Skip to content

Commit f3cbc24

Browse files
mattdean3-nhsmattdean3-nhs
authored
Merge branch 'develop' into feature/made14-NRL-959-add-fhir-resources
2 parents fbab195 + 4d3b81a commit f3cbc24

File tree

6 files changed

+368
-2
lines changed

6 files changed

+368
-2
lines changed

‎.github/workflows/persistent-environment.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -234,8 +234,7 @@ jobs:
234234

235235
- name: Update environment config version
236236
run: |
237-
short_commit_ref="$(echo ${{ github.sha }} | cut -c1-8)"
238-
deployed_version="${{ inputs.branch_name }}@${short_commit_ref}"
237+
deployed_version=$(terraform -chdir=terraform/infrastructure output --raw version)
239238
poetry run python ./scripts/set_env_config.py inactive-version ${deployed_version} ${{ inputs.environment }}
240239
241240
- name: Smoke Test

‎.github/workflows/update-lambda-permissions.yml‎

Lines changed: 270 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,270 @@
1+
name: Update Lambda Permissions
2+
run-name: Updating permissions on ${{ inputs.environment }} using ${{ inputs.branch_name }} by ${{ github.actor }}
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
environment:
8+
description: Environment to deploy to
9+
required: true
10+
default: "dev"
11+
type: environment
12+
13+
stack_name:
14+
description: Name of stack to apply permissions to
15+
required: true
16+
type: string
17+
18+
branch_name:
19+
description: Branch to deploy
20+
required: true
21+
22+
permissions:
23+
id-token: write
24+
contents: read
25+
actions: write
26+
27+
jobs:
28+
check-versions:
29+
name: Check versions
30+
runs-on: [self-hosted, ci]
31+
32+
steps:
33+
- name: Git clone - ${{ github.ref }}
34+
uses: actions/checkout@v4
35+
with:
36+
ref: ${{ github.ref }}
37+
38+
- name: Setup asdf cache
39+
uses: actions/cache@v4
40+
with:
41+
path: ~/.asdf
42+
key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
43+
restore-keys: |
44+
${{ runner.os }}-asdf-
45+
46+
- name: Install asdf
47+
uses: asdf-vm/actions/[email protected]
48+
49+
- name: Install zip
50+
run: sudo apt-get install zip
51+
52+
- name: Setup Python environment
53+
run: |
54+
poetry install --no-root
55+
source $(poetry env info --path)/bin/activate
56+
57+
- name: Configure Management Credentials
58+
uses: aws-actions/configure-aws-credentials@v4
59+
with:
60+
aws-region: eu-west-2
61+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
62+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
63+
64+
- name: Terraform Init
65+
run: |
66+
terraform -chdir=terraform/infrastructure init
67+
terraform -chdir=terraform/infrastructure workspace new ${{ inputs.stack_name }} || \
68+
terraform -chdir=terraform/infrastructure workspace select ${{ inputs.stack_name }}
69+
70+
- name: Check deployed version matches build version
71+
run: |
72+
this_version="$(./scripts/get-current-info.sh) | jq -r .version)"
73+
deployed_version="$(terraform -chdir=terraform/infrastructure output --raw version)"
74+
75+
if [ "${deployed_version}" != "${this_version}" ]; then
76+
echo "Deployed version is ${deployed_version}, not ${this_version}"
77+
exit 1
78+
fi
79+
80+
echo "Deployed version matches this version: ${deployed_version}"
81+
82+
build-permissions:
83+
name: Build permissions for ${{ inputs.environment }}
84+
runs-on: [self-hosted, ci]
85+
environment: ${{ inputs.environment }}
86+
87+
needs: [check-versions]
88+
89+
steps:
90+
- name: Git clone - ${{ github.ref }}
91+
uses: actions/checkout@v4
92+
with:
93+
ref: ${{ github.ref }}
94+
95+
- name: Setup asdf cache
96+
uses: actions/cache@v4
97+
with:
98+
path: ~/.asdf
99+
key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
100+
restore-keys: |
101+
${{ runner.os }}-asdf-
102+
103+
- name: Install asdf
104+
uses: asdf-vm/actions/[email protected]
105+
106+
- name: Install zip
107+
run: sudo apt-get install zip
108+
109+
- name: Setup Python environment
110+
run: |
111+
poetry install --no-root
112+
source $(poetry env info --path)/bin/activate
113+
114+
- name: Configure Management Credentials
115+
uses: aws-actions/configure-aws-credentials@v4
116+
with:
117+
aws-region: eu-west-2
118+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
119+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
120+
121+
- name: Create lambda permissions layer
122+
run: |
123+
account=$(echo '${{ inputs.environment }}' | cut -d '-' -f1)
124+
make get-s3-perms ENV=${account} TF_WORKSPACE_NAME=${{ inputs.stack_name }}
125+
126+
- name: Save NRLF permissions in cache
127+
uses: actions/cache/save@v4
128+
with:
129+
key: ${{ github.run_id }}-nrlf-permissions
130+
path: dist/nrlf_permissions.zip
131+
132+
pull-deployed-lambdas:
133+
name: Pull deployed lambdas from ${{ inputs.stack_name }}
134+
runs-on: [self-hosted, ci]
135+
environment: ${{ inputs.environment }}
136+
137+
needs: [check-versions]
138+
139+
steps:
140+
- name: Git clone - ${{ github.ref }}
141+
uses: actions/checkout@v4
142+
with:
143+
ref: ${{ github.ref }}
144+
145+
- name: Configure Management Credentials
146+
uses: aws-actions/configure-aws-credentials@v4
147+
with:
148+
aws-region: eu-west-2
149+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
150+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
151+
152+
- name: Configure Account Role
153+
uses: aws-actions/configure-aws-credentials@v4
154+
with:
155+
aws-region: eu-west-2
156+
role-chaining: true
157+
role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
158+
role-session-name: github-actions-ci-acc-${{ inputs.environment }}-${{ github.run_id }}
159+
160+
- name: Pull deployed lambda artifacts
161+
run: |
162+
account=$(echo '${{ inputs.environment }}' | cut -d '-' -f1)
163+
./scripts/pull-lambda-code-for-stack.sh ${{ inputs.stack_name }}
164+
165+
- name: Save lambda artifacts in cache
166+
uses: actions/cache/save@v4
167+
with:
168+
key: ${{ github.run_id }}-pulled-lambda-artifacts
169+
path: dist/*.zip
170+
171+
terraform-plan:
172+
name: Plan changes to ${{ inputs.stack_name }} for ${{ inputs.environment }}
173+
runs-on: [self-hosted, ci]
174+
environment: ${{ inputs.environment }}
175+
176+
needs: [build-permissions, pull-deployed-lambdas]
177+
178+
steps:
179+
- name: Git clone - ${{ github.ref }}
180+
uses: actions/checkout@v4
181+
with:
182+
ref: ${{ github.ref }}
183+
184+
- name: Restore pulled lambda artifacts
185+
uses: actions/cache/restore@v4
186+
with:
187+
key: ${{ github.run_id }}-pulled-lambda-artifacts
188+
path: ./dist
189+
fail-on-cache-miss: true
190+
191+
- name: Restore NRLF permissions cache
192+
uses: actions/cache/restore@v4
193+
with:
194+
key: ${{ github.run_id }}-nrlf-permissions
195+
path: dist/nrlf_permissions.zip
196+
fail-on-cache-miss: true
197+
198+
- name: Configure Management Credentials
199+
uses: aws-actions/configure-aws-credentials@v4
200+
with:
201+
aws-region: eu-west-2
202+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
203+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
204+
205+
- name: Terraform Init
206+
run: |
207+
terraform -chdir=terraform/infrastructure init
208+
terraform -chdir=terraform/infrastructure workspace new ${{ inputs.stack_name }} || \
209+
terraform -chdir=terraform/infrastructure workspace select ${{ inputs.stack_name }}
210+
211+
- name: Terraform Plan
212+
run: |
213+
terraform -chdir=terraform/infrastructure plan \
214+
--var-file=etc/${{ vars.ACCOUNT_NAME }}.tfvars \
215+
--var assume_role_arn=${{ secrets.DEPLOY_ROLE_ARN }} \
216+
--var use_shared_resources=$(poetry run python scripts/are_resources_shared_for_stack.py ${{ inputs.stack_name }}) \
217+
--out tfplan
218+
219+
- name: Save Terraform Plan
220+
run: |
221+
terraform -chdir=terraform/infrastructure show -no-color tfplan > terraform/infrastructure/tfplan.txt
222+
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan
223+
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan.txt
224+
225+
terraform-apply:
226+
name: Apply permissions to ${{ inputs.stack_name }} for ${{ inputs.environment }}
227+
runs-on: [self-hosted, ci]
228+
environment: ${{ inputs.environment }}
229+
230+
needs: terraform-plan
231+
232+
steps:
233+
- name: Git clone - ${{ github.ref }}
234+
uses: actions/checkout@v4
235+
with:
236+
ref: ${{ github.ref }}
237+
238+
- name: Restore pulled lambda artifacts
239+
uses: actions/cache/restore@v4
240+
with:
241+
key: ${{ github.run_id }}-pulled-lambda-artifacts
242+
path: ./dist
243+
fail-on-cache-miss: true
244+
245+
- name: Restore NRLF permissions cache
246+
uses: actions/cache/restore@v4
247+
with:
248+
key: ${{ github.run_id }}-nrlf-permissions
249+
path: dist/nrlf_permissions.zip
250+
fail-on-cache-miss: true
251+
252+
- name: Configure Management Credentials
253+
uses: aws-actions/configure-aws-credentials@v4
254+
with:
255+
aws-region: eu-west-2
256+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
257+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
258+
259+
- name: Download Terraform Plan artifact
260+
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
261+
262+
- name: Terraform Init
263+
run: |
264+
terraform -chdir=terraform/infrastructure init
265+
terraform -chdir=terraform/infrastructure workspace new ${{ inputs.stack_name }} || \
266+
terraform -chdir=terraform/infrastructure workspace select ${{ inputs.stack_name }}
267+
268+
- name: Terraform Apply
269+
run: |
270+
terraform -chdir=terraform/infrastructure apply tfplan

‎scripts/get_current_info.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
# Get the current info about the codebase
3+
set -o errexit -o nounset -o pipefail
4+
5+
BRANCH_NAME="$(git rev-parse --abbrev-ref HEAD)"
6+
SHORT_COMMIT_HASH="$(git rev-parse --short=8 HEAD)"
7+
8+
echo "{ \"version\": \"${BRANCH_NAME}@${SHORT_COMMIT_HASH}\" }"

‎scripts/pull-lambda-code-for-stack.sh‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
# Pull down all the lambda code for the named stack
3+
set -o errexit -o nounset -o pipefail
4+
5+
: "${DIST_DIR:="./dist"}"
6+
7+
if [ $# -ne 1 ]
8+
then
9+
echo "Error: stack-name argument is missing" 1>&2
10+
echo "Usage: $0 <stack-name>" 1>&2
11+
exit 1
12+
fi
13+
14+
stack_name="$1"
15+
16+
function pull_lambda_code(){
17+
local api_name="$1"
18+
local endpoint_name="$2"
19+
20+
lambda_name="nhsd-nrlf--${stack_name}--api--${api_name}--${endpoint_name}"
21+
22+
echo -n "- Downloading code for lambda ${lambda_name}.... "
23+
code_url="$(aws lambda get-function --function-name "${lambda_name}" | jq -r .Code.Location)"
24+
curl "${code_url}" 2>/dev/null > "${DIST_DIR}/${api_name}-${endpoint_name}.zip"
25+
echo "✅"
26+
}
27+
28+
function pull_layer_code(){
29+
local name="$1"
30+
31+
layer_name="nhsd-nrlf--${stack_name}--${name}"
32+
layer_pkg_name="$(echo "${name}" | tr '-' '_').zip"
33+
layer_version="$(aws lambda list-layer-versions --layer-name "${layer_name}" | jq -r '.LayerVersions[0].Version')"
34+
35+
echo -n "- Downloading code for layer ${layer_name} version ${layer_version}.... "
36+
code_url="$(aws lambda get-layer-version --layer-name "${layer_name}" --version-number "${layer_version}" | jq -r .Content.Location)"
37+
curl "${code_url}" 2>/dev/null > "${DIST_DIR}/${layer_pkg_name}"
38+
echo "✅"
39+
}
40+
41+
mkdir -p "${DIST_DIR}"
42+
43+
echo
44+
echo "Pulling code for consumer API lambdas...."
45+
for endpoint_path in api/consumer/*
46+
do
47+
if [ ! -d "${endpoint_path}" ]
48+
then
49+
continue
50+
fi
51+
52+
endpoint_name="$(basename "${endpoint_path}")"
53+
pull_lambda_code "consumer" "${endpoint_name}"
54+
done
55+
56+
echo
57+
echo "Pulling code for producer API lambdas...."
58+
for endpoint_path in api/producer/*
59+
do
60+
if [ ! -d "${endpoint_path}" ]
61+
then
62+
continue
63+
fi
64+
65+
endpoint_name="$(basename "${endpoint_path}")"
66+
pull_lambda_code "producer" "${endpoint_name}"
67+
done
68+
69+
echo
70+
echo "Pulling code for layers...."
71+
for layer_name in nrlf dependency-layer nrlf-permissions
72+
do
73+
pull_layer_code "${layer_name}"
74+
done
75+
76+
echo
77+
echo "✅ Done. Code is in ${DIST_DIR}"
78+
echo

‎terraform/infrastructure/data.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,10 @@ data "aws_iam_policy" "pointers-kms-read-write" {
3434
count = var.use_shared_resources ? 1 : 0
3535
name = "${local.shared_prefix}-pointers-kms-read-write"
3636
}
37+
38+
data "external" "current-info" {
39+
program = [
40+
"bash",
41+
"../../scripts/get_current_info.sh",
42+
]
43+
}

‎terraform/infrastructure/output.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,7 @@ output "certificate_domain_name" {
4646
output "auth_store" {
4747
value = local.auth_store_id
4848
}
49+
50+
output "version" {
51+
value = data.external.current-info.result.version
52+
}

0 commit comments

Comments
 (0)