Skip to content

Commit 39ed489

Browse files
JessWinterborneJessWinterborne
committed
LIME-2030: Setting up GHAs
1 parent 6e4830d commit 39ed489

17 files changed

Lines changed: 541 additions & 83 deletions

‎.github/actions/node-setup/action.yml‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎.github/workflows/_secure-pipeline-deploy.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
name: Build and deploy
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
role_arn:
7+
required: true
8+
artifact_bucket:
9+
required: true
10+
ecr_repository_test:
11+
required: true
12+
ecr_repository_traffic_test:
13+
required: true
14+
container_sign_kms_key:
15+
required: true
16+
signing_profile:
17+
required: true
18+
inputs:
19+
region:
20+
required: false
21+
type: string
22+
default: eu-west-2
23+
environment:
24+
type: string
25+
required: true
26+
27+
permissions:
28+
id-token: write
29+
contents: read
30+
31+
concurrency:
32+
group: secure-deploy-${{ inputs.environment }}
33+
34+
jobs:
35+
test-images-build-and-push:
36+
name: Build and push test images
37+
runs-on: ubuntu-latest
38+
steps:
39+
- name: Test image build and push
40+
uses: govuk-one-login/devplatform-upload-action-ecr@v1.5.0
41+
with:
42+
role-to-assume-arn: ${{ secrets.role_arn }}
43+
build-and-push-image-only: true
44+
working-directory: test/acceptance-tests
45+
artifact-bucket-name: ''
46+
ecr-repo-name: ${{ secrets.ecr_repository_test }}
47+
dockerfile: test.Dockerfile
48+
push-latest-tag: true
49+
container-sign-kms-key-arn: ${{ secrets.container_sign_kms_key }}
50+
51+
- name: Traffic test image build and push
52+
uses: govuk-one-login/devplatform-upload-action-ecr@v1.5.0
53+
with:
54+
role-to-assume-arn: ${{ secrets.role_arn }}
55+
build-and-push-image-only: true
56+
working-directory: test/acceptance-tests
57+
artifact-bucket-name: ''
58+
ecr-repo-name: ${{ secrets.ecr_repository_traffic_test }}
59+
dockerfile: traffic-test.Dockerfile
60+
push-latest-tag: true
61+
container-sign-kms-key-arn: ${{ secrets.container_sign_kms_key }}
62+
63+
deploy:
64+
name: Deploy stack
65+
runs-on: ubuntu-latest
66+
environment: ${{ inputs.environment }}
67+
needs: test-images-build-and-push
68+
steps:
69+
# - name: Checkout
70+
# uses: actions/checkout@v6
71+
72+
# - name: Assume temporary AWS role
73+
# uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
74+
# with:
75+
# role-to-assume: ${{ secrets.role_arn }}
76+
# aws-region: ${{ inputs.region }}
77+
78+
# - name: SAM validate
79+
# run: sam validate --region ${{ inputs.region }} -t deploy/template.yaml --lint
80+
81+
# - name: SAM build
82+
# run: |
83+
# mkdir out
84+
# sam build -t deploy/template.yaml --region ${{ inputs.region }} -b out/
85+
86+
- name: Build app
87+
uses: govuk-one-login/github-actions/sam/build-application@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
88+
with:
89+
template: deploy/template.yaml
90+
aws-role-arn: ${{ secrets.role_arn }}
91+
pull-repository: true
92+
93+
- name: SAM package and upload to S3
94+
uses: govuk-one-login/devplatform-upload-action@v3.13.0
95+
with:
96+
aws-role-arn: ${{ secrets.role_arn}}
97+
artifact-bucket-name: ${{ secrets.artifact_bucket }}
98+
signing-profile-name: ${{ secrets.signing_profile }}

‎.github/workflows/cleanup.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Clean up stacks and log groups
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
# Every weekday at 9am
7+
- cron: '0 9 * * 1-5'
8+
9+
permissions:
10+
id-token: write
11+
12+
concurrency:
13+
group: cleanup-dev
14+
15+
jobs:
16+
delete-stacks:
17+
name: Delete stale stacks
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Assume AWS Role
21+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
22+
with:
23+
role-to-assume: ${{ secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
24+
aws-region: eu-west-2
25+
26+
- name: Get stale preview stacks
27+
uses: govuk-one-login/github-actions/sam/get-stale-stacks@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
28+
with:
29+
threshold-days: 14
30+
stack-name-filter: preview
31+
stack-tag-filters: |
32+
cri:deployment-source=github-actions
33+
cri:stack-type=preview
34+
description: preview
35+
env-var-name: PREVIEW_STACKS
36+
37+
- name: Get stale manually deployed stacks
38+
uses: govuk-one-login/github-actions/sam/get-stale-stacks@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
39+
with:
40+
threshold-days: 90
41+
stack-tag-filters: |
42+
cri:component=ipv-cri-ob-api
43+
cri:stack-type=dev
44+
cri:application=Lime
45+
cri:deployment-source=manual
46+
description: manually deployed
47+
env-var-name: MANUALLY_DEPLOYED_STACKS
48+
49+
- name: Delete stale preview stacks
50+
if: ${{ env.PREVIEW_STACKS != null }}
51+
uses: govuk-one-login/github-actions/sam/delete-stacks@2518d831abb4ec03fa3125619507f932966f2833
52+
with:
53+
stack-names: ${{ env.PREVIEW_STACKS }}
54+
verbose: true
55+
56+
- name: Delete stale manually deployed stacks
57+
if: ${{ env.MANUALLY_DEPLOYED_STACKS != null }}
58+
uses: govuk-one-login/github-actions/sam/delete-stacks@2518d831abb4ec03fa3125619507f932966f2833
59+
with:
60+
stack-names: ${{ env.MANUALLY_DEPLOYED_STACKS }}
61+
verbose: true
62+
63+
delete-log-groups:
64+
name: Delete stale log groups
65+
runs-on: ubuntu-latest
66+
steps:
67+
- uses: govuk-one-login/github-actions/sam/delete-stale-log-groups@8d9b70ea03249a138db2b04c02071d7826cb00d9
68+
with:
69+
aws-role-arn: ${{ secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
70+
cutoff-days: 30
71+
limit: 300
72+
safe-patterns: '/preview-|^API-Gateway-Execution-Logs_'
73+
destructive: true
74+
verbose: true

‎.github/workflows/deploy-dev.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Deploy branch to dev
2+
on:
3+
workflow_dispatch:
4+
pull_request: # temp
5+
6+
jobs:
7+
deploy-dev:
8+
name: Deploy to dev
9+
permissions:
10+
id-token: write
11+
contents: read
12+
concurrency:
13+
group: deploy-to-dev
14+
uses: ./.github/workflows/_secure-pipeline-deploy.yml
15+
secrets:
16+
role_arn: ${{ secrets.DEV_GHA_ROLE_ARN }}
17+
artifact_bucket: ${{ secrets.DEV_ARTIFACT_BUCKET }}
18+
ecr_repository_test: ${{ secrets.DEV_ECR_TEST }}
19+
ecr_repository_traffic_test: ${{ secrets.DEV_ECR_TRAFFIC_TEST }}
20+
container_sign_kms_key: $ {{ secrets.DEV_CONTAINER_SIGN_KMS_KEY }}
21+
signing_profile: ${{ secrets.DEV_SIGNING_PROFILE_NAME }}
22+
with:
23+
environment: development

‎.github/workflows/deploy-preview.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Deploy preview
2+
3+
on:
4+
workflow_dispatch:
5+
workflow_call:
6+
secrets:
7+
role_arn:
8+
required: true
9+
bucket_name:
10+
required: true
11+
outputs:
12+
stack-name:
13+
value: ${{ jobs.deploy-preview.outputs.stack-name }}
14+
aws-region:
15+
value: ${{ jobs.deploy-preview.outputs.aws-region}}
16+
17+
permissions: {}
18+
concurrency:
19+
group: deploy-preview-${{ github.event.pull_request.number || github.ref_name || github.run_id }}
20+
21+
jobs:
22+
build-preview:
23+
name: Build app
24+
permissions:
25+
id-token: write
26+
contents: read
27+
runs-on: ubuntu-latest
28+
outputs:
29+
sha-short: ${{ steps.get-sha.outputs.sha-short }}
30+
steps:
31+
- name: Get short SHA
32+
id: get-sha
33+
run: echo "sha-short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
34+
35+
- name: Build app
36+
uses: govuk-one-login/github-actions/sam/build-application@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
37+
with:
38+
template: deploy/template.yaml
39+
cache-name: ipv-cri-ob-api-${{ steps.get-sha.outputs.sha-short }}
40+
aws-role-arn: ${{ secrets.role_arn || secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
41+
pull-repository: true
42+
43+
deploy-preview:
44+
name: Deploy stack
45+
runs-on: ubuntu-latest
46+
permissions:
47+
id-token: write
48+
timeout-minutes: 15
49+
needs: build-preview
50+
outputs:
51+
aws-region: ${{ steps.deploy.outputs.aws-region }}
52+
stack-name: ${{ steps.deploy.outputs.stack-name }}
53+
steps:
54+
- name: Deploy stack
55+
uses: govuk-one-login/github-actions/sam/deploy-stack@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
56+
id: deploy
57+
with:
58+
aws-role-arn: ${{ secrets.role_arn || secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
59+
s3-prefix: preview
60+
sam-deployment-bucket: ${{ secrets.bucket_name || secrets.DEV_PREVIEW_ARTIFACT_BUCKET }}
61+
stack-name: preview-${{ needs.build-preview.outputs.sha-short}}
62+
cache-name: ipv-cri-ob-api-${{ needs.build-preview.outputs.sha-short}}
63+
delete-failed-stack: true
64+
65+
tags: |
66+
cri:component=ipv-cri-ob-api
67+
cri:stack-type=preview
68+
cri:application=Lime
69+
cri:deployment-source=github-actions
70+
parameters: |
71+
DeploymentType=not-pipeline
72+
Environment=dev
73+
ParameterPrefix="ipv-cri-ob-api"

‎.github/workflows/post-merge.yml‎

Lines changed: 78 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,90 @@ on:
44
push:
55
branches:
66
- main
7+
# pull_request: # temp
8+
9+
permissions: {}
710

811
jobs:
9-
sonar-scan:
12+
unit-tests:
1013
runs-on: ubuntu-latest
14+
concurrency:
15+
group: unit-tests-${{ github.ref }}
16+
cancel-in-progress: true
1117
permissions:
1218
contents: read
1319
steps:
14-
- name: Checkout
15-
uses: actions/checkout@v6
16-
with:
17-
fetch-depth: 0 # required for sonar
1820
- name: Setup Node
19-
uses: ./.github/actions/node-setup
21+
uses: govuk-one-login/github-actions/node/install-dependencies@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
22+
2023
- name: Unit tests
2124
run: npm run test:coverage
22-
- name: Sonar scan
23-
uses: SonarSource/sonarqube-scan-action@v7.0.0
24-
env:
25-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
25+
26+
- name: Upload coverage report
27+
uses: actions/upload-artifact@v4
28+
with:
29+
name: coverage
30+
path: coverage/
31+
retention-days: 1
32+
33+
sonar-scan:
34+
name: Sonar scan
35+
runs-on: ubuntu-latest
36+
concurrency:
37+
group: sonar-${{ github.ref }}
38+
cancel-in-progress: true
39+
needs: unit-tests
40+
permissions:
41+
contents: read
42+
steps:
43+
- name: Run Sonar scan
44+
uses: govuk-one-login/github-actions/code-quality/sonarcloud@9d6ee027d0b9167dfc25e67124951956278bb585
45+
with:
46+
github-token: ${{ secrets.GITHUB_TOKEN }}
47+
sonar-token: ${{ secrets.SONAR_TOKEN }}
48+
coverage-artifact: coverage
49+
coverage-run-id: ${{ github.run_id }}
50+
51+
codeql:
52+
name: CodeQL scan
53+
runs-on: ubuntu-latest
54+
concurrency:
55+
group: codeql-${{ github.ref }}
56+
cancel-in-progress: true
57+
permissions:
58+
security-events: write
59+
steps:
60+
- name: Run CodeQL scan
61+
uses: govuk-one-login/github-actions/code-quality/codeql@f5362528578198e7851e96e0594f593beff0162e
62+
63+
deploy-dev:
64+
uses: ./.github/workflows/_secure-pipeline-deploy.yml
65+
concurrency:
66+
group: deploy-to-dev
67+
permissions:
68+
id-token: write
69+
contents: read
70+
secrets:
71+
role_arn: ${{ secrets.DEV_GHA_ROLE_ARN }}
72+
artifact_bucket: ${{ secrets.DEV_ARTIFACT_BUCKET }}
73+
container_sign_kms_key: ${{ secrets.DEV_CONTAINER_SIGN_KMS_KEY }}
74+
ecr_repository: ${{ secrets.DEV_ECR_TEST }}
75+
ecr_repository_traffic_test: ${{ secrets.DEV_ECR_TRAFFIC_TEST }}
76+
with:
77+
environment: development
78+
79+
deploy-build:
80+
uses: ./.github/workflows/_secure-pipeline-deploy.yml
81+
concurrency:
82+
group: deploy-to-build
83+
permissions:
84+
id-token: write
85+
contents: read
86+
secrets:
87+
role_arn: ${{ secrets.BUILD_GHA_ROLE_ARN }}
88+
artifact_bucket: ${{ secrets.BUILD_ARTIFACT_BUCKET }}
89+
container_sign_kms_key: ${{ secrets.BUILD_CONTAINER_SIGN_KMS_KEY }}
90+
ecr_repository: ${{ secrets.BUILD_ECR_TEST }}
91+
ecr_repository_traffic_test: ${{ secrets.BUILD_ECR_TRAFFIC_TEST }}
92+
with:
93+
environment: build

0 commit comments

Comments
 (0)