Skip to content

Commit 70ff5a0

Browse files
eddalmond1eddalmond1
authored
Merge branch 'main' into feature/eja-eli-384-adding-WAF-for-API-gateway
2 parents f3dd84d + 0f1328e commit 70ff5a0

18 files changed

+798
-160
lines changed

‎.act/act_tests.mk‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
ACT_IMAGE = ghcr.io/nhs-england-tools/github-runner-image:20230909-321fd1e-rt
2+
PREPROD_WORKFLOW = .github/workflows/cicd-4-preprod-deploy.yaml
3+
JOB = metadata # This can be changed depending on which part of the workflow we are testing
4+
5+
# Usage: make act EVENT=.act/auto_preprod_trigger_*.json TRIGGER_TYPE=workflow_run
6+
act-preprod-deploy:
7+
@if [ -z "$(EVENT)" ]; then \
8+
echo "Usage: make act EVENT=<path-to-event-json>"; \
9+
exit 1; \
10+
fi
11+
@echo "Running act with event file: $(EVENT)"
12+
ACT=true act \
13+
-W $(PREPROD_WORKFLOW) \
14+
--job $(JOB) \
15+
--eventpath $(EVENT) \
16+
-P ubuntu-latest=$(ACT_IMAGE) \
17+
-s GITHUB_TOKEN="$$GITHUB_TOKEN" \
18+
-s GH_TOKEN="$$GITHUB_TOKEN" \
19+
--env GITHUB_REPOSITORY="$$REPO" \
20+
--env TEST_WORKFLOW_ID=190123511 \
21+
--env GITHUB_EVENT_NAME=$(TRIGGER_TYPE)
22+
23+
24+
#act-dev-deploy:
25+
# @if [ -z "$(EVENT)" ]; then \
26+
# echo "Usage: make act EVENT=<path-to-event-json>"; \
27+
# exit 1; \
28+
# fi
29+
# @echo "Running act with event file: $(EVENT)"
30+
# ACT=true act \
31+
# -W $(WORKFLOW) \
32+
# --job $(JOB) \
33+
# --eventpath $(EVENT) \
34+
# -P ubuntu-latest=$(ACT_IMAGE) \
35+
# -s GITHUB_TOKEN="$$GITHUB_TOKEN" \
36+
# -s GH_TOKEN="$$GITHUB_TOKEN" \
37+
# --env GITHUB_REPOSITORY="$$REPO" \
38+
# --env DEV_WORKFLOW_ID=143714547 \
39+
# --env GITHUB_EVENT_NAME=$(TRIGGER_TYPE)

‎.act/auto_preprod_trigger_latest.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"event_name": "workflow_run",
3+
"action": "completed",
4+
"workflow": {
5+
"name": "Test stage",
6+
"path": ".github/workflows/cicd-3-test-deploy.yaml"
7+
},
8+
"workflow_run": {
9+
"id": 18556637650,
10+
"name": "Test stage",
11+
"event": "push",
12+
"status": "completed",
13+
"conclusion": "success",
14+
"head_branch": "main",
15+
"head_sha": "758a8d751ca1885695e9ac0766fcc0007dfb2995"
16+
},
17+
"repository": {
18+
"full_name": "NHSDigital/eligibility-signposting-api",
19+
"name": "eligibility-signposting-api",
20+
"owner": {"login": "NHSDigital"}
21+
}
22+
}

‎.act/auto_preprod_trigger_newer.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"event_name": "workflow_run",
3+
"action": "completed",
4+
"workflow": {
5+
"name": "Test stage",
6+
"path": ".github/workflows/cicd-3-test-deploy.yaml"
7+
},
8+
"workflow_run": {
9+
"id": 18556637650,
10+
"name": "Test stage",
11+
"event": "push",
12+
"status": "completed",
13+
"conclusion": "success",
14+
"head_branch": "main",
15+
"head_sha": "60d567d18eb4916e931d4bdd4e15b9639ef1a0a0"
16+
},
17+
"repository": {
18+
"full_name": "NHSDigital/eligibility-signposting-api",
19+
"name": "eligibility-signposting-api",
20+
"owner": {"login": "NHSDigital"}
21+
}
22+
}

‎.act/auto_preprod_trigger_stale.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"event_name": "workflow_run",
3+
"action": "completed",
4+
"workflow": {
5+
"name": "Test stage",
6+
"path": ".github/workflows/cicd-3-test-deploy.yaml"
7+
},
8+
"workflow_run": {
9+
"id": 18556637650,
10+
"name": "Test stage",
11+
"event": "push",
12+
"status": "completed",
13+
"conclusion": "success",
14+
"head_branch": "main",
15+
"head_sha": "b2675604f38a7c89f3cfe66f8b927b39d7ddedf6"
16+
},
17+
"repository": {
18+
"full_name": "NHSDigital/eligibility-signposting-api",
19+
"name": "eligibility-signposting-api",
20+
"owner": {"login": "NHSDigital"}
21+
}
22+
}

‎.act/manual_preprod_trigger.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"event_name": "workflow_dispatch",
3+
"ref": "refs/heads/main",
4+
"inputs": {
5+
"ref": "dev-20251015111601",
6+
"release_type": "minor",
7+
"reason": "manual promotion from test to pre-prod"
8+
},
9+
"repository": {
10+
"full_name": "NHSDigital/eligibility-signposting-api",
11+
"name": "eligibility-signposting-api",
12+
"owner": { "login": "NHSDigital" }
13+
},
14+
"sender": {
15+
"login": "tome"
16+
}
17+
}

‎.github/workflows/cicd-3-test-deploy.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ on:
55
workflows: ["2. CD | Deploy to Dev"]
66
types: [completed]
77

8+
concurrency:
9+
group: test-deployments
10+
cancel-in-progress: false
11+
812
permissions:
913
contents: read
1014
id-token: write
@@ -52,11 +56,6 @@ jobs:
5256
id-token: write
5357
contents: read
5458
steps:
55-
- name: "Acquire deploy lock"
56-
uses: softprops/turnstyle@v3
57-
with:
58-
poll-interval-seconds: 10
59-
6059
- name: "Checkout same commit"
6160
uses: actions/checkout@v5
6261
with:

‎.github/workflows/cicd-4-preprod-deploy.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: "4. CD | Deploy to PreProd"
2+
3+
concurrency:
4+
group: preprod-deploy
5+
cancel-in-progress: false
6+
7+
on:
8+
workflow_run:
9+
workflows: ["3. CD | Deploy to Test"]
10+
types: [completed]
11+
workflow_dispatch:
12+
inputs:
13+
ref:
14+
description: "dev-* tag to deploy to PreProd"
15+
required: true
16+
release_type:
17+
description: "rc|patch|minor|major"
18+
required: true
19+
default: "rc"
20+
reason:
21+
description: "Why are you doing a manual deployment?"
22+
required: true
23+
default: "To roll back to a previous commit"
24+
25+
permissions:
26+
contents: write
27+
id-token: write
28+
actions: read
29+
30+
jobs:
31+
metadata:
32+
name: "Resolve ref + stale guard + release type"
33+
runs-on: ubuntu-latest
34+
outputs:
35+
ref: ${{ steps.resolver.outputs.this_ref }}
36+
this_sha: ${{ steps.resolver.outputs.this_sha }}
37+
latest_sha: ${{ steps.resolver.outputs.latest_test_sha }}
38+
release_type: ${{ steps.release_type.outputs.release_type }}
39+
40+
env:
41+
TEST_WORKFLOW_ID: "190123511" # this will need updating if the workflow is recreated
42+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
44+
45+
steps:
46+
- name: Checkout (full history & tags)
47+
uses: actions/checkout@v4
48+
with: { fetch-depth: 0 }
49+
50+
- name: Force HTTPS remote for act
51+
if: env.ACT == 'true'
52+
env:
53+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
54+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55+
shell: bash
56+
run: |
57+
set -euo pipefail
58+
echo "::add-mask::${GITHUB_TOKEN}"
59+
git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git"
60+
git ls-remote --tags origin >/dev/null
61+
62+
- name: Debug event
63+
if: env.ACT == 'true'
64+
run: |
65+
echo "GITHUB_EVENT_NAME=${GITHUB_EVENT_NAME}"
66+
echo "Payload:" && cat "$GITHUB_EVENT_PATH" || true
67+
68+
- name: Resolve THIS vs LATEST TEST + stale guard (auto only)
69+
id: resolver
70+
env:
71+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
72+
EVENT_NAME: ${{ github.event_name }}
73+
WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
74+
MANUAL_REF: ${{ github.event.inputs.ref }}
75+
WORKFLOW_NAME: "3. CD | Deploy to Test"
76+
BRANCH: "main"
77+
LIMIT: "100"
78+
run: python3 scripts/workflow/pre-release_resolver.py
79+
80+
- name: Resolve release_type (labels → default rc)
81+
id: release_type
82+
env:
83+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
84+
BRANCH: "main"
85+
AGGREGATE: "true"
86+
THIS_SHA: ${{ steps.resolver.outputs.this_sha }}
87+
LATEST_TEST_SHA: ${{ steps.resolver.outputs.latest_test_sha }}
88+
MANUAL_RELEASE_TYPE: ${{ github.event.inputs.release_type }}
89+
run: python3 scripts/workflow/release_type_resolver.py
90+
91+
deploy:
92+
name: "Call base-deploy.yml (PreProd)"
93+
needs: [metadata]
94+
uses: ./.github/workflows/base-deploy.yml
95+
with:
96+
environment: preprod
97+
ref: ${{ needs.metadata.outputs.ref }}
98+
release_type: ${{ needs.metadata.outputs.release_type }}
99+
secrets: inherit

‎.github/workflows/cicd-4-preprod-deploy.yml‎

Lines changed: 0 additions & 32 deletions
This file was deleted.

0 commit comments

Comments
 (0)