national-document-repository-infrastructure/.github/workflows/base-cleanup-lambda-edge.yml at ec314b210b369db0e9b40ae4d41700c0ebb2902c · NHSDigital/national-document-repository-infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: 'Z-BASE: Cleanup - Lambda@Edge'

on:
  workflow_call:
    inputs:
      git_ref:
        description: 'Branch, tag or SHA'
        required: true
        type: string
      sandbox_name:
        description: 'Sandbox name'
        required: true
        type: string
      environment:
        description: "GitHub Environment name"
        required: true
        type: string
    secrets:
      AWS_ASSUME_ROLE:
        required: true

permissions:
  pull-requests: write
  id-token: write # Required for requesting the JWT
  contents: read # Required for actions/checkout

jobs:
  remove_edge_associations:
    name: Remove Lambda@Edge Associations
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          repository: 'NHSDigital/national-document-repository-infrastructure'
          ref: ${{ inputs.git_ref }}
          fetch-depth: '0'

      - name: Setup Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: 3.11

      - name: Configure AWS Credentials for ${{ vars.AWS_REGION }}
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
          role-skip-session-tagging: true
          aws-region: ${{ vars.AWS_REGION }}
          mask-aws-account-id: true

      - name: Get CloudFront Distribution ID
        id: cloudfront
        run: |
          aws cloudfront list-distributions > distributions.json
          distribution_id=$(jq -r --arg origin_id "${{ inputs.sandbox_name }}-lloyd-george-store" \
          '.DistributionList.Items[] | select(.Origins.Items[].Id==$origin_id) | .Id' distributions.json | head -n 1)

          if [ -z "$distribution_id" ]; then
            echo "No distribution found for origin ID: ${{ inputs.sandbox_name }}-lloyd-george-store"
          else
            echo "Distribution ID found: $distribution_id"
          fi

          echo "DISTRIBUTION_ID=$distribution_id" >> $GITHUB_ENV

      - name: Install Python Dependencies
        if: env.DISTRIBUTION_ID != ''
        run: |
          python3 -m venv ./venv
          ./venv/bin/pip3 install --upgrade pip boto3==1.42.1

      - name: Remove Lambda@Edge & CloudFront Associations
        if: env.DISTRIBUTION_ID != ''
        run: ./venv/bin/python3 -u scripts/remove_edge_associations.py
        env:
          DISTRIBUTION_ID: ${{ env.DISTRIBUTION_ID }}
          LAMBDA_FUNCTION_NAME: "${{ inputs.sandbox_name }}_EdgePresignLambda"