Skip to content

Commit 500c672

Browse files
JessWinterborneJessWinterborne
committed
LIME-2030: Setting up GHAs
1 parent 6e4830d commit 500c672

17 files changed

Lines changed: 517 additions & 83 deletions

‎.github/actions/node-setup/action.yml‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎.github/workflows/_secure-pipeline-deploy.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Build and deploy
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
role_arn:
7+
required: true
8+
artifact_bucket:
9+
required: true
10+
ecr_repository_test:
11+
required: true
12+
ecr_repository_traffic_test:
13+
required: true
14+
container_sign_kms_key:
15+
required: true
16+
signing_profile:
17+
required: true
18+
inputs:
19+
environment:
20+
type: string
21+
required: true
22+
23+
permissions:
24+
id-token: write
25+
contents: read
26+
27+
concurrency:
28+
group: secure-deploy-${{ inputs.environment }}
29+
30+
jobs:
31+
test-images-build-and-push:
32+
name: Build and push test images
33+
runs-on: ubuntu-latest
34+
steps:
35+
- name: Test image build and push
36+
uses: govuk-one-login/devplatform-upload-action-ecr@v1.5.0
37+
with:
38+
role-to-assume-arn: ${{ secrets.role_arn }}
39+
build-and-push-image-only: true
40+
working-directory: test/acceptance-tests
41+
artifact-bucket-name: ''
42+
ecr-repo-name: ${{ secrets.ecr_repository_test }}
43+
dockerfile: test.Dockerfile
44+
push-latest-tag: true
45+
container-sign-kms-key-arn: ${{ secrets.container_sign_kms_key }}
46+
47+
- name: Traffic test image build and push
48+
uses: govuk-one-login/devplatform-upload-action-ecr@v1.5.0
49+
with:
50+
role-to-assume-arn: ${{ secrets.role_arn }}
51+
build-and-push-image-only: true
52+
working-directory: test/acceptance-tests
53+
artifact-bucket-name: ''
54+
ecr-repo-name: ${{ secrets.ecr_repository_traffic_test }}
55+
dockerfile: traffic-test.Dockerfile
56+
push-latest-tag: true
57+
container-sign-kms-key-arn: ${{ secrets.container_sign_kms_key }}
58+
59+
deploy:
60+
name: Deploy stack
61+
runs-on: ubuntu-latest
62+
environment: ${{ inputs.environment }}
63+
needs: test-images-build-and-push
64+
steps:
65+
- name: SAM build
66+
uses: govuk-one-login/github-actions/sam/build-application@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
67+
with:
68+
template: deploy/template.yaml
69+
aws-role-arn: ${{ secrets.role_arn }}
70+
pull-repository: true
71+
72+
- name: SAM package and upload to S3
73+
uses: govuk-one-login/devplatform-upload-action@v3.13.0
74+
with:
75+
aws-role-arn: ${{ secrets.role_arn}}
76+
artifact-bucket-name: ${{ secrets.artifact_bucket }}
77+
signing-profile-name: ${{ secrets.signing_profile }}
78+
working-directory: .aws-sam/build

‎.github/workflows/cleanup.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Clean up stacks and log groups
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
# Every weekday at 9am
7+
- cron: '0 9 * * 1-5'
8+
9+
permissions:
10+
id-token: write
11+
12+
concurrency:
13+
group: cleanup-dev
14+
15+
jobs:
16+
delete-stacks:
17+
name: Delete stale stacks
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Assume AWS Role
21+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
22+
with:
23+
role-to-assume: ${{ secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
24+
aws-region: eu-west-2
25+
26+
- name: Get stale preview stacks
27+
uses: govuk-one-login/github-actions/sam/get-stale-stacks@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
28+
with:
29+
threshold-days: 14
30+
stack-name-filter: preview
31+
stack-tag-filters: |
32+
cri:deployment-source=github-actions
33+
cri:stack-type=preview
34+
description: preview
35+
env-var-name: PREVIEW_STACKS
36+
37+
- name: Get stale manually deployed stacks
38+
uses: govuk-one-login/github-actions/sam/get-stale-stacks@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
39+
with:
40+
threshold-days: 90
41+
stack-tag-filters: |
42+
cri:component=ipv-cri-ob-api
43+
cri:stack-type=dev
44+
cri:application=Lime
45+
cri:deployment-source=manual
46+
description: manually deployed
47+
env-var-name: MANUALLY_DEPLOYED_STACKS
48+
49+
- name: Delete stale preview stacks
50+
if: ${{ env.PREVIEW_STACKS != null }}
51+
uses: govuk-one-login/github-actions/sam/delete-stacks@2518d831abb4ec03fa3125619507f932966f2833
52+
with:
53+
stack-names: ${{ env.PREVIEW_STACKS }}
54+
verbose: true
55+
56+
- name: Delete stale manually deployed stacks
57+
if: ${{ env.MANUALLY_DEPLOYED_STACKS != null }}
58+
uses: govuk-one-login/github-actions/sam/delete-stacks@2518d831abb4ec03fa3125619507f932966f2833
59+
with:
60+
stack-names: ${{ env.MANUALLY_DEPLOYED_STACKS }}
61+
verbose: true
62+
63+
delete-log-groups:
64+
name: Delete stale log groups
65+
runs-on: ubuntu-latest
66+
steps:
67+
- uses: govuk-one-login/github-actions/sam/delete-stale-log-groups@cdb78df3693be21f3a8975a3cbdcb659956bc761 # temp until merged
68+
with:
69+
aws-role-arn: ${{ secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
70+
cutoff-days: 30
71+
limit: 300
72+
safe-patterns: '/preview-|^API-Gateway-Execution-Logs_'
73+
destructive: true
74+
verbose: true

‎.github/workflows/deploy-dev.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Deploy branch to dev
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
deploy-dev:
7+
name: Deploy to dev
8+
permissions:
9+
id-token: write
10+
contents: read
11+
concurrency:
12+
group: deploy-to-dev
13+
uses: ./.github/workflows/_secure-pipeline-deploy.yml
14+
secrets:
15+
role_arn: ${{ secrets.DEV_GHA_ROLE_ARN }}
16+
artifact_bucket: ${{ secrets.DEV_ARTIFACT_BUCKET }}
17+
ecr_repository_test: ${{ secrets.DEV_ECR_TEST }}
18+
ecr_repository_traffic_test: ${{ secrets.DEV_ECR_TRAFFIC_TEST }}
19+
container_sign_kms_key: $ {{ secrets.DEV_CONTAINER_SIGN_KMS_KEY }}
20+
signing_profile: ${{ secrets.DEV_SIGNING_PROFILE_NAME }}
21+
with:
22+
environment: development

‎.github/workflows/deploy-preview.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Deploy preview
2+
3+
on:
4+
workflow_dispatch:
5+
workflow_call:
6+
secrets:
7+
role_arn:
8+
required: true
9+
bucket_name:
10+
required: true
11+
outputs:
12+
stack-name:
13+
value: ${{ jobs.deploy-preview.outputs.stack-name }}
14+
aws-region:
15+
value: ${{ jobs.deploy-preview.outputs.aws-region}}
16+
17+
permissions: {}
18+
concurrency:
19+
group: deploy-preview-${{ github.event.pull_request.number || github.ref_name || github.run_id }}
20+
21+
jobs:
22+
build-preview:
23+
name: Build app
24+
permissions:
25+
id-token: write
26+
contents: read
27+
runs-on: ubuntu-latest
28+
outputs:
29+
sha-short: ${{ steps.get-sha.outputs.sha-short }}
30+
steps:
31+
- name: Get short SHA
32+
id: get-sha
33+
run: echo "sha-short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
34+
35+
- name: Build app
36+
uses: govuk-one-login/github-actions/sam/build-application@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
37+
with:
38+
template: deploy/template.yaml
39+
cache-name: ipv-cri-ob-api-${{ steps.get-sha.outputs.sha-short }}
40+
aws-role-arn: ${{ secrets.role_arn || secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
41+
pull-repository: true
42+
43+
deploy-preview:
44+
name: Deploy stack
45+
runs-on: ubuntu-latest
46+
permissions:
47+
id-token: write
48+
timeout-minutes: 15
49+
needs: build-preview
50+
outputs:
51+
aws-region: ${{ steps.deploy.outputs.aws-region }}
52+
stack-name: ${{ steps.deploy.outputs.stack-name }}
53+
steps:
54+
- name: Deploy stack
55+
uses: govuk-one-login/github-actions/sam/deploy-stack@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
56+
id: deploy
57+
with:
58+
aws-role-arn: ${{ secrets.role_arn || secrets.DEV_GHA_PREVIEW_ROLE_ARN }}
59+
s3-prefix: preview
60+
sam-deployment-bucket: ${{ secrets.bucket_name || secrets.DEV_PREVIEW_ARTIFACT_BUCKET }}
61+
stack-name: preview-${{ needs.build-preview.outputs.sha-short}}
62+
cache-name: ipv-cri-ob-api-${{ needs.build-preview.outputs.sha-short}}
63+
delete-failed-stack: true
64+
65+
tags: |
66+
cri:component=ipv-cri-ob-api
67+
cri:stack-type=preview
68+
cri:application=Lime
69+
cri:deployment-source=github-actions
70+
parameters: |
71+
DeploymentType=not-pipeline
72+
Environment=dev
73+
ParameterPrefix="ipv-cri-ob-api"

‎.github/workflows/post-merge.yml‎

Lines changed: 79 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,90 @@ on:
55
branches:
66
- main
77

8+
permissions: {}
9+
810
jobs:
9-
sonar-scan:
11+
unit-tests:
1012
runs-on: ubuntu-latest
13+
concurrency:
14+
group: unit-tests-${{ github.ref }}
15+
cancel-in-progress: true
1116
permissions:
1217
contents: read
1318
steps:
14-
- name: Checkout
15-
uses: actions/checkout@v6
16-
with:
17-
fetch-depth: 0 # required for sonar
1819
- name: Setup Node
19-
uses: ./.github/actions/node-setup
20+
uses: govuk-one-login/github-actions/node/install-dependencies@350c58b28e56f0fd67c4a8d8c8cd4fdc6355bdf3 # my branch - change once merged
21+
2022
- name: Unit tests
2123
run: npm run test:coverage
22-
- name: Sonar scan
23-
uses: SonarSource/sonarqube-scan-action@v7.0.0
24-
env:
25-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
24+
25+
- name: Upload coverage report
26+
uses: actions/upload-artifact@v4
27+
with:
28+
name: coverage
29+
path: coverage/
30+
retention-days: 1
31+
32+
sonar-scan:
33+
name: Sonar scan
34+
runs-on: ubuntu-latest
35+
concurrency:
36+
group: sonar-${{ github.ref }}
37+
cancel-in-progress: true
38+
needs: unit-tests
39+
permissions:
40+
contents: read
41+
steps:
42+
- name: Run Sonar scan
43+
uses: govuk-one-login/github-actions/code-quality/sonarcloud@9d6ee027d0b9167dfc25e67124951956278bb585
44+
with:
45+
github-token: ${{ secrets.GITHUB_TOKEN }}
46+
sonar-token: ${{ secrets.SONAR_TOKEN }}
47+
coverage-artifact: coverage
48+
coverage-run-id: ${{ github.run_id }}
49+
50+
codeql:
51+
name: CodeQL scan
52+
runs-on: ubuntu-latest
53+
concurrency:
54+
group: codeql-${{ github.ref }}
55+
cancel-in-progress: true
56+
permissions:
57+
security-events: write
58+
steps:
59+
- name: Run CodeQL scan
60+
uses: govuk-one-login/github-actions/code-quality/codeql@f5362528578198e7851e96e0594f593beff0162e
61+
62+
deploy-dev:
63+
uses: ./.github/workflows/_secure-pipeline-deploy.yml
64+
concurrency:
65+
group: deploy-to-dev
66+
permissions:
67+
id-token: write
68+
contents: read
69+
secrets:
70+
role_arn: ${{ secrets.DEV_GHA_ROLE_ARN }}
71+
artifact_bucket: ${{ secrets.DEV_ARTIFACT_BUCKET }}
72+
container_sign_kms_key: ${{ secrets.DEV_CONTAINER_SIGN_KMS_KEY }}
73+
ecr_repository_test: ${{ secrets.DEV_ECR_TEST }}
74+
ecr_repository_traffic_test: ${{ secrets.DEV_ECR_TRAFFIC_TEST }}
75+
signing_profile: ${{ secrets.DEV_SIGNING_PROFILE_NAME }}
76+
with:
77+
environment: development
78+
79+
deploy-build:
80+
uses: ./.github/workflows/_secure-pipeline-deploy.yml
81+
concurrency:
82+
group: deploy-to-build
83+
permissions:
84+
id-token: write
85+
contents: read
86+
secrets:
87+
role_arn: ${{ secrets.BUILD_GHA_ROLE_ARN }}
88+
artifact_bucket: ${{ secrets.BUILD_ARTIFACT_BUCKET }}
89+
container_sign_kms_key: ${{ secrets.BUILD_CONTAINER_SIGN_KMS_KEY }}
90+
ecr_repository_test: ${{ secrets.BUILD_ECR_TEST }}
91+
ecr_repository_traffic_test: ${{ secrets.BUILD_ECR_TRAFFIC_TEST }}
92+
signing_profile: $ {{ secrets.BUILD_SIGNING_PROFILE_NAME }}
93+
with:
94+
environment: build

0 commit comments

Comments
 (0)