Skip to content

Commit 227e14a

Browse files
RossBugginsNHSRossBugginsNHS
committed
Moving docs and schemas to separate workflow.
1 parent 29b7644 commit 227e14a

File tree

6 files changed

+885
-0
lines changed

6 files changed

+885
-0
lines changed

‎.github/workflows/docs-cicd-1-docs.yaml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
name: "Docs 1. CI/CD"
2+
3+
# The total recommended execution time for the "CI/CD Pull Request" workflow is around 20 minutes.
4+
5+
on:
6+
workflow_dispatch:
7+
push:
8+
branches:
9+
- "**"
10+
pull_request:
11+
types: [opened, reopened, synchronize]
12+
branches:
13+
- main
14+
15+
permissions:
16+
id-token: write
17+
contents: write
18+
19+
jobs:
20+
changes:
21+
name: "Only run on docs change"
22+
runs-on: ubuntu-latest
23+
timeout-minutes: 1
24+
steps:
25+
- uses: dorny/paths-filter@v3
26+
id: changes
27+
with:
28+
filters: |
29+
docs:`
30+
- 'docs/**'
31+
src:`
32+
- 'src/**'
33+
outputs:
34+
docs: ${{ steps.changes.outputs.docs }}
35+
src: ${{ steps.changes.outputs.src }}
36+
37+
metadata:
38+
name: "Set CI/CD metadata"
39+
runs-on: ubuntu-latest
40+
timeout-minutes: 1
41+
needs: changes
42+
if: ${{ needs.changes.outputs.docs == 'true' || needs.changes.outputs.src == 'true' }}
43+
44+
outputs:
45+
build_datetime_london: ${{ steps.variables.outputs.build_datetime_london }}
46+
build_datetime: ${{ steps.variables.outputs.build_datetime }}
47+
build_timestamp: ${{ steps.variables.outputs.build_timestamp }}
48+
build_epoch: ${{ steps.variables.outputs.build_epoch }}
49+
nodejs_version: ${{ steps.variables.outputs.nodejs_version }}
50+
python_version: ${{ steps.variables.outputs.python_version }}
51+
terraform_version: ${{ steps.variables.outputs.terraform_version }}
52+
version: ${{ steps.variables.outputs.version }}
53+
is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
54+
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
55+
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
56+
steps:
57+
- name: "Checkout code"
58+
uses: actions/checkout@v5
59+
- name: "Set CI/CD variables"
60+
id: variables
61+
run: |
62+
datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
63+
BUILD_DATETIME=$datetime make version-create-effective-file dir=.
64+
version=$(head -n 1 .version 2> /dev/null || echo unknown)
65+
echo "build_datetime_london=$(TZ=Europe/London date --date=$datetime +'%Y-%m-%dT%H:%M:%S%z')" >> $GITHUB_OUTPUT
66+
echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
67+
echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
68+
echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
69+
echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
70+
echo "python_version=$(grep "^python\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
71+
echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
72+
echo "version=$(echo $version)" >> $GITHUB_OUTPUT
73+
echo "is_version_prerelease=$(if [[ $version == *-* ]]; then echo "true"; else echo "false"; fi)" >> $GITHUB_OUTPUT
74+
75+
- name: "Check if pull request exists for this branch"
76+
id: pr_exists
77+
env:
78+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
79+
run: |
80+
branch_name=${GITHUB_HEAD_REF:-$(echo $GITHUB_REF | sed 's#refs/heads/##')}
81+
echo "Current branch is '$branch_name'"
82+
83+
pr_json=$(gh pr list --head "$branch_name" --state open --json number --limit 1)
84+
pr_number=$(echo "$pr_json" | jq -r '.[0].number // empty')
85+
86+
if [[ -n "$pr_number" ]]; then
87+
echo "Pull request exists: #$pr_number"
88+
echo "does_pull_request_exist=true" >> $GITHUB_OUTPUT
89+
echo "pr_number=$pr_number" >> $GITHUB_OUTPUT
90+
else
91+
echo "Pull request doesn't exist"
92+
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
93+
echo "pr_number=" >> $GITHUB_OUTPUT
94+
fi
95+
96+
- name: "List variables"
97+
run: |
98+
export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
99+
export BUILD_DATETIME="${{ steps.variables.outputs.build_datetime }}"
100+
export BUILD_TIMESTAMP="${{ steps.variables.outputs.build_timestamp }}"
101+
export BUILD_EPOCH="${{ steps.variables.outputs.build_epoch }}"
102+
export NODEJS_VERSION="${{ steps.variables.outputs.nodejs_version }}"
103+
export PYTHON_VERSION="${{ steps.variables.outputs.python_version }}"
104+
export TERRAFORM_VERSION="${{ steps.variables.outputs.terraform_version }}"
105+
export VERSION="${{ steps.variables.outputs.version }}"
106+
export DOES_PULL_REQUEST_EXIST="${{ steps.pr_exists.outputs.does_pull_request_exist }}"
107+
export IS_VERSION_PRERELEASE="${{ steps.variables.outputs.is_version_prerelease }}"
108+
make list-variables
109+
commit-stage: # Recommended maximum execution time is 2 minutes
110+
name: "Commit stage"
111+
needs: [metadata]
112+
uses: ./.github/workflows/docs-stage-1-commit.yaml
113+
with:
114+
build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
115+
build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
116+
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
117+
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
118+
python_version: "${{ needs.metadata.outputs.python_version }}"
119+
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
120+
version: "${{ needs.metadata.outputs.version }}"
121+
# secrets: inherit
122+
test-stage: # Recommended maximum execution time is 5 minutes
123+
name: "Test stage"
124+
needs: [metadata, commit-stage]
125+
uses: ./.github/workflows/docs-stage-2-test.yaml
126+
with:
127+
build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
128+
build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
129+
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
130+
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
131+
python_version: "${{ needs.metadata.outputs.python_version }}"
132+
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
133+
version: "${{ needs.metadata.outputs.version }}"
134+
secrets: #inherit
135+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
136+
build-stage: # Recommended maximum execution time is 3 minutes
137+
name: "Build stage"
138+
needs: [metadata, test-stage]
139+
uses: ./.github/workflows/docs-stage-3-build.yaml
140+
if: needs.metadata.outputs.does_pull_request_exist == 'true' || (github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened')) || (github.event_name == 'push' && github.ref == 'refs/heads/main')
141+
with:
142+
build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
143+
build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
144+
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
145+
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
146+
python_version: "${{ needs.metadata.outputs.python_version }}"
147+
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
148+
version: "${{ needs.metadata.outputs.version }}"
149+
# secrets: inherit
150+
publish-stage: # Recommended maximum execution time is 10 minutes
151+
name: "Publish stage"
152+
needs: [metadata, build-stage]
153+
uses: ./.github/workflows/docs-stage-5-publish.yaml
154+
if: (github.event_name == 'push' && github.ref == 'refs/heads/main')
155+
with:
156+
build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
157+
build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
158+
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
159+
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
160+
python_version: "${{ needs.metadata.outputs.python_version }}"
161+
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
162+
version: "${{ needs.metadata.outputs.version }}"
163+
is_version_prerelease: "${{ needs.metadata.outputs.is_version_prerelease }}"
164+
# secrets: inherit

‎.github/workflows/docs-stage-1-commit.yaml‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
name: "Commit stage"
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
build_datetime:
7+
description: "Build datetime, set by the CI/CD pipeline workflow"
8+
required: true
9+
type: string
10+
build_timestamp:
11+
description: "Build timestamp, set by the CI/CD pipeline workflow"
12+
required: true
13+
type: string
14+
build_epoch:
15+
description: "Build epoch, set by the CI/CD pipeline workflow"
16+
required: true
17+
type: string
18+
nodejs_version:
19+
description: "Node.js version, set by the CI/CD pipeline workflow"
20+
required: true
21+
type: string
22+
python_version:
23+
description: "Python version, set by the CI/CD pipeline workflow"
24+
required: true
25+
type: string
26+
terraform_version:
27+
description: "Terraform version, set by the CI/CD pipeline workflow"
28+
required: true
29+
type: string
30+
version:
31+
description: "Version of the software, set by the CI/CD pipeline workflow"
32+
required: true
33+
type: string
34+
35+
jobs:
36+
scan-secrets:
37+
name: "Scan secrets"
38+
runs-on: ubuntu-latest
39+
timeout-minutes: 5
40+
steps:
41+
- name: "Checkout code"
42+
uses: actions/checkout@v5
43+
with:
44+
fetch-depth: 0 # Full history is needed to scan all commits
45+
- name: "Scan secrets"
46+
uses: ./.github/actions/scan-secrets
47+
check-file-format:
48+
name: "Check file format"
49+
runs-on: ubuntu-latest
50+
timeout-minutes: 5
51+
steps:
52+
- name: "Checkout code"
53+
uses: actions/checkout@v5
54+
with:
55+
fetch-depth: 0 # Full history is needed to compare branches
56+
- name: "Check file format"
57+
uses: ./.github/actions/check-file-format
58+
check-markdown-format:
59+
name: "Check Markdown format"
60+
runs-on: ubuntu-latest
61+
timeout-minutes: 5
62+
steps:
63+
- name: "Checkout code"
64+
uses: actions/checkout@v5
65+
with:
66+
fetch-depth: 0 # Full history is needed to compare branches
67+
- name: "Check Markdown format"
68+
uses: ./.github/actions/check-markdown-format
69+
terraform-docs:
70+
name: "Run terraform-docs"
71+
runs-on: ubuntu-latest
72+
needs: detect-terraform-changes
73+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
74+
permissions:
75+
contents: write
76+
steps:
77+
- name: "Checkout code"
78+
uses: actions/checkout@v5
79+
with:
80+
fetch-depth: 0 # Full history is needed to compare branches
81+
- name: "Check to see if Terraform Docs are up-to-date"
82+
run: |
83+
make terraform-docs
84+
- name: "Stage changes"
85+
run: |
86+
git add infrastructure/terraform/**/*.md
87+
- name: "Check for changes in Terraform Docs"
88+
run: |
89+
if git diff --cached --name-only | grep -qE '\.md$'; then
90+
echo "Markdown files have changed. Please run 'make terraform-docs' and commit the changes."
91+
exit 1
92+
fi
93+
check-english-usage:
94+
name: "Check English usage"
95+
runs-on: ubuntu-latest
96+
timeout-minutes: 5
97+
steps:
98+
- name: "Checkout code"
99+
uses: actions/checkout@v5
100+
with:
101+
fetch-depth: 0 # Full history is needed to compare branches
102+
- name: "Check English usage"
103+
uses: ./.github/actions/check-english-usage
104+
check-todo-usage:
105+
name: "Check TODO usage"
106+
runs-on: ubuntu-latest
107+
timeout-minutes: 5
108+
steps:
109+
- name: "Checkout code"
110+
uses: actions/checkout@v5
111+
with:
112+
fetch-depth: 0 # Full history is needed to compare branches
113+
- name: "Check TODO usage"
114+
uses: ./.github/actions/check-todo-usage
115+
detect-terraform-changes:
116+
name: "Detect Terraform Changes"
117+
runs-on: ubuntu-latest
118+
outputs:
119+
terraform_changed: ${{ steps.check.outputs.terraform_changed }}
120+
steps:
121+
- name: "Checkout code"
122+
uses: actions/checkout@v5
123+
124+
- name: "Check for Terraform changes"
125+
id: check
126+
run: |
127+
git fetch origin main || true # Ensure you have the latest main branch
128+
CHANGED_FILES=$(git diff --name-only HEAD origin/main)
129+
echo "Changed files: $CHANGED_FILES"
130+
131+
if echo "$CHANGED_FILES" | grep -qE '\.tf$'; then
132+
echo "Terraform files have changed."
133+
echo "terraform_changed=true" >> $GITHUB_OUTPUT
134+
else
135+
echo "No Terraform changes detected."
136+
echo "terraform_changed=false" >> $GITHUB_OUTPUT
137+
fi
138+
lint-terraform:
139+
name: "Lint Terraform"
140+
runs-on: ubuntu-latest
141+
timeout-minutes: 5
142+
needs: detect-terraform-changes
143+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
144+
steps:
145+
- name: "Checkout code"
146+
uses: actions/checkout@v5
147+
- name: "Lint Terraform"
148+
uses: ./.github/actions/lint-terraform
149+
trivy:
150+
name: "Trivy Scan"
151+
runs-on: ubuntu-latest
152+
timeout-minutes: 5
153+
needs: detect-terraform-changes
154+
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
155+
steps:
156+
- name: "Checkout code"
157+
uses: actions/checkout@v5
158+
- name: "Setup ASDF"
159+
uses: asdf-vm/actions/setup@v4
160+
- name: "Perform Setup"
161+
uses: ./.github/actions/setup
162+
- name: "Trivy Scan"
163+
uses: ./.github/actions/trivy
164+
count-lines-of-code:
165+
name: "Count lines of code"
166+
runs-on: ubuntu-latest
167+
permissions:
168+
id-token: write
169+
contents: read
170+
timeout-minutes: 5
171+
steps:
172+
- name: "Checkout code"
173+
uses: actions/checkout@v5
174+
- name: "Count lines of code"
175+
uses: ./.github/actions/create-lines-of-code-report
176+
with:
177+
build_datetime: "${{ inputs.build_datetime }}"
178+
build_timestamp: "${{ inputs.build_timestamp }}"
179+
idp_aws_report_upload_account_id: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}"
180+
idp_aws_report_upload_region: "${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}"
181+
idp_aws_report_upload_role_name: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}"
182+
idp_aws_report_upload_bucket_endpoint: "${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}"
183+
scan-dependencies:
184+
name: "Scan dependencies"
185+
runs-on: ubuntu-latest
186+
permissions:
187+
id-token: write
188+
contents: read
189+
timeout-minutes: 5
190+
steps:
191+
- name: "Checkout code"
192+
uses: actions/checkout@v5
193+
- name: "Scan dependencies"
194+
uses: ./.github/actions/scan-dependencies
195+
with:
196+
build_datetime: "${{ inputs.build_datetime }}"
197+
build_timestamp: "${{ inputs.build_timestamp }}"
198+
idp_aws_report_upload_account_id: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ACCOUNT_ID }}"
199+
idp_aws_report_upload_region: "${{ secrets.IDP_AWS_REPORT_UPLOAD_REGION }}"
200+
idp_aws_report_upload_role_name: "${{ secrets.IDP_AWS_REPORT_UPLOAD_ROLE_NAME }}"
201+
idp_aws_report_upload_bucket_endpoint: "${{ secrets.IDP_AWS_REPORT_UPLOAD_BUCKET_ENDPOINT }}"

0 commit comments

Comments
 (0)