Skip to content

Commit 5755291

Browse files
JessWinterborneJessWinterborne
committed
Initial tests
1 parent 6e4830d commit 5755291

12 files changed

Lines changed: 501 additions & 46 deletions

‎.github/workflows/_secure-pipeline-deploy.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Build and deploy
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
role_arn:
7+
required: true
8+
artifact_bucket:
9+
required: true
10+
# ecr_repository_test:
11+
# required: true
12+
# ecr_repository_traffic_test:
13+
# required: true
14+
# container_sign_kms_key:
15+
# required: true
16+
signing_profile:
17+
required: true
18+
# environment:
19+
# required: true
20+
# dynatrace_paas_token:
21+
# required: true
22+
inputs:
23+
region:
24+
required: false
25+
type: string
26+
default: eu-west-2
27+
28+
permissions:
29+
id-token: write
30+
contents: read
31+
32+
jobs:
33+
# test-images-build-and-push:
34+
# name: Build and push test images
35+
# runs-on: ubuntu-latest
36+
# env:
37+
# AWS_REGION: eu-west-2
38+
# ENVIRONMENT: ${{ secrets.environment }}
39+
# is this needed?
40+
# could these run in paralell?
41+
# steps:
42+
# why ?
43+
# - name: Login to Dynatrace Container Registry
44+
# uses: docker/login-action@v4
45+
# with:
46+
# registry: khw46367.live.dynatrace.com
47+
# username: khw46367
48+
# password: ${{ secrets.dynatrace_paas_token }}
49+
50+
# # this checkouts, sets up AWS creds and logs into docker registry
51+
# - name: Test image build and push
52+
# uses: uses: govuk-one-login/devplatform-upload-action-ecr@v1.5.0
53+
# with:
54+
# role-to-assume-arn: ${{ secrets.role_arn }}
55+
# build-and-push-image-only: true
56+
# working-directory: test
57+
# artifact-bucket-name: "" # ? shouldnt that be optional?
58+
# ecr-repo-name: ${{ secrets.ecr_repository_test }}
59+
# push-latest-tag: true
60+
# container-sign-kms-key-arn: ${{ secrets.container_sign_kms_key }} # ?
61+
62+
# # this checkouts, sets up AWS creds and logs into docker registry
63+
# - name: Traffic test image build and push
64+
# uses: uses: govuk-one-login/devplatform-upload-action-ecr@v1.5.0
65+
# with:
66+
# role-to-assume-arn: ${{ secrets.role_arn }}
67+
# build-and-push-image-only: true
68+
# working-directory: test
69+
# artifact-bucket-name: "" # ? shouldnt that be optional?
70+
# ecr-repo-name: ${{ secrets.ecr_repository_traffic_test }}
71+
# dockerfile: Dockerfile-traffictest # think about name
72+
# push-latest-tag: true # ?
73+
# container-sign-kms-key-arn: ${{ secrets.container_sign_kms_key }} # ?
74+
# UNCOMMENT LAST in case cosign blocks ^
75+
# hopefully can run pipeline without test images - might have to change terraform for build?
76+
# hasn't blocked front though - whats the difference?
77+
78+
deploy:
79+
name: Deploy stack
80+
runs-on: ubuntu-latest
81+
# needs: test-images-build-and-push
82+
steps:
83+
- name: Checkout
84+
uses: actions/checkout@v6
85+
86+
- name: Assume temporary AWS role
87+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
88+
with:
89+
role-to-assume: ${{ secrets.role_arn }}
90+
aws-region: ${{ inputs.region }}
91+
92+
- name: SAM validate
93+
run: sam validate --region ${{ inputs.region }} -t deploy/template.yaml --lint
94+
95+
- name: SAM build
96+
run: |
97+
mkdir out
98+
sam build -t deploy/template.yaml --region ${{ inputs.region }} -b out/
99+
100+
- name: SAM Deploy
101+
# concurrency and cancel in progress false
102+
uses: govuk-one-login/devplatform-upload-action@v3.13.0
103+
with:
104+
aws-role-arn: ${{ secrets.role_arn}}
105+
artifact-bucket-name: ${{ secrets.artifact_bucket }}
106+
signing-profile-name: ${{ secrets.signing_profile }}
107+
working-directory: ./out

‎.github/workflows/cleanup.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Clean up stacks and log groups
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
# Every weekday at 9am
7+
- cron: '0 9 * * 1-5'
8+
9+
permissions:
10+
id-token: write
11+
12+
# concurrency: cleanup-dev-${{ github.head_ref || github.ref_name }}
13+
14+
jobs:
15+
delete-stacks:
16+
name: Delete stale stacks
17+
runs-on: ubuntu-latest
18+
# environment: development
19+
steps:
20+
- name: Assume AWS Role
21+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
22+
with:
23+
role-to-assume: ${{ secrets.DEV_GHA_ROLE_ARN }}
24+
aws-region: eu-west-2
25+
26+
- name: Get stale preview stacks
27+
uses: govuk-one-login/github-actions/sam/get-stale-stacks@b6494ab79812830486ab6cc1838999d2e1dfba7d
28+
with:
29+
threshold-days: 14
30+
stack-name-filter: preview
31+
stack-tag-filters: |
32+
cri:deployment-source=github-actions
33+
cri:stack-type=preview
34+
description: preview
35+
env-var-name: PREVIEW_STACKS
36+
37+
- name: Get stale manually deployed stacks
38+
uses: govuk-one-login/github-actions/sam/get-stale-stacks@b6494ab79812830486ab6cc1838999d2e1dfba7d
39+
with:
40+
threshold-days: 90
41+
stack-tag-filters: |
42+
cri:component=ipv-cri-ob-api
43+
cri:stack-type=dev
44+
cri:application=Lime
45+
cri:deployment-source=manual
46+
description: manually deployed
47+
env-var-name: MANUALLY_DEPLOYED_STACKS
48+
49+
- name: Delete stale preview stacks
50+
if: ${{ env.PREVIEW_STACKS != null }}
51+
uses: govuk-one-login/github-actions/sam/delete-stacks@2518d831abb4ec03fa3125619507f932966f2833
52+
with:
53+
stack-names: ${{ env.PREVIEW_STACKS }}
54+
verbose: true
55+
56+
- name: Delete stale manually deployed stacks
57+
if: ${{ env.MANUALLY_DEPLOYED_STACKS != null }}
58+
uses: govuk-one-login/github-actions/sam/delete-stacks@2518d831abb4ec03fa3125619507f932966f2833
59+
with:
60+
stack-names: ${{ env.MANUALLY_DEPLOYED_STACKS }}
61+
verbose: true
62+
63+
delete-log-groups:
64+
name: Delete stale log groups
65+
runs-on: ubuntu-latest
66+
steps:
67+
- uses: govuk-one-login/github-actions/sam/delete-stale-log-groups@8d9b70ea03249a138db2b04c02071d7826cb00d9
68+
with:
69+
aws-role-arn: ${{ secrets.DEV_GHA_ROLE_ARN }}
70+
cutoff-days: '30'
71+
limit: '300'
72+
safe-patterns: '/preview-|^API-Gateway-Execution-Logs_'
73+
destructive: true
74+
verbose: true

‎.github/workflows/deploy-dev.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Deploy branch to dev
2+
on:
3+
workflow_dispatch:
4+
pull_request: # temp
5+
6+
jobs:
7+
deploy-dev:
8+
name: Deploy to dev
9+
permissions:
10+
id-token: write
11+
contents: read
12+
uses: ./.github/workflows/_secure-pipeline-deploy.yml
13+
secrets:
14+
role_arn: ${{ secrets.DEV_GHA_ROLE_ARN }}
15+
artifact_bucket: ${{ secrets.DEV_ARTIFACT_BUCKET }}
16+
# ecr_repository_test: ${{ secrets.DEV_TEST_ECR_REPOSITORY }}
17+
# ecr_repository_traffic_test: ${{ secrets.DEV_TRAFFIC_TEST_ECR_REPOSITORY }}
18+
# container_sign_kms_key: $ {{ secrets.DEV_CONTAINER_SIGN_KMS_KEY }}
19+
signing_profile: ${{ secrets.DEV_SIGNING_PROFILE_NAME }}
20+
# environment: development
21+
# dynatrace_paas_token: ${{ secrets.DYNATRACE_PAAS_TOKEN }}

‎.github/workflows/deploy-preview.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: Deploy preview
2+
3+
on:
4+
workflow_dispatch:
5+
workflow_call:
6+
# if I want to make this triggerable without PR, need to add conditionals for secrets
7+
secrets:
8+
role_arn:
9+
required: true
10+
bucket_name:
11+
required: true
12+
outputs:
13+
stack-name:
14+
value: ${{ jobs.deploy-preview.outputs.stack-name }}
15+
aws-region:
16+
value: ${{ jobs.deploy-preview.outputs.aws-region}}
17+
# sha-short:
18+
# value: ${{ jobs.build-preview.outputs.sha-short }}
19+
20+
permissions: {}
21+
22+
jobs:
23+
build-preview:
24+
name: Build app
25+
permissions:
26+
id-token: write
27+
contents: read
28+
runs-on: ubuntu-latest
29+
# concurrency:
30+
# group: build-development-${{ github.head_ref || github.ref_name }}
31+
outputs:
32+
sha-short: ${{ steps.get-sha.outputs.sha-short }}
33+
steps:
34+
- name: Get short SHA
35+
id: get-sha
36+
run: echo "sha-short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
37+
38+
- name: Build app
39+
uses: govuk-one-login/github-actions/sam/build-application@c35aa8daed14bd1b102f6c55afdf77eaeb958954
40+
with:
41+
template: deploy/template.yaml
42+
cache-name: ipv-cri-ob-api-${{ steps.get-sha.outputs.sha-short }}
43+
role-to-assume-arn: ${{ secrets.role_arn }}
44+
pull-repository: true
45+
46+
deploy-preview:
47+
name: Deploy stack
48+
runs-on: ubuntu-latest
49+
permissions:
50+
id-token: write
51+
timeout-minutes: 15
52+
needs: build-preview
53+
# concurrency:
54+
# group: deploy-development-${{ github.head_ref || github.ref_name }}
55+
# environment: development
56+
outputs:
57+
aws-region: ${{ steps.deploy.outputs.aws-region }}
58+
stack-name: ${{ steps.deploy.outputs.stack-name }}
59+
steps:
60+
- name: Deploy stack
61+
uses: govuk-one-login/github-actions/sam/deploy-stack@c35aa8daed14bd1b102f6c55afdf77eaeb958954
62+
id: deploy
63+
with:
64+
aws-role-arn: ${{ secrets.role_arn }}
65+
s3-prefix: preview
66+
sam-deployment-bucket: ${{ secrets.bucket_name }}
67+
stack-name: preview-${{ needs.build-preview.outputs.sha-short}}
68+
cache-name: ipv-cri-ob-api-${{ needs.build-preview.outputs.sha-short}}
69+
delete-failed-stack: true
70+
# do we want disable rollback? I reckon so...
71+
72+
tags: |
73+
cri:component=ipv-cri-ob-api
74+
cri:stack-type=preview
75+
cri:application=Lime
76+
cri:deployment-source=github-actions
77+
parameters: |
78+
DeploymentType=not-pipeline
79+
Environment=dev
80+
ParameterPrefix="ipv-cri-ob-api"

‎.github/workflows/post-merge.yml‎

Lines changed: 56 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,71 @@ on:
44
push:
55
branches:
66
- main
7+
# pull_request: # temp
8+
9+
permissions: {}
710

811
jobs:
9-
sonar-scan:
12+
unit-tests:
1013
runs-on: ubuntu-latest
1114
permissions:
1215
contents: read
1316
steps:
17+
# this can be condensed with a shared action
1418
- name: Checkout
1519
uses: actions/checkout@v6
16-
with:
17-
fetch-depth: 0 # required for sonar
20+
1821
- name: Setup Node
1922
uses: ./.github/actions/node-setup
23+
2024
- name: Unit tests
2125
run: npm run test:coverage
22-
- name: Sonar scan
23-
uses: SonarSource/sonarqube-scan-action@v7.0.0
24-
env:
25-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
26+
27+
- name: Upload coverage report
28+
uses: actions/upload-artifact@v4
29+
with:
30+
name: coverage
31+
path: coverage/
32+
retention-days: 1
33+
34+
sonar-scan:
35+
name: Sonar scan
36+
runs-on: ubuntu-latest
37+
needs: unit-tests
38+
permissions:
39+
contents: read
40+
steps:
41+
- name: Checkout
42+
uses: actions/checkout@v6
43+
44+
- name: Run Sonar scan
45+
uses: govuk-one-login/github-actions/code-quality/sonarcloud@9d6ee027d0b9167dfc25e67124951956278bb585
46+
with:
47+
github-token: ${{ secrets.GITHUB_TOKEN }}
48+
sonar-token: ${{ secrets.SONAR_TOKEN }}
49+
coverage-artifact: coverage
50+
coverage-run-id: ${{ github.run_id }}
51+
52+
# deploy-dev:
53+
# uses: ./.github/workflows/_secure-pipeline-deploy.yml
54+
# permissions:
55+
# id-token: write
56+
# contents: read
57+
# secrets:
58+
# role_arn: ${{ secrets.DEV_GH_ACTIONS_ROLE_ARN }}
59+
# artifact_bucket: ${{ secrets.DEV_ARTIFACT_BUCKET }}
60+
# container_sign_kms_key: ${{ secrets.DEV_CONTAINER_SIGN_KMS_KEY }}
61+
# ecr_repository: ${{ secrets.DEV_ECR_REPOSITORY }}
62+
# dynatrace_paas_token: ${{ secrets.DYNATRACE_PAAS_TOKEN }}
63+
64+
# deploy-build:
65+
# uses: ./.github/workflows/_deploy.yml
66+
# permissions:
67+
# id-token: write
68+
# contents: read
69+
# secrets:
70+
# role_arn: ${{ secrets.BUILD_GH_ACTIONS_ROLE_ARN }}
71+
# artifact_bucket: ${{ secrets.BUILD_ARTIFACT_BUCKET }}
72+
# container_sign_kms_key: ${{ secrets.BUILD_CONTAINER_SIGN_KMS_KEY }}
73+
# ecr_repository: ${{ secrets.BUILD_ECR_REPOSITORY }}
74+
# dynatrace_paas_token: ${{ secrets.DYNATRACE_PAAS_TOKEN }}

0 commit comments

Comments
 (0)