Merge pull request #711 from NHSDigital/feature/made14-NRL-793-perms-pipeline-fixups

[NRL-793] Fixup permissions pipeline issues

Author: mattdean3-nhs

.github/workflows/update-lambda-permissions.yml

@@ -1,5 +1,5 @@
 name: Update Lambda Permissions
-run-name: Updating permissions on ${{ inputs.environment }} using ${{ inputs.branch_name }} by ${{ github.actor }}
+run-name: Updating permissions on ${{ inputs.stack_name }} using ${{ inputs.branch_name }} by ${{ github.actor }}
 
 on:
   workflow_dispatch:
@@ -11,14 +11,20 @@ on:
         type: environment
 
       stack_name:
-        description: Name of stack to apply permissions to
+        description: Stack to update
         required: true
         type: string
 
       branch_name:
         description: Branch to deploy
         required: true
 
+      strict_versioning:
+        description: Use strict versioning (recommended)
+        required: true
+        type: boolean
+        default: true
+
 permissions:
   id-token: write
   contents: read
@@ -69,18 +75,23 @@ jobs:
 
       - name: Check deployed version matches build version
         run: |
-          this_version="$(./scripts/get-current-info.sh) | jq -r .version)"
+          this_version="$(./scripts/get-current-info.sh | jq -r .version)"
           deployed_version="$(terraform -chdir=terraform/infrastructure output --raw version)"
 
-          if [ "${deployed_version}" != "${this_version}" ]; then
-            echo "Deployed version is ${deployed_version}, not ${this_version}"
-            exit 1
-          fi
+          echo "code-version=${this_version} deployed-version=${deployed_version}"
 
-          echo "Deployed version matches this version: ${deployed_version}"
+          if [ "${deployed_version}" != "${this_version}" ]
+          then
+            echo "${this_version} does not match deployed version: ${deployed_version}" 1>&2
+
+            if [ "${{ inputs.strict_versioning }}" == "true" ]; then
+              echo "Strict version checking failed, cancelling workflow" 1>&2
+              exit 1
+            fi
+          fi
 
   build-permissions:
-    name: Build permissions for ${{ inputs.environment }}
+    name: Build permissions
     runs-on: [self-hosted, ci]
     environment: ${{ inputs.environment }}
 
@@ -130,7 +141,7 @@ jobs:
           path: dist/nrlf_permissions.zip
 
   pull-deployed-lambdas:
-    name: Pull deployed lambdas from ${{ inputs.stack_name }}
+    name: Pull deployed lambdas
     runs-on: [self-hosted, ci]
     environment: ${{ inputs.environment }}
 
@@ -169,7 +180,7 @@ jobs:
           path: dist/*.zip
 
   terraform-plan:
-    name: Plan changes to ${{ inputs.stack_name }} for ${{ inputs.environment }}
+    name: Plan changes
     runs-on: [self-hosted, ci]
     environment: ${{ inputs.environment }}
 
@@ -181,11 +192,30 @@ jobs:
         with:
           ref: ${{ github.ref }}
 
+      - name: Setup asdf cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.asdf
+          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
+          restore-keys: |
+            ${{ runner.os }}-asdf-
+
+      - name: Install asdf
+        uses: asdf-vm/actions/[email protected]
+
+      - name: Install zip
+        run: sudo apt-get install zip
+
+      - name: Setup Python environment
+        run: |
+          poetry install --no-root
+          source $(poetry env info --path)/bin/activate
+
       - name: Restore pulled lambda artifacts
         uses: actions/cache/restore@v4
         with:
           key: ${{ github.run_id }}-pulled-lambda-artifacts
-          path: ./dist
+          path: dist/*.zip
           fail-on-cache-miss: true
 
       - name: Restore NRLF permissions cache
@@ -223,7 +253,7 @@ jobs:
           aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan.txt
 
   terraform-apply:
-    name: Apply permissions to ${{ inputs.stack_name }} for ${{ inputs.environment }}
+    name: Apply permissions
     runs-on: [self-hosted, ci]
     environment: ${{ inputs.environment }}
 
@@ -239,7 +269,7 @@ jobs:
         uses: actions/cache/restore@v4
         with:
           key: ${{ github.run_id }}-pulled-lambda-artifacts
-          path: ./dist
+          path: dist/*.zip
           fail-on-cache-miss: true
 
       - name: Restore NRLF permissions cache

scripts/get_current_info.sh scripts/get-current-info.shscripts/get_current_info.sh renamed to scripts/get-current-info.sh

@@ -38,6 +38,6 @@ data "aws_iam_policy" "pointers-kms-read-write" {
 data "external" "current-info" {
   program = [
     "bash",
-    "../../scripts/get_current_info.sh",
+    "../../scripts/get-current-info.sh",
   ]
 }