Skip to content

Commit 4662310

Browse files
anthony-nhsanthony-nhs
committed
build nhsd_git_secrets
1 parent 0f8dc72 commit 4662310

File tree

3 files changed

+194
-3
lines changed

3 files changed

+194
-3
lines changed

‎.github/workflows/build_nhsd_git_secrets.yml‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
name: Build nhsd git secrets
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
SONAR_TOKEN:
7+
required: false
8+
PUSH_IMAGE_ROLE:
9+
required: true
10+
inputs:
11+
git_secrets_container_ecr:
12+
type: string
13+
description: "The name of the ECR repository to push the dev container image to."
14+
required: true
15+
git_secrets_container_image_tag:
16+
type: string
17+
description: "The tag to use for the dev container image."
18+
required: true
19+
check_ecr_image_scan_results_script_tag:
20+
type: string
21+
description: "The tag to download check_ecr_image_scan_results.sh script."
22+
required: false
23+
default: "dev_container_build"
24+
jobs:
25+
build_nhsd_git_secrets_x64:
26+
permissions:
27+
id-token: write
28+
runs-on: ubuntu-22.04
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@v5
32+
with:
33+
fetch-depth: 0
34+
35+
- name: Download check_ecr_image_scan_results.sh script
36+
env:
37+
SCRIPT_TAG: ${{ inputs.check_ecr_image_scan_results_script_tag }}
38+
run: |
39+
curl -L "https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/heads/${SCRIPT_TAG}/.github/scripts/check_ecr_image_scan_results.sh" -o check_ecr_image_scan_results.sh
40+
chmod +x check_ecr_image_scan_results.sh
41+
- name: Build dev container
42+
run: |
43+
docker build -f dockerfiles/nhsd-git-secrets.dockerfile -t nhsd-git-secrets-image .
44+
45+
- name: Configure AWS Credentials
46+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
47+
id: connect-aws-deploy
48+
with:
49+
aws-region: eu-west-2
50+
role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
51+
role-session-name: dev-container-build-x64
52+
output-credentials: true
53+
54+
- name: Retrieve AWS Account ID
55+
id: retrieve-deploy-account-id
56+
run: |
57+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
58+
echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
59+
60+
- name: Login to Amazon ECR
61+
run: |
62+
aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
63+
64+
- name: Push x64 image to Amazon ECR
65+
env:
66+
ECR_REPOSITORY: ${{ inputs.git_secrets_container_ecr }}
67+
IMAGE_TAG: ${{ inputs.git_secrets_container_image_tag }}
68+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
69+
run: |
70+
docker tag "dev-container-image" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64"
71+
docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64"
72+
- name: Check dev container scan results
73+
env:
74+
REPOSITORY_NAME: ${{ inputs.git_secrets_container_ecr }}
75+
IMAGE_TAG: ${{ inputs.git_secrets_container_image_tag }}-amd64
76+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
77+
run: |
78+
sleep 30
79+
./check_ecr_image_scan_results.sh
80+
81+
build_nhsd_git_secrets_arm64:
82+
permissions:
83+
id-token: write
84+
runs-on: ubuntu-22.04-arm
85+
steps:
86+
- name: Checkout code
87+
uses: actions/checkout@v5
88+
with:
89+
fetch-depth: 0
90+
91+
- name: Download check_ecr_image_scan_results.sh script
92+
env:
93+
SCRIPT_TAG: ${{ inputs.check_ecr_image_scan_results_script_tag }}
94+
run: |
95+
curl -L "https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/heads/${SCRIPT_TAG}/.github/scripts/check_ecr_image_scan_results.sh" -o check_ecr_image_scan_results.sh
96+
chmod +x check_ecr_image_scan_results.sh
97+
98+
- name: Build dev container
99+
run: |
100+
docker build -f dockerfiles/nhsd-git-secrets.dockerfile -t nhsd-git-secrets-image-arm .
101+
102+
- name: Configure AWS Credentials
103+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
104+
id: connect-aws-deploy
105+
with:
106+
aws-region: eu-west-2
107+
role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
108+
role-session-name: dev-container-build-arm64
109+
output-credentials: true
110+
111+
- name: Retrieve AWS Account ID
112+
id: retrieve-deploy-account-id
113+
run: |
114+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
115+
echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
116+
117+
- name: Login to Amazon ECR
118+
run: |
119+
aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
120+
121+
- name: Push ARM64 image to Amazon ECR
122+
env:
123+
ECR_REPOSITORY: ${{ inputs.git_secrets_container_ecr }}
124+
IMAGE_TAG: ${{ inputs.git_secrets_container_image_tag }}
125+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
126+
run: |
127+
docker tag "dev-container-image-arm" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
128+
docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
129+
- name: Check dev container scan results
130+
env:
131+
REPOSITORY_NAME: ${{ inputs.git_secrets_container_ecr }}
132+
IMAGE_TAG: ${{ inputs.git_secrets_container_image_tag }}-arm64
133+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
134+
run: |
135+
# Wait a moment for ECR to process the new manifest
136+
sleep 30
137+
./check_ecr_image_scan_results.sh
138+
139+
create_multi_arch_manifest:
140+
permissions:
141+
id-token: write
142+
runs-on: ubuntu-22.04
143+
needs: [build_nhsd_git_secrets_x64, build_nhsd_git_secrets_arm64]
144+
steps:
145+
- name: Set up Docker Buildx
146+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
147+
148+
- name: Configure AWS Credentials
149+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8
150+
with:
151+
aws-region: eu-west-2
152+
role-to-assume: ${{ secrets.PUSH_IMAGE_ROLE }}
153+
role-session-name: multi-arch-manifest
154+
output-credentials: true
155+
156+
- name: Retrieve AWS Account ID
157+
id: retrieve-deploy-account-id
158+
run: |
159+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
160+
echo "account_id=$ACCOUNT_ID" >> "$GITHUB_OUTPUT"
161+
162+
- name: Login to Amazon ECR
163+
run: |
164+
aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin ${{ steps.retrieve-deploy-account-id.outputs.account_id }}.dkr.ecr.eu-west-2.amazonaws.com
165+
166+
- name: Create and push multi-architecture manifest for tag
167+
env:
168+
ECR_REPOSITORY: ${{ inputs.git_secrets_container_ecr }}
169+
IMAGE_TAG: ${{ inputs.git_secrets_container_image_tag }}
170+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
171+
run: |
172+
# Create manifest list combining both architectures
173+
docker buildx imagetools create -t "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}" \
174+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-amd64" \
175+
"${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}-arm64"
176+
177+
- name: Verify multi-architecture manifest
178+
env:
179+
ECR_REPOSITORY: ${{ inputs.git_secrets_container_ecr }}
180+
IMAGE_TAG: ${{ inputs.git_secrets_container_image_tag }}
181+
ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.account_id }}
182+
run: |
183+
echo "=== Verifying multi-architecture manifest ==="
184+
docker buildx imagetools inspect "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/${ECR_REPOSITORY}:${IMAGE_TAG}"

‎.github/workflows/pull_request.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,16 @@ jobs:
7777
secrets:
7878
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
7979
PUSH_IMAGE_ROLE: ${{ secrets.PUSH_IMAGE_ROLE }}
80+
81+
build_nhsd_git_secrets_x64:
82+
uses: ./.github/workflows/build_nhsd_git_secrets.yml
83+
needs: [get_asdf_version, get_issue_number_and_commit_id]
84+
with:
85+
git_secrets_container_ecr: dev-container-quality-checks
86+
git_secrets_container_image_tag: PR-${{ needs.get_issue_number_and_commit_id.outputs.issue_number }}-${{ needs.get_issue_number_and_commit_id.outputs.sha_short }}
87+
secrets:
88+
PUSH_IMAGE_ROLE: ${{ secrets.PUSH_IMAGE_ROLE }}
89+
8090
tag_latest_dev_container:
8191
needs: [quality_checks, get_issue_number_and_commit_id]
8292
uses: ./.github/workflows/tag_latest_dev_container.yml

‎.github/workflows/quality-checks.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -417,9 +417,6 @@ jobs:
417417
run: |
418418
curl -L "https://raw.githubusercontent.com/NHSDigital/eps-workflow-quality-checks/refs/heads/${SCRIPT_TAG}/.github/scripts/check_ecr_image_scan_results.sh" -o check_ecr_image_scan_results.sh
419419
chmod +x check_ecr_image_scan_results.sh
420-
- name: Build dev container
421-
run: |
422-
docker build -f .devcontainer/Dockerfile -t dev-container-image .
423420
424421
- name: Build dev container
425422
run: |

0 commit comments

Comments
 (0)