electronic-prescription-service-clinical-prescription-tracker/.github/workflows/cdk_package_code.yml at main · NHSDigital/electronic-prescription-service-clinical-prescription-tracker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
name: cdk package code

on:
  workflow_call:
    inputs:
      BRANCH_NAME:
        required: true
        type: string
      VERSION_NUMBER:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      runtime_docker_image:
        required: true
        type: string
      verify_published_from_main_image:
        type: boolean
        required: true

jobs:
  verify_attestation:
    uses: NHSDigital/eps-common-workflows/.github/workflows/verify-attestation.yml@36677e1d6bfaa010d7b78942a1ade12fbefecb80
    with:
      runtime_docker_image: "${{ inputs.runtime_docker_image }}"
      verify_published_from_main_image: ${{ inputs.verify_published_from_main_image }}

  package_code:
    runs-on: ubuntu-22.04
    needs: verify_attestation
    container:
      image: ${{ needs.verify_attestation.outputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    permissions:
      id-token: write
      contents: read
      packages: read
    steps:
      - name: copy .tool-versions
        run: |
          cp /home/vscode/.tool-versions "$HOME/.tool-versions"
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ inputs.BRANCH_NAME }}

      - name: install dependencies
        uses: ./.github/actions/install_dependencies
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: make compile
        run: make compile

      - name: download the get secrets lambda layer
        run: |
          make download-get-secrets-layer

      - name: "Tar files"
        run: |
          tar -rf artifact.tar \
            .github \
            packages \
            node_modules \
            package.json \
            package-lock.json \
            tsconfig.defaults.json

      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
        name: upload build artifact
        with:
          name: build_artifact
          path: artifact.tar