backend-config="key=review-apps/forms-runner/pr-${{github.event.pull_request.number}}.tfstate"
10+
permissions:
11+
id-token: write
12+
contents: read
13+
pull-requests: write
6414

65-
terraform apply \
66-
-var "pull_request_number=${{github.event.pull_request.number}}" \
67-
-var "forms_runner_container_image=${{env.CONTAINER_IMAGE_URI}}" \
68-
-no-color \
69-
-auto-approve
70-
71-
# shellcheck disable=SC2129 # SC2129 is "mainly a stylistic issue" and it breaks our flow
72-
echo "REVIEW_APP_URL=$(terraform output -raw review_app_url)" >> "$GITHUB_OUTPUT"
73-
echo "ADMIN_APP_URL=$(terraform output -raw admin_app_url)" >> "$GITHUB_OUTPUT"
74-
echo "ECS_CLUSTER_ID=$(terraform output -raw review_app_ecs_cluster_id)" >> "$GITHUB_OUTPUT"
75-
echo "ECS_SERVICE_NAME=$(terraform output -raw review_app_ecs_service_name)" >> "$GITHUB_OUTPUT"
76-
77-
- name: Wait for AWS ECS deployments to finish
78-
run: |
79-
aws ecs wait services-stable \
80-
--cluster "${{steps.deploy.outputs.ECS_CLUSTER_ID}}" \
81-
--services "${{steps.deploy.outputs.ECS_SERVICE_NAME}}"
82-
83-
- name: Comment on PR
84-
env:
85-
COMMENT_MARKER: <!-- review apps on pr change -->
86-
GH_TOKEN: ${{ github.token }}
87-
run: |
88-
cat <<EOF > "${{runner.temp}}/pr-comment.md"
89-
:tada: A review copy of this PR has been deployed! It is made of up two components
90-
91-
1. [A review copy of forms-runner](${{steps.deploy.outputs.REVIEW_APP_URL}})
92-
2. [A production copy of forms-admin](${{steps.deploy.outputs.ADMIN_APP_URL}})
93-
94-
> [!IMPORTANT]
95-
> Not all of the functionality of forms-runner is present in review apps.
96-
> Functionality such as sending emails, file upload, and S3 submission types are
97-
> deliberately disabled for the sake of simplifying review apps.
98-
>
99-
> You should use the full dev environment to test the functionality which is disabled here.
100-
101-
It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
102-
after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
103-
to debug, or otherwise ask an infrastructure person.
104-
105-
For the sign in details and more information, [see the review apps wiki page](https://github.com/alphagov/forms-team/wiki/Review-apps).
106-
107-
$COMMENT_MARKER
108-
EOF
109-
110-
# shellcheck disable=SC2016
111-
# `jq` uses single-quote characters on Unix shells
112-
old_comment_ids=$(gh api "repos/{owner}/{repo}/issues/${{github.event.pull_request.number}}/comments" --jq 'map(select((.user.login == "github-actions[bot]") and (.body | endswith($ENV.COMMENT_MARKER + "\n")))) | .[].id')
113-
for comment_id in $old_comment_ids; do
114-
gh api -X DELETE "repos/{owner}/{repo}/issues/comments/${comment_id}"
115-
done
116-
117-
gh pr comment "${{github.event.pull_request.html_url}}" --body-file "${{runner.temp}}/pr-comment.md"
15+
jobs:
16+
update-review-app:
17+
name: Update review app
18+
uses: alphagov/forms-deploy/.github/workflows/reusable-review_apps_on_pr_change.yml@main
19+
with:
20+
app-name: forms-runner

‎.github/workflows/review_apps_on_pr_close.yml‎

Lines changed: 11 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,20 @@
11
name: "Review apps: on PR close"
22
on:
33
pull_request:
4-
# only run when a PR is closed or merged
54
types: [closed]
65

76
concurrency:
8-
group: "review-apps-forms-runner-pr-${{ github.event.pull_request.number }}"
7+
group: "review-apps-pr-${{ github.event.pull_request.number }}"
98
cancel-in-progress: false
10-
env:
11-
IMAGE_TAG: "842676007477.dkr.ecr.eu-west-2.amazonaws.com/forms-runner:pr-${{github.event.pull_request.number}}-${{github.event.pull_request.head.ref}}"
12-
jobs:
13-
delete-review-app:
14-
# this references a codebuild project configured in forms-deploy
15-
# see: https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html
16-
runs-on: codebuild-review-forms-runner-gha-runner-${{github.run_id}}-${{github.run_attempt}}
17-
18-
steps:
19-
- name: Checkout code
20-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21-
22-
- name: Determine Terraform version
23-
id: terraform-version
24-
run: |
25-
echo "TF_VERSION=$(< .review_apps/.terraform-version)" >> "$GITHUB_OUTPUT"
269

27-
- uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
28-
with:
29-
terraform_version: ${{steps.terraform-version.outputs.TF_VERSION}}
10+
permissions:
11+
id-token: write
12+
contents: read
13+
pull-requests: write
3014

31-
- name: Delete review app
32-
run: |
33-
cd .review_apps/
34-
35-
terraform init -backend-config="key=review-apps/forms-runner/pr-${{github.event.pull_request.number}}.tfstate"
36-
terraform destroy \
37-
-var "pull_request_number=${{github.event.pull_request.number}}" \
38-
-var "forms_runner_container_image=${{env.IMAGE_TAG}}" \
39-
-no-color \
40-
-auto-approve
15+
jobs:
16+
delete-review-app:
17+
name: Delete review app
18+
uses: alphagov/forms-deploy/.github/workflows/reusable-review_apps_on_pr_close.yml@main
19+
with:
20+
app-name: forms-runner

0 commit comments

Comments
 (0)