Skip to content

Commit ff7712c

Browse files
thomasleesethomasleese
authored
v2.1.1 (work in progress) (#3256)
2 parents ea36ec7 + 2b45d20 commit ff7712c

15 files changed

Lines changed: 262 additions & 119 deletions

.github/workflows/build.yml renamed to .github/workflows/build-and-push-image.yml

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,34 @@
1-
name: Build Mavis image
1+
name: Build and push image
2+
23
on:
34
workflow_dispatch:
45
workflow_call:
56

67
jobs:
7-
Build:
8+
build:
89
runs-on: ubuntu-latest
910
steps:
1011
- name: Checkout code
1112
uses: actions/checkout@v4
1213
- name: Build Docker image
13-
run: |
14-
docker build -t "mavis:latest" .
14+
run: docker build -t "mavis:latest" .
1515
- name: Save Docker image
16-
run: |
17-
docker save -o image.tar mavis:latest
16+
run: docker save -o image.tar mavis:latest
1817
- name: Upload Docker image
1918
uses: actions/upload-artifact@v4
2019
with:
2120
name: image
2221
path: image.tar
23-
Push-image:
22+
push:
2423
runs-on: ubuntu-latest
25-
needs: Build
24+
needs: build
2625
permissions:
2726
id-token: write
2827
strategy:
2928
matrix:
3029
aws-role:
31-
[
32-
"arn:aws:iam::820242920762:role/GitHubActionsRole",
33-
"arn:aws:iam::393416225559:role/GitHubActionsRole",
34-
]
30+
- arn:aws:iam::820242920762:role/GitHubActionsRole
31+
- arn:aws:iam::393416225559:role/GitHubActionsRole
3532
steps:
3633
- name: Download Docker image
3734
uses: actions/download-artifact@v4
@@ -46,11 +43,8 @@ jobs:
4643
id: login-ecr
4744
uses: aws-actions/amazon-ecr-login@v2
4845
- name: Load Docker image
49-
run: |
50-
docker load -i image.tar
46+
run: docker load -i image.tar
5147
- name: Tag Docker image
52-
run: |
53-
docker tag mavis:latest "${{ steps.login-ecr.outputs.registry }}/mavis/webapp":"${{ github.sha }}"
48+
run: docker tag mavis:latest "${{ steps.login-ecr.outputs.registry }}/mavis/webapp":"${{ github.sha }}"
5449
- name: Push Docker image
55-
run: |
56-
docker push "${{ steps.login-ecr.outputs.registry }}/mavis/webapp":"${{ github.sha }}"
50+
run: docker push "${{ steps.login-ecr.outputs.registry }}/mavis/webapp":"${{ github.sha }}"

‎.github/workflows/continuous-deployment.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Continuous deployment
2+
run-name: Continuous deployment of ${{ github.ref }} to "copilotmigration"
3+
4+
on:
5+
push:
6+
branches: [main]
7+
8+
jobs:
9+
test:
10+
uses: ./.github/workflows/test.yml
11+
build-and-push-image:
12+
needs: test
13+
uses: ./.github/workflows/build-and-push-image.yml
14+
deploy-infrastructure:
15+
needs: test
16+
uses: ./.github/workflows/deploy-infrastructure.yml
17+
with:
18+
environment: copilotmigration
19+
deploy-application:
20+
needs: [build-and-push-image, deploy-infrastructure]
21+
uses: ./.github/workflows/deploy-application.yml
22+
with:
23+
environment: copilotmigration

‎.github/workflows/continuous_deployment.yml‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

.github/workflows/deploy_application.yml renamed to .github/workflows/deploy-application.yml

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
name: TF Deploy Application
2-
run-name: TF Deploy Application on ${{ inputs.environment }}
1+
name: Deploy application
2+
run-name: Deploy application to ${{ inputs.environment }}
33

44
on:
55
workflow_dispatch:
66
inputs:
77
environment:
8-
description: "Deployment environment"
8+
description: Deployment environment
99
required: true
1010
type: choice
1111
options:
@@ -15,9 +15,9 @@ on:
1515
- test
1616
- preview
1717
- training
18-
# - production
18+
- production
1919
image_tag:
20-
description: "Docker image tag"
20+
description: Docker image tag
2121
required: false
2222
type: string
2323
workflow_call:
@@ -28,12 +28,13 @@ on:
2828

2929
env:
3030
aws-role: ${{ inputs.environment == 'production'
31-
&& 'arn:aws:iam::820242920762:role/GitHubActionsRole'
31+
&& 'arn:aws:iam::820242920762:role/GithubDeployMavisAndInfrastructure'
3232
|| 'arn:aws:iam::393416225559:role/GithubDeployMavisAndInfrastructure' }}
3333
tf-dir: terraform/app
3434

3535
jobs:
36-
PlanUpdate:
36+
plan-changes:
37+
name: Plan task definition changes
3738
runs-on: ubuntu-latest
3839
permissions:
3940
id-token: write
@@ -78,9 +79,11 @@ jobs:
7879
with:
7980
name: tfplan_app
8081
path: ${{ runner.temp }}/tfplan
81-
DeployUpdate:
82+
83+
apply-changes:
84+
name: Apply task definition changes
8285
runs-on: ubuntu-latest
83-
needs: PlanUpdate
86+
needs: plan-changes
8487
environment: ${{ inputs.environment }}
8588
permissions:
8689
id-token: write
@@ -115,9 +118,11 @@ jobs:
115118
with:
116119
name: CODEDEPLOY_ENV
117120
path: ${{ runner.temp }}/CODEDEPLOY_ENV
118-
TriggerCodeDeploy:
121+
122+
create-deployment:
123+
name: Create deployment
119124
runs-on: ubuntu-latest
120-
needs: DeployUpdate
125+
needs: apply-changes
121126
environment: ${{ inputs.environment }}
122127
permissions:
123128
id-token: write
@@ -133,8 +138,7 @@ jobs:
133138
role-to-assume: ${{ env.aws-role }}
134139
aws-region: eu-west-2
135140
- name: Install AWS CLI
136-
run: |
137-
sudo snap install --classic aws-cli
141+
run: sudo snap install --classic aws-cli
138142
- name: Trigger CodeDeploy deployment
139143
run: |
140144
source ${{ runner.temp }}/artifact/CODEDEPLOY_ENV

.github/workflows/deploy_infrastructure.yml renamed to .github/workflows/deploy-infrastructure.yml

Lines changed: 27 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
name: Deploy Infrastructure with Terraform
2-
run-name: Deploy AWS infrastructure for ${{ inputs.environment }}
1+
name: Deploy infrastructure
2+
run-name: Deploy infrastructure for ${{ inputs.environment }}
33

44
on:
55
workflow_dispatch:
66
inputs:
77
environment:
8-
description: "Deployment environment"
8+
description: Deployment environment
99
required: true
1010
type: choice
1111
options:
@@ -15,22 +15,27 @@ on:
1515
- test
1616
- preview
1717
- training
18-
# - production
18+
- production
19+
docker_sha:
20+
description: "Docker image sha to deploy. This is used only if no existing task definition is found"
21+
required: false
22+
type: string
1923
workflow_call:
2024
inputs:
2125
environment:
22-
description: "Deployment environment"
26+
description: Deployment environment
2327
required: true
2428
type: string
2529

2630
env:
2731
aws_role: ${{ inputs.environment == 'production'
28-
&& 'arn:aws:iam::820242920762:role/GitHubActionsRole'
32+
&& 'arn:aws:iam::820242920762:role/GithubDeployMavisAndInfrastructure'
2933
|| 'arn:aws:iam::393416225559:role/GithubDeployMavisAndInfrastructure' }}
3034
tf_dir: terraform/app
3135

3236
jobs:
33-
TerraformPlan:
37+
plan:
38+
name: Terraform plan
3439
runs-on: ubuntu-latest
3540
permissions:
3641
id-token: write
@@ -47,36 +52,24 @@ jobs:
4752
with:
4853
terraform_version: 1.10.5
4954
- name: Install AWS Cli
50-
run: |
51-
sudo snap install --classic aws-cli
55+
run: sudo snap install --classic aws-cli
5256
- name: Check if any deployments are running
5357
working-directory: ${{ env.tf_dir }}
5458
run: |
55-
set -e
56-
terraform init -backend-config="env/${{ inputs.environment }}-backend.hcl" -upgrade
57-
APPLICATION_NAME=$(terraform output -raw codedeploy_application_name)
58-
echo "Application Name: $APPLICATION_NAME"
59-
APPLICATION_GROUP=$(terraform output -raw codedeploy_deployment_group_name)
60-
echo "Deployment Group Name: $APPLICATION_GROUP"
61-
running_deployment=$(aws deploy list-deployments --application-name $APPLICATION_NAME \
62-
--deployment-group-name $APPLICATION_GROUP --include-only-statuses InProgress \
63-
--query 'deployments[0]' --output text)
64-
if [ "$running_deployment" != "None" ]; then
65-
echo "A mavis deployment for ${{ inputs.environment }} is currently running: $running_deployment"
66-
echo "Aborting infrastructure deployment"
67-
exit 1
68-
fi
69-
- name: Get saved image digest
59+
../scripts/check-for-running-deployments.sh ${{ inputs.environment }}
60+
- name: Get image digest
7061
working-directory: ${{ env.tf_dir }}
7162
run: |
72-
DIGEST=$(terraform state show aws_ecs_task_definition.task_definition | grep -oP '(?<=mavis/webapp@)sha256:[0-9a-z]{64}')
73-
if [ -z "$DIGEST" ]; then
74-
echo "Image digest not found in the currently deployed task definition"
75-
echo "Aborting infrastructure deployment"
76-
exit 1
63+
DIGEST="${{ inputs.docker_sha }}"
64+
if terraform state list | grep -q 'aws_ecs_task_definition.task_definition'; then
65+
DIGEST=$(terraform state show aws_ecs_task_definition.task_definition | grep -oP '(?<=mavis/webapp@)sha256:[0-9a-z]{64}')
66+
echo "Existing task definition found, using image digest from the state: $DIGEST"
67+
elif [ -z "$DIGEST" ]; then
68+
echo "Aborting infrastructure deployment: Missing existing task definition or image digest input parameter"
69+
else
70+
echo "No existing task definition found: Using image digest from the input parameter: $DIGEST"
7771
fi
7872
echo "DIGEST=$DIGEST" >> $GITHUB_ENV
79-
echo "Image digest in terraform state: $DIGEST"
8073
- name: Terraform Plan
8174
id: plan
8275
working-directory: ${{ env.tf_dir }}
@@ -93,9 +86,11 @@ jobs:
9386
with:
9487
name: tfplan_infrastructure
9588
path: ${{ runner.temp }}/tfplan
96-
ApplyUpdate:
89+
90+
apply:
91+
name: Terraform apply
9792
runs-on: ubuntu-latest
98-
needs: TerraformPlan
93+
needs: plan
9994
environment: ${{ inputs.environment }}
10095
permissions:
10196
id-token: write

‎.github/workflows/destroy_infrastructure.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: Destroy Infrastructure
2+
run-name: Destroy Infrastructure for ${{ inputs.environment }}
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
environment:
8+
description: "Environment to be Destroyed"
9+
required: true
10+
type: choice
11+
options:
12+
- qa
13+
- poc
14+
- copilotmigration
15+
- test
16+
- preview
17+
- training
18+
19+
env:
20+
aws_role: arn:aws:iam::393416225559:role/GithubDeployMavisAndInfrastructure
21+
tf_dir: terraform/app
22+
23+
jobs:
24+
destroy-resources:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
id-token: write
28+
environment: ${{ inputs.environment }}
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@v4
32+
- name: Configure AWS Credentials
33+
uses: aws-actions/configure-aws-credentials@v4
34+
with:
35+
role-to-assume: ${{ env.aws_role }}
36+
aws-region: eu-west-2
37+
- name: Install terraform
38+
uses: hashicorp/setup-terraform@v3
39+
with:
40+
terraform_version: 1.10.5
41+
- name: Ensure DB cluster can be deleted
42+
working-directory: ${{ env.tf_dir }}
43+
run: |
44+
set -e
45+
terraform init -backend-config="env/${{ inputs.environment }}-backend.hcl" -upgrade
46+
if terraform state list | grep -q 'aws_rds_cluster.aurora_cluster'; then
47+
echo "DB cluster exsits: removing delete protection"
48+
CLUSTER_IDENTIFIER=$(grep -oP 'db_cluster\s*=\s*"\K[^"]+' env/${{ inputs.environment }}.tfvars)
49+
aws rds modify-db-cluster --db-cluster-identifier "$CLUSTER_IDENTIFIER" --no-deletion-protection
50+
echo "DB cluster delete protection removed: proceeding to delete stage"
51+
else
52+
echo "DB cluster not in state: proceeding to delete stage"
53+
fi
54+
55+
- name: Delete cluster
56+
working-directory: ${{ env.tf_dir }}
57+
run: |
58+
terraform destroy -var-file="env/${{ inputs.environment }}.tfvars" \
59+
-var="image_digest=notneededfordestroy" -auto-approve
60+
destroy-backend:
61+
runs-on: ubuntu-latest
62+
needs: destroy-resources
63+
permissions:
64+
id-token: write
65+
environment: ${{ inputs.environment }}
66+
steps:
67+
- name: Configure AWS Credentials
68+
uses: aws-actions/configure-aws-credentials@v4
69+
with:
70+
role-to-assume: ${{ env.aws_role }}
71+
aws-region: eu-west-2
72+
- name: Install AWS CLI
73+
run: |
74+
sudo snap install --classic aws-cli
75+
- name: Delete terraform backend elements
76+
run: |
77+
TF_STATE_FILE=nhse-mavis-terraform-state/terraform-${{ inputs.environment }}.tfstate
78+
aws s3 rm s3://$TF_STATE_FILE
79+
aws dynamodb delete-item --table-name mavis-terraform-state-lock \
80+
--key "{\"LockID\": {\"S\": \"$TF_STATE_FILE-md5\"}}"

‎terraform/app/codedeploy.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,14 +59,14 @@ resource "aws_s3_bucket" "code_deploy_bucket" {
5959

6060

6161
data "aws_s3_bucket" "logs" {
62-
bucket = "nhse-mavis-logs-${var.environment}"
62+
bucket = var.access_logs_bucket
6363
}
6464

6565
resource "aws_s3_bucket_logging" "example" {
6666
bucket = aws_s3_bucket.code_deploy_bucket.id
6767

6868
target_bucket = data.aws_s3_bucket.logs.id
69-
target_prefix = "codedeploy-log/"
69+
target_prefix = "codedeploy-log-${var.environment}/"
7070
}
7171

7272
resource "aws_s3_bucket_versioning" "code_deploy_bucket_versioning" {

0 commit comments

Comments
 (0)