Skip to content

Commit 1d3d145

Browse files
TOEL2TOEL2
authored
Merge branch 'main' into feature/rgjb-te-eli-422-s3_audit_copy_terraform_changes
2 parents 73ea8f1 + cd3eebc commit 1d3d145

File tree

133 files changed

+5261
-945
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

133 files changed

+5261
-945
lines changed

‎.github/workflows/base-deploy.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ jobs:
119119
path: ./build
120120

121121
- name: "Configure AWS Credentials"
122-
uses: aws-actions/configure-aws-credentials@v4
122+
uses: aws-actions/configure-aws-credentials@v5
123123
with:
124124
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
125125
aws-region: eu-west-2
@@ -266,3 +266,13 @@ jobs:
266266
Auto-release created during production deployment.
267267
draft: false
268268
prerelease: false
269+
270+
regression-tests:
271+
name: "Regression Tests"
272+
if: ${{ needs.metadata.outputs.environment == 'preprod' }}
273+
needs: deploy
274+
uses: ./.github/workflows/regression-tests.yml
275+
with:
276+
ENVIRONMENT: "preprod"
277+
VERSION_NUMBER: "main"
278+
secrets: inherit

‎.github/workflows/cicd-2-publish.yaml‎

Lines changed: 10 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ jobs:
8888
path: ./build
8989

9090
- name: "Configure AWS Credentials"
91-
uses: aws-actions/configure-aws-credentials@v4
91+
uses: aws-actions/configure-aws-credentials@v5
9292
with:
9393
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
9494
aws-region: eu-west-2
@@ -103,7 +103,6 @@ jobs:
103103
TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
104104
TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
105105

106-
# just planning for now for safety and until review
107106
run: |
108107
mkdir -p ./build
109108
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=networking tf-command=apply"
@@ -119,29 +118,6 @@ jobs:
119118
git tag ${{ needs.metadata.outputs.version }}
120119
git push origin ${{ needs.metadata.outputs.version }}
121120
122-
# --- Keeping these just in case: Uncomment to release to GitHub ---
123-
# - name: "Create release"
124-
# id: create_release
125-
# uses: actions/create-release@v1
126-
# env:
127-
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
128-
# with:
129-
# tag_name: ${{ needs.metadata.outputs.version }}
130-
# release_name: Release ${{ needs.metadata.outputs.version }}
131-
# body: |
132-
# Release of ${{ needs.metadata.outputs.version }}
133-
# draft: false
134-
# prerelease: true
135-
136-
# - name: "Upload release asset"
137-
# uses: actions/upload-release-asset@v1
138-
# env:
139-
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
140-
# with:
141-
# upload_url: "${{ steps.create_release.outputs.upload_url }}"
142-
# asset_path: ./build/lambda.zip
143-
# asset_name: lambda-${{ needs.metadata.outputs.version }}.zip
144-
# asset_content_type: application/zip
145121
- name: "Notify Slack on PR merge"
146122
uses: slackapi/[email protected]
147123
with:
@@ -153,3 +129,12 @@ jobs:
153129
Author: "${{ github.actor }}"
154130
title: "Pushed to main"
155131
version: "${{ needs.metadata.outputs.version }}"
132+
133+
regression-tests:
134+
name: "Regression Tests"
135+
needs: publish
136+
uses: ./.github/workflows/regression-tests.yml
137+
with:
138+
ENVIRONMENT: "dev"
139+
VERSION_NUMBER: "main"
140+
secrets: inherit

‎.github/workflows/cicd-3-test.yaml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ jobs:
8888

8989
- name: "Checkout Repository"
9090
uses: actions/checkout@v5
91+
with:
92+
ref: ${{ github.event.inputs.tag }}
9193

9294
- name: "Build lambda artefact"
9395
run: |
@@ -107,7 +109,7 @@ jobs:
107109
path: ./build
108110

109111
- name: "Configure AWS Credentials"
110-
uses: aws-actions/configure-aws-credentials@v4
112+
uses: aws-actions/configure-aws-credentials@v5
111113
with:
112114
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
113115
aws-region: eu-west-2
@@ -128,3 +130,12 @@ jobs:
128130
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply"
129131
make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE
130132
working-directory: ./infrastructure
133+
134+
regression-tests:
135+
name: "Regression Tests"
136+
needs: deploy
137+
uses: ./.github/workflows/regression-tests.yml
138+
with:
139+
ENVIRONMENT: "test"
140+
VERSION_NUMBER: "main"
141+
secrets: inherit

‎.github/workflows/cicd-3-test_auto.yaml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: "Auto Deploy to test"
2+
3+
on:
4+
workflow_run:
5+
workflows: ["CI/CD publish"]
6+
types: [completed]
7+
8+
concurrency:
9+
group: terraform-deploy-test
10+
cancel-in-progress: false
11+
12+
permissions:
13+
contents: read
14+
id-token: write
15+
actions: read
16+
17+
jobs:
18+
metadata:
19+
name: "Resolve metadata from triggering run"
20+
runs-on: ubuntu-latest
21+
if: >
22+
${{
23+
github.event.workflow_run.conclusion == 'success' &&
24+
github.event.workflow_run.head_branch == 'main'
25+
}}
26+
outputs:
27+
terraform_version: ${{ steps.vars.outputs.terraform_version }}
28+
tag: ${{ steps.tag.outputs.name }}
29+
steps:
30+
- name: "Checkout exact commit from CI/CD publish"
31+
uses: actions/checkout@v5
32+
with:
33+
ref: ${{ github.event.workflow_run.head_sha }}
34+
35+
- name: "Set CI/CD variables"
36+
id: vars
37+
run: |
38+
echo "terraform_version=$(grep '^terraform' .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
39+
40+
- name: "Resolve the dev-* tag for this commit"
41+
id: tag
42+
run: |
43+
git fetch --tags --force
44+
SHA="${{ github.event.workflow_run.head_sha }}"
45+
TAG=$(git tag --points-at "$SHA" | grep '^dev-' | head -n1 || true)
46+
if [ -z "$TAG" ]; then
47+
echo "No dev-* tag found on $SHA" >&2
48+
exit 1
49+
fi
50+
echo "name=$TAG" >> $GITHUB_OUTPUT
51+
echo "Resolved tag: $TAG"
52+
53+
deploy:
54+
name: "Deploy to TEST (approval required)"
55+
runs-on: ubuntu-latest
56+
needs: [metadata]
57+
environment: test
58+
permissions:
59+
id-token: write
60+
contents: read
61+
steps:
62+
- name: "Checkout same commit"
63+
uses: actions/checkout@v5
64+
with:
65+
ref: ${{ github.event.workflow_run.head_sha }}
66+
67+
- name: "Setup Terraform"
68+
uses: hashicorp/setup-terraform@v3
69+
with:
70+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
71+
72+
- name: "Set up Python"
73+
uses: actions/setup-python@v5
74+
with:
75+
python-version: "3.13"
76+
77+
- name: "Configure AWS Credentials"
78+
uses: aws-actions/configure-aws-credentials@v5
79+
with:
80+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
81+
aws-region: eu-west-2
82+
83+
- name: "Build lambda artefact (rebuild in TEST)"
84+
run: |
85+
make dependencies install-python
86+
make build
87+
88+
- name: "Terraform Apply (TEST)"
89+
env:
90+
ENVIRONMENT: test
91+
WORKSPACE: "default"
92+
TF_VAR_API_CA_CERT: ${{ secrets.API_CA_CERT }}
93+
TF_VAR_API_CLIENT_CERT: ${{ secrets.API_CLIENT_CERT }}
94+
TF_VAR_API_PRIVATE_KEY_CERT: ${{ secrets.API_PRIVATE_KEY_CERT }}
95+
TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
96+
TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
97+
run: |
98+
mkdir -p ./build
99+
echo "Deploying tag: ${{ needs.metadata.outputs.tag }}"
100+
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=networking tf-command=apply"
101+
make terraform env=$ENVIRONMENT stack=networking tf-command=apply workspace=$WORKSPACE
102+
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply"
103+
make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE
104+
working-directory: ./infrastructure
105+
106+
regression-tests:
107+
name: "Regression Tests"
108+
needs: deploy
109+
uses: ./.github/workflows/regression-tests.yml
110+
with:
111+
ENVIRONMENT: "test"
112+
VERSION_NUMBER: "main"
113+
secrets: inherit

.github/workflows/cicd-4-preprod-deploy.yml renamed to .github/workflows/cicd-4a-preprod-deploy.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,4 @@ jobs:
3030
ref: ${{ inputs.ref }}
3131
release_type: ${{ inputs.release_type }}
3232
secrets: inherit
33+

‎.github/workflows/cicd-4b-preprod-seed-users.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: preprod - Seed DynamoDB table
2+
3+
concurrency:
4+
group: seed-preprod-dynamodb
5+
cancel-in-progress: false
6+
7+
on:
8+
workflow_run:
9+
workflows: [ "Preprod Deploy" ]
10+
types:
11+
- completed
12+
filters:
13+
conclusion:
14+
- success
15+
workflow_dispatch:
16+
inputs:
17+
environment:
18+
description: Target environment
19+
required: true
20+
type: choice
21+
options:
22+
- preprod
23+
24+
jobs:
25+
seed-dynamodb:
26+
runs-on: ubuntu-latest
27+
environment: "preprod"
28+
permissions:
29+
id-token: write
30+
contents: read
31+
env:
32+
AWS_REGION: eu-west-2
33+
DATA_FOLDER: tests/e2e/data/dynamoDB/vitaIntegrationTestData
34+
DYNAMODB_TABLE: eligibility-signposting-api-preprod-eligibility_datastore
35+
36+
steps:
37+
- name: Checkout repo
38+
uses: actions/checkout@v5
39+
40+
- name: Set up Python
41+
uses: actions/setup-python@v5
42+
with:
43+
python-version: '3.13'
44+
45+
- name: Install dependencies
46+
run: pip install boto3
47+
48+
- name: "Configure AWS Credentials"
49+
uses: aws-actions/configure-aws-credentials@v5
50+
with:
51+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
52+
aws-region: ${{ env.AWS_REGION }}
53+
54+
- name: Run seed script
55+
run: |
56+
python scripts/seed_users/seed_dynamodb.py \
57+
--table-name "${{ env.DYNAMODB_TABLE }}" \
58+
--region "${{ env.AWS_REGION }}" \
59+
--data-folder "${{ env.DATA_FOLDER }}"

‎.github/workflows/manual-terraform-apply.yaml‎

Lines changed: 0 additions & 75 deletions
This file was deleted.

0 commit comments

Comments
 (0)