Skip to content

Commit 6e0e39e

Browse files
thomasleesethomasleese
authored
Merge pull request #5544 from nhsuk/next
Version 6.7.0
2 parents 1401fc1 + 155d5cb commit 6e0e39e

File tree

148 files changed

+2855
-1827
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

148 files changed

+2855
-1827
lines changed

‎.github/workflows/build-and-push-image.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ jobs:
9999
- name: Save web image
100100
run: docker save -o image.tar mavis-webapp:latest
101101
- name: Upload web image
102-
uses: actions/upload-artifact@v5
102+
uses: actions/upload-artifact@v6
103103
with:
104104
name: webapp-image
105105
path: image.tar
@@ -108,7 +108,7 @@ jobs:
108108
- name: Save ops image
109109
run: docker save -o image.tar mavis-ops:latest
110110
- name: Upload ops image
111-
uses: actions/upload-artifact@v5
111+
uses: actions/upload-artifact@v6
112112
with:
113113
name: ops-image
114114
path: image.tar
@@ -123,7 +123,7 @@ jobs:
123123
image_type: ["webapp", "ops"]
124124
steps:
125125
- name: Download Docker image
126-
uses: actions/download-artifact@v6
126+
uses: actions/download-artifact@v7
127127
with:
128128
name: ${{ matrix.image_type }}-image
129129
- name: Configure AWS Credentials

‎.github/workflows/continuous-deployment.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ on:
77

88
jobs:
99
test:
10-
permissions: {}
10+
permissions:
11+
contents: write
12+
id-token: write
1113
uses: ./.github/workflows/test.yml
1214
deploy:
1315
needs: test

‎.github/workflows/create_dockerized_db.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Create Dockerized Database
2+
run-name: Creating dockerized image from ${{ github.ref_name }}
3+
4+
on:
5+
workflow_dispatch:
6+
push:
7+
tags:
8+
- 'v[0-9]+.[0-9]+.[0-9]+'
9+
10+
permissions:
11+
id-token: write
12+
contents: read
13+
14+
jobs:
15+
setup-development-database:
16+
name: Setup Development Database
17+
runs-on: ubuntu-latest
18+
env:
19+
RAILS_ENV: development
20+
DATABASE_HOST: localhost
21+
DATABASE_USER: postgres
22+
DATABASE_PASSWORD: postgres
23+
BUNDLE_WITHOUT: test
24+
RAILS_MASTER_KEY: intentionally-insecure-dev-key00
25+
SKIP_TEST_DATABASE: true
26+
steps:
27+
- uses: actions/checkout@v6
28+
- uses: actions/setup-node@v6
29+
with:
30+
node-version-file: .tool-versions
31+
cache: yarn
32+
- name: Build custom postgres image
33+
run: |
34+
echo -e "FROM postgres:16.11\n\nENV PGDATA=\"/var/lib/postgresql/mydata\"" > db.Dockerfile
35+
docker build -t custom-postgres:latest -f db.Dockerfile .
36+
- name: Start db container
37+
run: |
38+
docker run -d \
39+
--name database \
40+
-e "POSTGRES_HOST_AUTH_METHOD=trust" \
41+
-p 5432:5432 \
42+
custom-postgres:latest
43+
- name: Wait for db to be ready
44+
run: |
45+
docker exec database bash -c '
46+
until pg_isready -U postgres; do
47+
echo "Waiting for postgres..."
48+
sleep 2
49+
done
50+
'
51+
- uses: ruby/setup-ruby@v1
52+
with:
53+
bundler-cache: true
54+
- name: Populate database for testing
55+
run: |
56+
bin/rails db:setup
57+
bin/rails feature_flags:enable_for_development
58+
bin/mavis gias import
59+
- name: Configure AWS Credentials
60+
uses: aws-actions/configure-aws-credentials@v5
61+
with:
62+
role-to-assume: arn:aws:iam::393416225559:role/GitHubAssuranceTestRole
63+
aws-region: eu-west-2
64+
- name: Login to ECR
65+
id: login-ecr
66+
uses: aws-actions/amazon-ecr-login@v2
67+
- name: Commit postgres container with database
68+
run: |
69+
docker commit database ${{ steps.login-ecr.outputs.registry }}/mavis/development/postgres_db:latest
70+
- name: Push image
71+
run: |
72+
docker tag ${{ steps.login-ecr.outputs.registry }}/mavis/development/postgres_db:latest ${{ steps.login-ecr.outputs.registry }}/mavis/development/postgres_db:${{ github.ref_name }}
73+
docker push ${{ steps.login-ecr.outputs.registry }}/mavis/development/postgres_db --all-tags

‎.github/workflows/data-replication-pipeline.yml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,21 @@ on:
2121
Use code from: ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
2222
(Git ref to deploy, for example, a tag, branch name or commit SHA. Will use workflow ref if not provided.)
2323
type: string
24+
workflow_call:
25+
inputs:
26+
environment:
27+
description: Deployment environment
28+
required: true
29+
type: string
30+
git_ref_to_deploy:
31+
description: Git ref to deploy, for example, a tag, branch name or commit SHA
32+
type: string
33+
required: true
2434

2535
permissions: {}
2636

2737
env:
2838
environment: ${{ inputs.environment }}
29-
deployment_type: ${{ inputs.deployment_type }}
30-
db_snapshot_arn: ${{ inputs.db_snapshot_arn }}
31-
egress_cidr: ${{ inputs.egress_cidr }}
32-
take_db_snapshot: ${{ inputs.take_db_snapshot }}
3339
git_ref_to_deploy: ${{ inputs.git_ref_to_deploy || github.sha }}
3440
aws_role: ${{ inputs.environment == 'production'
3541
&& 'arn:aws:iam::820242920762:role/GithubDeployDataReplicationInfrastructure'
@@ -125,7 +131,7 @@ jobs:
125131
- name: Rename task definition file
126132
run: mv ${{ steps.create-task-definition.outputs.task-definition }} ${{ runner.temp }}/data-replication-task-definition.json
127133
- name: Upload artifact for data-replication task definition
128-
uses: actions/upload-artifact@v5
134+
uses: actions/upload-artifact@v6
129135
with:
130136
name: ${{ inputs.environment }}-data-replication-task-definition
131137
path: ${{ runner.temp }}/data-replication-task-definition.json
@@ -134,7 +140,7 @@ jobs:
134140
name: Notify on approval required
135141
runs-on: ubuntu-latest
136142
needs: prepare-deployment
137-
if: ${{ inputs.environment == 'production' }}
143+
if: ${{ inputs.environment == 'production' && github.event_name == 'workflow_dispatch' }}
138144
steps:
139145
- name: Notify pending approval
140146
if: inputs.environment == 'production'
@@ -160,7 +166,7 @@ jobs:
160166
name: Wait for approval if required
161167
runs-on: ubuntu-latest
162168
needs: prepare-deployment
163-
environment: ${{ inputs.environment }}
169+
environment: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || null }}
164170
steps:
165171
- run: echo "Proceeding with deployment to $environment environment"
166172

@@ -177,7 +183,7 @@ jobs:
177183
role-to-assume: ${{ env.aws_role }}
178184
aws-region: eu-west-2
179185
- name: Download data-replication task definition artifact
180-
uses: actions/download-artifact@v6
186+
uses: actions/download-artifact@v7
181187
with:
182188
path: ${{ runner.temp }}
183189
name: ${{ inputs.environment }}-data-replication-task-definition

‎.github/workflows/deploy-application.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ jobs:
161161
- name: Rename task definition file
162162
run: mv ${{ steps.create-task-definition.outputs.task-definition }} ${{ runner.temp }}/${{ matrix.service }}-task-definition.json
163163
- name: Upload artifact for ${{ matrix.service }} task definition
164-
uses: actions/upload-artifact@v5
164+
uses: actions/upload-artifact@v6
165165
with:
166166
name: ${{ inputs.environment }}-${{ matrix.service }}-task-definition
167167
path: ${{ runner.temp }}/${{ matrix.service }}-task-definition.json
@@ -213,7 +213,7 @@ jobs:
213213
role-to-assume: ${{ env.aws_role }}
214214
aws-region: eu-west-2
215215
- name: Download ops task definition artifact
216-
uses: actions/download-artifact@v6
216+
uses: actions/download-artifact@v7
217217
with:
218218
path: ${{ runner.temp }}
219219
name: ${{ inputs.environment }}-ops-task-definition
@@ -339,7 +339,7 @@ jobs:
339339
role-to-assume: ${{ env.aws_role }}
340340
aws-region: eu-west-2
341341
- name: Download ${{ matrix.service }} task definition artifact
342-
uses: actions/download-artifact@v6
342+
uses: actions/download-artifact@v7
343343
with:
344344
path: ${{ runner.temp }}
345345
name: ${{ inputs.environment }}-${{ matrix.service }}-task-definition

‎.github/workflows/deploy-backup-infrastructure.yml‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,21 +49,27 @@ jobs:
4949
id: plan
5050
env:
5151
PERSONAL_ACCESS_TOKEN: ${{ secrets.BACKUP_MODULES_ACCESS_TOKEN }}
52+
SLACK_WEBHOOK_URL: ${{ inputs.environment == 'production' && secrets.SLACK_AWS_BACKUP_PRODUCTION_WEBHOOK || secrets.SLACK_AWS_BACKUP_TEST_WEBHOOK }}
5253
run: |
5354
set -e
5455
git config --global url."https://foo:${PERSONAL_ACCESS_TOKEN}@github.com/NHSDigital".insteadOf "https://github.com/NHSDigital"
5556
terraform init -backend-config="env/$environment-backend.hcl" -upgrade
56-
terraform plan -var-file="env/$environment.tfvars" \
57+
terraform plan -var-file="env/$environment.tfvars" -var="slack_webhook_url=${SLACK_WEBHOOK_URL}" \
5758
-out ${{ runner.temp }}/tfplan | tee ${{ runner.temp }}/tf_stdout
5859
- name: Validate the changes
5960
run: |
6061
set -e
6162
../../scripts/validate_plan.sh ${{ runner.temp }}/tf_stdout
6263
- name: Upload artifact
63-
uses: actions/upload-artifact@v5
64+
uses: actions/upload-artifact@v6
6465
with:
6566
name: tfplan_infrastructure-${{ inputs.environment }}
6667
path: ${{ runner.temp }}/tfplan
68+
- name: Upload Lambda
69+
uses: actions/upload-artifact@v6
70+
with:
71+
name: backup_alert_lambda_${{ inputs.environment }}
72+
path: terraform/backup/source/lambda/backup_alert_function.zip
6773

6874
apply:
6975
name: Terraform apply
@@ -81,10 +87,15 @@ jobs:
8187
role-to-assume: ${{ env.aws_role }}
8288
aws-region: eu-west-2
8389
- name: Download artifact
84-
uses: actions/download-artifact@v6
90+
uses: actions/download-artifact@v7
8591
with:
8692
name: tfplan_infrastructure-${{ inputs.environment }}
8793
path: ${{ runner.temp }}
94+
- name: Download Lambda zip
95+
uses: actions/download-artifact@v7
96+
with:
97+
name: backup_alert_lambda_${{ inputs.environment }}
98+
path: terraform/backup/source/lambda
8899
- name: Install terraform
89100
uses: hashicorp/setup-terraform@v3
90101
with:

‎.github/workflows/deploy-infrastructure.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ jobs:
7676
fi
7777
../scripts/validate_plan.sh ${{ runner.temp }}/tf_stdout
7878
- name: Upload artifact
79-
uses: actions/upload-artifact@v5
79+
uses: actions/upload-artifact@v6
8080
with:
8181
name: tfplan_infrastructure-${{ inputs.environment }}
8282
path: ${{ runner.temp }}/tfplan
@@ -99,7 +99,7 @@ jobs:
9999
role-to-assume: ${{ env.aws_role }}
100100
aws-region: eu-west-2
101101
- name: Download artifact
102-
uses: actions/download-artifact@v6
102+
uses: actions/download-artifact@v7
103103
with:
104104
name: tfplan_infrastructure-${{ inputs.environment }}
105105
path: ${{ runner.temp }}

‎.github/workflows/deploy-monitoring.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ jobs:
7777
echo "Infrastructure changes detected"
7878
fi
7979
- name: Upload AWS plan artifact
80-
uses: actions/upload-artifact@v5
80+
uses: actions/upload-artifact@v6
8181
with:
8282
name: tfplan_monitoring_aws-${{ inputs.environment }}
8383
path: ${{ runner.temp }}/tfplan-aws
@@ -104,7 +104,7 @@ jobs:
104104
role-to-assume: ${{ env.aws_role }}
105105
aws-region: eu-west-2
106106
- name: Download AWS plan artifact
107-
uses: actions/download-artifact@v6
107+
uses: actions/download-artifact@v7
108108
with:
109109
name: tfplan_monitoring_aws-${{ inputs.environment }}
110110
path: ${{ runner.temp }}

0 commit comments

Comments
 (0)