Skip to content

Commit 4e61c0c

Browse files
TOEL2TOEL2
committed
[ELI-702] - removing workflow changes for now
1 parent c9d8c2a commit 4e61c0c

File tree

2 files changed

+257
-125
lines changed

2 files changed

+257
-125
lines changed

‎.github/workflows/cicd-3-test-deploy-updated.yaml‎

Lines changed: 244 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,244 @@
1+
name: "Updated - 3. CD | Deploy to Test"
2+
3+
#on:
4+
# workflow_run:
5+
# workflows: ["2. CD | Deploy to Dev"]
6+
# types: [completed]
7+
8+
concurrency:
9+
group: test-deployments
10+
cancel-in-progress: false
11+
12+
permissions:
13+
contents: read
14+
id-token: write
15+
actions: read
16+
17+
jobs:
18+
metadata:
19+
name: "Resolve metadata from triggering run"
20+
runs-on: ubuntu-latest
21+
if: ${{ github.event.workflow_run.conclusion == 'success' }}
22+
outputs:
23+
terraform_version: ${{ steps.vars.outputs.terraform_version }}
24+
tag: ${{ steps.tag.outputs.name }}
25+
steps:
26+
- name: "Checkout exact commit from CI/CD publish"
27+
uses: actions/checkout@v6
28+
with:
29+
ref: ${{ github.event.workflow_run.head_sha }}
30+
31+
- name: "Set CI/CD variables"
32+
id: vars
33+
run: |
34+
echo "terraform_version=$(grep '^terraform' .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
35+
36+
- name: "Resolve the dev-* tag for this commit"
37+
id: tag
38+
run: |
39+
git fetch --tags --force
40+
SHA="${{ github.event.workflow_run.head_sha }}"
41+
TAG=$(git tag --points-at "$SHA" | grep '^dev-' | sort -r | head -n1 || true)
42+
if [ -z "$TAG" ]; then
43+
echo "No dev-* tag found on $SHA" >&2
44+
exit 1
45+
fi
46+
echo "name=$TAG" >> $GITHUB_OUTPUT
47+
echo "Resolved tag: $TAG"
48+
49+
sign-lambda-artifact:
50+
name: "Sign lambda artifact for TEST"
51+
runs-on: ubuntu-latest
52+
needs: [metadata]
53+
environment: test
54+
timeout-minutes: 45
55+
permissions:
56+
id-token: write
57+
contents: read
58+
outputs:
59+
bucket_name: ${{ steps.tf_output.outputs.bucket_name }}
60+
steps:
61+
- name: "Checkout same commit"
62+
uses: actions/checkout@v6
63+
with:
64+
ref: ${{ github.event.workflow_run.head_sha }}
65+
66+
- name: "Setup Terraform"
67+
uses: hashicorp/setup-terraform@v3
68+
with:
69+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
70+
71+
- name: "Configure AWS Credentials"
72+
uses: aws-actions/configure-aws-credentials@v6
73+
with:
74+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
75+
aws-region: eu-west-2
76+
77+
- name: "Download lambda artefact from dev workflow"
78+
uses: actions/download-artifact@v7
79+
with:
80+
name: lambda-${{ needs.metadata.outputs.tag }}
81+
path: ./dist
82+
run-id: ${{ github.event.workflow_run.id }}
83+
github-token: ${{ github.token }}
84+
85+
- name: "Terraform Init (TEST api-layer)"
86+
env:
87+
ENVIRONMENT: test
88+
WORKSPACE: "default"
89+
run: |
90+
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
91+
make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
92+
working-directory: ./infrastructure
93+
94+
- name: "Extract S3 bucket name from Terraform output"
95+
id: tf_output
96+
run: |
97+
BUCKET=$(terraform output -raw lambda_artifact_bucket)
98+
PROFILE=$(terraform output -raw lambda_signing_profile_name)
99+
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
100+
echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
101+
working-directory: ./infrastructure/stacks/api-layer
102+
103+
- name: "Upload unsigned lambda artifact to S3"
104+
run: |
105+
aws s3 cp ./dist/lambda.zip \
106+
s3://${{ steps.tf_output.outputs.bucket_name }}/unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip \
107+
--region eu-west-2
108+
109+
- name: "Get uploaded source object version"
110+
id: source_object
111+
run: |
112+
VERSION_ID=$(aws s3api head-object \
113+
--bucket "${{ steps.tf_output.outputs.bucket_name }}" \
114+
--key "unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip" \
115+
--query 'VersionId' \
116+
--output text \
117+
--region eu-west-2)
118+
echo "version_id=$VERSION_ID" >> $GITHUB_OUTPUT
119+
120+
- name: "Start signing job"
121+
id: signing
122+
env:
123+
SIGNING_PROFILE_NAME: ${{ steps.tf_output.outputs.signing_profile_name }}
124+
run: |
125+
JOB_ID=$(aws signer start-signing-job \
126+
--source "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},key=unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip,version=${{ steps.source_object.outputs.version_id }}}" \
127+
--destination "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},prefix=signed/${{ needs.metadata.outputs.tag }}/}" \
128+
--profile-name "$SIGNING_PROFILE_NAME" \
129+
--query 'jobId' \
130+
--output text \
131+
--region eu-west-2)
132+
echo "job_id=$JOB_ID" >> $GITHUB_OUTPUT
133+
134+
- name: "Wait for signing job"
135+
run: |
136+
aws signer wait successful-signing-job \
137+
--job-id "${{ steps.signing.outputs.job_id }}" \
138+
--region eu-west-2
139+
140+
- name: "Resolve signed artifact location"
141+
id: signed_object
142+
run: |
143+
SIGNED_BUCKET=$(aws signer describe-signing-job \
144+
--job-id "${{ steps.signing.outputs.job_id }}" \
145+
--region eu-west-2 \
146+
--query 'signedObject.s3.bucketName' \
147+
--output text)
148+
149+
SIGNED_KEY=$(aws signer describe-signing-job \
150+
--job-id "${{ steps.signing.outputs.job_id }}" \
151+
--region eu-west-2 \
152+
--query 'signedObject.s3.key' \
153+
--output text)
154+
155+
echo "bucket_name=$SIGNED_BUCKET" >> $GITHUB_OUTPUT
156+
echo "object_key=$SIGNED_KEY" >> $GITHUB_OUTPUT
157+
158+
- name: "Download signed lambda artifact"
159+
run: |
160+
aws s3 cp \
161+
"s3://${{ steps.signed_object.outputs.bucket_name }}/${{ steps.signed_object.outputs.object_key }}" \
162+
./dist/lambda.zip \
163+
--region eu-west-2
164+
165+
- name: "Upload signed lambda artifact for current workflow"
166+
uses: actions/upload-artifact@v6
167+
with:
168+
name: lambda-${{ needs.metadata.outputs.tag }}
169+
path: ./dist/lambda.zip
170+
171+
deploy:
172+
name: "Deploy to TEST (approval required)"
173+
runs-on: ubuntu-latest
174+
needs: [metadata, sign-lambda-artifact]
175+
environment: test
176+
timeout-minutes: 10080
177+
permissions:
178+
id-token: write
179+
contents: read
180+
steps:
181+
- name: "Checkout same commit"
182+
uses: actions/checkout@v6
183+
with:
184+
ref: ${{ github.event.workflow_run.head_sha }}
185+
186+
- name: "Setup Terraform"
187+
uses: hashicorp/setup-terraform@v3
188+
with:
189+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
190+
191+
- name: "Download signed lambda artefact"
192+
uses: actions/download-artifact@v7
193+
with:
194+
name: lambda-${{ needs.metadata.outputs.tag }}
195+
path: ./dist
196+
197+
- name: "Configure AWS Credentials"
198+
uses: aws-actions/configure-aws-credentials@v6
199+
with:
200+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
201+
aws-region: eu-west-2
202+
203+
- name: "Terraform Apply (TEST)"
204+
env:
205+
ENVIRONMENT: test
206+
WORKSPACE: "default"
207+
TF_VAR_API_CA_CERT: ${{ secrets.API_CA_CERT }}
208+
TF_VAR_API_CLIENT_CERT: ${{ secrets.API_CLIENT_CERT }}
209+
TF_VAR_API_PRIVATE_KEY_CERT: ${{ secrets.API_PRIVATE_KEY_CERT }}
210+
TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
211+
TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
212+
TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
213+
TF_VAR_PROXYGEN_PRIVATE_KEY_PTL: ${{ secrets.PROXYGEN_PRIVATE_KEY_PTL }}
214+
TF_VAR_PROXYGEN_PRIVATE_KEY_PROD: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
215+
run: |
216+
mkdir -p ./build
217+
echo "Deploying tag: ${{ needs.metadata.outputs.tag }}"
218+
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=networking tf-command=apply"
219+
make terraform env=$ENVIRONMENT stack=networking tf-command=apply workspace=$WORKSPACE
220+
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply"
221+
make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE
222+
working-directory: ./infrastructure
223+
224+
- name: "Validate Feature Toggles"
225+
env:
226+
ENV: test
227+
run: |
228+
pip install boto3
229+
python scripts/feature_toggle/validate_toggles.py
230+
231+
- name: "Upload signed lambda artifact to S3"
232+
run: |
233+
aws s3 cp ./dist/lambda.zip \
234+
s3://${{ needs.sign-lambda-artifact.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
235+
--region eu-west-2
236+
237+
regression-tests:
238+
name: "Regression Tests"
239+
needs: deploy
240+
uses: ./.github/workflows/regression-tests.yml
241+
with:
242+
ENVIRONMENT: "test"
243+
VERSION_NUMBER: "main"
244+
secrets: inherit

0 commit comments

Comments
 (0)