stage-4-acceptance.yaml

name: "Acceptance stage"

on:
  workflow_call:
    inputs:
      build_datetime:
        description: "Build datetime, set by the CI/CD pipeline workflow"
        required: true
        type: string
      build_timestamp:
        description: "Build timestamp, set by the CI/CD pipeline workflow"
        required: true
        type: string
      build_epoch:
        description: "Build epoch, set by the CI/CD pipeline workflow"
        required: true
        type: string
      nodejs_version:
        description: "Node.js version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      python_version:
        description: "Python version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      terraform_version:
        description: "Terraform version, set by the CI/CD pipeline workflow"
        required: true
        type: string
      version:
        description: "Version of the software, set by the CI/CD pipeline workflow"
        required: true
        type: string

env:
  AWS_REGION: eu-west-2

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read  # This is required for actions/checkout

jobs:
  sandbox-set-up:
    name: "Sandbox set up"
    runs-on: ubuntu-latest
    environment: dev
    timeout-minutes: 15
    steps:
      - uses: hashicorp/setup-terraform@v3
      - uses: asdf-vm/actions/setup@v3
      - name: "Checkout code"
        uses: actions/checkout@v4
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ASSUME_ROLE_NAME }}
          role-session-name: deployInfra
          aws-region: ${{ env.AWS_REGION }}
      - name: "Get normalized branch name"
        id: normalize_branch_name
        uses: ./.github/actions/normalize-branch-name
      - name: "Create Backend sandbox"
        run: |
          npm run create-backend-sandbox ${{ steps.normalize_branch_name.outputs.normalized_branch_name }}
      - uses: actions/upload-artifact@v4
        with:
          name: sandbox_tf_outputs.json
          path: sandbox_tf_outputs.json
  test-security:
    name: "Security test"
    runs-on: ubuntu-latest
    needs: [sandbox-set-up]
    timeout-minutes: 10
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
      - name: "Run security test"
        run: |
          make test-security
      - name: "Save result"
        run: |
          echo "Nothing to save"
  test-accessibility:
    name: "Accessibility test"
    runs-on: ubuntu-latest
    needs: [sandbox-set-up]
    environment: dev
    env:
      INCLUDE_AUTH_PAGES: 'true'
    timeout-minutes: 10
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: sandbox_tf_outputs.json
          path: ./
      - name: "Repo setup"
        run: |
          npm ci
      - name: "Generate dependencies"
        run: |
          npm run generate-dependencies --workspaces --if-present
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ASSUME_ROLE_NAME }}
          role-session-name: deployInfra
          aws-region: eu-west-2
      - name: "Run accessibility test"
        run: |
          npm run create-amplify-outputs file
          make test-accessibility
      - name: Archive accessibility results
        uses: actions/upload-artifact@v4
        with:
          name: accessibility
          path: ".reports/accessibility"
  test-ui-component:
    name: "UI Component test"
    runs-on: ubuntu-latest
    needs: [sandbox-set-up]
    environment: dev
    env:
      INCLUDE_AUTH_PAGES: 'true'
    timeout-minutes: 10
    steps:
      - name: "Checkout code"
        uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: sandbox_tf_outputs.json
          path: ./
      - name: "Repo setup"
        run: |
          npm ci
      - name: "Generate dependencies"
        run: |
          npm run generate-dependencies --workspaces --if-present
      - name: Install Playwright Browsers
        run: npx playwright install --with-deps
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ASSUME_ROLE_NAME }}
          role-session-name: deployInfra
          aws-region: eu-west-2
      - name: "Run ui component test"
        run: |
          npm run create-amplify-outputs file
          cd tests/test-team
          npm run test:local-ui
      - name: Archive component test results
        if: success() || failure()
        uses: actions/upload-artifact@v4
        with:
          name: component test report
          path: "tests/test-team/playwright-report"
  sandbox-tear-down:
    name: "Sandbox tear down"
    if: success() || failure()
    runs-on: ubuntu-latest
    needs: [test-accessibility, test-ui-component]
    environment: dev
    steps:
      - uses: hashicorp/setup-terraform@v3
      - uses: asdf-vm/actions/setup@v3
      - name: "Checkout code"
        uses: actions/checkout@v4
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ASSUME_ROLE_NAME }}
          role-session-name: deployInfra
          aws-region: eu-west-2
      - name: "Get normalized branch name"
        id: normalize_branch_name
        uses: ./.github/actions/normalize-branch-name
      - name: "Destroy Backend sandbox"
        run: |
          npm run destroy-backend-sandbox ${{ steps.normalize_branch_name.outputs.normalized_branch_name }}