Skip to content

Commit 2855e68

Browse files
francisco-videira-nhsfrancisco-videira-nhs
committed
Merge remote-tracking branch 'origin/main' into feature/CCM-11188 
2 parents 3a0c8b5 + 3b7b924 commit 2855e68

File tree

110 files changed

+1273
-1401
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

110 files changed

+1273
-1401
lines changed

‎.github/CODEOWNERS‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,19 @@
11
# NHS Notify Code Owners
22

3-
* @NHSDigital/nhs-notify-supplier-api
4-
/.github/ @NHSDigital/nhs-notify-admins
5-
*.code-workspace @NHSDigital/nhs-notify-admins
3+
* @NHSDigital/nhs-notify-supplier-api
4+
5+
/.github/ @NHSDigital/nhs-notify-supplier-api-admins
6+
*.code-workspace @NHSDigital/nhs-notify-supplier-api-admins
7+
/docs/ @NHSDigital/nhs-notify-supplier-api
8+
/infrastructure/terraform/ @NHSDigital/nhs-notify-platform
69

710
# Codeowners must be final check
8-
/.github/CODEOWNERS @NHSDigital/nhs-notify-code-owners
9-
/CODEOWNERS @NHSDigital/nhs-notify-code-owners
11+
/.github/CODEOWNERS @NHSDigital/nhs-notify-code-owners
12+
/CODEOWNERS @NHSDigital/nhs-notify-code-owners
13+
14+
# Each NHS Notify repository should have clear code owners set.
15+
# Do not use GitHub team names, instead use the GitHub usernames
16+
# of the people who are responsible for the code maintenance.
1017

1118
# This is a comment.
1219
# Each line is a file pattern followed by one or more owners.

‎.github/actions/build-proxies/action.yml‎

Lines changed: 5 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
name: "Build Proxies"
22
description: "Build Proxies"
3+
34
inputs:
45
version:
56
description: "Version number"
67
required: true
8+
79
runs:
810
using: composite
911

@@ -26,15 +28,16 @@ runs:
2628
if [ -z $PR_NUMBER ]
2729
then
2830
echo "INSTANCE=$PROXYGEN_API_NAME" >> $GITHUB_ENV
29-
echo "TARGET=https://suppliers.dev.nhsnotify.national.nhs.uk" >> $GITHUB_ENV
31+
echo "TARGET=https://main.suppliers.dev.nhsnotify.national.nhs.uk" >> $GITHUB_ENV
3032
echo "SANDBOX_TAG=latest" >> $GITHUB_ENV
33+
echo "MTLS_NAME=notify-supplier-mtls" >> $GITHUB_ENV
3134
else
3235
echo "TARGET=https://pr$PR_NUMBER.suppliers.dev.nhsnotify.national.nhs.uk" >> $GITHUB_ENV
3336
echo "INSTANCE=$PROXYGEN_API_NAME-PR-$PR_NUMBER" >> $GITHUB_ENV
3437
echo "SANDBOX_TAG=pr$PR_NUMBER" >> $GITHUB_ENV
38+
echo "MTLS_NAME=notify-supplier-mtls-pr$PR_NUMBER" >> $GITHUB_ENV
3539
fi
3640
37-
3841
- name: Install Proxygen client
3942
shell: bash
4043
run: |
@@ -50,28 +53,6 @@ runs:
5053
envsubst < ./.github/proxygen-settings.yaml > ${HOME}/.proxygen/settings.yaml
5154
envsubst < ./.github/proxygen-settings.yaml | cat
5255
53-
- name: Build internal dev oas
54-
working-directory: .
55-
shell: bash
56-
run: |
57-
if [ -z $PR_NUMBER ]
58-
then
59-
make build-json-oas-spec APIM_ENV=dev
60-
else
61-
make build-json-oas-spec APIM_ENV=dev-pr
62-
fi
63-
64-
- name: Set target
65-
shell: bash
66-
run: |
67-
jq --arg newurl "$TARGET" '.["x-nhsd-apim"].target.url = $newurl' build/notify-supplier.json > build/notify-supplier_target.json && mv build/notify-supplier_target.json build/notify-supplier.json
68-
69-
70-
- name: Deploy to Internal Dev
71-
shell: bash
72-
run: |
73-
proxygen instance deploy internal-dev $INSTANCE build/notify-supplier.json --no-confirm
74-
7556
- name: Build sandbox oas
7657
working-directory: .
7758
shell: bash

‎.github/scripts/dispatch_internal_repo_workflow.sh‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
#!/bin/bash
2+
3+
# Triggers a remote GitHub workflow in nhs-notify-internal and waits for completion.
4+
5+
# Usage:
6+
# ./dispatch_internal_repo_workflow.sh \
7+
# --infraRepoName <repo> \
8+
# --releaseVersion <version> \
9+
# --targetWorkflow <workflow.yaml> \
10+
# --targetEnvironment <env> \
11+
# --targetComponent <component> \
12+
# --targetAccountGroup <group> \
13+
# --terraformAction <action> \
14+
# --internalRef <ref> \
15+
# --overrides <overrides> \
16+
# --overrideProjectName <name> \
17+
# --overrideRoleName <name>
18+
19+
#
20+
# All arguments are required except terraformAction, and internalRef.
21+
# Example:
22+
# ./dispatch_internal_repo_workflow.sh \
23+
# --infraRepoName "nhs-notify-web-template-management" \
24+
# --releaseVersion "v1.2.3" \
25+
# --targetWorkflow "deploy.yaml" \
26+
# --targetEnvironment "prod" \
27+
# --targetComponent "web" \
28+
# --targetAccountGroup "core" \
29+
# --terraformAction "apply" \
30+
# --internalRef "main" \
31+
# --overrides "tf_var=someString" \
32+
# --overrideProjectName nhs \
33+
# --overrideRoleName nhs-service-iam-role
34+
35+
set -e
36+
37+
while [[ $# -gt 0 ]]; do
38+
case $1 in
39+
--infraRepoName) # Name of the infrastructure repo in NHSDigital org (required)
40+
infraRepoName="$2"
41+
shift 2
42+
;;
43+
--releaseVersion) # Release version, commit, or tag to deploy (required)
44+
releaseVersion="$2"
45+
shift 2
46+
;;
47+
--targetWorkflow) # Name of the workflow file to call in nhs-notify-internal (required)
48+
targetWorkflow="$2"
49+
shift 2
50+
;;
51+
--targetEnvironment) # Terraform environment to deploy (required)
52+
targetEnvironment="$2"
53+
shift 2
54+
;;
55+
--targetComponent) # Terraform component to deploy (required)
56+
targetComponent="$2"
57+
shift 2
58+
;;
59+
--targetAccountGroup) # Terraform account group to deploy (required)
60+
targetAccountGroup="$2"
61+
shift 2
62+
;;
63+
--terraformAction) # Terraform action to run (optional)
64+
terraformAction="$2"
65+
shift 2
66+
;;
67+
--internalRef) # Internal repo reference branch or tag (optional, default: "main")
68+
internalRef="$2"
69+
shift 2
70+
;;
71+
--overrides) # Terraform overrides for passing in extra variables (optional)
72+
overrides="$2"
73+
shift 2
74+
;;
75+
--overrideProjectName) # Override the project name (optional)
76+
overrideProjectName="$2"
77+
shift 2
78+
;;
79+
--overrideRoleName) # Override the role name (optional)
80+
overrideRoleName="$2"
81+
shift 2
82+
;;
83+
*)
84+
echo "[ERROR] Unknown argument: $1"
85+
exit 1
86+
;;
87+
esac
88+
done
89+
90+
# Set default values if not provided
91+
if [[ -z "$PR_TRIGGER_PAT" ]]; then
92+
echo "[ERROR] PR_TRIGGER_PAT environment variable is not set or is empty."
93+
exit 1
94+
fi
95+
96+
if [[ -z "$overrides" ]]; then
97+
overrides=""
98+
fi
99+
100+
if [[ -z "$internalRef" ]]; then
101+
internalRef="main"
102+
fi
103+
104+
echo "==================== Workflow Dispatch Parameters ===================="
105+
echo " infraRepoName: $infraRepoName"
106+
echo " releaseVersion: $releaseVersion"
107+
echo " targetWorkflow: $targetWorkflow"
108+
echo " targetEnvironment: $targetEnvironment"
109+
echo " targetComponent: $targetComponent"
110+
echo " targetAccountGroup: $targetAccountGroup"
111+
echo " terraformAction: $terraformAction"
112+
echo " internalRef: $internalRef"
113+
echo " overrides: $overrides"
114+
echo " overrideProjectName: $overrideProjectName"
115+
echo " overrideRoleName: $overrideRoleName"
116+
echo " targetProject: $targetProject"
117+
118+
DISPATCH_EVENT=$(jq -ncM \
119+
--arg infraRepoName "$infraRepoName" \
120+
--arg releaseVersion "$releaseVersion" \
121+
--arg targetEnvironment "$targetEnvironment" \
122+
--arg targetAccountGroup "$targetAccountGroup" \
123+
--arg targetComponent "$targetComponent" \
124+
--arg terraformAction "$terraformAction" \
125+
--arg targetWorkflow "$targetWorkflow" \
126+
--arg overrides "$overrides" \
127+
--arg overrideProjectName "$overrideProjectName" \
128+
--arg overrideRoleName "$overrideRoleName" \
129+
--arg targetProject "$targetProject" \
130+
'{
131+
"ref": "'"$internalRef"'",
132+
"inputs": (
133+
(if $infraRepoName != "" then { "infraRepoName": $infraRepoName } else {} end) +
134+
(if $terraformAction != "" then { "terraformAction": $terraformAction } else {} end) +
135+
(if $overrideProjectName != "" then { "overrideProjectName": $overrideProjectName } else {} end) +
136+
(if $overrideRoleName != "" then { "overrideRoleName": $overrideRoleName } else {} end) +
137+
(if $targetProject != "" then { "targetProject": $targetProject } else {} end) +
138+
{
139+
"releaseVersion": $releaseVersion,
140+
"targetEnvironment": $targetEnvironment,
141+
"targetAccountGroup": $targetAccountGroup,
142+
"targetComponent": $targetComponent,
143+
"overrides": $overrides,
144+
}
145+
)
146+
}')
147+
148+
echo "[INFO] Triggering workflow '$targetWorkflow' in nhs-notify-internal..."
149+
150+
trigger_response=$(curl -s -L \
151+
--fail \
152+
-X POST \
153+
-H "Accept: application/vnd.github+json" \
154+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
155+
-H "X-GitHub-Api-Version: 2022-11-28" \
156+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/workflows/$targetWorkflow/dispatches" \
157+
-d "$DISPATCH_EVENT" 2>&1)
158+
159+
if [[ $? -ne 0 ]]; then
160+
echo "[ERROR] Failed to trigger workflow. Response: $trigger_response"
161+
exit 1
162+
fi
163+
164+
echo "[INFO] Workflow trigger request sent successfully, waiting for completion..."
165+
166+
sleep 10 # Wait a few seconds before checking for the presence of the api to account for GitHub updating
167+
168+
# Poll GitHub API to check the workflow status
169+
workflow_run_url=""
170+
171+
for _ in {1..18}; do
172+
173+
response=$(curl -s -L \
174+
-H "Accept: application/vnd.github+json" \
175+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
176+
-H "X-GitHub-Api-Version: 2022-11-28" \
177+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/runs?event=workflow_dispatch")
178+
179+
if ! echo "$response" | jq empty 2>/dev/null; then
180+
echo "[ERROR] Invalid JSON response from GitHub API during workflow polling:"
181+
echo "$response"
182+
exit 1
183+
fi
184+
185+
workflow_run_url=$(echo "$response" | jq -r \
186+
--arg targetWorkflow "$targetWorkflow" \
187+
--arg targetEnvironment "$targetEnvironment" \
188+
--arg targetAccountGroup "$targetAccountGroup" \
189+
--arg targetComponent "$targetComponent" \
190+
--arg terraformAction "$terraformAction" \
191+
'.workflow_runs[]
192+
| select(.path == ".github/workflows/" + $targetWorkflow)
193+
| select(.name
194+
| contains($targetEnvironment)
195+
and contains($targetAccountGroup)
196+
and contains($targetComponent)
197+
and contains($terraformAction)
198+
)
199+
| .url')
200+
201+
if [[ -n "$workflow_run_url" && "$workflow_run_url" != null ]]; then
202+
# Workflow_run_url is a list of all workflows which were run for this combination of inputs, but are the API uri
203+
workflow_run_url=$(echo "$workflow_run_url" | head -n 1)
204+
205+
# Take the first and strip it back to being an accessible url
206+
# Example https://api.github.com/repos/MyOrg/my-repo/actions/runs/12346789 becomes
207+
# becomes https://github.com/MyOrg/my-repo/actions/runs/12346789
208+
workflow_run_ui_url=${workflow_run_url/api./} # Strips the api. prefix
209+
workflow_run_ui_url=${workflow_run_ui_url/\/repos/} # Strips the repos/ uri
210+
echo "[INFO] Found workflow run url: $workflow_run_ui_url"
211+
break
212+
fi
213+
214+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Waiting for workflow to start..."
215+
sleep 10
216+
done
217+
218+
if [[ -z "$workflow_run_url" || "$workflow_run_url" == null ]]; then
219+
echo "[ERROR] Failed to get the workflow run url. Exiting."
220+
exit 1
221+
fi
222+
223+
# Wait for workflow completion
224+
while true; do
225+
sleep 10
226+
response=$(curl -s -L \
227+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
228+
-H "Accept: application/vnd.github+json" \
229+
"$workflow_run_url")
230+
231+
status=$(echo "$response" | jq -r '.status')
232+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Workflow status: $status"
233+
234+
if [ "$status" == "completed" ]; then
235+
conclusion=$(echo "$response" | jq -r '.conclusion')
236+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Workflow conclusion: $conclusion"
237+
238+
if [ -z "$conclusion" ] || [ "$conclusion" == "null" ]; then
239+
echo "[WARN] Workflow marked completed but conclusion not yet available, retrying..."
240+
sleep 5
241+
continue
242+
fi
243+
244+
if [ "$conclusion" == "success" ]; then
245+
echo "[SUCCESS] Workflow completed successfully!"
246+
exit 0
247+
else
248+
echo "[FAIL] Workflow failed with conclusion: $conclusion"
249+
exit 1
250+
fi
251+
fi
252+
done

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,22 +46,25 @@ jobs:
4646
echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
4747
echo "version=$(echo $version)" >> $GITHUB_OUTPUT
4848
echo "is_version_prerelease=$(if [[ $version == *-* ]]; then echo "true"; else echo "false"; fi)" >> $GITHUB_OUTPUT
49-
5049
- name: "Check if pull request exists for this branch"
5150
id: pr_exists
5251
env:
5352
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5453
run: |
5554
branch_name=${GITHUB_HEAD_REF:-$(echo $GITHUB_REF | sed 's#refs/heads/##')}
5655
echo "Current branch is '$branch_name'"
57-
if gh pr list --head $branch_name | grep -q .; then
58-
echo "Pull request exists"
56+
57+
pr_json=$(gh pr list --head "$branch_name" --state open --json number --limit 1)
58+
pr_number=$(echo "$pr_json" | jq -r '.[0].number // empty')
59+
60+
if [[ -n "$pr_number" ]]; then
61+
echo "Pull request exists: #$pr_number"
5962
echo "does_pull_request_exist=true" >> $GITHUB_OUTPUT
60-
PR_NUMBER=$(gh pr list --head "$branch_name" --state open --json number -q '.[0].number')
61-
echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
63+
echo "pr_number=$pr_number" >> $GITHUB_OUTPUT
6264
else
6365
echo "Pull request doesn't exist"
6466
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
67+
echo "pr_number=" >> $GITHUB_OUTPUT
6568
fi
6669
- name: "List variables"
6770
run: |
@@ -75,7 +78,6 @@ jobs:
7578
export VERSION="${{ steps.variables.outputs.version }}"
7679
export DOES_PULL_REQUEST_EXIST="${{ steps.pr_exists.outputs.does_pull_request_exist }}"
7780
export IS_VERSION_PRERELEASE="${{ steps.variables.outputs.is_version_prerelease }}"
78-
export PR_NUMBER="${{ steps.pr_exists.outputs.pr_number }}"
7981
make list-variables
8082
commit-stage: # Recommended maximum execution time is 2 minutes
8183
name: "Commit stage"
@@ -131,6 +133,7 @@ jobs:
131133
python_version: "${{ needs.metadata.outputs.python_version }}"
132134
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
133135
version: "${{ needs.metadata.outputs.version }}"
136+
pr_number: ${{ needs.metadata.outputs.pr_number }}
134137
secrets: inherit
135138
publish-stage: # Recommended maximum execution time is 10 minutes
136139
name: "Publish stage"

0 commit comments

Comments
 (0)