Skip to content

Commit 0030cbe

Browse files
KarthikeyannhsKarthikeyannhs
authored
adding back the reuse artifacts code with fix (#418)
1 parent ab358fc commit 0030cbe

File tree

5 files changed

+126
-41
lines changed

5 files changed

+126
-41
lines changed

‎.github/workflows/base-deploy.yml‎

Lines changed: 85 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ jobs:
3232
terraform_version: ${{ steps.variables.outputs.terraform_version }}
3333
ref: ${{ steps.variables.outputs.ref }}
3434
environment: ${{ steps.variables.outputs.environment }}
35+
tag: ${{ steps.tag.outputs.name }}
36+
promoted_environment: ${{ steps.promoted_env.outputs.promoted_environment }}
3537
steps:
3638
- name: "Checkout ref"
3739
uses: actions/checkout@v5
@@ -74,6 +76,74 @@ jobs:
7476
echo "ref=$REF"
7577
echo "environment=$ENVIRONMENT"
7678
79+
- name: "Resolve the dev-* tag for this commit"
80+
id: tag
81+
run: |
82+
git fetch --tags --force
83+
SHA="${{ github.event.workflow_run.head_sha }}"
84+
TAG=$(git tag --points-at "$SHA" | grep '^dev-' | head -n1 || true)
85+
if [ -z "$TAG" ]; then
86+
echo "No dev-* tag found on $SHA" >&2
87+
exit 1
88+
fi
89+
echo "name=$TAG" >> $GITHUB_OUTPUT
90+
echo "Resolved tag: $TAG"
91+
92+
- name: "Resolve promoted environment"
93+
id: promoted_env
94+
run: |
95+
ENV="${{ steps.variables.outputs.environment }}"
96+
if [[ "$ENV" == "preprod" ]]; then
97+
echo "promoted_environment=test" >> $GITHUB_OUTPUT
98+
elif [[ "$ENV" == "prod" ]]; then
99+
echo "promoted_environment=preprod" >> $GITHUB_OUTPUT
100+
else
101+
echo "promoted_environment=$ENV" >> $GITHUB_OUTPUT
102+
fi
103+
104+
download-lambda-artifact:
105+
name: "Fetch the lambda artifact from previous stage"
106+
runs-on: ubuntu-latest
107+
needs: [metadata]
108+
timeout-minutes: 45
109+
permissions:
110+
id-token: write
111+
contents: write
112+
environment: ${{ needs.metadata.outputs.promoted_environment }}
113+
steps:
114+
- name: "Checkout repository at ref"
115+
uses: actions/checkout@v5
116+
with:
117+
ref: ${{ needs.metadata.outputs.ref }}
118+
fetch-depth: 0
119+
120+
- name: "Configure AWS Credentials"
121+
uses: aws-actions/configure-aws-credentials@v5
122+
with:
123+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
124+
aws-region: eu-west-2
125+
126+
- name: "Extract S3 bucket name from Terraform output"
127+
id: tf_output
128+
run: |
129+
BUCKET=$(terraform output -raw lambda_artifact_bucket)
130+
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
131+
working-directory: ./infrastructure/stacks/api-layer
132+
133+
- name: "Download lambda artifact from S3"
134+
run: |
135+
aws s3 cp \
136+
s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
137+
./build/lambda.zip \
138+
--region eu-west-2
139+
140+
- name: "Upload lambda artifact for the current workflow"
141+
uses: actions/upload-artifact@v4
142+
with:
143+
name: lambda-${{ needs.metadata.outputs.tag }}
144+
path: ./build/lambda.zip
145+
146+
77147
deploy:
78148
name: "Deploy to ${{ needs.metadata.outputs.environment }}"
79149
runs-on: ubuntu-latest
@@ -95,36 +165,10 @@ jobs:
95165
with:
96166
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
97167

98-
- name: "Install Poetry"
99-
run: |
100-
curl -sSL https://install.python-poetry.org | python3 -
101-
echo "$HOME/.local/bin" >> $GITHUB_PATH
102-
103-
- name: "Set up Python"
104-
uses: actions/setup-python@v6
105-
with:
106-
python-version: "3.13"
107-
cache: 'poetry'
108-
109-
- name: "Install dependencies"
110-
run: poetry install
111-
112-
- name: "Build lambda artefact"
113-
shell: bash
114-
run: |
115-
make dependencies install-python
116-
make build
117-
118-
- name: "Upload lambda artefact"
119-
uses: actions/upload-artifact@v4
120-
with:
121-
name: lambda
122-
path: dist/lambda.zip
123-
124-
- name: "Download Built Lambdas"
168+
- name: "Download Lambda Artifact"
125169
uses: actions/download-artifact@v5
126170
with:
127-
name: lambda
171+
name: lambda-${{ needs.metadata.outputs.tag }}
128172
path: ./build
129173

130174
- name: "Configure AWS Credentials"
@@ -153,6 +197,19 @@ jobs:
153197
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply"
154198
make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE
155199
200+
- name: "Extract S3 bucket name from Terraform output"
201+
id: tf_output
202+
run: |
203+
BUCKET=$(terraform output -raw lambda_artifact_bucket)
204+
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
205+
working-directory: ./infrastructure/stacks/api-layer
206+
207+
- name: "Upload lambda artifact to S3"
208+
run: |
209+
aws s3 cp ./build/lambda.zip \
210+
s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
211+
--region eu-west-2
212+
156213
- name: "Validate Feature Toggles"
157214
env:
158215
ENV: ${{ needs.metadata.outputs.environment }}

‎.github/workflows/cicd-2-publish.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -81,16 +81,16 @@ jobs:
8181
make dependencies install-python
8282
make build
8383
84-
- name: "Upload lambda artefact"
84+
- name: "Upload lambda artefact for cross-workflow use"
8585
uses: actions/upload-artifact@v4
8686
with:
87-
name: lambda
87+
name: lambda-${{ needs.metadata.outputs.version }}
8888
path: dist/lambda.zip
8989

9090
- name: "Download Built Lambdas"
9191
uses: actions/download-artifact@v5
9292
with:
93-
name: lambda
93+
name: lambda-${{ needs.metadata.outputs.version }}
9494
path: ./build
9595

9696
- name: "Configure AWS Credentials"

‎.github/workflows/cicd-3-test-deploy.yaml‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -67,21 +67,19 @@ jobs:
6767
with:
6868
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
6969

70-
- name: "Set up Python"
71-
uses: actions/setup-python@v6
72-
with:
73-
python-version: "3.13"
74-
7570
- name: "Configure AWS Credentials"
7671
uses: aws-actions/configure-aws-credentials@v5
7772
with:
7873
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
7974
aws-region: eu-west-2
8075

81-
- name: "Build lambda artefact (rebuild in TEST)"
82-
run: |
83-
make dependencies install-python
84-
make build
76+
- name: "Download lambda artefact from dev workflow"
77+
uses: actions/download-artifact@v5
78+
with:
79+
name: lambda-${{ needs.metadata.outputs.tag }}
80+
path: ./build
81+
run-id: ${{ github.event.workflow_run.id }}
82+
github-token: ${{ github.token }}
8583

8684
- name: "Terraform Apply (TEST)"
8785
env:
@@ -101,6 +99,19 @@ jobs:
10199
make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE
102100
working-directory: ./infrastructure
103101

102+
- name: "Extract S3 bucket name from Terraform output"
103+
id: tf_output
104+
run: |
105+
BUCKET=$(terraform output -raw lambda_artifact_bucket)
106+
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
107+
working-directory: ./infrastructure/stacks/api-layer
108+
109+
- name: "Upload lambda artifact to S3"
110+
run: |
111+
aws s3 cp ./build/lambda.zip \
112+
s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
113+
--region eu-west-2
114+
104115
regression-tests:
105116
name: "Regression Tests"
106117
needs: deploy

‎infrastructure/stacks/api-layer/s3_buckets.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,16 @@ module "s3_firehose_backup_bucket" {
2525
stack_name = local.stack_name
2626
workspace = terraform.workspace
2727
}
28+
29+
module "s3_lambda_artifact_bucket" {
30+
source = "../../modules/s3"
31+
bucket_name = "eli-artifacts"
32+
environment = var.environment
33+
project_name = var.project_name
34+
stack_name = local.stack_name
35+
workspace = terraform.workspace
36+
}
37+
38+
output "lambda_artifact_bucket" {
39+
value = module.s3_lambda_artifact_bucket.storage_bucket_name
40+
}

‎infrastructure/stacks/iams-developer-roles/github_actions_policies.tf‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,11 @@ resource "aws_iam_policy" "s3_management" {
198198
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk",
199199
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk/*",
200200
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs",
201-
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs/*"
201+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs/*",
202+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts",
203+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts/*",
204+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts-access-logs",
205+
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts-access-logs/*",
202206
]
203207
}
204208
]

0 commit comments

Comments
 (0)