Skip to content

Commit 1f8d25c

Browse files
aidenvaines-cgiaidenvaines-cgi
authored
Merge branch 'main' into CCM_11015_HelloWorldProxy
2 parents 35a4e47 + eedf32c commit 1f8d25c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+5779
-5445
lines changed

‎.github/workflows/pr_closed.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: PR Closed
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
types: [closed]
7+
branches:
8+
- main
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: false
13+
14+
jobs:
15+
check-merge-or-workflow-dispatch:
16+
runs-on: ubuntu-latest
17+
outputs:
18+
deploy: ${{ steps.check.outputs.deploy }}
19+
steps:
20+
- name: Check if PR was merged or workflow is triggered by workflow_dispatch
21+
id: check
22+
run: |
23+
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
24+
echo "deploy=true" >> $GITHUB_OUTPUT
25+
echo "Job triggered by workflow_dispatch - running 'deploy-main'"
26+
elif [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.merged }}" == "true" ]]; then
27+
echo "deploy=true" >> $GITHUB_OUTPUT
28+
echo "Job triggered by Merged PR - running 'deploy-main'"
29+
else
30+
echo "deploy=false" >> $GITHUB_OUTPUT
31+
echo "Job not triggered by workflow_dispatch or Merged PR - Skipping 'deploy-main'"
32+
fi
33+
34+
deploy-main:
35+
needs: check-merge-or-workflow-dispatch
36+
name: Deploy changes to main in dev AWS account
37+
if: needs.check-merge-or-workflow-dispatch.outputs.deploy == 'true'
38+
39+
permissions:
40+
id-token: write
41+
contents: read
42+
43+
strategy:
44+
max-parallel: 1
45+
matrix:
46+
component: [api]
47+
48+
uses: ./.github/workflows/reusable_internal_repo_build.yaml
49+
secrets: inherit
50+
with:
51+
releaseVersion: main
52+
targetWorkflow: "dispatch-deploy-static-notify-supplier-api-env.yaml"
53+
targetEnvironment: "main"
54+
targetAccountGroup: "nhs-notify-supplier-api-dev"
55+
targetComponent: ${{ matrix.component }}
56+
terraformAction: "apply"

‎.github/workflows/pr_create_dynamic_env.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: PR Create Environment
2+
3+
on:
4+
pull_request:
5+
types: [labeled, opened, synchronize, reopened, unlabeled, edited]
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref }}
9+
cancel-in-progress: false
10+
11+
jobs:
12+
create-dynamic-environment:
13+
name: Create Dynamic Environment
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Trigger nhs-notify-internal dynamic environment workflow
18+
shell: bash
19+
run: |
20+
set -x
21+
this_repo_name=$(echo ${{ github.repository }} | cut -d'/' -f2)
22+
23+
DISPATCH_EVENT=$(jq -ncM \
24+
--arg infraRepoName "${this_repo_name}" \
25+
--arg releaseVersion "${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" \
26+
--arg targetProject "nhs" \
27+
--arg targetEnvironment "pr${{ github.event.number }}" \
28+
--arg targetAccountGroup "nhs-notify-supplier-api-dev" \
29+
--arg targetComponent "api" \
30+
--arg terraformAction "apply" \
31+
--arg overrides "branch_name=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" \
32+
'{ "ref": "main",
33+
"inputs": {
34+
"infraRepoName": $infraRepoName,
35+
"releaseVersion", $releaseVersion,
36+
"targetProject", $targetProject,
37+
"targetEnvironment", $targetEnvironment,
38+
"targetAccountGroup", $targetAccountGroup,
39+
"targetComponent", $targetComponent,
40+
"terraformAction", $terraformAction,
41+
"overrides", $overrides,
42+
}
43+
}')
44+
45+
curl --fail -L \
46+
-X POST \
47+
-H "Accept: application/vnd.github+json" \
48+
-H "Authorization: Bearer ${{ secrets.PR_TRIGGER_PAT }}" \
49+
-H "X-GitHub-Api-Version: 2022-11-28" \
50+
https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/workflows/dispatch-deploy-dynamic-env.yaml/dispatches \
51+
-d "${DISPATCH_EVENT}"

‎.github/workflows/pr_destroy_dynamic_env.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: PR Destroy Environment
2+
3+
on:
4+
pull_request:
5+
types: [closed]
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref }}
9+
cancel-in-progress: false
10+
11+
jobs:
12+
create-dynamic-environment:
13+
name: Destroy Dynamic Environment
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Trigger nhs-notify-internal dynamic environment destruction
18+
shell: bash
19+
run: |
20+
set -x
21+
this_repo_name=$(echo ${{ github.repository }} | cut -d'/' -f2)
22+
23+
DISPATCH_EVENT=$(jq -ncM \
24+
--arg infraRepoName "${this_repo_name}" \
25+
--arg releaseVersion "main" \
26+
--arg targetProject "nhs" \
27+
--arg targetEnvironment "pr${{ github.event.number }}" \
28+
--arg targetAccountGroup "nhs-notify-supplier-api-dev" \
29+
--arg targetComponent "api" \
30+
--arg terraformAction "destroy" \
31+
'{ "ref": "main",
32+
"inputs": {
33+
"infraRepoName": $infraRepoName,
34+
"releaseVersion", $releaseVersion,
35+
"targetProject", $targetProject,
36+
"targetEnvironment", $targetEnvironment,
37+
"targetAccountGroup", $targetAccountGroup,
38+
"targetComponent", $targetComponent,
39+
"terraformAction", $terraformAction,
40+
}
41+
}')
42+
43+
curl --fail -L \
44+
-X POST \
45+
-H "Accept: application/vnd.github+json" \
46+
-H "Authorization: Bearer ${{ secrets.PR_TRIGGER_PAT }}" \
47+
-H "X-GitHub-Api-Version: 2022-11-28" \
48+
https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/workflows/dispatch-deploy-dynamic-env.yaml/dispatches \
49+
-d "${DISPATCH_EVENT}"

‎.github/workflows/release_created.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Github Release Created
2+
3+
on:
4+
release:
5+
types: ["published"] # Inherits all input defaults
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref }}
9+
cancel-in-progress: false
10+
11+
jobs:
12+
deploy-main:
13+
name: Deploy changes to main in nonprod AWS Account
14+
15+
permissions:
16+
id-token: write
17+
contents: read
18+
19+
strategy:
20+
max-parallel: 1
21+
matrix:
22+
component: [api]
23+
24+
uses: ./.github/workflows/reusable_internal_repo_build.yaml
25+
secrets: inherit
26+
with:
27+
releaseVersion: ${{ github.event.release.tag_name }}
28+
targetWorkflow: "dispatch-deploy-static-notify-supliers-api-env.yaml"
29+
targetEnvironment: "main"
30+
targetAccountGroup: "nhs-notify-supliers-api-nonprod"
31+
targetComponent: ${{ matrix.component }}
32+
terraformAction: "apply"

‎.github/workflows/reusable_internal_repo_build.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
name: Call Notify Internal Infrastructure Deployment
2+
## Sub workflow which plans and deploys Notify components as part of the workflow.
3+
## Review Gates may be required to proceed on triggered builds.
4+
5+
on:
6+
workflow_call:
7+
inputs:
8+
releaseVersion:
9+
type: string
10+
description: The Github release version, commit, or tag.
11+
default: main
12+
targetWorkflow:
13+
type: string
14+
description: The name of the github workflow to call.
15+
default: main
16+
targetEnvironment:
17+
type: string
18+
description: The Terraform environment to deploy
19+
default: main
20+
targetComponent:
21+
type: string
22+
description: The Terraform component to deploy
23+
required: true
24+
targetAccountGroup:
25+
type: string
26+
description: The Terraform group to deploy
27+
required: true
28+
terraformAction:
29+
type: string
30+
description: The Terraform component to deploy
31+
default: plan
32+
33+
concurrency:
34+
group: ${{ inputs.targetEnvironment }}-${{ inputs.targetAccountGroup }}-${{ inputs.targetComponent }}-${{ inputs.terraformAction }}
35+
36+
jobs:
37+
trigger:
38+
runs-on: ubuntu-latest
39+
40+
permissions:
41+
id-token: write
42+
contents: read
43+
44+
steps:
45+
- uses: actions/checkout@v4
46+
47+
- name: Trigger nhs-notify-internal static environment workflow deployment
48+
shell: bash
49+
run: |
50+
set -x
51+
52+
DISPATCH_EVENT=$(jq -ncM \
53+
--arg releaseVersion ${{ inputs.releaseVersion }} \
54+
--arg targetEnvironment ${{ inputs.targetEnvironment }} \
55+
--arg targetAccountGroup ${{ inputs.targetAccountGroup }} \
56+
--arg targetComponent ${{ inputs.targetComponent }} \
57+
--arg terraformAction ${{ inputs.terraformAction }} \
58+
'{ "ref": "main",
59+
"inputs": {
60+
"releaseVersion", $releaseVersion,
61+
"targetEnvironment", $targetEnvironment,
62+
"targetAccountGroup", $targetAccountGroup,
63+
"targetComponent", $targetComponent,
64+
"terraformAction", $terraformAction
65+
}
66+
}')
67+
68+
# Trigger The workflow
69+
curl -L \
70+
--fail \
71+
--silent \
72+
-X POST \
73+
-H "Accept: application/vnd.github+json" \
74+
-H "Authorization: Bearer ${{ secrets.PR_TRIGGER_PAT }}" \
75+
-H "X-GitHub-Api-Version: 2022-11-28" \
76+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/workflows/${{ inputs.targetWorkflow }}/dispatches" \
77+
-d "${DISPATCH_EVENT}"
78+
79+
echo "Workflow triggered successfully. HTTP response. Waiting for the workflow to complete.."
80+
81+
# Poll GitHub API to check the workflow status
82+
run_id=""
83+
for i in {1..12}; do
84+
in_progress=$(curl -s \
85+
-H "Accept: application/vnd.github+json" \
86+
-H "Authorization: Bearer ${{ secrets.PR_TRIGGER_PAT }}" \
87+
-H "X-GitHub-Api-Version: 2022-11-28" \
88+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/runs?event=workflow_dispatch&status=in_progress")
89+
90+
run_id=$(echo "$in_progress" | jq -r \
91+
--arg env "${{ inputs.targetEnvironment }}" \
92+
--arg component "${{ inputs.targetComponent }}" \
93+
--arg group "${{ inputs.targetAccountGroup }}" \
94+
--arg releaseVersion "${{ inputs.releaseVersion }}" \
95+
'.workflow_runs[]
96+
| select(.name | contains($env) and contains($component) and contains($group) and contains($releaseVersion))
97+
| .id' | head -n 1)
98+
99+
if [[ -n "$run_id" && "$run_id" != null ]]; then
100+
echo "Found workflow run with ID: $run_id"
101+
break
102+
fi
103+
104+
echo "Waiting for workflow to start..."
105+
sleep 10
106+
done
107+
108+
if [[ -z "$run_id" || "$run_id" == null ]]; then
109+
echo "Failed to get the workflow run ID. Exiting."
110+
exit 1
111+
fi
112+
113+
# Wait for workflow completion
114+
while true; do
115+
sleep 10
116+
status=$(curl -s \
117+
-H "Accept: application/vnd.github+json" \
118+
-H "Authorization: Bearer ${{ secrets.PR_TRIGGER_PAT }}" \
119+
-H "X-GitHub-Api-Version: 2022-11-28" \
120+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/runs/$run_id" \
121+
| jq -r '.status')
122+
123+
conclusion=$(curl -s \
124+
-H "Accept: application/vnd.github+json" \
125+
-H "Authorization: Bearer ${{ secrets.PR_TRIGGER_PAT }}" \
126+
-H "X-GitHub-Api-Version: 2022-11-28" \
127+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/runs/$run_id" \
128+
| jq -r '.conclusion')
129+
130+
if [ "$status" == "completed" ]; then
131+
if [ "$conclusion" == "success" ]; then
132+
echo "Workflow completed successfully."
133+
exit 0
134+
else
135+
echo "Workflow failed with conclusion: $conclusion"
136+
exit 1
137+
fi
138+
fi
139+
140+
echo "Workflow still running..."
141+
sleep 20
142+
done

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,6 @@ jobs:
6868
# Upload the results to GitHub's code scanning dashboard (optional).
6969
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
71+
uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2
7272
with:
7373
sarif_file: results.sarif

‎.tool-versions‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
11
act 0.2.64
2-
editorconfig-checker 3.3.0
32
gitleaks 8.24.0
43
jq 1.6
5-
markdownlint-cli2 0.18.1
64
nodejs 22.11.0
7-
pnpm 10.4.1
85
pre-commit 3.6.0
96
python 3.13.2
107
terraform 1.9.2

‎infrastructure/terraform/bin/terraform.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -403,7 +403,7 @@ readonly component_name=$(basename ${component_path});
403403
# verify terraform version matches .tool-versions
404404
echo ${PWD}
405405
tool_version=$(grep "terraform " .tool-versions | cut -d ' ' -f 2)
406-
asdf plugin-add terraform && asdf install terraform "${tool_version}"
406+
asdf plugin add terraform && asdf install terraform "${tool_version}"
407407
current_version=$(terraform --version | head -n 1 | cut -d 'v' -f 2)
408408

409409
if [ -z "${current_version}" ] || [ "${current_version}" != "${tool_version}" ]; then

infrastructure/terraform/components/examplecomponent/.tool-versions renamed to infrastructure/terraform/components/api/.tool-versions

File renamed without changes.

infrastructure/terraform/components/examplecomponent/README.md renamed to infrastructure/terraform/components/api/README.md

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,20 +10,29 @@ No requirements.
1010
| Name | Description | Type | Default | Required |
1111
|------|-------------|------|---------|:--------:|
1212
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
13-
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"examplecomponent"` | no |
13+
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"supapi"` | no |
1414
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1515
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
1616
| <a name="input_force_lambda_code_deploy"></a> [force\_lambda\_code\_deploy](#input\_force\_lambda\_code\_deploy) | If the lambda package in s3 has the same commit id tag as the terraform build branch, the lambda will not update automatically. Set to True if making changes to Lambda code from on the same commit for example during development | `bool` | `false` | no |
1717
| <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonmous with account short-name) | `string` | n/a | yes |
18+
| <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
19+
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | The log level to be used in lambda functions within the component. Any log with a lower severity than the configured value will not be logged: https://docs.python.org/3/library/logging.html#levels | `string` | `"INFO"` | no |
1820
| <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
21+
| <a name="input_parent_acct_environment"></a> [parent\_acct\_environment](#input\_parent\_acct\_environment) | Name of the environment responsible for the acct resources used, affects things like DNS zone. Useful for named dev environments | `string` | `"main"` | no |
1922
| <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
2023
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
2124
## Modules
2225

23-
No modules.
26+
| Name | Source | Version |
27+
|------|--------|---------|
28+
| <a name="module_authorizer_lambda"></a> [authorizer\_lambda](#module\_authorizer\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
29+
| <a name="module_hello_world"></a> [hello\_world](#module\_hello\_world) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.10 |
30+
| <a name="module_kms"></a> [kms](#module\_kms) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v2.0.10 |
2431
## Outputs
2532

26-
No outputs.
33+
| Name | Description |
34+
|------|-------------|
35+
| <a name="output_api_urll"></a> [api\_urll](#output\_api\_urll) | n/a |
2736
<!-- vale on -->
2837
<!-- markdownlint-enable -->
2938
<!-- END_TF_DOCS -->

0 commit comments

Comments
 (0)