Skip to content

Commit 39fcbe7

Browse files
whi-twwhi-tw
authored
Merge pull request #2507 from alphagov/whi-tw/allow-github-hosted-runner-deploy-review-apps
Use AWS credentials to deploy review apps
2 parents 214b93d + 10c1646 commit 39fcbe7

File tree

3 files changed

+51
-129
lines changed

3 files changed

+51
-129
lines changed

‎.github/workflows/review_apps_on_pr_change.yml‎

Lines changed: 13 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -1,104 +1,20 @@
11
name: "Review apps: on PR change"
22
on:
33
pull_request:
4-
# being explicit about what to trigger on.
5-
# matches the docs for the default types
6-
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request
74
types: [opened, reopened, synchronize]
8-
jobs:
9-
update-review-app:
10-
# this references a codebuild project configured in forms-deploy
11-
# see: https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html
12-
runs-on: codebuild-review-forms-admin-gha-runner-${{github.run_id}}-${{github.run_attempt}}
13-
14-
permissions:
15-
pull-requests: write
16-
17-
steps:
18-
- name: Generate container image URI
19-
run: |
20-
echo "CONTAINER_IMAGE_URI=842676007477.dkr.ecr.eu-west-2.amazonaws.com/forms-admin:pr-${{github.event.pull_request.number}}-${{github.event.pull_request.head.sha}}-$(date +%s)" >> "$GITHUB_ENV"
21-
22-
- name: Checkout code
23-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24-
25-
- name: Build container
26-
run: |
27-
# Docker credentials are configured in CodeBuild
28-
# CodeBuild retrieves the credentials from ParameterStore
29-
echo "${DOCKER_PASSWORD}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
30-
docker build \
31-
--tag "${{env.CONTAINER_IMAGE_URI}}" \
32-
.
33-
34-
- name: Push container
35-
id: build-container
36-
run: |
37-
aws ecr get-login-password --region eu-west-2 \
38-
| docker login --username AWS --password-stdin 842676007477.dkr.ecr.eu-west-2.amazonaws.com
39-
40-
echo "Pushing container image"
41-
echo "${{env.CONTAINER_IMAGE_URI}}"
42-
43-
docker push "${CONTAINER_IMAGE_URI}"
44-
45-
- name: Determine Terraform version
46-
id: terraform-version
47-
run: |
48-
TF_VERSION=$(< .review_apps/.terraform-version)
49-
printf "TF_VERSION=%s\n" "$TF_VERSION" >> "$GITHUB_OUTPUT"
505

51-
- uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
52-
with:
53-
terraform_version: ${{steps.terraform-version.outputs.TF_VERSION}}
6+
concurrency:
7+
group: "review-apps-pr-${{ github.event.pull_request.number }}"
8+
cancel-in-progress: false
549

55-
- name: Deploy review app
56-
id: deploy
57-
run: |
58-
cd .review_apps/
10+
permissions:
11+
id-token: write
12+
contents: read
13+
pull-requests: write
5914

60-
terraform init -backend-config="key=review-apps/forms-admin/pr-${{github.event.pull_request.number}}.tfstate"
61-
62-
terraform apply \
63-
-var "pull_request_number=${{github.event.pull_request.number}}" \
64-
-var "forms_admin_container_image=${{env.CONTAINER_IMAGE_URI}}" \
65-
-no-color \
66-
-auto-approve
67-
REVIEW_APP_URL=$(terraform output -raw review_app_url)
68-
ECS_CLUSTER_ID=$(terraform output -raw review_app_ecs_cluster_id)
69-
ECS_SERVICE_NAME=$(terraform output -raw review_app_ecs_service_name)
70-
{
71-
printf 'REVIEW_APP_URL=%s\n' "$REVIEW_APP_URL"
72-
printf 'ECS_CLUSTER_ID=%s\n' "$ECS_CLUSTER_ID"
73-
printf 'ECS_SERVICE_NAME=%s\n' "$ECS_SERVICE_NAME"
74-
} >> "$GITHUB_OUTPUT"
75-
76-
- name: Wait for AWS ECS deployments to finish
77-
run: |
78-
aws ecs wait services-stable \
79-
--cluster "${{steps.deploy.outputs.ECS_CLUSTER_ID}}" \
80-
--services "${{steps.deploy.outputs.ECS_SERVICE_NAME}}"
81-
82-
- name: Comment on PR
83-
env:
84-
COMMENT_MARKER: <!-- review apps on pr change -->
85-
GH_TOKEN: ${{ github.token }}
86-
run: |
87-
cat <<EOF > "${{runner.temp}}/pr-comment.md"
88-
:tada: A review copy of this PR has been deployed! You can reach it at: ${{steps.deploy.outputs.REVIEW_APP_URL}}
89-
90-
It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
91-
after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
92-
to debug, or otherwise ask an infrastructure person.
93-
94-
For the sign in details and more information, [see the review apps wiki page](https://github.com/alphagov/forms-team/wiki/Review-apps).
95-
96-
$COMMENT_MARKER
97-
EOF
98-
99-
old_comment_ids=$(gh api "repos/{owner}/{repo}/issues/${{github.event.pull_request.number}}/comments" --jq "map(select((.user.login == \"github-actions[bot]\") and (.body | endswith(env.COMMENT_MARKER + \"\n\")))) | .[].id")
100-
for comment_id in $old_comment_ids; do
101-
gh api -X DELETE "repos/{owner}/{repo}/issues/comments/${comment_id}"
102-
done
103-
104-
gh pr comment "${{github.event.pull_request.html_url}}" --body-file "${{runner.temp}}/pr-comment.md"
15+
jobs:
16+
update-review-app:
17+
name: Update review app
18+
uses: alphagov/forms-deploy/.github/workflows/reusable-review_apps_on_pr_change.yml@main
19+
with:
20+
app-name: forms-admin

‎.github/workflows/review_apps_on_pr_close.yml‎

Lines changed: 13 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,20 @@
11
name: "Review apps: on PR close"
22
on:
33
pull_request:
4-
# only run when a PR is closed or merged
54
types: [closed]
6-
env:
7-
IMAGE_TAG: "842676007477.dkr.ecr.eu-west-2.amazonaws.com/forms-admin:pr-${{github.event.pull_request.number}}-${{github.event.pull_request.head.ref}}"
8-
jobs:
9-
delete-review-app:
10-
# this references a codebuild project configured in forms-deploy
11-
# see: https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html
12-
runs-on: codebuild-review-forms-admin-gha-runner-${{github.run_id}}-${{github.run_attempt}}
13-
14-
steps:
15-
- name: Checkout code
16-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
175

18-
- name: Determine Terraform version
19-
id: terraform-version
20-
run: |
21-
TF_VERSION=$(< .review_apps/.terraform-version)
22-
printf "TF_VERSION=%s\n" "$TF_VERSION" >> "$GITHUB_OUTPUT"
6+
concurrency:
7+
group: "review-apps-pr-${{ github.event.pull_request.number }}"
8+
cancel-in-progress: false
239

24-
- uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
25-
with:
26-
terraform_version: ${{steps.terraform-version.outputs.TF_VERSION}}
10+
permissions:
11+
id-token: write
12+
contents: read
13+
pull-requests: write
2714

28-
- name: Delete review app
29-
run: |
30-
cd .review_apps/
31-
32-
terraform init -backend-config="key=review-apps/forms-admin/pr-${{github.event.pull_request.number}}.tfstate"
33-
terraform destroy \
34-
-var "pull_request_number=${{github.event.pull_request.number}}" \
35-
-var "forms_admin_container_image=${{env.IMAGE_TAG}}" \
36-
-no-color \
37-
-auto-approve
15+
jobs:
16+
delete-review-app:
17+
name: Delete review app
18+
uses: alphagov/forms-deploy/.github/workflows/reusable-review_apps_on_pr_close.yml@main
19+
with:
20+
app-name: forms-admin

‎.review_apps/ecs_task_definition.tf‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,11 +70,16 @@ resource "aws_ecs_task_definition" "task" {
7070
portMappings = [
7171
{
7272
containerPort = 3000
73+
hostPort = 3000
7374
protocol = "tcp"
7475
appProtocol = "http"
7576
}
7677
]
7778

79+
mountPoints = []
80+
systemControls = []
81+
volumesFrom = []
82+
7883
logConfiguration = {
7984
logDriver = "awslogs"
8085
options = {
@@ -89,6 +94,7 @@ resource "aws_ecs_task_definition" "task" {
8994
interval = 30
9095
retries = 5
9196
startPeriod = 180
97+
timeout = 5
9298
}
9399

94100
dependsOn = [
@@ -106,7 +112,17 @@ resource "aws_ecs_task_definition" "task" {
106112
command = []
107113
essential = true
108114

109-
portMappings = [{ containerPort = 5432 }]
115+
portMappings = [
116+
{
117+
containerPort = 5432
118+
hostPort = 5432
119+
protocol = "tcp"
120+
}
121+
]
122+
123+
mountPoints = []
124+
systemControls = []
125+
volumesFrom = []
110126

111127
environment = [
112128
{ name = "POSTGRES_PASSWORD", value = "postgres" }
@@ -122,7 +138,10 @@ resource "aws_ecs_task_definition" "task" {
122138
}
123139

124140
healthCheck = {
125-
command = ["CMD-SHELL", "psql -h localhost -p 5432 -U postgres -c \"SELECT current_timestamp - pg_postmaster_start_time();\""]
141+
command = ["CMD-SHELL", "psql -h localhost -p 5432 -U postgres -c \"SELECT current_timestamp - pg_postmaster_start_time();\""]
142+
interval = 30
143+
retries = 3
144+
timeout = 5
126145
}
127146
},
128147

@@ -135,6 +154,10 @@ resource "aws_ecs_task_definition" "task" {
135154
environment = local.forms_admin_env_vars
136155
readonlyRootFilesystem = true
137156

157+
mountPoints = []
158+
systemControls = []
159+
volumesFrom = []
160+
138161
logConfiguration = {
139162
logDriver = "awslogs"
140163
options = {

0 commit comments

Comments
 (0)