base-deploy.yml

name: Base Deploy

on:
  workflow_call:
    inputs:
      environment:
        description: "Target environment (preprod | prod)"
        required: true
        type: string
      ref:
        description: "Git ref to deploy (dev-tag). For prod, supply the RC tag to promote."
        required: true
        type: string
      release_type:
        description: "Version bump for base version (preprod only: patch|minor|major)"
        required: false
        default: "patch"
        type: string
    secrets: {}

jobs:
  metadata:
    name: "Set CI/CD metadata"
    runs-on: ubuntu-latest
    timeout-minutes: 2
    outputs:
      build_datetime: ${{ steps.variables.outputs.build_datetime }}
      build_timestamp: ${{ steps.variables.outputs.build_timestamp }}
      build_epoch: ${{ steps.variables.outputs.build_epoch }}
      nodejs_version: ${{ steps.variables.outputs.nodejs_version }}
      python_version: ${{ steps.variables.outputs.python_version }}
      terraform_version: ${{ steps.variables.outputs.terraform_version }}
      ref: ${{ steps.variables.outputs.ref }}
      environment: ${{ steps.variables.outputs.environment }}
      tag: ${{ steps.tag.outputs.name }}
      promoted_environment: ${{ steps.promoted_env.outputs.promoted_environment }}
    steps:
      - name: "Checkout ref"
        uses: actions/checkout@v6
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0 # get full history + tags

      - name: "Set CI/CD variables"
        id: variables
        shell: bash
        run: |
          set -euo pipefail
          datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
          echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
          echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
          echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
          echo "nodejs_version=$(grep -E '^nodejs' .tool-versions 2>/dev/null | cut -d' ' -f2 | head -n1)" >> $GITHUB_OUTPUT
          echo "python_version=$(grep -E '^python' .tool-versions 2>/dev/null | cut -d' ' -f2 | head -n1)" >> $GITHUB_OUTPUT
          echo "terraform_version=$(grep -E '^terraform' .tool-versions 2>/dev/null | cut -d' ' -f2 | head -n1)" >> $GITHUB_OUTPUT
          echo "ref=${{ inputs.ref }}" >> $GITHUB_OUTPUT
          echo "environment=${{ inputs.environment }}" >> $GITHUB_OUTPUT

      - name: "List variables"
        shell: bash
        run: |
          export BUILD_DATETIME="${{ steps.variables.outputs.build_datetime }}"
          export BUILD_TIMESTAMP="${{ steps.variables.outputs.build_timestamp }}"
          export BUILD_EPOCH="${{ steps.variables.outputs.build_epoch }}"
          export NODEJS_VERSION="${{ steps.variables.outputs.nodejs_version }}"
          export PYTHON_VERSION="${{ steps.variables.outputs.python_version }}"
          export TERRAFORM_VERSION="${{ steps.variables.outputs.terraform_version }}"
          export REF="${{ steps.variables.outputs.ref }}"
          export ENVIRONMENT="${{ steps.variables.outputs.environment }}"
          export PROMOTED_ENVIRONMENT="${{ steps.variables.outputs.promoted_environment }}"
          echo "build_datetime=$BUILD_DATETIME"
          echo "build_timestamp=$BUILD_TIMESTAMP"
          echo "build_epoch=$BUILD_EPOCH"
          echo "nodejs_version=$NODEJS_VERSION"
          echo "python_version=$PYTHON_VERSION"
          echo "terraform_version=$TERRAFORM_VERSION"
          echo "ref=$REF"
          echo "environment=$ENVIRONMENT"
          echo "promoted_environment=$PROMOTED_ENVIRONMENT"

      - name: "Resolve the dev-* tag for this commit"
        id: tag
        run: |
          git fetch --tags --force
          SHA="${{ github.event.workflow_run.head_sha }}"
          TAG=$(git tag --points-at "$SHA" | grep '^dev-' | sort -r | head -n1 || true)
          if [ -z "$TAG" ]; then
            echo "Using the dev tag provided in the input field" >&2
            TAG="${{ inputs.ref }}"
          fi
          echo "name=$TAG" >> $GITHUB_OUTPUT
          echo "Resolved tag: $TAG"

      - name: "Resolve promoted environment"
        id: promoted_env
        run: |
          ENV="${{ steps.variables.outputs.environment }}"
          if [[ "$ENV" == "preprod" ]]; then
            echo "promoted_environment=test" >> $GITHUB_OUTPUT
          elif [[ "$ENV" == "prod" ]]; then
            echo "promoted_environment=preprod" >> $GITHUB_OUTPUT
          else
            echo "promoted_environment=$ENV" >> $GITHUB_OUTPUT
          fi

  download-lambda-artifact:
    name: "Fetch the lambda artifact from previous stage"
    runs-on: ubuntu-latest
    needs: [metadata]
    timeout-minutes: 45
    permissions:
      id-token: write
      contents: write
    environment: ${{ needs.metadata.outputs.promoted_environment }}
    steps:
      - name: "Checkout repository at ref"
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.metadata.outputs.ref }}
          fetch-depth: 0

      - name: "Setup Terraform"
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ needs.metadata.outputs.terraform_version }}

      - name: "Configure AWS Credentials"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
          aws-region: eu-west-2

      - name: "Terraform Init"
        env:
          ENVIRONMENT: ${{ needs.metadata.outputs.promoted_environment }}
          WORKSPACE: "default"
        run: |
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
          make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
        working-directory: ./infrastructure

      - name: "Extract S3 bucket name from Terraform output"
        id: tf_output
        run: |
          BUCKET=$(terraform output -raw lambda_artifact_bucket)
          echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
        working-directory: ./infrastructure/stacks/api-layer

      - name: "Download lambda artifact from S3"
        run: |
          aws s3 cp \
            s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
            ./dist/lambda.zip \
            --region eu-west-2

      - name: "Upload lambda artifact for downstream jobs"
        uses: actions/upload-artifact@v6
        with:
          name: lambda-${{ needs.metadata.outputs.tag }}
          path: ./dist/lambda.zip

  sign-lambda-artifact:
    name: "Sign lambda artifact for PreProd"
    if: ${{ needs.metadata.outputs.environment == 'preprod' }}
    runs-on: ubuntu-latest
    needs: [ metadata, download-lambda-artifact ]
    timeout-minutes: 45
    permissions:
      id-token: write
      contents: read
    environment: preprod
    steps:
      - name: "Checkout repository at ref"
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.metadata.outputs.ref }}
          fetch-depth: 0

      - name: "Setup Terraform"
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ needs.metadata.outputs.terraform_version }}

      - name: "Configure AWS Credentials"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
          aws-region: eu-west-2

      - name: "Download unsigned lambda artifact from current workflow"
        uses: actions/download-artifact@v7
        with:
          name: lambda-${{ needs.metadata.outputs.tag }}
          path: ./dist

      - name: "Terraform Init (PREPROD api-layer)"
        env:
          ENVIRONMENT: preprod
          WORKSPACE: "default"
        run: |
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
          make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
        working-directory: ./infrastructure

      - name: "Extract PREPROD Terraform outputs"
        id: preprod_tf_output
        run: |
          BUCKET=$(terraform output -raw lambda_artifact_bucket)
          PROFILE=$(terraform output -raw signing_profile_name)
          echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
          echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
        working-directory: ./infrastructure/stacks/api-layer

      - name: "Upload unsigned lambda artifact to PREPROD S3"
        run: |
          aws s3 cp ./dist/lambda.zip \
            s3://${{ steps.preprod_tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
            --region eu-west-2

      - name: "Get uploaded source object version"
        id: source_object
        run: |
          VERSION_ID=$(aws s3api head-object \
            --bucket "${{ steps.preprod_tf_output.outputs.bucket_name }}" \
            --key "artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip" \
            --query 'VersionId' \
            --output text \
            --region eu-west-2)
          echo "version_id=$VERSION_ID" >> $GITHUB_OUTPUT

      - name: "Start signing job"
        id: signing
        env:
          SIGNING_PROFILE_NAME: ${{ steps.preprod_tf_output.outputs.signing_profile_name }}
        run: |
          JOB_ID=$(aws signer start-signing-job \
            --source "s3={bucketName=${{ steps.preprod_tf_output.outputs.bucket_name }},key=artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip,version=${{ steps.source_object.outputs.version_id }}}" \
            --destination "s3={bucketName=${{ steps.preprod_tf_output.outputs.bucket_name }},prefix=signed-artifacts/${{ needs.metadata.outputs.tag }}/}" \
            --profile-name "$SIGNING_PROFILE_NAME" \
            --query 'jobId' \
            --output text \
            --region eu-west-2)
          echo "job_id=$JOB_ID" >> $GITHUB_OUTPUT

      - name: "Wait for signing job"
        run: |
          aws signer wait successful-signing-job \
            --job-id "${{ steps.signing.outputs.job_id }}" \
            --region eu-west-2

      - name: "Resolve signed artifact location"
        id: signed_object
        run: |
          SIGNED_BUCKET=$(aws signer describe-signing-job \
            --job-id "${{ steps.signing.outputs.job_id }}" \
            --region eu-west-2 \
            --query 'signedObject.s3.bucketName' \
            --output text)

          SIGNED_KEY=$(aws signer describe-signing-job \
            --job-id "${{ steps.signing.outputs.job_id }}" \
            --region eu-west-2 \
            --query 'signedObject.s3.key' \
            --output text)

          echo "bucket_name=$SIGNED_BUCKET" >> $GITHUB_OUTPUT
          echo "object_key=$SIGNED_KEY" >> $GITHUB_OUTPUT

      - name: "Download signed lambda artifact"
        run: |
          aws s3 cp \
            "s3://${{ steps.signed_object.outputs.bucket_name }}/${{ steps.signed_object.outputs.object_key }}" \
            ./dist/lambda.zip \
            --region eu-west-2

      - name: "Upload signed lambda artifact for current workflow"
        uses: actions/upload-artifact@v6
        with:
          name: lambda-signed-${{ needs.metadata.outputs.tag }}
          path: ./dist/lambda.zip


  deploy-preprod:
    name: "Deploy to preprod"
    if: ${{ needs.metadata.outputs.environment == 'preprod' }}
    runs-on: ubuntu-latest
    needs: [metadata, download-lambda-artifact, sign-lambda-artifact]
    timeout-minutes: 45
    permissions:
      id-token: write
      contents: write
    environment: preprod
    steps:
      - name: "Checkout repository at ref"
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.metadata.outputs.ref }}
          fetch-depth: 0

      - name: "Setup Terraform"
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ needs.metadata.outputs.terraform_version }}

      - name: "Download signed Lambda Artifact"
        uses: actions/download-artifact@v7
        with:
          name: lambda-signed-${{ needs.metadata.outputs.tag }}
          path: ./dist

      - name: "Configure AWS Credentials (IAM Bootstrap Role)"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-iam-bootstrap-role
          aws-region: eu-west-2

      - name: "Deploy IAM roles (iams-developer-roles stack)"
        working-directory: ./infrastructure
        run: |
          make terraform env=preprod stack=iams-developer-roles tf-command=apply workspace=default

      - name: "Configure AWS Credentials (Main Deployment Role)"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
          aws-region: eu-west-2

      - name: "Terraform Apply"
        env:
          ENVIRONMENT: preprod
          WORKSPACE: "default"
          TF_VAR_API_CA_CERT: ${{ secrets.API_CA_CERT }}
          TF_VAR_API_CLIENT_CERT: ${{ secrets.API_CLIENT_CERT }}
          TF_VAR_API_PRIVATE_KEY_CERT: ${{ secrets.API_PRIVATE_KEY_CERT }}
          TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
          TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
          TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
          TF_VAR_PROXYGEN_PRIVATE_KEY_PTL: ${{ secrets.PROXYGEN_PRIVATE_KEY_PTL }}
          TF_VAR_PROXYGEN_PRIVATE_KEY_PROD: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
        working-directory: ./infrastructure
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p ./build
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=networking tf-command=apply"
          make terraform env=$ENVIRONMENT stack=networking tf-command=apply workspace=$WORKSPACE
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply"
          make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE

      - name: "Extract S3 bucket name from Terraform output"
        id: tf_output
        run: |
          BUCKET=$(terraform output -raw lambda_artifact_bucket)
          echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
        working-directory: ./infrastructure/stacks/api-layer

      - name: "Validate Feature Toggles"
        env:
          ENV: preprod
        run: |
          pip install boto3
          python scripts/feature_toggle/validate_toggles.py

      - name: "Tag and Release"
        env:
          ENVIRONMENT: preprod
          REF: ${{ needs.metadata.outputs.ref }}
          INPUT_RELEASE_TYPE: ${{ inputs.release_type }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          pip install requests
          python scripts/workflow/tag_and_release.py

      - name: "Capture release tag"
        id: release_tag
        run: |
          echo "release_tag=$(cat release_tag.txt)" >> $GITHUB_OUTPUT

      - name: "Upload lambda artifact to S3"
        run: |
          aws s3 cp ./dist/lambda.zip \
            s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ steps.release_tag.outputs.release_tag }}/lambda.zip \
            --region eu-west-2

  deploy-prod:
    name: "Deploy to prod"
    if: ${{ needs.metadata.outputs.environment == 'prod' }}
    runs-on: ubuntu-latest
    needs: [metadata, download-lambda-artifact]
    timeout-minutes: 45
    permissions:
      id-token: write
      contents: write
    environment: prod
    steps:
      - name: "Checkout repository at ref"
        uses: actions/checkout@v6
        with:
          ref: ${{ needs.metadata.outputs.ref }}
          fetch-depth: 0

      - name: "Setup Terraform"
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{ needs.metadata.outputs.terraform_version }}

      - name: "Download Lambda Artifact"
        uses: actions/download-artifact@v7
        with:
          name: lambda-${{ needs.metadata.outputs.tag }}
          path: ./dist

      - name: "Configure AWS Credentials (IAM Bootstrap Role)"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-iam-bootstrap-role
          aws-region: eu-west-2

      - name: "Deploy IAM roles (iams-developer-roles stack)"
        working-directory: ./infrastructure
        run: |
          make terraform env=prod stack=iams-developer-roles tf-command=apply workspace=default

      - name: "Configure AWS Credentials (Main Deployment Role)"
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
          aws-region: eu-west-2

      - name: "Terraform Apply"
        env:
          ENVIRONMENT: prod
          WORKSPACE: "default"
          TF_VAR_API_CA_CERT: ${{ secrets.API_CA_CERT }}
          TF_VAR_API_CLIENT_CERT: ${{ secrets.API_CLIENT_CERT }}
          TF_VAR_API_PRIVATE_KEY_CERT: ${{ secrets.API_PRIVATE_KEY_CERT }}
          TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
          TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
          TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
          TF_VAR_PROXYGEN_PRIVATE_KEY_PTL: ${{ secrets.PROXYGEN_PRIVATE_KEY_PTL }}
          TF_VAR_PROXYGEN_PRIVATE_KEY_PROD: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
        working-directory: ./infrastructure
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p ./build
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=networking tf-command=apply"
          make terraform env=$ENVIRONMENT stack=networking tf-command=apply workspace=$WORKSPACE
          echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply"
          make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE

      - name: "Extract S3 bucket name from Terraform output"
        id: tf_output
        run: |
          BUCKET=$(terraform output -raw lambda_artifact_bucket)
          echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
        working-directory: ./infrastructure/stacks/api-layer

      - name: "Validate Feature Toggles"
        env:
          ENV: prod
        run: |
          pip install boto3
          python scripts/feature_toggle/validate_toggles.py

      - name: "Tag and Release"
        env:
          ENVIRONMENT: prod
          REF: ${{ needs.metadata.outputs.ref }}
          INPUT_RELEASE_TYPE: ${{ inputs.release_type }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
        run: |
          pip install requests
          python scripts/workflow/tag_and_release.py

      - name: "Capture release tag"
        id: release_tag
        run: |
          echo "release_tag=$(cat release_tag.txt)" >> $GITHUB_OUTPUT

      - name: "Upload lambda artifact to S3"
        run: |
          aws s3 cp ./dist/lambda.zip \
            s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ steps.release_tag.outputs.release_tag }}/lambda.zip \
            --region eu-west-2

  regression-tests:
    name: "Regression Tests"
    if: ${{ needs.metadata.outputs.environment == 'preprod' }}
    needs: deploy-preprod
    permissions:
      id-token: write
      contents: read
      issues: write
      pull-requests: write
    uses: ./.github/workflows/regression-tests.yml
    with:
      ENVIRONMENT: "preprod"
      VERSION_NUMBER: "main"
    secrets:
      AWS_ACCOUNT_ID: ${{ secrets.PREPROD_AWS_ACCOUNT_ID }}