Skip to content

Commit 859ed04

Browse files
harrim91harrim91
committed
Merge branch 'main' into feature/CCM-11870-middleware-checks-client-id
2 parents 7dc217c + b0e3162 commit 859ed04

15 files changed

+418
-602
lines changed

‎.github/scripts/dispatch_internal_repo_workflow.sh‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
#!/bin/bash
2+
3+
# Triggers a remote GitHub workflow in nhs-notify-internal and waits for completion.
4+
5+
# Usage:
6+
# ./dispatch_internal_repo_workflow.sh \
7+
# --infraRepoName <repo> \
8+
# --releaseVersion <version> \
9+
# --targetWorkflow <workflow.yaml> \
10+
# --targetEnvironment <env> \
11+
# --targetComponent <component> \
12+
# --targetAccountGroup <group> \
13+
# --terraformAction <action> \
14+
# --internalRef <ref> \
15+
# --overrides <overrides> \
16+
# --overrideProjectName <name> \
17+
# --overrideRoleName <name>
18+
19+
#
20+
# All arguments are required except terraformAction, and internalRef.
21+
# Example:
22+
# ./dispatch_internal_repo_workflow.sh \
23+
# --infraRepoName "nhs-notify-web-template-management" \
24+
# --releaseVersion "v1.2.3" \
25+
# --targetWorkflow "deploy.yaml" \
26+
# --targetEnvironment "prod" \
27+
# --targetComponent "web" \
28+
# --targetAccountGroup "core" \
29+
# --terraformAction "apply" \
30+
# --internalRef "main" \
31+
# --overrides "tf_var=someString" \
32+
# --overrideProjectName nhs \
33+
# --overrideRoleName nhs-service-iam-role
34+
35+
set -e
36+
37+
while [[ $# -gt 0 ]]; do
38+
case $1 in
39+
--infraRepoName) # Name of the infrastructure repo in NHSDigital org (required)
40+
infraRepoName="$2"
41+
shift 2
42+
;;
43+
--releaseVersion) # Release version, commit, or tag to deploy (required)
44+
releaseVersion="$2"
45+
shift 2
46+
;;
47+
--targetWorkflow) # Name of the workflow file to call in nhs-notify-internal (required)
48+
targetWorkflow="$2"
49+
shift 2
50+
;;
51+
--targetEnvironment) # Terraform environment to deploy (required)
52+
targetEnvironment="$2"
53+
shift 2
54+
;;
55+
--targetComponent) # Terraform component to deploy (required)
56+
targetComponent="$2"
57+
shift 2
58+
;;
59+
--targetAccountGroup) # Terraform account group to deploy (required)
60+
targetAccountGroup="$2"
61+
shift 2
62+
;;
63+
--terraformAction) # Terraform action to run (optional)
64+
terraformAction="$2"
65+
shift 2
66+
;;
67+
--internalRef) # Internal repo reference branch or tag (optional, default: "main")
68+
internalRef="$2"
69+
shift 2
70+
;;
71+
--overrides) # Terraform overrides for passing in extra variables (optional)
72+
overrides="$2"
73+
shift 2
74+
;;
75+
--overrideProjectName) # Override the project name (optional)
76+
overrideProjectName="$2"
77+
shift 2
78+
;;
79+
--overrideRoleName) # Override the role name (optional)
80+
overrideRoleName="$2"
81+
shift 2
82+
;;
83+
*)
84+
echo "[ERROR] Unknown argument: $1"
85+
exit 1
86+
;;
87+
esac
88+
done
89+
90+
# Set default values if not provided
91+
if [[ -z "$PR_TRIGGER_PAT" ]]; then
92+
echo "[ERROR] PR_TRIGGER_PAT environment variable is not set or is empty."
93+
exit 1
94+
fi
95+
96+
if [[ -z "$overrides" ]]; then
97+
overrides=""
98+
fi
99+
100+
if [[ -z "$internalRef" ]]; then
101+
internalRef="main"
102+
fi
103+
104+
echo "==================== Workflow Dispatch Parameters ===================="
105+
echo " infraRepoName: $infraRepoName"
106+
echo " releaseVersion: $releaseVersion"
107+
echo " targetWorkflow: $targetWorkflow"
108+
echo " targetEnvironment: $targetEnvironment"
109+
echo " targetComponent: $targetComponent"
110+
echo " targetAccountGroup: $targetAccountGroup"
111+
echo " terraformAction: $terraformAction"
112+
echo " internalRef: $internalRef"
113+
echo " overrides: $overrides"
114+
echo " overrideProjectName: $overrideProjectName"
115+
echo " overrideRoleName: $overrideRoleName"
116+
echo " targetProject: $targetProject"
117+
118+
DISPATCH_EVENT=$(jq -ncM \
119+
--arg infraRepoName "$infraRepoName" \
120+
--arg releaseVersion "$releaseVersion" \
121+
--arg targetEnvironment "$targetEnvironment" \
122+
--arg targetAccountGroup "$targetAccountGroup" \
123+
--arg targetComponent "$targetComponent" \
124+
--arg terraformAction "$terraformAction" \
125+
--arg targetWorkflow "$targetWorkflow" \
126+
--arg overrides "$overrides" \
127+
--arg overrideProjectName "$overrideProjectName" \
128+
--arg overrideRoleName "$overrideRoleName" \
129+
--arg targetProject "$targetProject" \
130+
'{
131+
"ref": "'"$internalRef"'",
132+
"inputs": (
133+
(if $infraRepoName != "" then { "infraRepoName": $infraRepoName } else {} end) +
134+
(if $terraformAction != "" then { "terraformAction": $terraformAction } else {} end) +
135+
(if $overrideProjectName != "" then { "overrideProjectName": $overrideProjectName } else {} end) +
136+
(if $overrideRoleName != "" then { "overrideRoleName": $overrideRoleName } else {} end) +
137+
(if $targetProject != "" then { "targetProject": $targetProject } else {} end) +
138+
{
139+
"releaseVersion": $releaseVersion,
140+
"targetEnvironment": $targetEnvironment,
141+
"targetAccountGroup": $targetAccountGroup,
142+
"targetComponent": $targetComponent,
143+
"overrides": $overrides,
144+
}
145+
)
146+
}')
147+
148+
echo "[INFO] Triggering workflow '$targetWorkflow' in nhs-notify-internal..."
149+
150+
trigger_response=$(curl -s -L \
151+
--fail \
152+
-X POST \
153+
-H "Accept: application/vnd.github+json" \
154+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
155+
-H "X-GitHub-Api-Version: 2022-11-28" \
156+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/workflows/$targetWorkflow/dispatches" \
157+
-d "$DISPATCH_EVENT" 2>&1)
158+
159+
if [[ $? -ne 0 ]]; then
160+
echo "[ERROR] Failed to trigger workflow. Response: $trigger_response"
161+
exit 1
162+
fi
163+
164+
echo "[INFO] Workflow trigger request sent successfully, waiting for completion..."
165+
166+
sleep 10 # Wait a few seconds before checking for the presence of the api to account for GitHub updating
167+
168+
# Poll GitHub API to check the workflow status
169+
workflow_run_url=""
170+
171+
for _ in {1..18}; do
172+
173+
response=$(curl -s -L \
174+
-H "Accept: application/vnd.github+json" \
175+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
176+
-H "X-GitHub-Api-Version: 2022-11-28" \
177+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/runs?event=workflow_dispatch")
178+
179+
if ! echo "$response" | jq empty 2>/dev/null; then
180+
echo "[ERROR] Invalid JSON response from GitHub API during workflow polling:"
181+
echo "$response"
182+
exit 1
183+
fi
184+
185+
workflow_run_url=$(echo "$response" | jq -r \
186+
--arg targetWorkflow "$targetWorkflow" \
187+
--arg targetEnvironment "$targetEnvironment" \
188+
--arg targetAccountGroup "$targetAccountGroup" \
189+
--arg targetComponent "$targetComponent" \
190+
--arg terraformAction "$terraformAction" \
191+
'.workflow_runs[]
192+
| select(.path == ".github/workflows/" + $targetWorkflow)
193+
| select(.name
194+
| contains($targetEnvironment)
195+
and contains($targetAccountGroup)
196+
and contains($targetComponent)
197+
and contains($terraformAction)
198+
)
199+
| .url')
200+
201+
if [[ -n "$workflow_run_url" && "$workflow_run_url" != null ]]; then
202+
# Workflow_run_url is a list of all workflows which were run for this combination of inputs, but are the API uri
203+
workflow_run_url=$(echo "$workflow_run_url" | head -n 1)
204+
205+
# Take the first and strip it back to being an accessible url
206+
# Example https://api.github.com/repos/MyOrg/my-repo/actions/runs/12346789 becomes
207+
# becomes https://github.com/MyOrg/my-repo/actions/runs/12346789
208+
workflow_run_ui_url=${workflow_run_url/api./} # Strips the api. prefix
209+
workflow_run_ui_url=${workflow_run_ui_url/\/repos/} # Strips the repos/ uri
210+
echo "[INFO] Found workflow run url: $workflow_run_ui_url"
211+
break
212+
fi
213+
214+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Waiting for workflow to start..."
215+
sleep 10
216+
done
217+
218+
if [[ -z "$workflow_run_url" || "$workflow_run_url" == null ]]; then
219+
echo "[ERROR] Failed to get the workflow run url. Exiting."
220+
exit 1
221+
fi
222+
223+
# Wait for workflow completion
224+
while true; do
225+
sleep 10
226+
response=$(curl -s -L \
227+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
228+
-H "Accept: application/vnd.github+json" \
229+
"$workflow_run_url")
230+
231+
status=$(echo "$response" | jq -r '.status')
232+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Workflow status: $status"
233+
234+
if [ "$status" == "completed" ]; then
235+
conclusion=$(echo "$response" | jq -r '.conclusion')
236+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Workflow conclusion: $conclusion"
237+
238+
if [ -z "$conclusion" ] || [ "$conclusion" == "null" ]; then
239+
echo "[WARN] Workflow marked completed but conclusion not yet available, retrying..."
240+
sleep 5
241+
continue
242+
fi
243+
244+
if [ "$conclusion" == "success" ]; then
245+
echo "[SUCCESS] Workflow completed successfully!"
246+
exit 0
247+
else
248+
echo "[FAIL] Workflow failed with conclusion: $conclusion"
249+
exit 1
250+
fi
251+
fi
252+
done

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ jobs:
2727
terraform_version: ${{ steps.variables.outputs.terraform_version }}
2828
version: ${{ steps.variables.outputs.version }}
2929
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
30+
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
3031
steps:
3132
- name: "Checkout code"
3233
uses: actions/[email protected]
@@ -50,12 +51,18 @@ jobs:
5051
run: |
5152
branch_name=${GITHUB_HEAD_REF:-$(echo $GITHUB_REF | sed 's#refs/heads/##')}
5253
echo "Current branch is '$branch_name'"
53-
if gh pr list --head $branch_name | grep -q .; then
54-
echo "Pull request exists"
54+
55+
pr_json=$(gh pr list --head "$branch_name" --state open --json number --limit 1)
56+
pr_number=$(echo "$pr_json" | jq -r '.[0].number // empty')
57+
58+
if [[ -n "$pr_number" ]]; then
59+
echo "Pull request exists: #$pr_number"
5560
echo "does_pull_request_exist=true" >> $GITHUB_OUTPUT
61+
echo "pr_number=$pr_number" >> $GITHUB_OUTPUT
5662
else
5763
echo "Pull request doesn't exist"
5864
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
65+
echo "pr_number=" >> $GITHUB_OUTPUT
5966
fi
6067
- name: "List variables"
6168
run: |
@@ -68,6 +75,7 @@ jobs:
6875
export TERRAFORM_VERSION="${{ steps.variables.outputs.terraform_version }}"
6976
export VERSION="${{ steps.variables.outputs.version }}"
7077
export DOES_PULL_REQUEST_EXIST="${{ steps.pr_exists.outputs.does_pull_request_exist }}"
78+
export IS_VERSION_PRERELEASE="${{ steps.variables.outputs.is_version_prerelease }}"
7179
make list-variables
7280
commit-stage: # Recommended maximum execution time is 2 minutes
7381
name: "Commit stage"
@@ -99,4 +107,7 @@ jobs:
99107
name: "Acceptance stage"
100108
needs: [metadata, test-stage]
101109
uses: ./.github/workflows/stage-4-acceptance.yaml
110+
if: needs.metadata.outputs.does_pull_request_exist == 'true' || (github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened')) || (github.event_name == 'push' && github.ref == 'refs/heads/main')
102111
secrets: inherit
112+
with:
113+
pr_number: ${{ needs.metadata.outputs.pr_number }}

0 commit comments

Comments
 (0)