base-cleanup-workspace.yml

name: 'Z-BASE: Cleanup - Workspace'

on:
  workflow_call:
    inputs:
      git_ref:
        description: 'Branch, tag or SHA'
        required: true
        type: string
      sandbox_name:
        description: 'Sandbox name'
        required: true
        type: string
      environment:
        description: "GitHub Environment name"
        required: true
        type: string
    secrets:
      AWS_ASSUME_ROLE:
        required: true

permissions:
  pull-requests: write
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

jobs:
  cleanup_process:
    name: Run Cleanup Versions Script
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          repository: 'NHSDigital/national-document-repository-infrastructure'
          ref: ${{ inputs.git_ref }}
          fetch-depth: '0'

      - name: Setup Python 3.11
        uses: actions/setup-python@v6
        with:
          python-version: 3.11

      - name: Make Virtual Environment
        run: |
          python3 -m venv ./venv
          ./venv/bin/pip3 install --upgrade pip
          ./venv/bin/pip3 install boto3==1.42.68

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
          role-skip-session-tagging: true
          aws-region: ${{ vars.AWS_REGION }}
          mask-aws-account-id: true

      - name: Run Cleanup Versions Script
        run: |
          ./venv/bin/python3 scripts/cleanup_versions.py ${{ inputs.sandbox_name }}