Skip to content
Pipeline

Task/cdd 3175 permission sets cms #13736

Sign in to view logs

Task/cdd 3175 permission sets cms

Task/cdd 3175 permission sets cms #13736

Workflow file for this run

.github/workflows/actions.yml at 46507dd
name: Pipeline
on:
pull_request:
types: [opened, synchronize, reopened]
push:
branches:
- main
env:
APIENV: "LOCAL"
# With `LOCAL` set, a local sqlite db will be used
AWS_REGION: "eu-west-2"
permissions:
id-token: write # This is required for requesting the JWT
contents: read # This is required for actions/checkout
jobs:
###############################################################################
# Secret Scan
###############################################################################
secret-scan:
name: Gitleaks Secret Scan
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Run Gitleaks
if: github.actor != 'dependabot[bot]'
uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
###############################################################################
# Install dependencies & build packages
###############################################################################
build:
name: Build
needs: [secret-scan]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
###############################################################################
# Security checks
###############################################################################
dependency-checks:
name: Dependency checks
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Install uv
uses: astral-sh/setup-uv@v7
- name: Scan dependencies
run: |
source uhd.sh
uhd security dependencies
vulnerability-checks:
name: Vulnerability checks
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Scan for vulnerabilities
run: |
source uhd.sh
uhd security vulnerabilities
###############################################################################
# Code quality checks
###############################################################################
quality-checks:
name: Linting
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Run linters
run: |
source uhd.sh
uhd quality format-check
###############################################################################
# Architectural constraints checks
###############################################################################
architecture-checks:
name: Architecture checks
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Check architectural constraints
run: |
source uhd.sh
uhd quality architecture
###############################################################################
# Unit tests
###############################################################################
unit-tests:
name: Unit tests
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Run unit tests
run: |
source uhd.sh
uhd tests unit
###############################################################################
# Integration tests
###############################################################################
integration-tests:
name: Integration tests
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Run integration tests
run: |
source uhd.sh
uhd tests integration
###############################################################################
# System tests
###############################################################################
system-tests:
name: System tests
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Run system tests
run: |
source uhd.sh
uhd tests system
###############################################################################
# Migration tests
###############################################################################
migration-tests:
name: Migration tests
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Run migration tests
run: |
source uhd.sh
uhd tests migrations
###############################################################################
# Test coverage
###############################################################################
test-coverage:
name: Test coverage
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- uses: ./.github/actions/install-cache
- name: Evaluate test coverage
run: |
source uhd.sh
uhd tests coverage
###############################################################################
# Docker build check (PR validation)
###############################################################################
docker-build-check:
name: Docker Build Check
needs: [build]
runs-on: ubuntu-22.04-arm
steps:
- uses: actions/checkout@v4
- name: Build main API Docker image
run: docker build -t be-main-test -f Dockerfile .
- name: Build ingestion Docker image
run: docker build -t be-ingestion-test -f Dockerfile-ingestion .
- name: Run main API container
run: docker run -d --name be-main-test-container be-main-test
- name: Health check main API container
run: |
echo "Waiting for main API container to start..."
sleep 10
if [ "$(docker inspect -f '{{.State.Running}}' be-main-test-container)" != "true" ]; then
echo "Main API container failed to start"
docker logs be-main-test-container
exit 1
fi
echo "Main API container is running successfully"
- name: Run ingestion container
run: docker run -d --name be-ingestion-test-container be-ingestion-test
- name: Health check ingestion container
run: |
echo "Waiting for ingestion container to start..."
sleep 10
if [ "$(docker inspect -f '{{.State.Running}}' be-ingestion-test-container)" != "true" ]; then
echo "Ingestion container failed to start"
docker logs be-ingestion-test-container
exit 1
fi
echo "Ingestion container is running successfully"
- name: Cleanup
if: always()
run: |
docker rm -f be-main-test-container || true
docker rm -f be-ingestion-test-container || true
###############################################################################
# Build image
###############################################################################
publish-main-image:
name: Publish main image to central ECR
needs:
[
quality-checks,
unit-tests,
integration-tests,
system-tests,
migration-tests,
test-coverage,
dependency-checks,
vulnerability-checks,
architecture-checks,
docker-build-check,
]
runs-on: ubuntu-22.04-arm
if: ${{ github.ref == 'refs/heads/main' }}
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Build and publish docker image
uses: ./.github/actions/publish-image
with:
ecr-repository: ukhsa-data-dashboard/back-end
role-to-assume: ${{ secrets.AWS_TOOLS_ACCOUNT_ROLE }}
image-tag: ${{ github.sha }}
publish-ingestion-image:
name: Publish ingestion image to central ECR
needs:
[
quality-checks,
unit-tests,
integration-tests,
system-tests,
migration-tests,
test-coverage,
dependency-checks,
vulnerability-checks,
architecture-checks,
docker-build-check,
]
runs-on: ubuntu-22.04-arm
if: ${{ github.ref == 'refs/heads/main' }}
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Build and publish docker image
uses: ./.github/actions/publish-image
with:
ecr-repository: ukhsa-data-dashboard/ingestion
role-to-assume: ${{ secrets.AWS_TOOLS_ACCOUNT_ROLE }}
dockerfile: Dockerfile-ingestion
image-tag: ${{ github.sha }}
###############################################################################
# Deploy
###############################################################################
trigger-deployments:
name: Trigger deployments
needs: [publish-main-image, publish-ingestion-image]
runs-on: ubuntu-22.04-arm
if: ${{ github.ref == 'refs/heads/main' }}
# Only deploy if the changes are being pushed to the `main` branch
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Generate ephemeral deployment token
id: generate-deployment-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.DEPLOYMENT_TOKEN_FACTORY_APP_ID }}
private-key: ${{ secrets.DEPLOYMENT_TOKEN_FACTORY_PRIVATE_KEY }}
skip-token-revoke: false
# Although this is the default, this is explicitly set so that
# we know the token gets revoked after the job has finished
repositories: "data-dashboard-infra"
- uses: ./.github/actions/trigger-deployments
with:
token: ${{ steps.generate-deployment-token.outputs.token }}