Skip to content

Commit f512c64

Browse files
anthony-nhsanthony-nhs
authored
deploy from pull requests (#6)
## Summary - Routine Change ### Details - deploy from pull requests
1 parent 2fbad76 commit f512c64

6 files changed

Lines changed: 328 additions & 2 deletions

File tree

‎.github/scripts/release_code.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,5 @@ TRUSTSTORE_BUCKET_NAME=$(echo "${TRUSTSTORE_BUCKET_ARN}" | cut -d ":" -f 6)
1313
LATEST_TRUSTSTORE_VERSION=$(aws s3api list-object-versions --bucket "${TRUSTSTORE_BUCKET_NAME}" --prefix "${TRUSTSTORE_FILE}" --query 'Versions[?IsLatest].[VersionId]' --output text)
1414
export LATEST_TRUSTSTORE_VERSION
1515

16-
cd ../../.aws-sam/build || exit
16+
cd ../../ || exit
1717
make sam-deploy-package

‎.github/workflows/pull_request.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: deploy_pr
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
7+
env:
8+
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
9+
10+
jobs:
11+
quality_checks:
12+
uses: ./.github/workflows/quality_checks.yml
13+
secrets:
14+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
15+
16+
get_issue_number:
17+
runs-on: ubuntu-latest
18+
needs: quality_checks
19+
outputs:
20+
issue_number: ${{steps.get_issue_number.outputs.result}}
21+
22+
steps:
23+
- uses: actions/github-script@v7
24+
name: get issue number
25+
id: get_issue_number
26+
with:
27+
script: |
28+
if (context.issue.number) {
29+
// Return issue number if present
30+
return context.issue.number;
31+
} else {
32+
// Otherwise return issue number from commit
33+
return (
34+
await github.rest.repos.listPullRequestsAssociatedWithCommit({
35+
commit_sha: context.sha,
36+
owner: context.repo.owner,
37+
repo: context.repo.repo,
38+
})
39+
).data[0].number;
40+
}
41+
result-encoding: string
42+
43+
get_commit_id:
44+
runs-on: ubuntu-latest
45+
outputs:
46+
commit_id: ${{ steps.commit_id.outputs.commit_id }}
47+
steps:
48+
- name: Get Commit ID
49+
id: commit_id
50+
run: |
51+
echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
52+
53+
package_code:
54+
needs: get_issue_number
55+
uses: ./.github/workflows/sam_package_code.yml
56+
57+
release_code:
58+
needs: [get_issue_number, package_code, get_commit_id]
59+
uses: ./.github/workflows/sam_release_code.yml
60+
with:
61+
STACK_NAME: fhir-validator-pr-${{needs.get_issue_number.outputs.issue_number}}
62+
ARTIFACT_BUCKET_PREFIX: fhir-validator-PR-${{needs.get_issue_number.outputs.issue_number}}
63+
TARGET_ENVIRONMENT: dev-pr
64+
BUILD_ARTIFACT: packaged_code
65+
VERSION_NUMBER: fhir-validator-PR-${{ needs.get_issue_number.outputs.issue_number }}
66+
COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
67+
LOG_LEVEL: DEBUG
68+
LOG_RETENTION_DAYS: 30
69+
secrets:
70+
CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
71+

‎.github/workflows/quality_checks.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: quality checks
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
SONAR_TOKEN:
7+
required: true
8+
9+
jobs:
10+
quality_checks:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout code
14+
uses: actions/checkout@v4
15+
with:
16+
ref: ${{ env.BRANCH_NAME }}
17+
fetch-depth: 0
18+
19+
# using git commit sha for version of action to ensure we have stable version
20+
- name: Install asdf
21+
uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
22+
with:
23+
asdf_branch: v0.11.3
24+
25+
- name: Cache asdf
26+
uses: actions/cache@v4
27+
with:
28+
path: |
29+
~/.asdf
30+
key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
31+
restore-keys: |
32+
${{ runner.os }}-asdf-
33+
34+
- name: Install asdf dependencies in .tool-versions
35+
uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
36+
with:
37+
asdf_branch: v0.11.3
38+
env:
39+
PYTHON_CONFIGURE_OPTS: --enable-shared
40+
41+
- name: make install
42+
run: |
43+
make install
44+
45+
- name: run check-licenses
46+
run: make check-licenses
47+
48+
- name: run lint
49+
run: make lint
50+
51+
- name: run unit tests
52+
run: make test
53+
54+
# - name: SonarCloud Scan
55+
# uses: SonarSource/sonarcloud-github-action@master
56+
# env:
57+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎.github/workflows/sam_package_code.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: sam package code
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
sam_package_code:
8+
runs-on: ubuntu-latest
9+
permissions:
10+
id-token: write
11+
contents: read
12+
packages: read
13+
steps:
14+
- name: Checkout code
15+
uses: actions/checkout@v4
16+
with:
17+
ref: ${{ env.BRANCH_NAME }}
18+
19+
# using git commit sha for version of action to ensure we have stable version
20+
- name: Install asdf
21+
uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
22+
with:
23+
asdf_branch: v0.11.3
24+
25+
- name: Cache asdf
26+
uses: actions/cache@v4
27+
with:
28+
path: |
29+
~/.asdf
30+
key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
31+
restore-keys: |
32+
${{ runner.os }}-asdf-
33+
34+
- name: Install asdf dependencies in .tool-versions
35+
uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6
36+
with:
37+
asdf_branch: v0.11.3
38+
env:
39+
PYTHON_CONFIGURE_OPTS: --enable-shared
40+
41+
- name: make install
42+
run: |
43+
make install
44+
45+
- shell: bash
46+
name: package code
47+
run: |
48+
cp .tool-versions ~/
49+
rm -rf .aws-sam
50+
make sam-build
51+
cp Makefile .aws-sam/build/
52+
cp samconfig_package_and_deploy.toml .aws-sam/build/
53+
54+
- uses: actions/upload-artifact@v4
55+
name: upload build artifact
56+
with:
57+
name: packaged_code
58+
path: |
59+
.aws-sam/build
60+

‎.github/workflows/sam_release_code.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: sam release code
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
STACK_NAME:
7+
required: true
8+
type: string
9+
ARTIFACT_BUCKET_PREFIX:
10+
required: true
11+
type: string
12+
TARGET_ENVIRONMENT:
13+
required: true
14+
type: string
15+
BUILD_ARTIFACT:
16+
required: true
17+
type: string
18+
VERSION_NUMBER:
19+
required: true
20+
type: string
21+
COMMIT_ID:
22+
required: true
23+
type: string
24+
LOG_LEVEL:
25+
required: true
26+
type: string
27+
LOG_RETENTION_DAYS:
28+
required: true
29+
type: string
30+
CREATE_INT_RELEASE_NOTES:
31+
type: boolean
32+
default: false
33+
CREATE_INT_RC_RELEASE_NOTES:
34+
type: boolean
35+
default: false
36+
CREATE_PROD_RELEASE_NOTES:
37+
type: boolean
38+
default: false
39+
MARK_JIRA_RELEASED:
40+
type: boolean
41+
default: false
42+
secrets:
43+
CLOUD_FORMATION_DEPLOY_ROLE:
44+
required: true
45+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE:
46+
required: false
47+
INT_CLOUD_FORMATION_CHECK_VERSION_ROLE:
48+
required: false
49+
PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE:
50+
required: false
51+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
52+
required: false
53+
54+
jobs:
55+
sam_release_code:
56+
runs-on: ubuntu-latest
57+
environment: ${{ inputs.TARGET_ENVIRONMENT }}
58+
permissions:
59+
id-token: write
60+
contents: read
61+
62+
steps:
63+
- name: Checkout local github actions
64+
uses: actions/checkout@v4
65+
with:
66+
ref: ${{ env.BRANCH_NAME }}
67+
fetch-depth: 0
68+
sparse-checkout: |
69+
.github
70+
71+
- name: create_int_rc_release_notes
72+
uses: ./.github/actions/update_confluence_jira
73+
if: ${{ inputs.CREATE_INT_RC_RELEASE_NOTES == true }}
74+
with:
75+
TARGET_ENVIRONMENT: int
76+
RELEASE_TAG: ${{ inputs.VERSION_NUMBER }}
77+
CONFLUENCE_PAGE_ID: "778783127"
78+
CREATE_RC_RELEASE_NOTES: true
79+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
80+
TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.INT_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
81+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}
82+
83+
- name: Configure AWS Credentials
84+
uses: aws-actions/configure-aws-credentials@v4
85+
with:
86+
aws-region: eu-west-2
87+
role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
88+
role-session-name: github-actions
89+
90+
- name: download build artifact
91+
uses: actions/download-artifact@v4
92+
with:
93+
name: ${{ inputs.BUILD_ARTIFACT }}
94+
path: .
95+
96+
- name: release code
97+
shell: bash
98+
working-directory: .github/scripts
99+
env:
100+
artifact_bucket_prefix: fhir_validator/${{ inputs.ARTIFACT_BUCKET_PREFIX }}
101+
COMMIT_ID: ${{ inputs.COMMIT_ID }}
102+
LOG_LEVEL: ${{ inputs.LOG_LEVEL }}
103+
LOG_RETENTION_DAYS: ${{ inputs.LOG_RETENTION_DAYS }}
104+
stack_name: ${{ inputs.STACK_NAME }}
105+
TARGET_ENVIRONMENT: ${{ inputs.TARGET_ENVIRONMENT }}
106+
template_file: template.yaml
107+
VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
108+
run: ./release_code.sh
109+
110+
- name: create_int_release_notes
111+
uses: ./.github/actions/update_confluence_jira
112+
if: ${{ inputs.CREATE_INT_RELEASE_NOTES == true && always() && !failure() && !cancelled() }}
113+
with:
114+
TARGET_ENVIRONMENT: int
115+
CONFLUENCE_PAGE_ID: "778783122"
116+
CREATE_RC_RELEASE_NOTES: false
117+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
118+
TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.INT_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
119+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}
120+
121+
- name: create_prod_release_notes
122+
uses: ./.github/actions/update_confluence_jira
123+
if: ${{ inputs.CREATE_PROD_RELEASE_NOTES == true && always() && !failure() && !cancelled() }}
124+
with:
125+
TARGET_ENVIRONMENT: prod
126+
CONFLUENCE_PAGE_ID: "778783125"
127+
CREATE_RC_RELEASE_NOTES: false
128+
DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
129+
TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
130+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}
131+
132+
- name: mark_released_in_jira
133+
uses: ./.github/actions/mark_jira_released
134+
if: ${{ inputs.MARK_JIRA_RELEASED == true && always() && !failure() && !cancelled() }}
135+
with:
136+
RELEASE_TAG: ${{ inputs.VERSION_NUMBER }}
137+
DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ lint-githubaction-scripts:
3030
test: download-dependencies
3131
mvn test
3232

33-
check-licences:
33+
check-licenses:
3434
scripts/check_python_licenses.sh
3535
mvn validate
3636

0 commit comments

Comments
 (0)