Skip to content

Commit 06b292b

Browse files
anthony-nhsanthony-nhs
authored
Fix: [AEA-0000] - move to common workflows (#302)
## Summary - Routine Change ### Details - move to common workflow
1 parent 9179361 commit 06b292b

File tree

12 files changed

+7159
-13196
lines changed

12 files changed

+7159
-13196
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
FROM mcr.microsoft.com/devcontainers/base:ubuntu
22

3+
4+
ARG TARGETARCH
5+
ENV TARGETARCH=${TARGETARCH}
6+
7+
ARG ASDF_VERSION
8+
COPY .tool-versions.asdf /tmp/.tool-versions.asdf
9+
310
RUN apt-get update \
411
&& export DEBIAN_FRONTEND=noninteractive \
512
&& apt-get -y dist-upgrade \
@@ -11,21 +18,41 @@ RUN apt-get update \
1118
libreadline-dev libsqlite3-dev wget llvm libncurses5-dev libncursesw5-dev \
1219
xz-utils tk-dev liblzma-dev netcat libyaml-dev
1320

14-
# install aws stuff
15-
RUN wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" && \
21+
22+
# Download correct AWS CLI for arch
23+
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
24+
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip"; \
25+
else \
26+
wget -O /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"; \
27+
fi && \
1628
unzip /tmp/awscliv2.zip -d /tmp/aws-cli && \
1729
/tmp/aws-cli/aws/install && \
18-
rm tmp/awscliv2.zip && \
19-
rm -rf /tmp/aws-cli
30+
rm /tmp/awscliv2.zip && rm -rf /tmp/aws-cli
2031

21-
USER vscode
32+
# Download correct SAM CLI for arch
33+
RUN if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" == "aarch64" ]; then \
34+
wget -O /tmp/aws-sam-cli.zip "https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-arm64.zip"; \
35+
else \
36+
wget -O /tmp/aws-sam-cli.zip "https://github.com/aws/aws-sam-cli/releases/latest/download/aws-sam-cli-linux-x86_64.zip"; \
37+
fi && \
38+
unzip /tmp/aws-sam-cli.zip -d /tmp/aws-sam-cli && \
39+
/tmp/aws-sam-cli/install && \
40+
rm /tmp/aws-sam-cli.zip && rm -rf /tmp/aws-sam-cli
2241

2342
# Install ASDF
24-
RUN git clone https://github.com/asdf-vm/asdf.git ~/.asdf --branch v0.14.1; \
25-
echo '. $HOME/.asdf/asdf.sh' >> ~/.bashrc; \
26-
echo '. $HOME/.asdf/completions/asdf.bash' >> ~/.bashrc;
43+
RUN ASDF_VERSION=$(awk '!/^#/ && NF {print $1; exit}' /tmp/.tool-versions.asdf) && \
44+
if [ "$TARGETARCH" = "arm64" ] || [ "$TARGETARCH" = "aarch64" ]; then \
45+
wget -O /tmp/asdf.tar.gz https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-arm64.tar.gz; \
46+
else \
47+
wget -O /tmp/asdf.tar.gz https://github.com/asdf-vm/asdf/releases/download/v${ASDF_VERSION}/asdf-v${ASDF_VERSION}-linux-amd64.tar.gz; \
48+
fi && \
49+
tar -xvzf /tmp/asdf.tar.gz && \
50+
mv asdf /usr/bin
51+
52+
53+
USER vscode
2754

28-
ENV PATH="$PATH:/home/vscode/.asdf/bin/:/workspaces/eps-cdk-utils/node_modules/.bin"
55+
ENV PATH="$PATH:/home/vscode/.asdf/shims/:/workspaces/eps-cdk-utils/node_modules/.bin"
2956

3057
# Install ASDF plugins
3158
RUN asdf plugin add python; \
@@ -40,8 +67,5 @@ WORKDIR /workspaces/eps-workflow-quality-checks
4067
ADD .tool-versions /workspaces/eps-cdk-utils/.tool-versions
4168
ADD .tool-versions /home/vscode/.tool-versions
4269

43-
RUN asdf install; \
44-
asdf reshim python; \
45-
asdf reshim poetry; \
46-
asdf reshim nodejs; \
47-
asdf direnv setup --shell bash --version 2.32.2;
70+
RUN asdf install python; \
71+
asdf install

‎.github/config/settings.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
TAG_FORMAT: "v${version}"

‎.github/workflows/ci.yml‎

Lines changed: 67 additions & 150 deletions
Original file line numberDiff line numberDiff line change
@@ -8,118 +8,59 @@ env:
88
BRANCH_NAME: ${{ github.ref_name }}
99

1010
jobs:
11-
quality_checks:
12-
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/[email protected]
13-
secrets:
14-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
15-
1611
get_commit_id:
1712
runs-on: ubuntu-22.04
1813
outputs:
1914
commit_id: ${{ steps.commit_id.outputs.commit_id }}
15+
sha_short: ${{ steps.commit_id.outputs.sha_short }}
16+
2017
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v5
20+
with:
21+
ref: ${{ env.BRANCH_NAME }}
22+
2123
- name: Get Commit ID
2224
id: commit_id
2325
run: |
26+
# echo "commit_id=${{ github.sha }}" >> "$GITHUB_ENV"
2427
echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
25-
26-
tag_release:
27-
needs: quality_checks
28+
echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
29+
get_asdf_version:
2830
runs-on: ubuntu-22.04
2931
outputs:
30-
version_tag: ${{steps.output_version_tag.outputs.VERSION_TAG}}
32+
asdf_version: ${{ steps.asdf-version.outputs.version }}
33+
tag_format: ${{ steps.load-config.outputs.TAG_FORMAT }}
3134
steps:
3235
- name: Checkout code
3336
uses: actions/checkout@v5
34-
with:
35-
ref: ${{ env.BRANCH_NAME }}
36-
fetch-depth: 0
3737

38-
# using git commit sha for version of action to ensure we have stable version
39-
- name: Install asdf
40-
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
41-
with:
42-
asdf_branch: v0.14.1
43-
44-
- name: Cache asdf
45-
uses: actions/cache@v4
46-
with:
47-
path: |
48-
~/.asdf
49-
key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
50-
restore-keys: |
51-
${{ runner.os }}-asdf-
52-
53-
- name: Install asdf dependencies in .tool-versions
54-
uses: asdf-vm/actions/install@1902764435ca0dd2f3388eea723a4f92a4eb8302
55-
with:
56-
asdf_branch: v0.14.1
57-
env:
58-
PYTHON_CONFIGURE_OPTS: --enable-shared
59-
60-
- name: Setting up .npmrc
61-
env:
62-
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
- name: Get asdf version
39+
id: asdf-version
40+
run: echo "version=$(awk '!/^#/ && NF {print $1; exit}' .tool-versions.asdf)" >> "$GITHUB_OUTPUT"
41+
- name: Load config value
42+
id: load-config
6343
run: |
64-
echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
65-
echo "@NHSDigital:registry=https://npm.pkg.github.com" >> ~/.npmrc
66-
67-
- name: Install node packages
68-
run: |
69-
make install-node
70-
71-
- name: Set VERSION_TAG env var to be short git SHA and get next tag version
72-
id: output_version_tag
73-
run: |
74-
VERSION_TAG=$(git rev-parse --short HEAD)
75-
npx semantic-release --dry-run > semantic-release-output.log
76-
NEXT_VERSION=$(grep -i 'The next release version is' semantic-release-output.log | sed -E 's/.* ([[:digit:].]+)$/\1/')
77-
if [ -z "${NEXT_VERSION}" ]
78-
then
79-
echo "Could not get next tag. Here is the log from semantic-release"
80-
cat semantic-release-output.log
81-
exit 1
82-
fi
83-
tagFormat=$(node -e "const config=require('./release.config.js'); console.log(config.tagFormat)")
84-
if [ "${tagFormat}" = "null" ]
85-
then
86-
tagFormat="v\${version}"
87-
fi
88-
# disabling shellcheck as replace does not work
89-
# shellcheck disable=SC2001
90-
VERSION_TAG=$(echo "$tagFormat" | sed "s/\${version}/$NEXT_VERSION/")
91-
echo "## VERSION TAG : ${VERSION_TAG}" >> "$GITHUB_STEP_SUMMARY"
92-
echo "VERSION_TAG=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
93-
echo "VERSION_TAG=${VERSION_TAG}" >> "$GITHUB_ENV"
94-
env:
95-
GITHUB_TOKEN: ${{ github.token }}
96-
97-
- name: tag release
98-
env:
99-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
100-
run: |
101-
npx semantic-release
102-
103-
- name: Get release for editing
104-
id: get_release
105-
# version 1.2.4
106-
uses: cardinalby/git-get-release-action@5172c3a026600b1d459b117738c605fabc9e4e44
107-
env:
108-
GITHUB_TOKEN: ${{ github.token }}
109-
with:
110-
tag: ${{ env.VERSION_TAG }}
44+
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
45+
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
46+
quality_checks:
47+
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/quality-checks.yml@4a6d03ad51516eddc448daf454805f85fe2025b9
48+
needs: [get_asdf_version, get_commit_id]
49+
with:
50+
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
51+
secrets:
52+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
11153

112-
- name: Edit Release
113-
# version 1.2.0
114-
uses: irongut/EditRelease@ccf529ad26dddf9996e7dd0f24ca5da4ea507cc2
115-
with:
116-
token: ${{ secrets.GITHUB_TOKEN }}
117-
id: ${{ steps.get_release.outputs.id }}
118-
body: |
119-
## Info
120-
[See code diff](${{ github.event.compare }})
121-
[Release workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
122-
It was initialized by [${{ github.event.sender.login }}](${{ github.event.sender.html_url }})
54+
tag_release:
55+
needs: [quality_checks, get_commit_id, get_asdf_version]
56+
uses: NHSDigital/eps-workflow-semantic-release/.github/workflows/tag-release.yml@f80157cecce288dd175e61b477a1d2dbe9c88b99
57+
with:
58+
dry_run: false
59+
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
60+
branch_name: main
61+
publish_package: false
62+
tag_format: ${{ needs.get_asdf_version.outputs.tag_format }}
63+
secrets: inherit
12364

12465
package_code:
12566
needs: [tag_release, quality_checks, get_commit_id]
@@ -141,73 +82,49 @@ jobs:
14182
CDK_PUSH_IMAGE_ROLE: ${{ secrets.DEV_CDK_PUSH_IMAGE_ROLE }}
14283

14384
release_qa:
144-
needs:
145-
[
146-
tag_release,
147-
release_dev,
148-
package_code,
149-
get_commit_id,
150-
]
85+
needs: [tag_release, release_dev, package_code, get_commit_id]
15186
uses: ./.github/workflows/docker_image_upload.yml
15287
with:
153-
AWS_ENVIRONMENT: qa
154-
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
155-
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
156-
TAG_LATEST: true
157-
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
88+
AWS_ENVIRONMENT: qa
89+
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
90+
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
91+
TAG_LATEST: true
92+
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
15893
secrets:
159-
CDK_PUSH_IMAGE_ROLE: ${{ secrets.QA_CDK_PUSH_IMAGE_ROLE }}
160-
94+
CDK_PUSH_IMAGE_ROLE: ${{ secrets.QA_CDK_PUSH_IMAGE_ROLE }}
95+
16196
release_ref:
162-
needs:
163-
[
164-
tag_release,
165-
release_dev,
166-
package_code,
167-
get_commit_id,
168-
]
97+
needs: [tag_release, release_dev, package_code, get_commit_id]
16998
uses: ./.github/workflows/docker_image_upload.yml
17099
with:
171-
AWS_ENVIRONMENT: ref
172-
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
173-
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
174-
TAG_LATEST: true
175-
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
100+
AWS_ENVIRONMENT: ref
101+
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
102+
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
103+
TAG_LATEST: true
104+
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
176105
secrets:
177-
CDK_PUSH_IMAGE_ROLE: ${{ secrets.REF_CDK_PUSH_IMAGE_ROLE }}
178-
106+
CDK_PUSH_IMAGE_ROLE: ${{ secrets.REF_CDK_PUSH_IMAGE_ROLE }}
107+
179108
release_int:
180-
needs:
181-
[
182-
tag_release,
183-
release_qa,
184-
package_code,
185-
get_commit_id,
186-
]
109+
needs: [tag_release, release_qa, package_code, get_commit_id]
187110
uses: ./.github/workflows/docker_image_upload.yml
188111
with:
189-
AWS_ENVIRONMENT: int
190-
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
191-
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
192-
TAG_LATEST: true
193-
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
112+
AWS_ENVIRONMENT: int
113+
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
114+
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
115+
TAG_LATEST: true
116+
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
194117
secrets:
195-
CDK_PUSH_IMAGE_ROLE: ${{ secrets.INT_CDK_PUSH_IMAGE_ROLE }}
196-
118+
CDK_PUSH_IMAGE_ROLE: ${{ secrets.INT_CDK_PUSH_IMAGE_ROLE }}
119+
197120
release_prod:
198-
needs:
199-
[
200-
tag_release,
201-
release_int,
202-
package_code,
203-
get_commit_id,
204-
]
121+
needs: [tag_release, release_int, package_code, get_commit_id]
205122
uses: ./.github/workflows/docker_image_upload.yml
206123
with:
207-
AWS_ENVIRONMENT: prod
208-
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
209-
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
210-
TAG_LATEST: true
211-
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
124+
AWS_ENVIRONMENT: prod
125+
VERSION_NUMBER: ${{needs.tag_release.outputs.version_tag}}
126+
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
127+
TAG_LATEST: true
128+
DOCKER_IMAGE_TAG: ${{needs.tag_release.outputs.version_tag}}
212129
secrets:
213-
CDK_PUSH_IMAGE_ROLE: ${{ secrets.PROD_CDK_PUSH_IMAGE_ROLE }}
130+
CDK_PUSH_IMAGE_ROLE: ${{ secrets.PROD_CDK_PUSH_IMAGE_ROLE }}

‎.github/workflows/dependabot_auto_approve_and_merge.yml‎

Lines changed: 5 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -6,44 +6,8 @@ permissions:
66
contents: write
77

88
jobs:
9-
dependabot:
10-
runs-on: ubuntu-22.04
11-
if: ${{ github.actor == 'dependabot[bot]' }}
12-
steps:
13-
- name: Get token from Github App
14-
id: get_app_token
15-
uses: actions/create-github-app-token@v2
16-
with:
17-
app-id: ${{ secrets.AUTOMERGE_APP_ID }}
18-
private-key: ${{ secrets.AUTOMERGE_PEM }}
19-
- name: Dependabot metadata
20-
id: dependabot-metadata
21-
uses: dependabot/fetch-metadata@v2
22-
with:
23-
github-token: "${{ secrets.GITHUB_TOKEN }}"
24-
- name: Approve patch and minor updates
25-
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' || steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor'}}
26-
run: gh pr review "$PR_URL" --approve -b "I'm **approving** this pull request because **it includes a patch or minor update**"
27-
env:
28-
PR_URL: ${{github.event.pull_request.html_url}}
29-
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
30-
- name: Approve major updates of development dependencies
31-
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:development'}}
32-
run: gh pr review "$PR_URL" --approve -b "I'm **approving** this pull request because **it includes a major update of a dependency used only in development**"
33-
env:
34-
PR_URL: ${{github.event.pull_request.html_url}}
35-
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
36-
- name: Comment on major updates of non-development dependencies
37-
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:production'}}
38-
run: |
39-
gh pr comment "$PR_URL" --body "I'm **not approving** this PR because **it includes a major update of a dependency used in production**"
40-
gh pr edit "$PR_URL" --add-label "requires-manual-qa"
41-
env:
42-
PR_URL: ${{github.event.pull_request.html_url}}
43-
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
44-
# enable auto merge on all dependabot prs
45-
- name: Enable auto-merge for Dependabot PRs
46-
run: gh pr merge --auto --squash "$PR_URL"
47-
env:
48-
PR_URL: ${{github.event.pull_request.html_url}}
49-
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
9+
dependabot-auto-approve-and-merge:
10+
uses: NHSDigital/eps-workflow-dependabot/.github/workflows/dependabot-auto-approve-and-merge.yml@5dd998ea44b2e412ea51544b565be3d67f54dc41
11+
secrets:
12+
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
13+
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}

0 commit comments

Comments
 (0)