Skip to content

Commit 8c4f949

Browse files
anthony-nhsanthony-nhs
authored
add github workflows (#18)
## Summary - Routine Change ### Details - adds github workflows for the following - release - dependabot autoapprove and merge - pr-link
1 parent 7f4084f commit 8c4f949

4 files changed

Lines changed: 274 additions & 2 deletions

File tree

‎.github/workflows/dependabot_auto_approve_and_merge.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Dependabot auto-approve
2+
on: pull_request
3+
4+
permissions:
5+
pull-requests: write
6+
contents: write
7+
8+
jobs:
9+
dependabot:
10+
runs-on: ubuntu-latest
11+
if: ${{ github.actor == 'dependabot[bot]' }}
12+
steps:
13+
- name: Get token from Github App
14+
id: get_app_token
15+
uses: actions/create-github-app-token@v1
16+
with:
17+
app-id: ${{ secrets.AUTOMERGE_APP_ID }}
18+
private-key: ${{ secrets.AUTOMERGE_PEM }}
19+
- name: Dependabot metadata
20+
id: dependabot-metadata
21+
uses: dependabot/fetch-metadata@v1
22+
with:
23+
github-token: "${{ secrets.GITHUB_TOKEN }}"
24+
- name: Approve patch and minor updates
25+
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' || steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor'}}
26+
run: gh pr review "$PR_URL" --approve -b "I'm **approving** this pull request because **it includes a patch or minor update**"
27+
env:
28+
PR_URL: ${{github.event.pull_request.html_url}}
29+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
30+
- name: Approve major updates of development dependencies
31+
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:development'}}
32+
run: gh pr review "$PR_URL" --approve -b "I'm **approving** this pull request because **it includes a major update of a dependency used only in development**"
33+
env:
34+
PR_URL: ${{github.event.pull_request.html_url}}
35+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
36+
- name: Comment on major updates of non-development dependencies
37+
if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:production'}}
38+
run: |
39+
gh pr comment "$PR_URL" --body "I'm **not approving** this PR because **it includes a major update of a dependency used in production**"
40+
gh pr edit "$PR_URL" --add-label "requires-manual-qa"
41+
env:
42+
PR_URL: ${{github.event.pull_request.html_url}}
43+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}
44+
# enable auto merge on all dependabot prs
45+
- name: Enable auto-merge for Dependabot PRs
46+
run: gh pr merge --auto --squash "$PR_URL"
47+
env:
48+
PR_URL: ${{github.event.pull_request.html_url}}
49+
GITHUB_TOKEN: ${{ steps.get_app_token.outputs.token }}

‎.github/workflows/pr-link.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: PR Link ticket
2+
on:
3+
pull_request:
4+
types: [opened]
5+
jobs:
6+
link-ticket:
7+
runs-on: ubuntu-latest
8+
env:
9+
REF: ${{ github.event.pull_request.head.ref }}
10+
steps:
11+
- name: Check ticket name conforms to requirements
12+
run: echo "$REF" | grep -i -E -q "(aea-[0-9]+)|(apm-[0-9]+)|(apmspii-[0-9]+)|(adz-[0-9]+)|(amb-[0-9]+)|(dependabot\/)"
13+
continue-on-error: true
14+
15+
- name: Grab ticket name
16+
if: contains(github.event.pull_request.head.ref, 'aea-') || contains(github.event.pull_request.head.ref, 'AEA-') || contains(github.event.pull_request.head.ref, 'apm-') || contains(github.event.pull_request.head.ref, 'APM-') || contains(github.event.pull_request.head.ref, 'apmspii-') || contains(github.event.pull_request.head.ref, 'APMSPII-') || contains(github.event.pull_request.head.ref, 'adz-') || contains(github.event.pull_request.head.ref, 'ADZ-') || contains(github.event.pull_request.head.ref, 'amb-') || contains(github.event.pull_request.head.ref, 'AMB-')
17+
run: echo name=TICKET_NAME::"$(echo "$REF" | grep -i -o '\(aea-[0-9]\+\)\|\(apm-[0-9]\+\)\|\(apmspii-[0-9]\+\)\|\(adz-[0-9]\+\)|\(amb-[0-9]\+\)' | tr '[:lower:]' '[:upper:]')" >> "$GITHUB_ENV"
18+
continue-on-error: true
19+
env:
20+
ACTIONS_ALLOW_UNSECURE_COMMANDS: true
21+
22+
- name: Comment on PR with link to JIRA ticket
23+
if: contains(github.event.pull_request.head.ref, 'aea-') || contains(github.event.pull_request.head.ref, 'AEA-') || contains(github.event.pull_request.head.ref, 'apm-') || contains(github.event.pull_request.head.ref, 'APM-') || contains(github.event.pull_request.head.ref, 'apmspii-') || contains(github.event.pull_request.head.ref, 'APMSPII-') || contains(github.event.pull_request.head.ref, 'adz-') || contains(github.event.pull_request.head.ref, 'ADZ-') || contains(github.event.pull_request.head.ref, 'amb-') || contains(github.event.pull_request.head.ref, 'AMB-')
24+
continue-on-error: true
25+
uses: unsplash/comment-on-pr@master
26+
env:
27+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
with:
29+
msg: |
30+
This branch is work on a ticket in the NHS Digital APM JIRA Project. Here's a handy link to the ticket:
31+
# [${{ env.TICKET_NAME }}](https://nhsd-jira.digital.nhs.uk/browse/${{ env.TICKET_NAME }})

‎.github/workflows/pull_request.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: deploy_pr
1+
name: Pull request test and deploy
22

33
on:
44
pull_request:
@@ -68,4 +68,3 @@ jobs:
6868
LOG_RETENTION_DAYS: 30
6969
secrets:
7070
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
71-

‎.github/workflows/release.yml‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
name: release workflow
2+
3+
on:
4+
push:
5+
branches: [main]
6+
tags: [v**]
7+
8+
env:
9+
BRANCH_NAME: ${{ github.event.ref.BRANCH_NAME }}
10+
11+
jobs:
12+
quality_checks:
13+
uses: ./.github/workflows/quality_checks.yml
14+
secrets:
15+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
16+
17+
get_commit_id:
18+
runs-on: ubuntu-latest
19+
outputs:
20+
commit_id: ${{ steps.commit_id.outputs.commit_id }}
21+
steps:
22+
- name: Get Commit ID
23+
id: commit_id
24+
run: |
25+
echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
26+
27+
tag_release:
28+
needs: quality_checks
29+
runs-on: ubuntu-latest
30+
outputs:
31+
spec_version: ${{steps.output_spec_version.outputs.SPEC_VERSION}}
32+
steps:
33+
- name: Checkout code
34+
uses: actions/checkout@v4
35+
with:
36+
ref: ${{ env.BRANCH_NAME }}
37+
fetch-depth: 0
38+
39+
# using git commit sha for version of action to ensure we have stable version
40+
- name: Install asdf
41+
uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
42+
with:
43+
asdf_branch: v0.11.3
44+
45+
- name: Cache asdf
46+
uses: actions/cache@v4
47+
with:
48+
path: |
49+
~/.asdf
50+
key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
51+
restore-keys: |
52+
${{ runner.os }}-asdf-
53+
54+
- name: Install asdf dependencies in .tool-versions
55+
uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
56+
with:
57+
asdf_branch: v0.11.3
58+
env:
59+
PYTHON_CONFIGURE_OPTS: --enable-shared
60+
61+
- name: Install python packages
62+
run: |
63+
make install-python
64+
65+
- name: Set SPEC_VERSION env var for merges to main
66+
run: echo "SPEC_VERSION=$(poetry run python scripts/calculate_version.py)" >> "$GITHUB_ENV"
67+
if: github.ref == 'refs/heads/main'
68+
69+
- name: Set SPEC_VERSION env var for tags
70+
run: echo "SPEC_VERSION=${{ github.ref_name }}" >> "$GITHUB_ENV"
71+
if: github.ref != 'refs/heads/main'
72+
73+
- name: Create release (tags and main)
74+
id: create-release
75+
# using commit hash for version v1.13.0
76+
uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5
77+
continue-on-error: true
78+
env:
79+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80+
with:
81+
tag: ${{ env.SPEC_VERSION }}
82+
commit: ${{ github.sha }}
83+
body: |
84+
## Commit message
85+
${{ github.event.head_commit.message }}
86+
## Info
87+
[See code diff](${{ github.event.compare }})
88+
[Release workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
89+
90+
It was initialized by [${{ github.event.sender.login }}](${{ github.event.sender.html_url }})
91+
92+
- name: output SPEC_VERSION
93+
id: output_spec_version
94+
run: |
95+
echo "## RELEASE TAG :** ${{ env.SPEC_VERSION }}" >> "$GITHUB_STEP_SUMMARY"
96+
echo "SPEC_VERSION=${{ env.SPEC_VERSION }}" >> "$GITHUB_OUTPUT"
97+
98+
package_code:
99+
needs: tag_release
100+
uses: ./.github/workflows/sam_package_code.yml
101+
102+
release_dev:
103+
needs: [tag_release, package_code, get_commit_id]
104+
uses: ./.github/workflows/sam_release_code.yml
105+
with:
106+
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.spec_version}}
107+
STACK_NAME: fhir-validator
108+
TARGET_ENVIRONMENT: dev
109+
BUILD_ARTIFACT: packaged_code
110+
VERSION_NUMBER: ${{needs.tag_release.outputs.spec_version}}
111+
COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
112+
LOG_LEVEL: DEBUG
113+
LOG_RETENTION_DAYS: 30
114+
CREATE_INT_RELEASE_NOTES: true
115+
CREATE_PROD_RELEASE_NOTES: true
116+
secrets:
117+
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
118+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
119+
INT_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.INT_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
120+
PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
121+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}
122+
123+
release_ref:
124+
needs: [tag_release, release_dev, package_code, get_commit_id]
125+
uses: ./.github/workflows/sam_release_code.yml
126+
with:
127+
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.spec_version}}
128+
STACK_NAME: fhir-validator
129+
TARGET_ENVIRONMENT: ref
130+
BUILD_ARTIFACT: packaged_code
131+
VERSION_NUMBER: ${{needs.tag_release.outputs.spec_version}}
132+
COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
133+
LOG_LEVEL: DEBUG
134+
LOG_RETENTION_DAYS: 30
135+
secrets:
136+
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.REF_CLOUD_FORMATION_DEPLOY_ROLE }}
137+
138+
release_qa:
139+
needs: [tag_release, release_dev, package_code, get_commit_id]
140+
uses: ./.github/workflows/sam_release_code.yml
141+
with:
142+
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.spec_version}}
143+
STACK_NAME: fhir-validator
144+
TARGET_ENVIRONMENT: qa
145+
BUILD_ARTIFACT: packaged_code
146+
VERSION_NUMBER: ${{needs.tag_release.outputs.spec_version}}
147+
COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
148+
LOG_LEVEL: DEBUG
149+
LOG_RETENTION_DAYS: 30
150+
secrets:
151+
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.QA_CLOUD_FORMATION_DEPLOY_ROLE }}
152+
153+
release_int:
154+
needs: [tag_release, release_qa, package_code, get_commit_id]
155+
uses: ./.github/workflows/sam_release_code.yml
156+
with:
157+
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.spec_version}}
158+
STACK_NAME: fhir-validator
159+
TARGET_ENVIRONMENT: int
160+
BUILD_ARTIFACT: packaged_code
161+
VERSION_NUMBER: ${{needs.tag_release.outputs.spec_version}}
162+
COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
163+
LOG_LEVEL: DEBUG
164+
LOG_RETENTION_DAYS: 30
165+
CREATE_INT_RELEASE_NOTES: true
166+
CREATE_INT_RC_RELEASE_NOTES: true
167+
secrets:
168+
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.INT_CLOUD_FORMATION_DEPLOY_ROLE }}
169+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
170+
INT_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.INT_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
171+
PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
172+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}
173+
174+
release_prod:
175+
needs: [tag_release, release_int, package_code, get_commit_id]
176+
uses: ./.github/workflows/sam_release_code.yml
177+
with:
178+
ARTIFACT_BUCKET_PREFIX: ${{needs.tag_release.outputs.spec_version}}
179+
STACK_NAME: fhir-validator
180+
TARGET_ENVIRONMENT: prod
181+
BUILD_ARTIFACT: packaged_code
182+
VERSION_NUMBER: ${{needs.tag_release.outputs.spec_version}}
183+
COMMIT_ID: ${{needs.get_commit_id.outputs.commit_id}}
184+
LOG_LEVEL: INFO
185+
LOG_RETENTION_DAYS: 731
186+
MARK_JIRA_RELEASED: true
187+
CREATE_PROD_RELEASE_NOTES: true
188+
secrets:
189+
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_DEPLOY_ROLE }}
190+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
191+
INT_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.INT_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
192+
PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
193+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}

0 commit comments

Comments
 (0)