Skip to content

Commit dc5ee76

Browse files
kikidawson-gdskikidawson-gds
committed
DCMAW-12245: github action versioning spike
1 parent b3e84ef commit dc5ee76

14 files changed

Lines changed: 745 additions & 110 deletions

‎.github/jobs/ci-checks.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: CI Checks
2+
3+
description: {
4+
"name": "ci-checks",
5+
"version": "v1.0.0",
6+
"message":
7+
"This update adds versioning to the ci-checks job."
8+
}
9+
10+
on:
11+
workflow_call:
12+
inputs:
13+
RUN_FORMATTING:
14+
description: Whether to run the `format:check` npm script
15+
type: string
16+
default: true
17+
RUN_LINTER:
18+
description: Whether to run the `lint` npm script
19+
type: string
20+
default: true
21+
RUN_RAIN_FORMAT_VERIFY:
22+
description: Whether to verify template format by running the `infra:format:verify` npm script
23+
type: string
24+
default: false
25+
RUN_SAM_VALIDATE:
26+
description: Whether to run SAM validate lint on templates
27+
type: string
28+
default: true
29+
WORKING_DIRECTORY:
30+
description: Path to working directory in repo
31+
required: true
32+
type: string
33+
PRIVATE_PACKAGES_REQUIRED:
34+
description: Whether private packages must be installed
35+
type: string
36+
default: false
37+
38+
jobs:
39+
ci-checks:
40+
name: Run CI checks
41+
runs-on: ubuntu-24.04
42+
env:
43+
SAM_CLI_TELEMETRY: 0
44+
defaults:
45+
run:
46+
shell: bash
47+
working-directory: ${{ inputs.WORKING_DIRECTORY }}
48+
steps:
49+
- name: Check out repository code
50+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
51+
with:
52+
submodules: true
53+
54+
- name: Setup nodeJS
55+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
56+
with:
57+
cache: npm
58+
cache-dependency-path: ${{ inputs.WORKING_DIRECTORY }}/package-lock.json
59+
node-version-file: ${{ inputs.WORKING_DIRECTORY }}/.nvmrc
60+
61+
- name: Configure authentication for private packages in .npmrc
62+
if: inputs.PRIVATE_PACKAGES_REQUIRED == 'true'
63+
run: |
64+
echo "engine-strict=true" > .npmrc
65+
echo "@govuk-one-login:registry=https://npm.pkg.github.com/" >> .npmrc
66+
echo "//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN" >> .npmrc
67+
env:
68+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
69+
70+
- name: Install dependencies
71+
run: npm clean-install
72+
73+
- name: Check formatting
74+
if: inputs.RUN_FORMATTING == 'true'
75+
run: npm run format:check
76+
77+
- name: Check linting
78+
if: inputs.RUN_LINTER == 'true'
79+
run: npm run lint
80+
81+
- name: Set up Homebrew
82+
if: inputs.RUN_RAIN_FORMAT_VERIFY == 'true'
83+
id: set-up-homebrew
84+
run: |
85+
# Suggestion found in Ubuntu-24.02 runner image README; https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md
86+
# The suggested command doesn't persist across steps: eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
87+
# The following commands mimics the output from the suggested command. It may break for future runners.
88+
echo "HOMEBREW_CELLAR=/home/linuxbrew/.linuxbrew/Cellar" >> $GITHUB_ENV
89+
echo "HOMEBREW_REPOSITORY=/home/linuxbrew/.linuxbrew/Homebrew" >> $GITHUB_ENV
90+
echo "/home/linuxbrew/.linuxbrew/sbin" >> $GITHUB_PATH
91+
echo "/home/linuxbrew/.linuxbrew/bin" >> $GITHUB_PATH
92+
93+
- name: Install rain
94+
if: inputs.RUN_RAIN_FORMAT_VERIFY == 'true'
95+
run: brew install rain
96+
97+
- name: Verify template format using rain
98+
if: inputs.RUN_RAIN_FORMAT_VERIFY == 'true'
99+
run: npm run infra:format:verify
100+
101+
- name: Validate SAM template
102+
if: inputs.RUN_SAM_VALIDATE == 'true'
103+
run: |
104+
TEMPLATES="$(find . -name "template*.yaml")"
105+
for template in $TEMPLATES ; do
106+
sam validate --lint --template-file $template
107+
done

‎.github/jobs/push-docker-image.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Build, Push, Sign and Tag Test Image
2+
3+
description: {
4+
"name": "push-docker-image",
5+
"version": "v1.0.0",
6+
"message":
7+
"This update adds versioning to the push-docker-image job."
8+
}
9+
10+
on:
11+
workflow_call:
12+
inputs:
13+
AWS_REGION:
14+
description: The AWS region
15+
type: string
16+
default: eu-west-2
17+
IMAGE_TAG:
18+
description: The docker image tag
19+
type: string
20+
default: latest
21+
PRIVATE_PACKAGES_REQUIRED:
22+
description: Whether private packages must be installed
23+
type: string
24+
default: false
25+
WORKING_DIRECTORY:
26+
description: Path to working directory in repo
27+
required: true
28+
type: string
29+
secrets:
30+
CONTAINER_SIGN_KMS_KEY:
31+
description: KMS key for encrypting the test image
32+
required: true
33+
GH_ACTIONS_ROLE_ARN:
34+
description: AWS Role for pushing the test image and AWS artifact to AWS
35+
required: true
36+
TEST_IMAGE_REPOSITORY_URI:
37+
description: uri of the ECR for the test images
38+
required: true
39+
40+
jobs:
41+
docker-build-push-sign:
42+
name: "Build, Push, and Sign Test Image"
43+
runs-on: ubuntu-24.04
44+
defaults:
45+
run:
46+
shell: bash
47+
working-directory: ${{ inputs.WORKING_DIRECTORY }}
48+
steps:
49+
- name: Checkout Repository
50+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
51+
with:
52+
submodules: true
53+
fetch-depth: 0
54+
55+
- name: Install Cosign
56+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 #v3.9.2
57+
with:
58+
cosign-release: 'v2.5.2'
59+
60+
- name: Configure Authentication for Private Packages in .npmrc
61+
if: inputs.PRIVATE_PACKAGES_REQUIRED == 'true'
62+
env:
63+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64+
run: |
65+
echo "engine-strict=true" > .npmrc
66+
echo "@govuk-one-login:registry=https://npm.pkg.github.com/" >> .npmrc
67+
echo "//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN" >> .npmrc
68+
69+
- name: Authenticate with AWS
70+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 #v4.0.2
71+
with:
72+
aws-region: ${{ inputs.AWS_REGION }}
73+
role-to-assume: ${{ secrets.GH_ACTIONS_ROLE_ARN }}
74+
75+
- name: Login to AWS ECR
76+
uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 #v2.0.1
77+
78+
- name: Build Image
79+
run: |
80+
docker build -t ${{ secrets.TEST_IMAGE_REPOSITORY_URI }}:${{ inputs.IMAGE_TAG }} .
81+
82+
- name: Push Image
83+
run: |
84+
docker push ${{ secrets.TEST_IMAGE_REPOSITORY_URI }}:${{ inputs.IMAGE_TAG }}
85+
86+
- name: Sign Image
87+
run: |
88+
cosign sign --key awskms:///${{ secrets.CONTAINER_SIGN_KMS_KEY }} ${{ secrets.TEST_IMAGE_REPOSITORY_URI }}:${{ inputs.IMAGE_TAG }}

‎.github/jobs/test-suite.yml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
name: Run Test Suite
2+
3+
description: {
4+
"name": "test-suite",
5+
"version": "v1.0.0",
6+
"message":
7+
"This update adds versioning to the test-suite job."
8+
}
9+
10+
on:
11+
workflow_call:
12+
inputs:
13+
RUN_INFRA_TESTS:
14+
description: Whether to run infra tests using `test:infra` npm script
15+
type: string
16+
default: true
17+
RUN_SONARQUBE:
18+
description: Whether to run SonarQube checks. Needs RUN_UNIT_TESTS to be true.
19+
type: string
20+
default: true
21+
RUN_UNIT_TESTS:
22+
description: Whether to run unit tests using `test:unit` npm script
23+
type: string
24+
default: true
25+
SONARQUBE_CONTINUE_ON_ERROR:
26+
description: Whether to continue running the workflow if SonarQube quality gate fails
27+
type: string
28+
default: false
29+
WORKING_DIRECTORY:
30+
description: Path to working directory in repo
31+
required: true
32+
type: string
33+
PRIVATE_PACKAGES_REQUIRED:
34+
description: Whether private packages must be installed
35+
type: string
36+
default: false
37+
RUN_PACT_TESTS:
38+
description: Whether to run pact tests using `test:pact:ci` npm script
39+
type: string
40+
default: false
41+
secrets:
42+
SONAR_TOKEN:
43+
description: The token used for secure access to the SonarQube platform
44+
required: false
45+
46+
jobs:
47+
run-test-suite:
48+
name: Run test suite and SonarQube
49+
runs-on: ubuntu-24.04
50+
defaults:
51+
run:
52+
shell: bash
53+
working-directory: ${{ inputs.WORKING_DIRECTORY }}
54+
env:
55+
CONTINUE_ON_ERROR: ${{ inputs.SONARQUBE_CONTINUE_ON_ERROR }}
56+
steps:
57+
- name: Checkout Repository
58+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
59+
with:
60+
fetch-depth: 0
61+
submodules: true
62+
63+
- name: Setup NodeJS
64+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
65+
with:
66+
cache: npm
67+
cache-dependency-path: ${{ inputs.WORKING_DIRECTORY }}/package-lock.json
68+
node-version-file: ${{ inputs.WORKING_DIRECTORY }}/.nvmrc
69+
70+
- name: Configure Authentication for Private Packages in .npmrc
71+
if: inputs.GENERATE_OPEN_PROXY_API_SPEC == 'true'
72+
env:
73+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
74+
run: |
75+
echo "engine-strict=true" > .npmrc
76+
echo "@govuk-one-login:registry=https://npm.pkg.github.com/" >> .npmrc
77+
echo "//npm.pkg.github.com/:_authToken=$GITHUB_TOKEN" >> .npmrc
78+
79+
- name: Install Dependencies
80+
run: npm clean-install
81+
82+
- name: Run Unit Tests
83+
if: inputs.RUN_UNIT_TESTS == 'true'
84+
run: npm run test:unit
85+
86+
- name: Run Infra Tests
87+
if: inputs.RUN_INFRA_TESTS == 'true'
88+
run: npm run test:infra
89+
90+
- name: Run Pact Tests
91+
if: inputs.RUN_PACT_TESTS == 'true'
92+
continue-on-error: true # Pact tests are currently failing - remove step once fixed
93+
env:
94+
PACT_BROKER_URL: "https://pactbroker-onelogin.account.gov.uk"
95+
PACT_BROKER_USERNAME: ${{ secrets.PACT_BROKER_USERNAME }}
96+
PACT_BROKER_PASSWORD: ${{ secrets.PACT_BROKER_PASSWORD }}
97+
PACT_BROKER_SOURCE_SECRET: ${{ secrets.PACT_BROKER_SOURCE_SECRET }}
98+
PUBLISH_PACT_VERIFICATION_RESULTS: "false"
99+
run: npm run test:pact:ci
100+
101+
- name: Run SonarQube Scan
102+
if: inputs.RUN_SONARQUBE == 'true'
103+
uses: sonarsource/sonarqube-scan-action@8c71dc039c2dd71d3821e89a2b58ecc7fee6ced9 #v5.3.0
104+
env:
105+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
106+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
107+
with:
108+
projectBaseDir: ${{ inputs.WORKING_DIRECTORY }}
109+
110+
- name: Run SonarQube Quality Gate Check
111+
if: inputs.RUN_SONARQUBE == 'true'
112+
uses: Sonarsource/sonarqube-quality-gate-action@8406f4f1edaffef38e9fb9c53eb292fc1d7684fa #master
113+
continue-on-error: ${{ fromJSON(env.CONTINUE_ON_ERROR) }}
114+
timeout-minutes: 5
115+
env:
116+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
117+
with:
118+
scanMetadataReportFile: ${{ inputs.WORKING_DIRECTORY }}/.scannerwork/report-task.txt

0 commit comments

Comments
 (0)