nhs-notify-repository-template/.github/workflows/cicd-1-pull-request.yaml at 4831740ba9a378744cbee1efcebd96b5589e39c6 · NHSDigital/nhs-notify-repository-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: "1. CI/CD pull request"

# The total recommended execution time for the "CI/CD Pull Request" workflow is around 20 minutes.

on:
  push:
    branches:
      - "**"
  pull_request:
    types: [opened, reopened]
    branches:
      - main

jobs:
  metadata:
    name: "Set CI/CD metadata"
    runs-on: ubuntu-latest
    timeout-minutes: 1
    outputs:
      build_datetime_london: ${{ steps.variables.outputs.build_datetime_london }}
      build_datetime: ${{ steps.variables.outputs.build_datetime }}
      build_timestamp: ${{ steps.variables.outputs.build_timestamp }}
      build_epoch: ${{ steps.variables.outputs.build_epoch }}
      nodejs_version: ${{ steps.variables.outputs.nodejs_version }}
      python_version: ${{ steps.variables.outputs.python_version }}
      terraform_version: ${{ steps.variables.outputs.terraform_version }}
      version: ${{ steps.variables.outputs.version }}
      is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
      does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
      pr_number: ${{ steps.pr_exists.outputs.pr_number }}
      #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
      # skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
    steps:
      - name: "Checkout code"
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: "Set CI/CD variables"
        id: variables
        run: |
          datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
          BUILD_DATETIME=$datetime make version-create-effective-file dir=.
          version=$(head -n 1 .version 2> /dev/null || echo unknown)
          echo "build_datetime_london=$(TZ=Europe/London date --date=$datetime +'%Y-%m-%dT%H:%M:%S%z')" >> $GITHUB_OUTPUT
          echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
          echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
          echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
          echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
          echo "python_version=$(grep "^python\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
          echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
          echo "version=$(echo $version)" >> $GITHUB_OUTPUT
          echo "is_version_prerelease=$(if [[ $version == *-* ]]; then echo "true"; else echo "false"; fi)" >> $GITHUB_OUTPUT

      - name: "Check if pull request exists for this branch"
        id: pr_exists
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          branch_name=${GITHUB_HEAD_REF:-$(echo $GITHUB_REF | sed 's#refs/heads/##')}
          echo "Current branch is '$branch_name'"

          pr_json=$(gh pr list --head "$branch_name" --state open --json number --limit 1)
          pr_number=$(echo "$pr_json" | jq -r '.[0].number // empty')

          if [[ -n "$pr_number" ]]; then
            echo "Pull request exists: #$pr_number"
            echo "does_pull_request_exist=true" >> $GITHUB_OUTPUT
            echo "pr_number=$pr_number" >> $GITHUB_OUTPUT
          else
            echo "Pull request doesn't exist"
            echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
            echo "pr_number=" >> $GITHUB_OUTPUT
          fi
      #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
      # - name: "Determine if Trivy package scan should be skipped"
      #   id: skip_trivy
      #   env:
      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      #     PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
      #   run: |
      #     if [[ -z "$PR_NUMBER" ]]; then
      #       echo "No pull request detected; Trivy package scan will run."
      #       echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
      #       exit 0
      #     fi

      #     labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
      #     echo "Labels on PR #$PR_NUMBER: $labels"

      #     if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
      #       echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
      #     else
      #       echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
      #     fi
      - name: "List variables"
        run: |
          export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
          export BUILD_DATETIME="${{ steps.variables.outputs.build_datetime }}"
          export BUILD_TIMESTAMP="${{ steps.variables.outputs.build_timestamp }}"
          export BUILD_EPOCH="${{ steps.variables.outputs.build_epoch }}"
          export NODEJS_VERSION="${{ steps.variables.outputs.nodejs_version }}"
          export PYTHON_VERSION="${{ steps.variables.outputs.python_version }}"
          export TERRAFORM_VERSION="${{ steps.variables.outputs.terraform_version }}"
          export VERSION="${{ steps.variables.outputs.version }}"
          export DOES_PULL_REQUEST_EXIST="${{ steps.pr_exists.outputs.does_pull_request_exist }}"
          export IS_VERSION_PRERELEASE="${{ steps.variables.outputs.is_version_prerelease }}"
          make list-variables
  commit-stage: # Recommended maximum execution time is 2 minutes
    name: "Commit stage"
    needs: [metadata]
    uses: ./.github/workflows/stage-1-commit.yaml
    with:
      build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
      build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
      build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
      nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
      python_version: "${{ needs.metadata.outputs.python_version }}"
      #TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
      # skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
      terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
      version: "${{ needs.metadata.outputs.version }}"
    secrets: inherit
  test-stage: # Recommended maximum execution time is 5 minutes
    name: "Test stage"
    needs: [metadata, commit-stage]
    uses: ./.github/workflows/stage-2-test.yaml
    with:
      build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
      build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
      build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
      nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
      python_version: "${{ needs.metadata.outputs.python_version }}"
      terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
      version: "${{ needs.metadata.outputs.version }}"
    secrets: inherit
  build-stage: # Recommended maximum execution time is 3 minutes
    name: "Build stage"
    needs: [metadata, test-stage]
    uses: ./.github/workflows/stage-3-build.yaml
    if: needs.metadata.outputs.does_pull_request_exist == 'true' || (github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened')) || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    with:
      build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
      build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
      build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
      nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
      python_version: "${{ needs.metadata.outputs.python_version }}"
      terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
      version: "${{ needs.metadata.outputs.version }}"
    secrets: inherit
  acceptance-stage: # Recommended maximum execution time is 10 minutes
    name: "Acceptance stage"
    needs: [metadata, build-stage]
    uses: ./.github/workflows/stage-4-acceptance.yaml
    if: needs.metadata.outputs.does_pull_request_exist == 'true' || (github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'reopened')) || (github.event_name == 'push' && github.ref == 'refs/heads/main')
    with:
      build_datetime: "${{ needs.metadata.outputs.build_datetime }}"
      build_timestamp: "${{ needs.metadata.outputs.build_timestamp }}"
      build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
      nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
      python_version: "${{ needs.metadata.outputs.python_version }}"
      terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
      version: "${{ needs.metadata.outputs.version }}"
    secrets: inherit