cicd-3-test-deploy-updated.yaml

name: "Updated - 3. CD | Deploy to Test"

#on:
#  workflow_run:
#    workflows: ["2. CD | Deploy to Dev"]
#    types: [completed]

concurrency:
  group: test-deployments
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write
  actions: read

jobs:
  metadata:
    name: "Resolve metadata from triggering run"
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    outputs:
      terraform_version: ${{ steps.vars.outputs.terraform_version }}
      tag: ${{ steps.tag.outputs.name }}
    steps:
      - name: "Checkout exact commit from CI/CD publish"
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: "Set CI/CD variables"
        id: vars
        run: |
          echo "terraform_version=$(grep '^terraform' .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT

      - name: "Resolve the dev-* tag for this commit"
        id: tag
        run: |
          git fetch --tags --force
          SHA="${{ github.event.workflow_run.head_sha }}"
          TAG=$(git tag --points-at "$SHA" | grep '^dev-' | sort -r | head -n1 || true)
          if [ -z "$TAG" ]; then
            echo "No dev-* tag found on $SHA" >&2
            exit 1
          fi
          echo "name=$TAG" >> $GITHUB_OUTPUT
          echo "Resolved tag: $TAG"

  sign-lambda-artifact:
    name: "Sign lambda artifact for TEST"
    runs-on: ubuntu-latest
    needs: [metadata]
    environment: test
    timeout-minutes: 45
    permissions:
      id-token: write
      contents: read
    outputs:
      bucket_name: ${{ steps.tf_output.outputs.bucket_name }}
    steps:
      - name: "Checkout same commit"
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: "Setup Terraform"
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ needs.metadata.outputs.terraform_version }}

      - name: "Configure AWS Credentials"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
          aws-region: eu-west-2

      - name: "Download lambda artefact from dev workflow"
        uses: actions/download-artifact@v7
        with:
          name: lambda-${{ needs.metadata.outputs.tag }}
          path: ./dist
          run-id: ${{ github.event.workflow_run.id }}
          github-token: ${{ github.token }}

      - name: "Terraform Init (TEST api-layer)"
        env:
          ENVIRONMENT: test
          WORKSPACE: "default"
        run: |
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
          make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
        working-directory: ./infrastructure

      - name: "Extract S3 bucket name from Terraform output"
        id: tf_output
        run: |
          BUCKET=$(terraform output -raw lambda_artifact_bucket)
          PROFILE=$(terraform output -raw lambda_signing_profile_name)
          echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
          echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
        working-directory: ./infrastructure/stacks/api-layer

      - name: "Upload unsigned lambda artifact to S3"
        run: |
          aws s3 cp ./dist/lambda.zip \
            s3://${{ steps.tf_output.outputs.bucket_name }}/unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip \
            --region eu-west-2

      - name: "Get uploaded source object version"
        id: source_object
        run: |
          VERSION_ID=$(aws s3api head-object \
            --bucket "${{ steps.tf_output.outputs.bucket_name }}" \
            --key "unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip" \
            --query 'VersionId' \
            --output text \
            --region eu-west-2)
          echo "version_id=$VERSION_ID" >> $GITHUB_OUTPUT

      - name: "Start signing job"
        id: signing
        env:
          SIGNING_PROFILE_NAME: ${{ steps.tf_output.outputs.signing_profile_name }}
        run: |
          JOB_ID=$(aws signer start-signing-job \
            --source "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},key=unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip,version=${{ steps.source_object.outputs.version_id }}}" \
            --destination "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},prefix=signed/${{ needs.metadata.outputs.tag }}/}" \
            --profile-name "$SIGNING_PROFILE_NAME" \
            --query 'jobId' \
            --output text \
            --region eu-west-2)
          echo "job_id=$JOB_ID" >> $GITHUB_OUTPUT

      - name: "Wait for signing job"
        run: |
          aws signer wait successful-signing-job \
            --job-id "${{ steps.signing.outputs.job_id }}" \
            --region eu-west-2

      - name: "Resolve signed artifact location"
        id: signed_object
        run: |
          SIGNED_BUCKET=$(aws signer describe-signing-job \
            --job-id "${{ steps.signing.outputs.job_id }}" \
            --region eu-west-2 \
            --query 'signedObject.s3.bucketName' \
            --output text)

          SIGNED_KEY=$(aws signer describe-signing-job \
            --job-id "${{ steps.signing.outputs.job_id }}" \
            --region eu-west-2 \
            --query 'signedObject.s3.key' \
            --output text)

          echo "bucket_name=$SIGNED_BUCKET" >> $GITHUB_OUTPUT
          echo "object_key=$SIGNED_KEY" >> $GITHUB_OUTPUT

      - name: "Download signed lambda artifact"
        run: |
          aws s3 cp \
            "s3://${{ steps.signed_object.outputs.bucket_name }}/${{ steps.signed_object.outputs.object_key }}" \
            ./dist/lambda.zip \
            --region eu-west-2

      - name: "Upload signed lambda artifact for current workflow"
        uses: actions/upload-artifact@v6
        with:
          name: lambda-${{ needs.metadata.outputs.tag }}
          path: ./dist/lambda.zip

  deploy:
    name: "Deploy to TEST (approval required)"
    runs-on: ubuntu-latest
    needs: [metadata, sign-lambda-artifact]
    environment: test
    timeout-minutes: 10080
    permissions:
      id-token: write
      contents: read
    steps:
      - name: "Checkout same commit"
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: "Setup Terraform"
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ needs.metadata.outputs.terraform_version }}

      - name: "Download signed lambda artefact"
        uses: actions/download-artifact@v7
        with:
          name: lambda-${{ needs.metadata.outputs.tag }}
          path: ./dist

      - name: "Configure AWS Credentials"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
          aws-region: eu-west-2

      - name: "Terraform Apply (TEST)"
        env:
          ENVIRONMENT: test
          WORKSPACE: "default"
          TF_VAR_API_CA_CERT: ${{ secrets.API_CA_CERT }}
          TF_VAR_API_CLIENT_CERT: ${{ secrets.API_CLIENT_CERT }}
          TF_VAR_API_PRIVATE_KEY_CERT: ${{ secrets.API_PRIVATE_KEY_CERT }}
          TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
          TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
          TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
          TF_VAR_PROXYGEN_PRIVATE_KEY_PTL: ${{ secrets.PROXYGEN_PRIVATE_KEY_PTL }}
          TF_VAR_PROXYGEN_PRIVATE_KEY_PROD: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
        run: |
          mkdir -p ./build
          echo "Deploying tag: ${{ needs.metadata.outputs.tag }}"
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=networking tf-command=apply"
          make terraform env=$ENVIRONMENT stack=networking tf-command=apply workspace=$WORKSPACE
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply"
          make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE
        working-directory: ./infrastructure

      - name: "Validate Feature Toggles"
        env:
          ENV: test
        run: |
          pip install boto3
          python scripts/feature_toggle/validate_toggles.py

      - name: "Upload signed lambda artifact to S3"
        run: |
          aws s3 cp ./dist/lambda.zip \
            s3://${{ needs.sign-lambda-artifact.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
            --region eu-west-2

  regression-tests:
    name: "Regression Tests"
    needs: deploy
    uses: ./.github/workflows/regression-tests.yml
    with:
      ENVIRONMENT: "test"
      VERSION_NUMBER: "main"
    secrets: inherit