Skip to content

Commit 4901cd6

Browse files
megan-bower4megan-bower4
authored
Merge pull request #558 from NHSDigital/release/2025-03-26
Release/2025 03 26
2 parents ab5120d + f12c832 commit 4901cd6

File tree

82 files changed

+2154
-51
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+2154
-51
lines changed

‎.github/workflows/_deploy.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ jobs:
4747
branch_name=${branch_name#*refs/tags/}
4848
echo "branch_name=${branch_name}" >> $GITHUB_OUTPUT
4949
50+
# BACKUPS_LOGIC (Source account needs layers building)
5051
build:
5152
runs-on: [self-hosted, ci]
5253
needs: get-branch-from-workflow-file
@@ -61,7 +62,14 @@ jobs:
6162
save-to-cache: "true"
6263
restore-from-cache: "false"
6364
cache-suffix: ${{ env.CACHE_NAME }}
64-
- if: ${{ env.SCOPE != 'per_workspace'}}
65+
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account == 'dev'}}
66+
uses: ./.github/actions/make/
67+
with:
68+
command: build
69+
save-to-cache: "true"
70+
restore-from-cache: "false"
71+
cache-suffix: ${{ env.CACHE_NAME }}
72+
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account != 'dev'}}
6573
uses: ./.github/actions/make/
6674
with:
6775
command: poetry--update
@@ -167,7 +175,7 @@ jobs:
167175
- uses: actions/checkout@v4
168176
with:
169177
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
170-
- if: ${{ env.ACCOUNT != 'mgmt'}}
178+
- if: ${{ env.ACCOUNT != 'mgmt' && env.ACCOUNT != 'backups' }}
171179
uses: ./.github/actions/make/
172180
with:
173181
command: test--smoke WORKSPACE="${{ env.WORKSPACE }}" ACCOUNT="${{ env.ACCOUNT }}"

‎.github/workflows/_deploy_backups.yml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
account:
5+
description: The AWS account being deployed
6+
type: string
7+
required: true
8+
workspace:
9+
description: The Terraform workspace being deployed
10+
type: string
11+
required: true
12+
scope:
13+
description: The Terraform scope being deployed
14+
type: string
15+
required: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
actions: write
21+
22+
env:
23+
ACCOUNT: ${{ inputs.account }}
24+
WORKSPACE: ${{ inputs.workspace }}
25+
CACHE_NAME: ${{ inputs.workspace }}-${{ inputs.account }}-${{ inputs.scope }}
26+
SCOPE: ${{ inputs.scope }}
27+
CI_ROLE_NAME: ${{ secrets.CI_ROLE_NAME }}
28+
29+
jobs:
30+
parse-secrets:
31+
runs-on: [self-hosted, ci]
32+
steps:
33+
- id: parse-secrets
34+
run: |
35+
echo "::add-mask::${{ secrets.CI_ROLE_NAME }}"
36+
37+
get-branch-from-workflow-file:
38+
runs-on: [self-hosted, ci]
39+
needs: [parse-secrets]
40+
outputs:
41+
branch_name: ${{ steps.get_branch.outputs.branch_name }}
42+
steps:
43+
- id: get_branch
44+
run: |
45+
workflow_ref=${{ github.workflow_ref }}
46+
branch_name=${workflow_ref#*refs/heads/}
47+
branch_name=${branch_name#*refs/tags/}
48+
echo "branch_name=${branch_name}" >> $GITHUB_OUTPUT
49+
50+
build:
51+
runs-on: [self-hosted, ci]
52+
needs: get-branch-from-workflow-file
53+
steps:
54+
- uses: actions/checkout@v4
55+
with:
56+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
57+
- if: ${{ env.SCOPE == 'per_workspace'}}
58+
uses: ./.github/actions/make/
59+
with:
60+
command: build
61+
save-to-cache: "true"
62+
restore-from-cache: "false"
63+
cache-suffix: ${{ env.CACHE_NAME }}
64+
- if: ${{ env.SCOPE != 'per_workspace'}}
65+
uses: ./.github/actions/make/
66+
with:
67+
command: poetry--update
68+
save-to-cache: "true"
69+
restore-from-cache: "false"
70+
cache-suffix: ${{ env.CACHE_NAME }}
71+
72+
terraform--init:
73+
needs: [get-branch-from-workflow-file, build]
74+
runs-on: [self-hosted, ci]
75+
steps:
76+
- uses: actions/checkout@v4
77+
with:
78+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
79+
- uses: ./.github/actions/terraform/
80+
with:
81+
command: init
82+
account: ${{ env.ACCOUNT }}
83+
workspace: ${{ env.WORKSPACE }}
84+
scope: ${{ env.SCOPE }}
85+
restore-from-cache: "true"
86+
save-to-cache: "true"
87+
cache-suffix: ${{ env.CACHE_NAME }}
88+
89+
terraform--plan:
90+
needs: [get-branch-from-workflow-file, terraform--init]
91+
runs-on: [self-hosted, ci]
92+
steps:
93+
- uses: actions/checkout@v4
94+
with:
95+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
96+
- uses: ./.github/actions/terraform/
97+
with:
98+
command: plan
99+
account: ${{ env.ACCOUNT }}
100+
workspace: ${{ env.WORKSPACE }}
101+
scope: ${{ env.SCOPE }}
102+
restore-from-cache: "true"
103+
save-to-cache: "true"
104+
cache-suffix: ${{ env.CACHE_NAME }}
105+
106+
terraform--apply:
107+
needs: [get-branch-from-workflow-file, terraform--plan]
108+
environment: ${{ inputs.account }}
109+
runs-on: [self-hosted, ci]
110+
steps:
111+
- uses: actions/checkout@v4
112+
with:
113+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
114+
- uses: ./.github/actions/terraform/
115+
with:
116+
command: apply
117+
account: ${{ env.ACCOUNT }}
118+
workspace: ${{ env.WORKSPACE }}
119+
scope: ${{ env.SCOPE }}
120+
restore-from-cache: "true"
121+
save-to-cache: "true"
122+
cache-suffix: ${{ env.CACHE_NAME }}
123+
124+
set-success:
125+
name: Set Success
126+
needs: [terraform--apply]
127+
runs-on: [self-hosted, ci]
128+
steps:
129+
- name: Set success env var
130+
run: echo "success"
131+
outputs:
132+
success: "succeeded"
133+
134+
message-slack:
135+
name: Notify slack of deployment
136+
needs: [get-branch-from-workflow-file, set-success]
137+
if: always()
138+
runs-on: [self-hosted, ci]
139+
140+
steps:
141+
- name: Catch failed steps
142+
id: catch-failed-step
143+
uses: ./.github/actions/catch-failed-step
144+
- name: Send job result to slack
145+
id: slack
146+
uses: slackapi/[email protected]
147+
with:
148+
webhook-type: webhook-trigger
149+
payload: |
150+
{
151+
"action_url": "${{ format('{0}/{1}/actions/runs/{2}/attempts/{3}', github.server_url, github.repository, github.run_id, github.run_attempt) }}",
152+
"attempt": ${{ github.run_attempt }},
153+
"account": "${{ env.ACCOUNT }}",
154+
"workspace": "${{ env.WORKSPACE }}",
155+
"caller": "${{ github.triggering_actor }}",
156+
"scope": "${{ env.SCOPE }}",
157+
"branch": "${{ needs.get-branch-from-workflow-file.outputs.branch_name }}",
158+
"result": "${{ needs.set-success.outputs.success && needs.set-success.outputs.success || 'failed' }}",
159+
"result_detail": "${{ needs.set-success.outputs.success && 'None' || steps.catch-failed-step.outputs.failed-step-name }}"
160+
}
161+
env:
162+
SLACK_WEBHOOK_URL: ${{ secrets.DEPLOY_ENV_SLACK_HOOK_URL }}

‎.github/workflows/deploy-backups-account-wide-resources.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: "Deploy: Account Wide - Backups"
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
account:
7+
description: Account to deploy
8+
required: true
9+
default: backups
10+
jobs:
11+
deploy:
12+
uses: ./.github/workflows/_deploy_backups.yml
13+
with:
14+
account: ${{ inputs.account }}
15+
workspace: ${{ inputs.account }}
16+
scope: "per_account/${{ inputs.account }}"
17+
secrets: inherit # pragma: allowlist secret
18+
19+
run-name: Deploying account wide to nonprod workspace - ${{ inputs.account }}

‎.github/workflows/deploy-parameters-backups.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: "Deploy: Parameters - Backups"
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
account:
7+
description: Account to deploy
8+
required: true
9+
default: backups
10+
11+
jobs:
12+
deploy:
13+
uses: ./.github/workflows/_deploy_backups.yml
14+
with:
15+
account: ${{ inputs.account }}
16+
workspace: ${{ inputs.account }}
17+
scope: "per_account/${{ inputs.account }}/parameters"
18+
secrets: inherit # pragma: allowlist secret
19+
20+
run-name: Deploying parameters to nonprod workspace - ${{ inputs.account }}

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# Changelog
22

3+
## 2025-03-26
4+
- [PI-407] Immutable Backups
5+
36
## 2025-03-25
47
- [PI-857] Sonar Merge Commit
58
- [PI-865] Swagger refinement 2

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2025.03.25
1+
2025.03.26

‎changelog/2025-03-26.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
- [PI-407] Immutable Backups

‎infrastructure/terraform/etc/backups.tfvars‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
account_name = "backups"
2+
environment = "backups"

‎infrastructure/terraform/modules/api_worker/api_lambda/lambda.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
module "lambda_function" {
2+
source = "terraform-aws-modules/lambda/aws"
3+
version = "6.0.0"
4+
5+
function_name = var.lambda_name
6+
description = "${replace(var.name, "_", "-")} lambda function"
7+
handler = "api.${var.name}.index.handler"
8+
runtime = var.python_version
9+
timeout = 10
10+
memory_size = var.memory_size
11+
12+
timeouts = {
13+
create = "5m"
14+
update = "5m"
15+
delete = "5m"
16+
}
17+
18+
create_current_version_allowed_triggers = false
19+
allowed_triggers = var.allowed_triggers
20+
environment_variables = var.environment_variables
21+
22+
create_package = false
23+
local_existing_package = var.source_path
24+
25+
tags = {
26+
Name = replace(var.name, "_", "-")
27+
}
28+
29+
layers = var.layers
30+
31+
trusted_entities = var.trusted_entities
32+
attach_policy_json = var.attach_policy_json
33+
policy_json = var.policy_json
34+
35+
attach_policy_statements = var.attach_policy_statements
36+
policy_statements = var.policy_statements
37+
}

‎infrastructure/terraform/modules/api_worker/api_lambda/outputs.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "lambda_arn" {
2+
value = module.lambda_function.lambda_function_arn
3+
}
4+
5+
output "lambda_role_arn" {
6+
value = module.lambda_function.lambda_role_arn
7+
}
8+
9+
output "lambda_role_name" {
10+
value = module.lambda_function.lambda_role_name
11+
}
12+
13+
output "metadata" {
14+
value = {
15+
lambda_invoke_arn = module.lambda_function.lambda_function_invoke_arn
16+
authoriser_iam_role = module.lambda_function.lambda_role_arn
17+
authoriser_name = var.lambda_name
18+
}
19+
}

0 commit comments

Comments
 (0)