Skip to content

Commit 933f31c

Browse files
atraceatrace
committed
NRL-1595 Rough deploy account wide infra workflow
1 parent 5759942 commit 933f31c

File tree

1 file changed

+332
-0
lines changed

1 file changed

+332
-0
lines changed

‎.github/workflows/deploy-account-wide-infra.yml‎

Lines changed: 332 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,332 @@
1+
name: Deploy Account-wide infrastructure
2+
run-name: Account-wide infra deployment to ${{ inputs.account }} of ${{ inputs.branch_name }} by ${{ github.actor }}
3+
4+
# An action environment would need
5+
# name=acc-test
6+
# envs_to_pull: "qa" "ref" "int" "perftest"
7+
# aws_account_id: 123456789 - get this from tf vars or something maybe?
8+
9+
on:
10+
workflow_dispatch:
11+
inputs:
12+
account:
13+
description: "Account to deploy to"
14+
required: true
15+
default: "dev"
16+
type: choice
17+
options:
18+
- dev
19+
- test
20+
- prod
21+
branch_name:
22+
description: Branch to deploy
23+
required: true
24+
25+
permissions:
26+
id-token: write
27+
contents: read
28+
actions: write
29+
30+
jobs:
31+
# build:
32+
# name: Build - ${{ inputs.branch_name }}
33+
# runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
34+
35+
# steps:
36+
# - name: Git clone - ${{ inputs.branch_name }}
37+
# uses: actions/checkout@v4
38+
# with:
39+
# ref: ${{ inputs.branch_name }}
40+
41+
# - name: Setup environment
42+
# run: |
43+
# echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
44+
# poetry install --no-root
45+
46+
# - name: Run Linting
47+
# run: make lint
48+
49+
# - name: Run Unit Tests
50+
# run: make test
51+
52+
# - name: Build Project
53+
# run: make build
54+
55+
# - name: Configure Management Credentials
56+
# uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
57+
# with:
58+
# aws-region: eu-west-2
59+
# role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
60+
# role-session-name: github-actions-ci-${{ inputs.account }}-${{ github.run_id }}
61+
62+
# - name: Add S3 Permissions to Lambda
63+
# env:
64+
# ENVIRONMENT: ${{ inputs.environment }}
65+
# run: |
66+
# account=$(echo "$ENVIRONMENT" | cut -d '-' -f1)
67+
# inactive_stack=$(poetry run python ./scripts/get_env_config.py inactive-stack $ENVIRONMENT)
68+
# make get-s3-perms ENV=${account} TF_WORKSPACE_NAME=${inactive_stack}
69+
70+
# - name: Save Build Artifacts
71+
# uses: actions/upload-artifact@v4
72+
# with:
73+
# name: build-artifacts
74+
# path: |
75+
# dist/*.zip
76+
# !dist/nrlf_permissions.zip
77+
78+
# - name: Save NRLF Permissions cache
79+
# uses: actions/cache/save@v4
80+
# with:
81+
# key: ${{ github.run_id }}-nrlf-permissions
82+
# path: dist/nrlf_permissions.zip
83+
84+
terraform-plan:
85+
name: Terraform Plan - ${{ inputs.account }}
86+
# needs: [build]
87+
# environment: ${{ inputs.environment }}
88+
# environment: acc-${{ inputs.environment }} ??
89+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
90+
91+
steps:
92+
- name: Git clone - ${{ inputs.branch_name }}
93+
uses: actions/checkout@v4
94+
with:
95+
ref: ${{ inputs.branch_name }}
96+
97+
- name: Setup environment
98+
run: |
99+
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
100+
poetry install --no-root
101+
102+
- name: Configure Management Credentials
103+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
104+
with:
105+
aws-region: eu-west-2
106+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
107+
role-session-name: github-actions-ci-${{ inputs.account }}-${{ github.run_id }}
108+
109+
- name: Retrieve Server Certificates
110+
env:
111+
// TODO: needs to go in an environment or be looked up somehow envs_to_pull=("dev" "test" "preid")
112+
ENVS_TO_PULL: ${{ vars.envs_to_pull }}
113+
run: |
114+
# Needs doing for each env per account
115+
envs_array=($ENVS_TO_PULL)
116+
for env in $envs_array; do make truststore-pull-server ENV=${env}; done
117+
118+
# - name: Download build artifacts
119+
# uses: actions/download-artifact@v4
120+
# with:
121+
# name: build-artifacts
122+
# path: dist
123+
124+
# - name: Restore NRLF permissions cache
125+
# uses: actions/cache/restore@v4
126+
# with:
127+
# key: ${{ github.run_id }}-nrlf-permissions
128+
# path: dist/nrlf_permissions.zip
129+
# fail-on-cache-miss: true
130+
131+
- name: Terraform Init
132+
env:
133+
ACCOUNT_NAME: ${{ inputs.account }}
134+
run: |
135+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
136+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
137+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
138+
139+
- name: Terraform Plan
140+
env:
141+
DEPLOY_ROLE_ARN: ${{ secrets.DEPLOY_ROLE_ARN }}
142+
ACCOUNT_NAME: ${{ inputs.account }}
143+
run: |
144+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} plan \
145+
-var 'assume_account=AWS_ACCOUNT_ID' \
146+
-var 'assume_role=terraform' // TODO: is this still a good role? for CI?
147+
-out tfplan
148+
149+
- name: Save Terraform Plan
150+
env:
151+
ACCOUNT_NAME: ${{ inputs.account }}
152+
run: |
153+
terraform -chdir=terraform/account-wide-infrastructure show -no-color tfplan > terraform/account-wide-infrastructure/tfplan.txt
154+
aws s3 cp terraform/account-wide-infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan // TODO where tf is this?
155+
aws s3 cp terraform/account-wide-infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan.txt
156+
157+
terraform-apply:
158+
name: Terraform Apply - ${{ inputs.account }}
159+
needs: [terraform-plan]
160+
runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
161+
# environment: ${{ inputs.environment }}
162+
163+
steps:
164+
- name: Git clone - ${{ inputs.branch_name }}
165+
uses: actions/checkout@v4
166+
with:
167+
ref: ${{ inputs.branch_name }}
168+
169+
- name: Setup environment
170+
run: |
171+
echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
172+
poetry install --no-root
173+
174+
- name: Download build artifacts
175+
uses: actions/download-artifact@v4
176+
with:
177+
name: build-artifacts
178+
path: dist
179+
180+
- name: Restore NRLF permissions cache
181+
uses: actions/cache/restore@v4
182+
with:
183+
key: ${{ github.run_id }}-nrlf-permissions
184+
path: dist/nrlf_permissions.zip
185+
fail-on-cache-miss: true
186+
187+
- name: Configure Management Credentials
188+
uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
189+
with:
190+
aws-region: eu-west-2
191+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
192+
role-session-name: github-actions-ci-${{ inputs.account }}-${{ github.run_id}}
193+
194+
- name: Download Terraform Plan artifact
195+
env:
196+
ACCOUNT_NAME: ${{ inputs.ACCOUNT }}
197+
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/acc-$ACCOUNT_NAME/${{ github.run_id }}/tfplan terraform/account-wide-infrastructure/tfplan
198+
199+
- name: Retrieve Server Certificates
200+
env:
201+
// TODO: needs to go in an environment or be looked up somehow envs_to_pull=("dev" "test" "preid")
202+
ENVS_TO_PULL: ${{ vars.envs_to_pull }}
203+
run: |
204+
# Needs doing for each env per account
205+
envs_array=($ENVS_TO_PULL)
206+
for env in $envs_array; do make truststore-pull-server ENV=${env}; done
207+
208+
- name: Terraform Init
209+
env:
210+
ACCOUNT_NAME: ${{ inputs.account }}
211+
run: |
212+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} init
213+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace new ${ACCOUNT_NAME} || \
214+
terraform -chdir=terraform/account-wide-infrastructure/${ACCOUNT_NAME} workspace select ${ACCOUNT_NAME}
215+
216+
- name: Terraform Apply
217+
run: |
218+
terraform -chdir=terraform/account-wide-infrastructure apply tfplan \
219+
-var 'assume_account=AWS_ACCOUNT_ID' \
220+
-var 'assume_role=terraform'
221+
# TODO: the rest of this still needed now we're applying from a file? if not, don;t forget the backslash above!! \
222+
223+
# Is this where we'd burn commit & datetime into state?
224+
- name: Update environment config version
225+
env:
226+
ENVIRONMENT: ${{ inputs.environment }}
227+
run: |
228+
deployed_version=$(terraform -chdir=terraform/infrastructure output --raw version)
229+
poetry run python ./scripts/set_env_config.py inactive-version ${deployed_version} $ENVIRONMENT
230+
231+
- name: Smoke Test ?
232+
env:
233+
ENVIRONMENT: ${{ inputs.environment }}
234+
run: |
235+
account=$(echo "$ENVIRONMENT" | cut -d '-' -f1)
236+
make ENV=${account} truststore-pull-client
237+
make ENV=$ENVIRONMENT test-smoke-internal
238+
239+
# do we need this for account infra-only changes??
240+
# activate-stack:
241+
# name: Activate - ${{ inputs.environment }}
242+
# needs: [terraform-apply]
243+
# runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
244+
# environment: ${{ inputs.environment }}
245+
246+
# steps:
247+
# - name: Git clone - ${{ inputs.branch_name }}
248+
# uses: actions/checkout@v4
249+
# with:
250+
# ref: ${{ inputs.branch_name }}
251+
252+
# - name: Setup environment
253+
# run: |
254+
# echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
255+
# poetry install --no-root
256+
257+
# - name: Configure Management Credentials
258+
# uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
259+
# with:
260+
# aws-region: eu-west-2
261+
# role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
262+
# role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
263+
264+
# - name: Activate Stack
265+
# env:
266+
# ENVIRONMENT: ${{ inputs.environment }}
267+
# run: |
268+
# inactive_stack=$(poetry run python ./scripts/get_env_config.py inactive-stack $ENVIRONMENT)
269+
# poetry run python ./scripts/activate_stack.py ${inactive_stack} $ENVIRONMENT
270+
271+
# post-release-verify:
272+
# name: Verify - ${{ inputs.account }}
273+
# needs: [activate-stack]
274+
# runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
275+
# # environment: ${{ inputs.environment }}
276+
277+
# steps:
278+
# - name: Git clone - ${{ inputs.branch_name }}
279+
# uses: actions/checkout@v4
280+
# with:
281+
# ref: ${{ inputs.branch_name }}
282+
283+
# - name: Setup environment
284+
# run: |
285+
# echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
286+
# poetry install --no-root
287+
288+
# - name: Configure Management Credentials
289+
# uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
290+
# with:
291+
# aws-region: eu-west-2
292+
# role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
293+
# role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
294+
295+
# - name: "Smoke Test"
296+
# env:
297+
# ENVIRONMENT: ${{ inputs.environment }}
298+
# run: |
299+
# make ENV=$ENVIRONMENT test-smoke-public
300+
301+
# Can we rollback changes if needed? Or just manually rerun pipeline for last working commit?
302+
# rollback-stack:
303+
# name: Rollback - ${{ inputs.environment }}
304+
# needs: [post-release-verify]
305+
# if: always() && ( needs.post-release-verify.result == 'failure' )
306+
# runs-on: codebuild-nhsd-nrlf-ci-build-project-${{ github.run_id }}-${{ github.run_attempt }}
307+
# environment: ${{ inputs.environment }}
308+
309+
# steps:
310+
# - name: Git clone - ${{ inputs.branch_name }}
311+
# uses: actions/checkout@v4
312+
# with:
313+
# ref: ${{ inputs.branch_name }}
314+
315+
# - name: Setup environment
316+
# run: |
317+
# echo "${HOME}/.asdf/bin" >> $GITHUB_PATH
318+
# poetry install --no-root
319+
320+
# - name: Configure Management Credentials
321+
# uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a #v4.3.1
322+
# with:
323+
# aws-region: eu-west-2
324+
# role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
325+
# role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
326+
327+
# - name: Deactivate Stack
328+
# env:
329+
# ENVIRONMENT: ${{ inputs.environment }}
330+
# run: |
331+
# inactive_stack_name=$(poetry run python ./scripts/get_env_config.py inactive-stack $ENVIRONMENT)
332+
# poetry run python ./scripts/activate_stack.py ${inactive_stack_name} $ENVIRONMENT

0 commit comments

Comments
 (0)