Skip to content

Commit 36edf4d

Browse files
aidenvaines-cgim-houston
aidenvaines-cgi
and
m-houston
authored
CCM-11990 pipelines, config, amplify app etc (#66)
* CCM-11990 Performing Repo Sync with template * CCM-11990 Adding base app, workflows and iac * CCM-11990 Adding base app, workflows and iac * CCM-1190 fixing initial credential checks * CCM-1190 fixing initial credential checks * CCM-1190 fixing initial credential checks * CCM-1190 fixing initial credential checks * CCM-1190 fixing initial credential checks * CCM-1190 Adding workflows for branch envs * CCM-1190 Fixing package.json * CCM-1190 Fixing package.json * CCM-1190 Fixing package.json * CCM-1190 Fixing package.json * CCM-1190 Fixing amplify * CCM-1190 Fixing amplify * CCM-1190 Fixing amplify * CCM-11990: Update package-lock.json * CCM-11990: Fix remaining naming changes and patch package.json with updated dependency versions * Update src/jekyll-devcontainer/Makefile Co-authored-by: Mike Houston <60653100+m-houston@users.noreply.github.com> * Update src/jekyll-devcontainer/Makefile Co-authored-by: Mike Houston <60653100+m-houston@users.noreply.github.com> --------- Co-authored-by: Mike Houston <michael.houston4@nhs.net> Co-authored-by: Mike Houston <60653100+m-houston@users.noreply.github.com>
1 parent 75d1feb commit 36edf4d

File tree

79 files changed

+10091
-8403
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+10091
-8403
lines changed

‎.github/SECURITY.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,8 @@ If you wish to notify us of a vulnerability via email, please include detailed i
2121

2222
You can reach us at:
2323

24-
- _[ A product team email address ]_
25-
- [cybersecurity@nhs.net](cybersecurity@nhs.net)
24+
- [england.nhsnotify@nhs.net](mailto:england.nhsnotify@nhs.net)
25+
- [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)
2626

2727
### NCSC
2828

‎.github/actions/check-todo-usage/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: "Check Todo usage"
2+
description: "Check Todo usage"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Check Todo usage"
7+
shell: bash
8+
run: |
9+
export BRANCH_NAME=origin/${{ github.event.repository.default_branch }}
10+
check=branch ./scripts/githooks/check-todos.sh

‎.github/scripts/dispatch_internal_repo_workflow.sh‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
#!/bin/bash
2+
3+
# Triggers a remote GitHub workflow in nhs-notify-internal and waits for completion.
4+
5+
# Usage:
6+
# ./dispatch_internal_repo_workflow.sh \
7+
# --infraRepoName <repo> \
8+
# --releaseVersion <version> \
9+
# --targetWorkflow <workflow.yaml> \
10+
# --targetEnvironment <env> \
11+
# --targetComponent <component> \
12+
# --targetAccountGroup <group> \
13+
# --terraformAction <action> \
14+
# --internalRef <ref> \
15+
# --overrides <overrides> \
16+
# --overrideProjectName <name> \
17+
# --overrideRoleName <name>
18+
19+
#
20+
# All arguments are required except terraformAction, and internalRef.
21+
# Example:
22+
# ./dispatch_internal_repo_workflow.sh \
23+
# --infraRepoName "nhs-notify-dns" \
24+
# --releaseVersion "v1.2.3" \
25+
# --targetWorkflow "deploy.yaml" \
26+
# --targetEnvironment "prod" \
27+
# --targetComponent "web" \
28+
# --targetAccountGroup "core" \
29+
# --terraformAction "apply" \
30+
# --internalRef "main" \
31+
# --overrides "tf_var=someString" \
32+
# --overrideProjectName nhs \
33+
# --overrideRoleName nhs-service-iam-role
34+
35+
set -e
36+
37+
while [[ $# -gt 0 ]]; do
38+
case $1 in
39+
--infraRepoName) # Name of the infrastructure repo in NHSDigital org (required)
40+
infraRepoName="$2"
41+
shift 2
42+
;;
43+
--releaseVersion) # Release version, commit, or tag to deploy (required)
44+
releaseVersion="$2"
45+
shift 2
46+
;;
47+
--targetWorkflow) # Name of the workflow file to call in nhs-notify-internal (required)
48+
targetWorkflow="$2"
49+
shift 2
50+
;;
51+
--targetEnvironment) # Terraform environment to deploy (required)
52+
targetEnvironment="$2"
53+
shift 2
54+
;;
55+
--targetComponent) # Terraform component to deploy (required)
56+
targetComponent="$2"
57+
shift 2
58+
;;
59+
--targetAccountGroup) # Terraform account group to deploy (required)
60+
targetAccountGroup="$2"
61+
shift 2
62+
;;
63+
--terraformAction) # Terraform action to run (optional)
64+
terraformAction="$2"
65+
shift 2
66+
;;
67+
--internalRef) # Internal repo reference branch or tag (optional, default: "main")
68+
internalRef="$2"
69+
shift 2
70+
;;
71+
--overrides) # Terraform overrides for passing in extra variables (optional)
72+
overrides="$2"
73+
shift 2
74+
;;
75+
--overrideProjectName) # Override the project name (optional)
76+
overrideProjectName="$2"
77+
shift 2
78+
;;
79+
--overrideRoleName) # Override the role name (optional)
80+
overrideRoleName="$2"
81+
shift 2
82+
;;
83+
*)
84+
echo "[ERROR] Unknown argument: $1"
85+
exit 1
86+
;;
87+
esac
88+
done
89+
90+
# Set default values if not provided
91+
if [[ -z "$PR_TRIGGER_PAT" ]]; then
92+
echo "[ERROR] PR_TRIGGER_PAT environment variable is not set or is empty."
93+
exit 1
94+
fi
95+
96+
if [[ -z "$overrides" ]]; then
97+
overrides=""
98+
fi
99+
100+
if [[ -z "$internalRef" ]]; then
101+
internalRef="main"
102+
fi
103+
104+
echo "==================== Workflow Dispatch Parameters ===================="
105+
echo " infraRepoName: $infraRepoName"
106+
echo " releaseVersion: $releaseVersion"
107+
echo " targetWorkflow: $targetWorkflow"
108+
echo " targetEnvironment: $targetEnvironment"
109+
echo " targetComponent: $targetComponent"
110+
echo " targetAccountGroup: $targetAccountGroup"
111+
echo " terraformAction: $terraformAction"
112+
echo " internalRef: $internalRef"
113+
echo " overrides: $overrides"
114+
echo " overrideProjectName: $overrideProjectName"
115+
echo " overrideRoleName: $overrideRoleName"
116+
echo " targetProject: $targetProject"
117+
118+
DISPATCH_EVENT=$(jq -ncM \
119+
--arg infraRepoName "$infraRepoName" \
120+
--arg releaseVersion "$releaseVersion" \
121+
--arg targetEnvironment "$targetEnvironment" \
122+
--arg targetAccountGroup "$targetAccountGroup" \
123+
--arg targetComponent "$targetComponent" \
124+
--arg terraformAction "$terraformAction" \
125+
--arg targetWorkflow "$targetWorkflow" \
126+
--arg overrides "$overrides" \
127+
--arg overrideProjectName "$overrideProjectName" \
128+
--arg overrideRoleName "$overrideRoleName" \
129+
--arg targetProject "$targetProject" \
130+
'{
131+
"ref": "'"$internalRef"'",
132+
"inputs": (
133+
(if $infraRepoName != "" then { "infraRepoName": $infraRepoName } else {} end) +
134+
(if $terraformAction != "" then { "terraformAction": $terraformAction } else {} end) +
135+
(if $overrideProjectName != "" then { "overrideProjectName": $overrideProjectName } else {} end) +
136+
(if $overrideRoleName != "" then { "overrideRoleName": $overrideRoleName } else {} end) +
137+
(if $targetProject != "" then { "targetProject": $targetProject } else {} end) +
138+
{
139+
"releaseVersion": $releaseVersion,
140+
"targetEnvironment": $targetEnvironment,
141+
"targetAccountGroup": $targetAccountGroup,
142+
"targetComponent": $targetComponent,
143+
"overrides": $overrides,
144+
}
145+
)
146+
}')
147+
148+
echo "[INFO] Triggering workflow '$targetWorkflow' in nhs-notify-internal..."
149+
150+
trigger_response=$(curl -s -L \
151+
--fail \
152+
-X POST \
153+
-H "Accept: application/vnd.github+json" \
154+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
155+
-H "X-GitHub-Api-Version: 2022-11-28" \
156+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/workflows/$targetWorkflow/dispatches" \
157+
-d "$DISPATCH_EVENT" 2>&1)
158+
159+
if [[ $? -ne 0 ]]; then
160+
echo "[ERROR] Failed to trigger workflow. Response: $trigger_response"
161+
exit 1
162+
fi
163+
164+
echo "[INFO] Workflow trigger request sent successfully, waiting for completion..."
165+
166+
sleep 10 # Wait a few seconds before checking for the presence of the api to account for GitHub updating
167+
168+
# Poll GitHub API to check the workflow status
169+
workflow_run_url=""
170+
171+
for _ in {1..18}; do
172+
173+
response=$(curl -s -L \
174+
-H "Accept: application/vnd.github+json" \
175+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
176+
-H "X-GitHub-Api-Version: 2022-11-28" \
177+
"https://api.github.com/repos/NHSDigital/nhs-notify-internal/actions/runs?event=workflow_dispatch")
178+
179+
if ! echo "$response" | jq empty 2>/dev/null; then
180+
echo "[ERROR] Invalid JSON response from GitHub API during workflow polling:"
181+
echo "$response"
182+
exit 1
183+
fi
184+
185+
workflow_run_url=$(echo "$response" | jq -r \
186+
--arg targetWorkflow "$targetWorkflow" \
187+
--arg targetEnvironment "$targetEnvironment" \
188+
--arg targetAccountGroup "$targetAccountGroup" \
189+
--arg targetComponent "$targetComponent" \
190+
--arg terraformAction "$terraformAction" \
191+
'.workflow_runs[]
192+
| select(.path == ".github/workflows/" + $targetWorkflow)
193+
| select(.name
194+
| contains($targetEnvironment)
195+
and contains($targetAccountGroup)
196+
and contains($targetComponent)
197+
and contains($terraformAction)
198+
)
199+
| .url')
200+
201+
if [[ -n "$workflow_run_url" && "$workflow_run_url" != null ]]; then
202+
# Workflow_run_url is a list of all workflows which were run for this combination of inputs, but are the API uri
203+
workflow_run_url=$(echo "$workflow_run_url" | head -n 1)
204+
205+
# Take the first and strip it back to being an accessible url
206+
# Example https://api.github.com/repos/MyOrg/my-repo/actions/runs/12346789 becomes
207+
# becomes https://github.com/MyOrg/my-repo/actions/runs/12346789
208+
workflow_run_ui_url=${workflow_run_url/api./} # Strips the api. prefix
209+
workflow_run_ui_url=${workflow_run_ui_url/\/repos/} # Strips the repos/ uri
210+
echo "[INFO] Found workflow run url: $workflow_run_ui_url"
211+
break
212+
fi
213+
214+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Waiting for workflow to start..."
215+
sleep 10
216+
done
217+
218+
if [[ -z "$workflow_run_url" || "$workflow_run_url" == null ]]; then
219+
echo "[ERROR] Failed to get the workflow run url. Exiting."
220+
exit 1
221+
fi
222+
223+
# Wait for workflow completion
224+
while true; do
225+
sleep 10
226+
response=$(curl -s -L \
227+
-H "Authorization: Bearer ${PR_TRIGGER_PAT}" \
228+
-H "Accept: application/vnd.github+json" \
229+
"$workflow_run_url")
230+
231+
status=$(echo "$response" | jq -r '.status')
232+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Workflow status: $status"
233+
234+
if [ "$status" == "completed" ]; then
235+
conclusion=$(echo "$response" | jq -r '.conclusion')
236+
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Workflow conclusion: $conclusion"
237+
238+
if [ -z "$conclusion" ] || [ "$conclusion" == "null" ]; then
239+
echo "[WARN] Workflow marked completed but conclusion not yet available, retrying..."
240+
sleep 5
241+
continue
242+
fi
243+
244+
if [ "$conclusion" == "success" ]; then
245+
echo "[SUCCESS] Workflow completed successfully!"
246+
exit 0
247+
else
248+
echo "[FAIL] Workflow failed with conclusion: $conclusion"
249+
exit 1
250+
fi
251+
fi
252+
done

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ jobs:
2727
version: ${{ steps.variables.outputs.version }}
2828
is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
2929
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
30+
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
3031
steps:
3132
- name: "Checkout code"
3233
uses: actions/checkout@v5
@@ -53,12 +54,18 @@ jobs:
5354
run: |
5455
branch_name=${GITHUB_HEAD_REF:-$(echo $GITHUB_REF | sed 's#refs/heads/##')}
5556
echo "Current branch is '$branch_name'"
56-
if gh pr list --head $branch_name | grep -q .; then
57-
echo "Pull request exists"
57+
58+
pr_json=$(gh pr list --head "$branch_name" --state open --json number --limit 1)
59+
pr_number=$(echo "$pr_json" | jq -r '.[0].number // empty')
60+
61+
if [[ -n "$pr_number" ]]; then
62+
echo "Pull request exists: #$pr_number"
5863
echo "does_pull_request_exist=true" >> $GITHUB_OUTPUT
64+
echo "pr_number=$pr_number" >> $GITHUB_OUTPUT
5965
else
6066
echo "Pull request doesn't exist"
6167
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
68+
echo "pr_number=" >> $GITHUB_OUTPUT
6269
fi
6370
- name: "List variables"
6471
run: |
@@ -126,4 +133,5 @@ jobs:
126133
python_version: "${{ needs.metadata.outputs.python_version }}"
127134
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
128135
version: "${{ needs.metadata.outputs.version }}"
136+
pr_number: ${{ needs.metadata.outputs.pr_number }}
129137
secrets: inherit

‎.github/workflows/pr_closed.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: PR Closed
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
types: [closed]
7+
branches:
8+
- main
9+
10+
permissions:
11+
id-token: write
12+
contents: read
13+
14+
concurrency:
15+
group: ${{ github.workflow }}-${{ github.ref }}
16+
cancel-in-progress: false
17+
18+
jobs:
19+
check-merge-or-workflow-dispatch:
20+
runs-on: ubuntu-latest
21+
outputs:
22+
deploy: ${{ steps.check.outputs.deploy }}
23+
steps:
24+
- name: Check if PR was merged or wor§kflow is triggered by workflow_dispatch
25+
id: check
26+
run: |
27+
if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
28+
echo "deploy=true" >> $GITHUB_OUTPUT
29+
echo "Job triggered by workflow_dispatch - running 'deploy-main'"
30+
elif [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.merged }}" == "true" ]]; then
31+
echo "deploy=true" >> $GITHUB_OUTPUT
32+
echo "Job triggered by Merged PR - running 'deploy-main'"
33+
else
34+
echo "deploy=false" >> $GITHUB_OUTPUT
35+
echo "Job not triggered by workflow_dispatch or Merged PR - Skipping 'deploy-main'"
36+
fi
37+
38+
deploy-main:
39+
needs: check-merge-or-workflow-dispatch
40+
name: Deploy changes to main in dev AWS account
41+
runs-on: ubuntu-latest
42+
if: needs.check-merge-or-workflow-dispatch.outputs.deploy == 'true'
43+
44+
strategy:
45+
max-parallel: 1
46+
matrix:
47+
component: [ccapp]
48+
49+
steps:
50+
- name: Checkout repository
51+
uses: actions/checkout@v4
52+
53+
- name: Updating Main Environment
54+
env:
55+
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}
56+
run: |
57+
bash .github/scripts/dispatch_internal_repo_workflow.sh \
58+
--releaseVersion "main" \
59+
--targetWorkflow "dispatch-deploy-static-notify-client-config-env.yaml" \
60+
--targetEnvironment "main" \
61+
--targetAccountGroup "nhs-notify-client-config-dev" \
62+
--targetComponent "${{ matrix.component }}" \
63+
--terraformAction "apply" \
64+
--overrideProjectName "nhs" \
65+
--overrideRoleName "nhs-main-acct-client-config-github-deploy"

0 commit comments

Comments
 (0)