NRLF/.github/workflows/deploy-account-wide-infra.yml at 7de612717243563887b4c5e648db3f62f6ac304f · NHSDigital/NRLF · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
name: Deploy Account-wide infrastructure
run-name: Account-wide infra deployment to ${{ inputs.environment }} of ${{ inputs.branch_name }} by ${{ github.actor }}

on:
  workflow_dispatch:
    inputs:
      environment:
        description: "Account to deploy to"
        required: true
        default: "account-dev"
        type: environment
      branch_name:
        description: Branch to deploy
        required: true

permissions:
  id-token: write
  contents: read
  actions: write

jobs:
  check-selected-environment:
    name: Check Workflow Env
    runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
    steps:
      - name: Validate environment
        env:
          IS_VALID_ENV: ${{ startsWith(inputs.environment, 'account-') }}
        run: |
          echo "valid workflow environment selected:" $IS_VALID_ENV
          if [[ $IS_VALID_ENV == true ]]; then
            exit 0
          fi
          echo "This workflow can only be run with 'account-*' environments as it deploys account-specific infrastructure"
          exit 1

  terraform-plan:
    name: Terraform Plan - ${{ inputs.environment }}
    environment: ${{ inputs.environment }}
    needs: [check-selected-environment]
    runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}

    steps:
      - name: Git clone - ${{ inputs.branch_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch_name }}

      - name: Setup environment
        run: |
          echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
          poetry install --no-root

      - name: Configure Management Credentials
        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
          role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}

      - name: Retrieve Server Certificates
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
        run: |
          make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}

      - name: Terraform Init
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
        run: |
          terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
          terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
            terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}

      - name: Terraform Plan
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
          ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
        run: |
          terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} plan \
            -var assume_account=${ACCOUNT_ID} \
            -var assume_role=terraform \
            -out tfplan

      - name: Save Terraform Plan
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
        run: |
          terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} show -no-color tfplan > terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt

          aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan
          aws s3 cp terraform/account-wide-infrastructure/$ACCOUNT_NAME/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt

  terraform-apply:
    name: Terraform Apply - ${{ inputs.environment }}
    needs: [terraform-plan]
    runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
    environment: ${{ inputs.environment }}

    steps:
      - name: Git clone - ${{ inputs.branch_name }}
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.branch_name }}

      - name: Setup environment
        run: |
          echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
          poetry install --no-root

      - name: Configure Management Credentials
        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
          role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}

      - name: Download Terraform Plan artifact
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
        run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/${ACCOUNT_NAME}/tfplan

      - name: Retrieve Server Certificates
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
        run: |
          make truststore-pull-all-for-account ACCOUNT=${ACCOUNT_NAME}

      - name: Terraform Init
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
        run: |
          terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
          terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
            terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}

      - name: Terraform Apply
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
          ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
        run: |
          terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} apply tfplan

      - name: Update environment config version
        env:
          ACCOUNT_NAME: ${{ vars.ACCOUNT_NAME }}
        run: |
          deployed_version=$(terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} output --raw version)
          echo $deployed_version