Merge pull request #5758 from nhsuk/next

Version 6.11.0

Author: thomasleese

.github/actions/run-test-suites-check/action.yml

@@ -0,0 +1,42 @@
+name: 'Run Test Suites Check'
+description: 'Determines whether Rails test suites should run based on changed files'
+
+inputs:
+  base-ref:
+    description: 'Base ref for comparison'
+    required: false
+    default: ${{ github.event.pull_request.base.ref }}
+
+outputs:
+  run-test-suites:
+    description: 'Whether to run test suites (true/false)'
+    value: ${{ steps.check.outputs.run-test-suites }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Checkout code
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+
+    - name: Determine if rails tests are needed
+      id: check
+      shell: bash
+      run: |
+        if [ "${{ github.event_name }}" == "pull_request" ]; then
+          git fetch origin
+          RELEVANT_DIRS=$(git diff origin/${{ inputs.base-ref }}...HEAD --name-only)
+          if [ -z "$(echo "$RELEVANT_DIRS" | egrep -v '^(.github|adr|aws|docs|storage|terraform)/')" ]; then
+            echo "No relevant changes detected, skipping rails tests"
+            echo "run-test-suites=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+        fi
+        echo "Not a pull request or detected relevant changes: Running rails tests"
+        echo "run-test-suites=true" >> $GITHUB_OUTPUT
+
+    - name: Handle check failure
+      if: steps.check.outcome == 'failure'
+      shell: bash
+      run: echo "run-test-suites=true" >> $GITHUB_OUTPUT

.github/workflows/end-to-end-tests.yml

@@ -1,6 +1,7 @@
 name: End To End test run
 
 on:
+  pull_request:
   workflow_call:
     inputs:
       git_reference_for_application_image:
@@ -11,20 +12,45 @@ on:
         description: The environment to build the base image against
         type: string
         required: false
-        default: "next"
+        default: "origin/next"
     secrets:
       HTTP_AUTH_TOKEN_FOR_TESTS:
         description: HTTP Basic Auth token for the environment under test
         required: true
       MAVIS_TESTING_REPO_ACCESS_TOKEN:
         description: Access token for the manage-vaccinations-in-schools-testing repository
         required: true
+  workflow_dispatch:
+    inputs:
+      git_reference_for_application_image:
+        description: The git reference for deploying containerized mavis application
+        type: string
+        required: false
+      git_reference_for_database_image:
+        description: The environment to build the base image against
+        type: string
+        required: false
+        default: "origin/next"
 
 permissions: { }
 
 jobs:
+  check-if-run-needed:
+    name: Check if tests are required
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.git_reference_for_application_image || github.event.pull_request.head.sha ||  github.sha }}
+          repository: nhsuk/manage-vaccinations-in-schools
+      - name: Check if end-to-end tests need to run
+        id: check
+        uses: ./.github/actions/run-test-suites-check
+    outputs:
+      run-test-suites: ${{ steps.check.outputs.run-test-suites }}
   check-development-image-presence:
-    name: Check if docker image already exists
+    name: Check if mavis docker image already exists
     runs-on: ubuntu-latest
     permissions:
       id-token: write
@@ -39,24 +65,24 @@ jobs:
       - name: Check if image exists
         id: check-image
         run: |
-          if aws ecr describe-images --repository-name mavis/development --image-ids imageTag=${{ github.sha }} > /dev/null 2>&1; then
+          if aws ecr describe-images --repository-name mavis/development --image-ids imageTag=${{ inputs.git_reference_for_application_image || github.event.pull_request.head.sha ||  github.sha }} > /dev/null 2>&1; then
             echo "Docker image with given tag already exists"
             echo "build-needed=false" >> $GITHUB_OUTPUT
           else
             echo "Docker image does not exist. Build needed"
             echo "build-needed=true" >> $GITHUB_OUTPUT
           fi
   build-and-push-development-image:
-    needs: [ check-development-image-presence ]
-    if: needs.check-development-image-presence.outputs.build-needed == 'true'
+    needs: [ check-development-image-presence, check-if-run-needed ]
+    if: ${{ !cancelled() && needs.check-development-image-presence.outputs.build-needed == 'true' && (github.event_name != 'pull_request' || needs.check-if-run-needed.outputs.run-test-suites == 'true') }}
     runs-on: ubuntu-latest
     permissions:
       id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.git_reference_for_application_image || github.ref }}
+          ref: ${{ inputs.git_reference_for_application_image || github.event.pull_request.head.sha ||  github.sha }}
           repository: nhsuk/manage-vaccinations-in-schools
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v5
@@ -75,7 +101,7 @@ jobs:
             .
           docker push "393416225559.dkr.ecr.eu-west-2.amazonaws.com/mavis/development:${{ github.sha }}"
   check-database-image-presence:
-    name: Check if docker image already exists
+    name: Check if database docker image already exists
     runs-on: ubuntu-latest
     permissions:
       id-token: write
@@ -87,19 +113,24 @@ jobs:
         with:
           role-to-assume: arn:aws:iam::393416225559:role/GitHubAssuranceTestRole
           aws-region: eu-west-2
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
       - name: Check if image exists
         id: check-image
+        env:
+          GIT_REF: ${{ inputs.git_reference_for_database_image || (github.event_name == 'pull_request' && github.event.pull_request.base.sha) || github.sha }}
         run: |
-          if aws ecr describe-images --repository-name mavis/development --image-ids imageTag=${{ github.event.pull_request.base.ref }} > /dev/null 2>&1; then
+          if aws ecr describe-images --repository-name mavis/development --image-ids imageTag=$GIT_REF > /dev/null 2>&1; then
             echo "Docker image with given tag already exists"
             echo "build-needed=false" >> $GITHUB_OUTPUT
           else
             echo "Docker image does not exist. Build needed"
             echo "build-needed=true" >> $GITHUB_OUTPUT
           fi
   build-and-push-database-image:
-    needs: [ check-database-image-presence ]
-    if: needs.check-database-image-presence.outputs.build-needed == 'true'
+    needs: [ check-database-image-presence, check-if-run-needed ]
+    if: ${{ !cancelled() && needs.check-database-image-presence.outputs.build-needed == 'true' && (github.event_name != 'pull_request' || needs.check-if-run-needed.outputs.run-test-suites == 'true') }}
     permissions:
       id-token: write
       contents: read
@@ -110,13 +141,14 @@ jobs:
     needs: [ check-development-image-presence,
              build-and-push-development-image,
              check-database-image-presence,
-             build-and-push-database-image ]
+             build-and-push-database-image,
+             check-if-run-needed ]
     if: ${{ !cancelled() &&
       (needs.build-and-push-development-image.result == 'success' ||
       (needs.check-development-image-presence.result == 'success' && needs.build-and-push-development-image.result == 'skipped')) &&
       (needs.build-and-push-database-image.result == 'success' ||
       (needs.check-database-image-presence.result == 'success' && needs.build-and-push-database-image.result == 'skipped'))
-      }}
+      && (github.event_name != 'pull_request' || needs.check-if-run-needed.outputs.run-test-suites == 'true') }}
     runs-on: ubuntu-latest
     permissions:
       id-token: write

.github/workflows/test.yml

@@ -8,37 +8,15 @@ permissions: {}
 
 jobs:
   run-test-suites-check:
-    name: Check if Rails tests need to run
+    name: Check if E2E test is required
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - name: Determine if rails tests are needed
-        id: check-rails-relevant-changes
-        continue-on-error: true
-        run: |
-          if [ ${{ github.event_name }} == "pull_request" ]; then
-            git fetch origin
-            RELEVANT_DIRS=$(git diff origin/${{ github.event.pull_request.base.ref }}...HEAD --name-only)
-            if [ -z "$(echo "$RELEVANT_DIRS" | egrep -v "^(.github|adr|aws|docs|storage|terraform)/")" ]; then
-              echo "No relevant changes detected, skipping rails tests"
-              echo "RUN_TEST_SUITES=false" >> $GITHUB_ENV
-              exit 0
-            fi
-          fi
-          echo "Not a pull request or detected relevant changes: Running rails tests"
-          echo "RUN_TEST_SUITES=true" >> $GITHUB_ENV
-      - name: Run rails tests if diff check fails
-        id: check-rails-relevant-changes-failure
-        run: |
-          if [[ ${{ steps.check-rails-relevant-changes.outcome }} == failure ]]; then
-            echo "RUN_TEST_SUITES=true" >> $GITHUB_OUTPUT
-          else
-            echo "RUN_TEST_SUITES=$RUN_TEST_SUITES" >> $GITHUB_OUTPUT
-          fi
+      - name: Check if Rails tests need to run
+        id: check
+        uses: ./.github/actions/run-test-suites-check
     outputs:
-      run-test-suites: ${{ steps.check-rails-relevant-changes-failure.outputs.RUN_TEST_SUITES }}
+      run-test-suites: ${{ steps.check.outputs.run-test-suites }}
 
   rspec:
     name: RSpec
@@ -83,19 +61,6 @@ jobs:
         run: bundle exec rspec -t local_users
         env:
           MAVIS__CIS2__ENABLED: false
-  end-to-end:
-    name: End to End
-    needs: run-test-suites-check
-    if: ${{ needs.run-test-suites-check.outputs.run-test-suites == 'true' && github.event_name != 'push' }}
-    permissions:
-      id-token: write
-      contents: write
-    uses: ./.github/workflows/end-to-end-tests.yml
-    with:
-      git_reference_for_database_image: ${{ github.event.pull_request.base.ref }}
-    secrets:
-      HTTP_AUTH_TOKEN_FOR_TESTS: ${{ secrets.HTTP_AUTH_TOKEN_FOR_TESTS }}
-      MAVIS_TESTING_REPO_ACCESS_TOKEN: ${{ secrets.MAVIS_TESTING_REPO_ACCESS_TOKEN }}
 
   seeds:
     name: Seeds

.rubocop.yml

@@ -1,4 +1,6 @@
 inherit_gem:
+  pundit:
+    - config/rubocop-rspec.yml
   rubocop-govuk:
     - config/default.yml
     - config/rails.yml

.ruby-version

@@ -1 +1 @@
-ruby-3.4.6
+ruby-4.0.0

.tool-versions

@@ -4,6 +4,6 @@ nodejs      22.15.0
 pkl         0.28.1
 postgres    17.2
 redis       8.2.1
-ruby        3.4.6
+ruby        4.0.0
 terraform   1.13.3
 tflint      0.55.1

Dockerfile

@@ -2,7 +2,7 @@
 # check=error=true
 
 # Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.4.6
+ARG RUBY_VERSION=4.0.0
 ARG BUNDLE_WITHOUT="development:test"
 ARG RAILS_ENV="production"
 FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base

Gemfile

@@ -95,7 +95,10 @@ group :development do
   gem "hotwire-livereload"
   gem "prettier_print", require: false
   gem "rladr"
-  gem "rubocop-govuk", require: false
+  gem "rubocop-govuk",
+      require: false,
+      github: "alphagov/rubocop-govuk",
+      branch: "main"
   gem "ruby-prof", require: false
   gem "rufo", require: false
   gem "solargraph", require: false