alpha-integration-env.yml

name: Alpha Integration Environment

on:
  pull_request:
    branches: [alpha-integration]
    types: [closed]
  workflow_dispatch:

env:
  AWS_REGION: eu-west-2
  AWS_ACCOUNT_ID: "900119715266"
  ECR_REPOSITORY_NAME: "whoami"
  TF_STATE_BUCKET: "cds-cdg-dev-tfstate-900119715266"
  TF_STATE_KEY: "dev/preview/alpha-integration.tfstate"
  BRANCH_NAME: "alpha-integration"
  ALB_RULE_PRIORITY: "900"
  python_version: "3.14"
  PROXYGEN_API_NAME: ${{ vars.PROXYGEN_API_NAME }}

jobs:
  alpha-integration:
    name: Deploy alpha integration environment
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.merged == true

    permissions:
      id-token: write
      contents: read

    concurrency:
      group: alpha-integration-environment
      cancel-in-progress: true

    steps:
      - name: Checkout repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: alpha-integration

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
        with:
          role-to-assume: ${{ secrets.DEV_AWS_CREDENTIALS }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@19d944daaa35f0fa1d3f7f8af1d3f2e5de25c5b7

      - name: Compute deployment metadata
        id: meta
        run: |
          ECR_URL="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPOSITORY_NAME}"
          echo "ecr_url=$ECR_URL" >> "$GITHUB_OUTPUT"

      - name: Setup Python project
        uses: ./.github/actions/setup-python-project
        with:
          python-version: ${{ env.python_version }}

      - name: Build Docker image
        env:
          PYTHON_VERSION: ${{ env.python_version }}
        run: |
          make build IMAGE_TAG="${BRANCH_NAME}" ECR_URL="${{ steps.meta.outputs.ecr_url }}"

      - name: Push Docker image to ECR
        run: |
          docker push "${{ steps.meta.outputs.ecr_url }}:${BRANCH_NAME}"

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85
        with:
          terraform_version: 1.14.0

      - name: Terraform init
        working-directory: infrastructure/environments/preview
        run: |
          terraform init \
            -backend-config="bucket=${TF_STATE_BUCKET}" \
            -backend-config="key=${TF_STATE_KEY}" \
            -backend-config="region=${AWS_REGION}"

      - name: Terraform apply alpha integration env
        working-directory: infrastructure/environments/preview
        env:
          TF_VAR_branch_name: ${{ env.BRANCH_NAME }}
          TF_VAR_image_tag: ${{ env.BRANCH_NAME }}
          TF_VAR_alb_rule_priority: ${{ env.ALB_RULE_PRIORITY }}
        run: |
          terraform apply \
            -var-file="alpha-int.tfvars" \
            -auto-approve

      - name: Capture terraform outputs
        id: tf-output
        working-directory: infrastructure/environments/preview
        run: |
          terraform output -json > tf-output.json

          URL=$(jq -r '.url.value' tf-output.json)
          echo "preview_url=$URL" >> "$GITHUB_OUTPUT"

          TG=$(jq -r '.target_group_arn.value' tf-output.json)
          echo "target_group=$TG" >> "$GITHUB_OUTPUT"

          ECS_SERVICE=$(jq -r '.ecs_service_name.value' tf-output.json)
          echo "ecs_service=$ECS_SERVICE" >> "$GITHUB_OUTPUT"

          ECS_CLUSTER=$(jq -r '.ecs_cluster_name.value' tf-output.json)
          echo "ecs_cluster=$ECS_CLUSTER" >> "$GITHUB_OUTPUT"

      - name: Get proxygen machine user details
        id: proxygen-machine-user
        uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53
        with:
          secret-ids: /cds/gateway/dev/proxygen/proxygen-key-secret
          name-transformation: lowercase

      - name: Deploy alpha integration API proxy
        uses: ./.github/actions/proxy/deploy-proxy
        with:
          mtls-secret-name: ${{ vars.PREVIEW_ENV_MTLS_SECRET_NAME }}
          target-url: ${{ steps.tf-output.outputs.preview_url }}
          proxy-base-path: "clinical-data-gateway-api-poc-alpha-integration"
          proxygen-key-secret: ${{ env._cds_gateway_dev_proxygen_proxygen_key_secret }}
          proxygen-key-id: ${{ vars.PREVIEW_ENV_PROXYGEN_KEY_ID }}
          proxygen-api-name: ${{ vars.PROXYGEN_API_NAME }}
          proxygen-client-id: ${{ vars.PREVIEW_ENV_PROXYGEN_CLIENT_ID }}

      - name: Await deployment completion
        run: |
          aws ecs wait services-stable \
            --cluster "${{ steps.tf-output.outputs.ecs_cluster }}" \
            --services "${{ steps.tf-output.outputs.ecs_service }}" \
            --region "${AWS_REGION}"

      - name: Get mTLS certs for testing
        id: mtls-certs
        uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53
        with:
          secret-ids: |
            /cds/gateway/dev/mtls/client1-key-secret
            /cds/gateway/dev/mtls/client1-key-public
          name-transformation: lowercase

      - name: Prepare mTLS cert files for tests
        run: |
          printf '%s' "$_cds_gateway_dev_mtls_client1_key_secret" > /tmp/client1-key.pem
          printf '%s' "$_cds_gateway_dev_mtls_client1_key_public" > /tmp/client1-cert.pem
          chmod 600 /tmp/client1-key.pem /tmp/client1-cert.pem

      - name: Smoke test environment URL
        id: smoke-test
        env:
          PREVIEW_URL: ${{ steps.tf-output.outputs.preview_url }}
        run: |
          if [ -z "$PREVIEW_URL" ] || [ "$PREVIEW_URL" = "null" ]; then
            echo "Environment URL missing"
            echo "http_status=missing" >> "$GITHUB_OUTPUT"
            echo "http_result=missing-url" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          STATUS=$(curl \
                      --cert /tmp/client1-cert.pem \
                      --key /tmp/client1-key.pem \
                      --silent \
                      --output /tmp/preview.headers \
                      --write-out '%{http_code}' \
                      --head \
                      --max-time 30 "$PREVIEW_URL"/health || true)

          if [ "$STATUS" = "404" ]; then
            echo "Environment responded with expected 404"
            echo "http_status=404" >> "$GITHUB_OUTPUT"
            echo "http_result=allowed-404" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          if [[ "$STATUS" =~ ^[0-9]{3}$ ]] && [ "$STATUS" -ge 200 ] && [ "$STATUS" -lt 400 ]; then
            echo "Environment responded with status $STATUS"
            echo "http_status=$STATUS" >> "$GITHUB_OUTPUT"
            echo "http_result=success" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "Environment responded with unexpected status $STATUS"
          if [ -f /tmp/preview.headers ]; then
            echo "Response headers:"
            cat /tmp/preview.headers
          fi

          echo "http_status=$STATUS" >> "$GITHUB_OUTPUT"
          echo "http_result=unexpected-status" >> "$GITHUB_OUTPUT"
          exit 0

      - name: Run unit tests
        uses: ./.github/actions/run-test-suite
        with:
          test-type: unit

      - name: Run contract tests
        uses: ./.github/actions/run-test-suite
        with:
          test-type: contract
          env: alpha-int

      - name: Run schema validation tests
        uses: ./.github/actions/run-test-suite
        with:
          test-type: schema
          env: alpha-int

      - name: Run integration tests
        uses: ./.github/actions/run-test-suite
        with:
          test-type: integration
          env: alpha-int

      - name: Run acceptance tests
        uses: ./.github/actions/run-test-suite
        with:
          test-type: acceptance
          env: alpha-int

      - name: Remove mTLS temp files
        run: rm -f /tmp/client1-key.pem /tmp/client1-cert.pem

      # - name: Trivy IaC scan - replacement
      # - name: Trivy image scan - replacement
      # - name: Generate SBOM - replacement