Skip to content

Commit 98bffb2

Browse files
TomdangoTomdango
authored
Merge branch 'develop' into feature/thju1-NRL-679-fixAccessTokenForDevRef
2 parents 9678db2 + 929f9d9 commit 98bffb2

File tree

24 files changed

+180
-756
lines changed

24 files changed

+180
-756
lines changed

‎.github/workflows/persistent-environment.yml‎

Lines changed: 23 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,8 @@ on:
88
description: "Environment to deploy to"
99
required: true
1010
default: "dev"
11-
type: choice
12-
options:
13-
- dev
14-
- ref
15-
- int
16-
- dev-sandbox
17-
- ref-sandbox
18-
- int-sandbox
11+
type: environment
12+
1913
branch_name:
2014
description: Branch to deploy
2115
required: true
@@ -71,6 +65,7 @@ jobs:
7165
terraform-plan:
7266
name: Terraform Plan - ${{ inputs.environment }}
7367
needs: [build]
68+
environment: ${{ inputs.environment }}
7469
runs-on: [self-hosted, ci]
7570

7671
steps:
@@ -90,23 +85,17 @@ jobs:
9085
- name: Install asdf
9186
uses: asdf-vm/actions/[email protected]
9287

93-
- name: Configure AWS Credentials
88+
- name: Configure Management Credentials
9489
uses: aws-actions/configure-aws-credentials@v4
9590
with:
9691
aws-region: eu-west-2
97-
role-to-assume: ${{ secrets.CI_ROLE_NAME }}
98-
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
92+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
93+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
9994

100-
- name: Get AWS Account ID
101-
id: get_account_id
95+
- name: Retrieve Server Certificates
10296
run: |
10397
account=$(echo '${{ inputs.environment }}' | cut -d '-' -f1)
104-
105-
echo "account=${account}" >> "$GITHUB_OUTPUT"
106-
echo "aws_account_id=$(aws secretsmanager get-secret-value --secret-id nhsd-nrlf--mgmt--${account}-account-id --query SecretString --output text)" >> "$GITHUB_OUTPUT"
107-
108-
- name: Retrieve Server Certificates
109-
run: aws s3 cp s3://nhsd-nrlf--truststore/server/${{ steps.get_account_id.outputs.account }}.pem truststore/server/${{ steps.get_account_id.outputs.account }}.pem
98+
make truststore-pull-server ENV=${account}
11099
111100
- name: Download build artifacts
112101
uses: actions/download-artifact@v4
@@ -123,11 +112,16 @@ jobs:
123112
- name: Terraform Plan
124113
run: |
125114
terraform -chdir=terraform/infrastructure plan \
126-
--var-file=etc/dev.tfvars \
127-
--var assume_account=${{ steps.get_account_id.outputs.aws_account_id }} \
128-
--var assume_role=terraform \
115+
--var-file=etc/${{ vars.ACCOUNT_NAME }}.tfvars \
116+
--var assume_role_arn=${{ secrets.DEPLOY_ROLE_ARN }} \
129117
-out tfplan
130118
119+
- name: Save Terraform Plan
120+
run: |
121+
terraform -chdir=terraform/infrastructure show -no-color tfplan > terraform/infrastructure/tfplan.txt
122+
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan
123+
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan.txt
124+
131125
terraform-apply:
132126
name: Terraform Apply - ${{ inputs.environment }}
133127
needs: [terraform-plan]
@@ -157,29 +151,20 @@ jobs:
157151
name: build-artifacts
158152
path: dist
159153

160-
- name: Download Terraform Plan artifact
161-
uses: actions/download-artifact@v4
162-
with:
163-
name: tfplan-output
164-
path: terraform/infrastructure
165-
166-
- name: Configure AWS Credentials
154+
- name: Configure Management Credentials
167155
uses: aws-actions/configure-aws-credentials@v4
168156
with:
169157
aws-region: eu-west-2
170-
role-to-assume: ${{ secrets.CI_ROLE_NAME }}
158+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
171159
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id}}
172160

173-
- name: Get AWS Account ID
174-
id: get_account_id
175-
run: |
176-
account=$(echo '${{ inputs.environment }}' | cut -d '-' -f1)
177-
178-
echo "account=${account}" >> "$GITHUB_OUTPUT"
179-
echo "aws_account_id=$(aws secretsmanager get-secret-value --secret-id nhsd-nrlf--mgmt--${account}-account-id --query SecretString --output text)" >> "$GITHUB_OUTPUT"
161+
- name: Download Terraform Plan artifact
162+
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
180163

181164
- name: Retrieve Server Certificates
182-
run: aws s3 cp s3://nhsd-nrlf--truststore/server/${{ steps.get_account_id.outputs.account }}.pem truststore/server/${{ steps.get_account_id.outputs.account }}.pem
165+
run: |
166+
account=$(echo '${{ inputs.environment }}' | cut -d '-' -f1)
167+
make truststore-pull-server ENV=${account}
183168
184169
- name: Terraform Init
185170
run: |

‎.github/workflows/pr-env-deploy.yml‎

Lines changed: 24 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ jobs:
9999
deploy:
100100
name: Deploy PR Environment
101101
runs-on: [self-hosted, ci]
102+
environment: pull-request
102103
needs: [set-environment-id, build]
103104

104105
steps:
@@ -124,19 +125,15 @@ jobs:
124125
name: build-artifacts
125126
path: dist
126127

127-
- name: Configure AWS Credentials
128+
- name: Configure Management Credentials
128129
uses: aws-actions/configure-aws-credentials@v4
129130
with:
130131
aws-region: eu-west-2
131-
role-to-assume: ${{ secrets.CI_ROLE_NAME }}
132+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
132133
role-session-name: github-actions-ci-${{ needs.set-environment-id.outputs.environment_id }}
133134

134135
- name: Retrieve Server Certificates
135-
run: aws s3 cp s3://nhsd-nrlf--truststore/server/dev.pem truststore/server/dev.pem
136-
137-
- name: Get AWS Account ID
138-
id: get_account_id
139-
run: echo "aws_account_id=$(aws secretsmanager get-secret-value --secret-id nhsd-nrlf--mgmt--dev-account-id --query SecretString --output text)" >> "$GITHUB_OUTPUT"
136+
run: make truststore-pull-server ENV=dev
140137

141138
- name: Terraform Init
142139
run: |
@@ -145,17 +142,11 @@ jobs:
145142
terraform -chdir=terraform/infrastructure workspace select ${{ needs.set-environment-id.outputs.environment_id }}
146143
147144
- name: Terraform Plan
148-
run: |
149-
terraform -chdir=terraform/infrastructure plan \
150-
--var-file=etc/dev.tfvars \
151-
--var assume_account=${{ steps.get_account_id.outputs.aws_account_id }} \
152-
--var assume_role=terraform \
153-
-out tfplan
145+
run: terraform -chdir=terraform/infrastructure plan --var-file=etc/dev.tfvars --var assume_role_arn=${{ secrets.DEPLOY_ROLE_ARN }} -out tfplan
154146

155147
- name: Terraform Apply
156148
id: terraform-apply
157-
run: |
158-
terraform -chdir=terraform/infrastructure apply tfplan
149+
run: terraform -chdir=terraform/infrastructure apply tfplan
159150

160151
- name: Add Success Pull Request Comment
161152
uses: actions/github-script@v7
@@ -184,6 +175,7 @@ jobs:
184175
integration-test:
185176
name: Run Integration Tests
186177
needs: [set-environment-id, deploy]
178+
environment: pull-request
187179
runs-on: [self-hosted, ci]
188180

189181
steps:
@@ -206,40 +198,31 @@ jobs:
206198
- name: Python Dependency Install
207199
run: poetry install --no-root
208200

209-
- name: Configure AWS Credentials
201+
- name: Configure Management Credentials
210202
uses: aws-actions/configure-aws-credentials@v4
211203
with:
212204
aws-region: eu-west-2
213-
role-to-assume: ${{ secrets.CI_ROLE_NAME }}
205+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
214206
role-session-name: github-actions-ci-${{ needs.set-environment-id.outputs.environment_id }}
215207

216208
- name: Retrieve Client Certificates
217-
run: |
218-
aws s3 cp s3://nhsd-nrlf--truststore/client/dev.key truststore/client/dev.key
219-
aws s3 cp s3://nhsd-nrlf--truststore/client/dev.crt truststore/client/dev.crt
220-
221-
- name: Get AWS Account ID
222-
id: get_account_id
223-
run: echo "aws_account_id=$(aws secretsmanager get-secret-value --secret-id nhsd-nrlf--mgmt--dev-account-id --query SecretString --output text)" >> "$GITHUB_OUTPUT"
209+
run: make truststore-pull-client ENV=dev
224210

225211
- name: Configure Dev Account Credentials
226-
id: configure-dev-account-credentials
227-
run: |
228-
aws_credentials=$(aws sts assume-role --role-arn arn:aws:iam::${{ steps.get_account_id.outputs.aws_account_id }}:role/terraform --role-session-name github-actions-ci-${{ needs.set-environment-id.outputs.environment_id }} --output json)
229-
echo "aws_access_key_id=$(echo $aws_credentials | jq -r '.Credentials.AccessKeyId')" >> "$GITHUB_OUTPUT"
230-
echo "aws_secret_access_key=$(echo $aws_credentials | jq -r '.Credentials.SecretAccessKey')" >> "$GITHUB_OUTPUT"
231-
echo "aws_session_token=$(echo $aws_credentials | jq -r '.Credentials.SessionToken')" >> "$GITHUB_OUTPUT"
212+
uses: aws-actions/configure-aws-credentials@v4
213+
with:
214+
aws-region: eu-west-2
215+
role-chaining: true
216+
role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
217+
role-session-name: github-actions-ci-${{ needs.set-environment-id.outputs.environment_id }}
232218

233219
- name: Run Integration Tests
234220
run: make test-features-integration TF_WORKSPACE=${{ needs.set-environment-id.outputs.environment_id }}
235-
env:
236-
AWS_ACCESS_KEY_ID: ${{ steps.configure-dev-account-credentials.outputs.aws_access_key_id }}
237-
AWS_SECRET_ACCESS_KEY: ${{ steps.configure-dev-account-credentials.outputs.aws_secret_access_key }}
238-
AWS_SESSION_TOKEN: ${{ steps.configure-dev-account-credentials.outputs.aws_session_token }}
239221

240222
performance-test:
241223
name: Run Performance Tests
242224
needs: [set-environment-id, integration-test]
225+
environment: pull-request
243226
runs-on: [self-hosted, ci]
244227

245228
steps:
@@ -268,30 +251,22 @@ jobs:
268251
uses: aws-actions/configure-aws-credentials@v4
269252
with:
270253
aws-region: eu-west-2
271-
role-to-assume: ${{ secrets.CI_ROLE_NAME }}
254+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
272255
role-session-name: github-actions-ci-${{ needs.set-environment-id.outputs.environment_id }}
273256

274257
- name: Pull Client Certificates
275258
run: make truststore-pull-client ENV=dev
276259

277-
- name: Get AWS Account ID
278-
id: get_account_id
279-
run: echo "aws_account_id=$(aws secretsmanager get-secret-value --secret-id nhsd-nrlf--mgmt--dev-account-id --query SecretString --output text)" >> "$GITHUB_OUTPUT"
280-
281260
- name: Configure Dev Account Credentials
282-
id: configure-dev-account-credentials
283-
run: |
284-
aws_credentials=$(aws sts assume-role --role-arn arn:aws:iam::${{ steps.get_account_id.outputs.aws_account_id }}:role/terraform --role-session-name github-actions-ci-${{ needs.set-environment-id.outputs.environment_id }} --output json)
285-
echo "aws_access_key_id=$(echo $aws_credentials | jq -r '.Credentials.AccessKeyId')" >> "$GITHUB_OUTPUT"
286-
echo "aws_secret_access_key=$(echo $aws_credentials | jq -r '.Credentials.SecretAccessKey')" >> "$GITHUB_OUTPUT"
287-
echo "aws_session_token=$(echo $aws_credentials | jq -r '.Credentials.SessionToken')" >> "$GITHUB_OUTPUT"
261+
uses: aws-actions/configure-aws-credentials@v4
262+
with:
263+
aws-region: eu-west-2
264+
role-chaining: true
265+
role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
266+
role-session-name: github-actions-ci-${{ needs.set-environment-id.outputs.environment_id }}
288267

289268
- name: Setup Environment Test Data
290269
run: make test-performance-prepare TF_WORKSPACE=${{ needs.set-environment-id.outputs.environment_id }}
291-
env:
292-
AWS_ACCESS_KEY_ID: ${{ steps.configure-dev-account-credentials.outputs.aws_access_key_id }}
293-
AWS_SECRET_ACCESS_KEY: ${{ steps.configure-dev-account-credentials.outputs.aws_secret_access_key }}
294-
AWS_SESSION_TOKEN: ${{ steps.configure-dev-account-credentials.outputs.aws_session_token }}
295270

296271
- name: Run Performance Test - Baseline
297272
run: make test-performance-baseline HOST=${{ needs.set-environment-id.outputs.environment_id }}.api.record-locator.dev.national.nhs.uk ENV_TYPE=dev
@@ -310,7 +285,3 @@ jobs:
310285

311286
- name: Cleanup Environment Test Data
312287
run: make test-performance-cleanup TF_WORKSPACE=${{ needs.set-environment-id.outputs.environment_id }}
313-
env:
314-
AWS_ACCESS_KEY_ID: ${{ steps.configure-dev-account-credentials.outputs.aws_access_key_id }}
315-
AWS_SECRET_ACCESS_KEY: ${{ steps.configure-dev-account-credentials.outputs.aws_secret_access_key }}
316-
AWS_SESSION_TOKEN: ${{ steps.configure-dev-account-credentials.outputs.aws_session_token }}

‎.tool-versions‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
awscli 2.15.11
2-
poetry 1.5.1
2+
poetry 1.8.2
33
jq 1.7.1
44
python 3.12.2
55
terraform 1.3.4

‎Makefile‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ DIST_PATH ?= ./dist
1111
TEST_ARGS ?= --cov --cov-report=term-missing
1212
FEATURE_TEST_ARGS ?= ./tests/features --format progress2
1313
TF_WORKSPACE ?= $(shell terraform -chdir=terraform/infrastructure workspace show)
14-
14+
ENV ?= dev
15+
APP_ALIAS ?= default
1516

1617
export PATH := $(PATH):$(PWD)/.venv/bin
1718

@@ -125,3 +126,9 @@ truststore-pull-client: check-warn ## Pull a client certificate
125126

126127
truststore-pull-ca: check-warn ## Pull a CA certificate
127128
@./scripts/truststore.sh pull-ca "$(ENV)"
129+
130+
swagger-merge: check-warn ## Generate Swagger Documentation
131+
@./scripts/swagger.sh merge "$(TYPE)"
132+
133+
generate-model: check-warn ## Generate Pydantic Models
134+
@./scripts/swagger.sh generate-model "$(TYPE)"

0 commit comments

Comments
 (0)