Update core workflows to use reusable pipelines

ministryofjustice · Jun 24, 2024 · 414f78d · 414f78d
1 parent d3aa63d
commit 414f78d
Show file tree

Hide file tree

Showing 4 changed files with 29 additions and 385 deletions.
diff --git a/.github/workflows/core-logging-deployment.yml b/.github/workflows/core-logging-deployment.yml
@@ -20,107 +20,20 @@ on:
       - '.github/workflows/core-logging-deployment.yml'
   workflow_dispatch:
 
-env:
-  TF_IN_AUTOMATION: true
-  AWS_REGION: "eu-west-2"
-  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}
-
 permissions:
   id-token: write # This is required for requesting the JWT
   contents: read # This is required for actions/checkout
 
-
 defaults:
   run:
     shell: bash
 
 jobs:
   core-logging-deployment-plan:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - name: Setup Go
-        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
-        with:
-          go-version: 1.21
-          cache-dependency-path: "terraform/environments/core-logging/test/go.sum"
-      - name: Set Account Number
-        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
-      - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
-        with:
-          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
-          role-session-name: githubactionsrolesession
-          aws-region: ${{ env.AWS_REGION }}
-      - uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
-        with:
-          terraform_version: "~1"
-          terraform_wrapper: false
-
-      - name: Run terraform plan in terraform/environments/core-logging
-        run: |
-          git_dir=`git rev-parse --show-toplevel`
-          terraform --version
-          # Test if this is a PR or PULL event
-          if [ ! -z ${{ github.event.pull_request.number }} ]
-          then
-          #CONFIGURE TERRAFORM AND WORKSPACE
-          bash scripts/terraform-init.sh terraform/environments/core-logging
-          terraform -chdir="terraform/environments/core-logging" workspace select core-logging-production
-
-          #RUN TERRATEST
-          pushd terraform/environments/core-logging/test
-          go mod tidy
-          TEST=`go test | ${git_dir}/scripts/redact-output.sh | tee /dev/stderr | tail -n 1`
-          popd
-          TEST="> TERRATEST RESULT - core-logging
-          ${TEST}"
-          bash scripts/update-pr-comments.sh "${TEST}"
-
-          #RUN TERRAFORM PLAN
-          PLAN=`bash scripts/terraform-plan.sh terraform/environments/core-logging | tee /dev/stderr | grep '^Plan: \|^No changes.'`
-          PLAN="> TERRAFORM PLAN RESULT - core-logging
-          ${PLAN}"
-          bash scripts/update-pr-comments.sh "${PLAN}"
-          fi
-        env:
-          SECRET: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ secrets.GITHUB_REPOSITORY }}
-          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-
-  core-logging-deployment-apply:
-    runs-on: ubuntu-latest
-    if: github.event.ref == 'refs/heads/main'
-    needs: [core-logging-deployment-plan]
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - name: Set Account Number
-        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
-      - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
-        with:
-          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
-          role-session-name: githubactionsrolesession
-          aws-region: ${{ env.AWS_REGION }}
-      - uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
-        with:
-          terraform_version: "~1"
-          terraform_wrapper: false
-
-      - name: Run Terraform apply in terraform/environments/core-logging
-        run: |
-          terraform --version
-          bash scripts/terraform-init.sh terraform/environments/core-logging
-          terraform -chdir="terraform/environments/core-logging" workspace select core-logging-production
-          bash scripts/terraform-apply.sh terraform/environments/core-logging
-      - name: Slack failure notification
-        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
-        with:
-          payload: |
-            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
-        if: ${{ failure() }}
+    uses: ./.github/workflows/reusable_terraform_plan_apply_core.yml
+    with:
+      account_name: core-logging
+      environment: production
+    secrets:
+      modernisation_platform_environments: "${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}"
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/.github/workflows/core-network-services-deployment.yml b/.github/workflows/core-network-services-deployment.yml
@@ -21,11 +21,6 @@ on:
       - '.github/workflows/core-network-services-deployment.yml'
   workflow_dispatch:
 
-env:
-  TF_IN_AUTOMATION: true
-  AWS_REGION: "eu-west-2"
-  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}
-
 permissions:
   id-token: write # This is required for requesting the JWT
   contents: read # This is required for actions/checkout
@@ -35,102 +30,11 @@ defaults:
     shell: bash
 
 jobs:
-  core-network-services-deployment-plan:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-
-      - name: Setup Go
-        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
-        with:
-          go-version: 1.21
-          cache-dependency-path: "terraform/environments/core-network-services/test/go.sum"
-
-      - name: Set Account Number
-        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
-        with:
-          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
-          role-session-name: githubactionsrolesession
-          aws-region: ${{ env.AWS_REGION }}
-
-      - name: Set up Terraform
-        uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
-        with:
-          terraform_version: "~1"
-          terraform_wrapper: false
-
-      - name: Run terraform plan in terraform/environments/core-network-services
-        run: |
-          git_dir=`git rev-parse --show-toplevel`
-          terraform --version
-          # Test if this is a PR or PULL event
-          if [ ! -z ${{ github.event.pull_request.number }} ]
-          then
-          #CONFIGURE TERRAFORM AND WORKSPACE
-          bash scripts/terraform-init.sh terraform/environments/core-network-services
-          terraform -chdir="terraform/environments/core-network-services" workspace select core-network-services-production
-
-          #RUN TERRATEST
-          pushd terraform/environments/core-network-services/test
-          go mod tidy
-          TEST=`go test | ${git_dir}/scripts/redact-output.sh | tee /dev/stderr | tail -n 1`
-          popd
-          TEST="> TERRATEST RESULT - core-network-services
-          ${TEST}"
-          bash scripts/update-pr-comments.sh "${TEST}"
-
-          #RUN TERRAFORM PLAN
-          PLAN=`bash scripts/terraform-plan.sh terraform/environments/core-network-services | tee /dev/stderr | grep '^Plan: \|^No changes.'`
-          PLAN="> TERRAFORM PLAN RESULT - core-network-services
-          ${PLAN}"
-          bash scripts/update-pr-comments.sh "${PLAN}"
-          fi
-        env:
-          SECRET: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ secrets.GITHUB_REPOSITORY }}
-          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-
-  core-network-services-deployment-apply:
-    runs-on: ubuntu-latest
-    if: github.event.ref == 'refs/heads/main'
-    needs: [core-network-services-deployment-plan]
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-
-      - name: Set Account Number
-        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
-        with:
-          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
-          role-session-name: githubactionsrolesession
-          aws-region: ${{ env.AWS_REGION }}
-
-      - name: Set up Terraform
-        uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
-        with:
-          terraform_version: "~1"
-          terraform_wrapper: false
-
-      - name: Run Terraform apply in terraform/environments/core-network-services
-        run: |
-          terraform --version
-          bash scripts/terraform-init.sh terraform/environments/core-network-services
-          terraform -chdir="terraform/environments/core-network-services" workspace select core-network-services-production
-          bash scripts/terraform-apply.sh terraform/environments/core-network-services
-
-      - name: Slack failure notification
-        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
-        with:
-          payload: |
-            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
-        if: ${{ failure() }}
+  core-network-services-deployment-plan-apply:
+    uses: ./.github/workflows/reusable_terraform_plan_apply_core.yml
+    with:
+      account_name: core-network-services
+      environment: production
+    secrets:
+      modernisation_platform_environments: "${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}"
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/.github/workflows/core-security-deployment.yml b/.github/workflows/core-security-deployment.yml
@@ -20,107 +20,20 @@ on:
       - '.github/workflows/core-security-deployment.yml'
   workflow_dispatch:
 
-env:
-  TF_IN_AUTOMATION: true
-  AWS_REGION: "eu-west-2"
-  ENVIRONMENT_MANAGEMENT: ${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}
-
 permissions:
   id-token: write # This is required for requesting the JWT
   contents: read # This is required for actions/checkout
 
-
 defaults:
   run:
     shell: bash
 
 jobs:
   core-security-deployment-plan:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - name: Setup Go
-        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
-        with:
-          go-version: 1.21
-          cache-dependency-path: "terraform/environments/core-security/test/go.sum"
-      - name: Set Account Number
-        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
-      - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
-        with:
-          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
-          role-session-name: githubactionsrolesession
-          aws-region: ${{ env.AWS_REGION }}
-      - uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
-        with:
-          terraform_version: "~1"
-          terraform_wrapper: false
-
-      - name: Run terraform plan in terraform/environments/core-security
-        run: |
-          git_dir=`git rev-parse --show-toplevel`
-          terraform --version
-          # Test if this is a PR or PULL event
-          if [ ! -z ${{ github.event.pull_request.number }} ]
-          then
-          #CONFIGURE TERRAFORM AND WORKSPACE
-          bash scripts/terraform-init.sh terraform/environments/core-security
-          terraform -chdir="terraform/environments/core-security" workspace select core-security-production
-
-          #RUN TERRATEST
-          pushd terraform/environments/core-security/test
-          go mod tidy
-          TEST=`go test | ${git_dir}/scripts/redact-output.sh | tee /dev/stderr | tail -n 1`
-          popd
-          TEST="> TERRATEST RESULT - core-security
-          ${TEST}"
-          bash scripts/update-pr-comments.sh "${TEST}"
-
-          #RUN TERRAFORM PLAN
-          PLAN=`bash scripts/terraform-plan.sh terraform/environments/core-security | tee /dev/stderr | grep '^Plan: \|^No changes.'`
-          PLAN="> TERRAFORM PLAN RESULT - core-security
-          ${PLAN}"
-          bash scripts/update-pr-comments.sh "${PLAN}"
-          fi
-        env:
-          SECRET: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ secrets.GITHUB_REPOSITORY }}
-          PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-
-  core-security-deployment-apply:
-    runs-on: ubuntu-latest
-    if: github.event.ref == 'refs/heads/main'
-    needs: [core-security-deployment-plan]
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - name: Set Account Number
-        run: echo "ACCOUNT_NUMBER=$(jq -r -e '.modernisation_platform_account_id' <<< $ENVIRONMENT_MANAGEMENT)" >> $GITHUB_ENV
-      - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
-        with:
-          role-to-assume: "arn:aws:iam::${{ env.ACCOUNT_NUMBER }}:role/github-actions"
-          role-session-name: githubactionsrolesession
-          aws-region: ${{ env.AWS_REGION }}
-      - uses: hashicorp/setup-terraform@651471c36a6092792c552e8b1bef71e592b462d8 # v3.1.1
-        with:
-          terraform_version: "~1"
-          terraform_wrapper: false
-
-      - name: Run Terraform apply in terraform/environments/core-security
-        run: |
-          terraform --version
-          bash scripts/terraform-init.sh terraform/environments/core-security
-          terraform -chdir="terraform/environments/core-security" workspace select core-security-production
-          bash scripts/terraform-apply.sh terraform/environments/core-security
-      - name: Slack failure notification
-        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
-        with:
-          payload: |
-            {"blocks":[{"type": "section","text": {"type": "mrkdwn","text": ":no_entry: Failed GitHub Action:"}},{"type": "section","fields":[{"type": "mrkdwn","text": "*Workflow:*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }}>"},{"type": "mrkdwn","text": "*Job:*\n${{ github.job }}"},{"type": "mrkdwn","text": "*Repo:*\n${{ github.repository }}"}]}]}
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
-        if: ${{ failure() }}
+    uses: ./.github/workflows/reusable_terraform_plan_apply_core.yml
+    with:
+      account_name: core-security
+      environment: production
+    secrets:
+      modernisation_platform_environments: "${{ secrets.MODERNISATION_PLATFORM_ENVIRONMENTS }}"
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}