[DTOSS-13744] Manual pipeline to deploy gateways

.github/workflows/cicd-1-pull-request.yaml

@@ -30,7 +30,7 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'deploy')
     permissions:
       id-token: write
-    uses: ./.github/workflows/stage-4-deploy.yaml
+    uses: ./.github/workflows/stage-4-deploy-infrastructure-stack.yaml
     with:
       environments: '["review"]'
       commit_sha: ${{ github.event.pull_request.head.sha }}
@@ -54,7 +54,7 @@ jobs:
     if: contains(github.event.pull_request.labels.*.name, 'deploy')
     permissions:
       id-token: write
-    uses: ./.github/workflows/stage-4-deploy-app.yaml
+    uses: ./.github/workflows/stage-4-deploy-application-stack.yaml
     with:
       environments: '["review"]'
       release_tag: pr-${{ github.event.pull_request.number }}

.github/workflows/cicd-2-main-branch.yaml

@@ -194,7 +194,7 @@ jobs:
     if: needs.resolve.outputs.deploy_review == 'true'
     permissions:
       id-token: write
-    uses: ./.github/workflows/stage-4-deploy.yaml
+    uses: ./.github/workflows/stage-4-deploy-infrastructure-stack.yaml
     with:
       environments: '["review"]'
       commit_sha: ${{ github.sha }}
@@ -207,7 +207,7 @@ jobs:
     if: needs.resolve.outputs.deploy_review == 'true'
     permissions:
       id-token: write
-    uses: ./.github/workflows/stage-4-deploy-app.yaml
+    uses: ./.github/workflows/stage-4-deploy-application-stack.yaml
     with:
       environments: '["review"]'
       release_tag: ${{ needs.resolve.outputs.release_tag }}

.github/workflows/stage-4-deploy-application-stack.yaml

@@ -0,0 +1,82 @@
+name: Deployment application stack
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: GitHub release tag to deploy (defaults to the last release if not specified)
+        required: false
+        type: string
+
+      environment:
+        description: Environment to deploy to
+        required: true
+        type: choice
+        options:
+          - review
+          - dev
+          - preprod
+          - prod
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy:
+    name: Deploy ${{ inputs.environment }}
+    runs-on: ubuntu-latest
+
+    environment: ${{ inputs.environment }}
+
+    # Prevent concurrent app deployments to the same environment
+    concurrency: deploy-app-${{ inputs.environment }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Azure login
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Call deployment pipeline
+
+        env:
+          ENVIRONMENT: ${{ inputs.environment }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+          ADO_PROJECT: ${{ github.event.repository.name }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
+
+          echo "Starting Azure DevOps pipeline \"Deploy Gateway App - ${ENVIRONMENT}\"..."
+
+          if [ -z "${RELEASE_TAG}" ]; then
+            RELEASE_TAG=$(gh release view --repo "${GITHUB_REPOSITORY}" --json tagName --jq '.tagName')
+            echo "No release tag supplied. Using latest release (default): ${RELEASE_TAG}"
+          else
+            echo "Using supplied release tag: ${RELEASE_TAG}"
+          fi
+
+          RUN_ID=$(az pipelines run \
+            --name "Deploy Gateway App - ${ENVIRONMENT}" \
+            --org https://dev.azure.com/nhse-dtos \
+            --project "${ADO_PROJECT}" \
+            --parameters \
+              releaseTag="${RELEASE_TAG}" \
+              environment="${ENVIRONMENT}" \
+              pool="${ADO_MANAGEMENT_POOL}" \
+              githubToken="${GITHUB_TOKEN}" \
+            --output tsv \
+            --query id)
+
+          echo "See pipeline run in Azure DevOps: https://dev.azure.com/nhse-dtos/${ADO_PROJECT}/_build/results?buildId=${RUN_ID}&view=results"
+
+          scripts/bash/wait_ado_pipeline.sh \
+            "$RUN_ID" \
+            https://dev.azure.com/nhse-dtos \
+            "${ADO_PROJECT}"

.github/workflows/stage-4-deploy-infrastructure-stack.yaml

@@ -0,0 +1,73 @@
+name: Deployment infrastructure stack
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Target environment
+        required: true
+        type: choice
+        options:
+          - review
+          - dev
+          - preprod
+          - prod
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy:
+    name: Deploy ${{ inputs.environment }}
+    runs-on: ubuntu-latest
+
+    environment: ${{ inputs.environment }}
+
+    # Prevent concurrent deployments to the same environment
+    concurrency: deploy-${{ inputs.environment }}
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Azure login
+        uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Call deployment pipeline
+        env:
+          ENVIRONMENT: ${{ inputs.environment }}
+          COMMIT_SHA: ${{ github.sha }}
+          BRANCH_NAME: ${{ github.ref_name }}
+          ADO_PROJECT: ${{ github.event.repository.name }}
+        run: |
+          source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
+
+          echo "Starting Azure DevOps pipeline \"Deploy to Azure - ${ENVIRONMENT}\"..."
+
+          RUN_ID=$(az pipelines run \
+            --branch "${BRANCH_NAME}" \
+            --commit-id "${COMMIT_SHA}" \
+            --name "Deploy to Azure - ${ENVIRONMENT}" \
+            --org https://dev.azure.com/nhse-dtos \
+            --project "${ADO_PROJECT}" \
+            --parameters \
+              commitSHA="${COMMIT_SHA}" \
+              environment="${ENVIRONMENT}" \
+              pool="${ADO_MANAGEMENT_POOL}" \
+            --output tsv \
+            --query id)
+
+          echo "See pipeline run in Azure DevOps: https://dev.azure.com/nhse-dtos/${ADO_PROJECT}/_build/results?buildId=${RUN_ID}&view=results"
+
+          scripts/bash/wait_ado_pipeline.sh \
+            "$RUN_ID" \
+            https://dev.azure.com/nhse-dtos \
+            "${ADO_PROJECT}"