Skip to content

Commit ecfac68

Browse files
anthony-nhsanthony-nhs
committed
update readme
1 parent a747f32 commit ecfac68

File tree

1 file changed

+176
-55
lines changed

1 file changed

+176
-55
lines changed

‎README.md‎

Lines changed: 176 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,182 @@
1-
# eps-workflow-quality-checks
1+
# eps-common-workflows
22

3+
A collection of common workflows used by other EPS repositories
34

4-
A workflow to run the quality checks for EPS repositories. The main element of this lives in the [`quality-checks.yml`](./.github/workflows/quality-checks.yml) configuration file. The steps executed by this workflow are as follows:
5+
The workflows that are available to use are
56

6-
- **Install Project Dependencies**
7-
- **Generate and Check SBOMs**: Creates Software Bill of Materials (SBOMs) to track dependencies for security and compliance. Uses [THIS](https://github.com/NHSDigital/eps-action-sbom) action.
8-
- **Run Linting**
9-
- **Run Unit Tests**
10-
- **Scan git history for secrets**: Scans for secret-like patterns, using https://github.com/NHSDigital/software-engineering-quality-framework/blob/main/tools/nhsd-git-secrets/git-secrets
11-
- **SonarCloud Scan**: Performs code analysis using SonarCloud to detect quality issues and vulnerabilities.
12-
- **Validate CloudFormation Templates** (*Conditional*): If CloudFormation, AWS SAM templates or CDK are present, runs `cfn-lint` (SAM and cloudformation only) and `cfn-guard` to validate templates against AWS best practices and security rules.
13-
- **Validate Terraform Plans** Terraform plans can also be scanned by `cfn-guard` by uploading plans as artefacts in the calling workflow. All Terraform plans must end _terraform_plan and be in json format.
14-
- **CDK Synth** (*Conditional*): Runs `make cdk-synth` if packages/cdk folder exists
15-
- **Check Licenses**: Runs `make check-licenses`.
16-
- **Check Python Licenses** (*Conditional*): If the project uses Poetry, scans Python dependencies for incompatible licenses.
7+
## combine dependabot prs
8+
9+
This workflow can be called to combine multiple open Dependabot PRs into a single PR.
10+
11+
#### Inputs
12+
13+
- `branchPrefix`: Branch prefix to find combinable PRs based on. Default: `dependabot`
14+
- `mustBeGreen`: Only combine PRs that are green (status is success). Default: `true`
15+
- `combineBranchName`: Name of the branch to combine PRs into. Default: `combine-dependabot-PRs`
16+
- `ignoreLabel`: Exclude PRs with this label. Default: `nocombine`
17+
18+
#### Example
19+
20+
```yaml
21+
name: Combine Dependabot PRs
22+
23+
on:
24+
workflow_dispatch:
25+
inputs:
26+
branchPrefix:
27+
description: "Branch prefix to find combinable PRs based on"
28+
required: true
29+
type: string
30+
mustBeGreen:
31+
description: "Only combine PRs that are green (status is success)"
32+
required: true
33+
type: boolean
34+
combineBranchName:
35+
description: "Name of the branch to combine PRs into"
36+
required: true
37+
type: string
38+
ignoreLabel:
39+
description: "Exclude PRs with this label"
40+
required: true
41+
type: string
42+
43+
jobs:
44+
combine-dependabot-prs:
45+
uses: NHSDigital/eps-common-workflows/.github/workflows/combine-dependabot-prs.yml@f5c8313a10855d0cc911db6a9cd666494c00045a
46+
with:
47+
branchPrefix: ${{ github.event.inputs.branchPrefix }}
48+
mustBeGreen: ${{ github.event.inputs.mustBeGreen }}
49+
combineBranchName: ${{ github.event.inputs.combineBranchName }}
50+
ignoreLabel: ${{ github.event.inputs.ignoreLabel }}
51+
```
52+
53+
## dependabot auto approve and merge
54+
This workflow can be called to automatically approve and merge Dependabot PRs as part of the pull request workflow.
55+
56+
#### Requirements
57+
58+
Ensure that the `AUTOMERGE_APP_ID` and `AUTOMERGE_PEM` secrets are set, a `requires-manual-qa` PR label is created, and the repo is added to the `eps-autoapprove-dependabot` GitHub App.
59+
60+
#### Example
61+
62+
```yaml
63+
name: Pull Request
64+
65+
on:
66+
pull_request:
67+
branches: [main]
68+
69+
jobs:
70+
dependabot-auto-approve-and-merge:
71+
uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@f5c8313a10855d0cc911db6a9cd666494c00045a
72+
secrets:
73+
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
74+
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
75+
```
76+
## pr title check
77+
This workflow checks that all pull requests have a title that matches the required format, and comments on the PR with a link to the relevant ticket if a ticket reference is found.
78+
79+
#### Example
80+
81+
To use this workflow in your repository, call it from another workflow file:
82+
83+
```yaml
84+
name: Pull Request
85+
86+
on:
87+
pull_request:
88+
branches: [main]
89+
90+
jobs:
91+
pr_title_format_check:
92+
uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@f5c8313a10855d0cc911db6a9cd666494c00045a
93+
```
94+
95+
## quality checks
96+
This workflow runs common quality checks.
97+
To use this, you must have the following Makefile targets defined
98+
- install
99+
- check-licences
100+
- lint
101+
- test
102+
- cdk-synth (only for cdk projects)
103+
104+
#### Inputs
105+
106+
- `install_java`: Whether to install java or not
107+
- `run_sonar`: Whether to run sonar checks or not.
108+
- `asdfVersion`: Override the version of asdf to install.
109+
- `reinstall_poetry`: If you are using this from a primarily python based project, you should set this to true to force a poetry reinstallation after python is installed
110+
111+
#### Secret Inputs
112+
- `SONAR_TOKEN`: Token used to authenticate to sonar
113+
114+
#### Outputs
115+
116+
None
117+
118+
#### Example
119+
120+
To use this workflow in your repository, call it from another workflow file:
121+
122+
```yaml
123+
name: Release
124+
125+
on:
126+
workflow_dispatch:
127+
128+
jobs:
129+
quality_checks:
130+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@f5c8313a10855d0cc911db6a9cd666494c00045a
131+
needs: [get_asdf_version]
132+
with:
133+
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
134+
secrets:
135+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
136+
```
137+
138+
139+
140+
## tag release
141+
This workflow uses the semantic-release npm package to generate a new version tag, changelog, and github release for a repo.
142+
143+
#### Inputs
144+
145+
- `dry_run`: Whether to run in dry_run mode (do not create tags) or not
146+
- `tagFormat`: Default `v\\${version}`. A template for the version tag.
147+
- `branch_name`: The branch name to base the release on
148+
- `publish_package`: Default false. If true, semantic-release will publish npm package.
149+
- `asdfVersion`: Override the version of asdf to install.
150+
- `main_branch`: The branch to use for publishing. Defaults to main
151+
152+
#### Outputs
153+
154+
- `version_tag`: The version tag created by semantic-release.
155+
- `change_set_version`: A timestamped string that con be used for creating changesets.
156+
157+
#### Example
158+
159+
To use this workflow in your repository, call it from another workflow file:
160+
161+
```yaml
162+
name: Release
163+
164+
on:
165+
workflow_dispatch:
166+
167+
jobs:
168+
tag_release:
169+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@f5c8313a10855d0cc911db6a9cd666494c00045a
170+
with:
171+
tagFormat: "v\\${version}-beta"
172+
dry_run: true
173+
asdfVersion: 0.18.0
174+
branch_name: main
175+
publish_package: false
176+
```
177+
178+
179+
## Secret scanning docker
17180

18181
The secret scanning also has a dockerfile, which can be run against a repo in order to scan it manually (or as part of pre-commit hooks). This can be done like so:
19182
```bash
@@ -51,45 +214,3 @@ repos:
51214
- 'docker run -v "$LOCAL_WORKSPACE_FOLDER:/src" git-secrets --pre_commit_hook'
52215
language: system
53216
```
54-
55-
# Usage
56-
57-
## Inputs
58-
59-
None
60-
61-
## Required Makefile targets
62-
63-
In order to run, these `make` commands must be present. They may be mocked, if they are not relevant to the project.
64-
65-
- `install`
66-
- `lint`
67-
- `test`
68-
- `check-licenses`
69-
- `cdk-synth` - only needed if packages/cdk folder exists
70-
71-
## Environment variables
72-
73-
### `SONAR_TOKEN`
74-
75-
Required for the SonarCloud Scan step, which analyzes your code for quality and security issues using SonarCloud.
76-
77-
# Example Workflow Call
78-
79-
To use this workflow in your repository, call it from another workflow file:
80-
81-
```yaml
82-
name: Quality Checks
83-
84-
on:
85-
push:
86-
branches:
87-
- main
88-
- develop
89-
90-
jobs:
91-
quality_checks:
92-
uses: NHSDigital/eps-workflow-quality-checks/.github/workflows/[email protected]
93-
secrets:
94-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
95-
```

0 commit comments

Comments
 (0)