Skip to content

Commit 7baf1d5

Browse files
TOEL2TOEL2
authored
Merge pull request #639 from NHSDigital/feature/ELI-702-code-signing
Feature/eli 702 code signing test workflow
2 parents 05a0fbb + 522d468 commit 7baf1d5

1 file changed

Lines changed: 202 additions & 0 deletions

File tree

‎.github/workflows/signing_test.yaml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
name: "signing-test"
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
ref:
7+
description: "Branch, tag, or commit SHA to check out"
8+
required: true
9+
default: "feature/ELI-702-code-signing"
10+
artifact_tag:
11+
description: "Artifact tag to deploy, for example dev-20260410120000"
12+
required: true
13+
artifact_run_id:
14+
description: "Workflow run ID that produced the lambda artifact"
15+
required: true
16+
17+
concurrency:
18+
group: test-deployments
19+
cancel-in-progress: false
20+
21+
permissions:
22+
contents: read
23+
id-token: write
24+
actions: read
25+
26+
jobs:
27+
metadata:
28+
name: "Resolve metadata"
29+
runs-on: ubuntu-latest
30+
outputs:
31+
terraform_version: ${{ steps.vars.outputs.terraform_version }}
32+
tag: ${{ steps.tag.outputs.name }}
33+
steps:
34+
- name: "Checkout selected ref"
35+
uses: actions/checkout@v6
36+
with:
37+
ref: ${{ inputs.ref }}
38+
39+
- name: "Set CI/CD variables"
40+
id: vars
41+
run: |
42+
echo "terraform_version=$(grep '^terraform' .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
43+
44+
- name: "Use provided artifact tag"
45+
id: tag
46+
run: |
47+
echo "name=${{ inputs.artifact_tag }}" >> $GITHUB_OUTPUT
48+
echo "Resolved tag: ${{ inputs.artifact_tag }}"
49+
50+
sign-lambda-artifact:
51+
name: "Sign lambda artifact for TEST"
52+
runs-on: ubuntu-latest
53+
needs: [metadata]
54+
environment: test
55+
timeout-minutes: 45
56+
permissions:
57+
id-token: write
58+
contents: read
59+
outputs:
60+
bucket_name: ${{ steps.tf_output.outputs.bucket_name }}
61+
steps:
62+
- name: "Checkout selected ref"
63+
uses: actions/checkout@v6
64+
with:
65+
ref: ${{ inputs.ref }}
66+
67+
- name: "Setup Terraform"
68+
uses: hashicorp/setup-terraform@v3
69+
with:
70+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
71+
72+
- name: "Configure AWS Credentials"
73+
uses: aws-actions/configure-aws-credentials@v6
74+
with:
75+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
76+
aws-region: eu-west-2
77+
78+
- name: "Download lambda artefact from chosen workflow run"
79+
uses: actions/download-artifact@v7
80+
with:
81+
name: lambda-${{ needs.metadata.outputs.tag }}
82+
path: ./dist
83+
run-id: ${{ inputs.artifact_run_id }}
84+
github-token: ${{ github.token }}
85+
86+
- name: "Terraform Init (TEST api-layer)"
87+
env:
88+
ENVIRONMENT: test
89+
WORKSPACE: "default"
90+
run: |
91+
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
92+
make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
93+
working-directory: ./infrastructure
94+
95+
- name: "Extract Terraform outputs"
96+
id: tf_output
97+
run: |
98+
BUCKET=$(terraform output -raw lambda_artifact_bucket)
99+
PROFILE=$(terraform output -raw lambda_signing_profile_name)
100+
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
101+
echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
102+
working-directory: ./infrastructure/stacks/api-layer
103+
104+
- name: "Upload unsigned lambda artifact to S3"
105+
run: |
106+
aws s3 cp ./dist/lambda.zip \
107+
s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
108+
--region eu-west-2
109+
110+
- name: "Get uploaded source object version"
111+
id: source_object
112+
run: |
113+
VERSION_ID=$(aws s3api head-object \
114+
--bucket "${{ steps.tf_output.outputs.bucket_name }}" \
115+
--key "artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip" \
116+
--query 'VersionId' \
117+
--output text \
118+
--region eu-west-2)
119+
echo "version_id=$VERSION_ID" >> $GITHUB_OUTPUT
120+
121+
- name: "Start signing job"
122+
id: signing
123+
env:
124+
SIGNING_PROFILE_NAME: ${{ steps.tf_output.outputs.signing_profile_name }}
125+
run: |
126+
JOB_ID=$(aws signer start-signing-job \
127+
--source "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},key=artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip,version=${{ steps.source_object.outputs.version_id }}}" \
128+
--destination "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},prefix=signed-artifacts/${{ needs.metadata.outputs.tag }}/}" \
129+
--profile-name "$SIGNING_PROFILE_NAME" \
130+
--query 'jobId' \
131+
--output text \
132+
--region eu-west-2)
133+
echo "job_id=$JOB_ID" >> $GITHUB_OUTPUT
134+
135+
- name: "Wait for signing job"
136+
run: |
137+
aws signer wait successful-signing-job \
138+
--job-id "${{ steps.signing.outputs.job_id }}" \
139+
--region eu-west-2
140+
141+
- name: "Resolve signed artifact location"
142+
id: signed_object
143+
run: |
144+
SIGNED_BUCKET=$(aws signer describe-signing-job \
145+
--job-id "${{ steps.signing.outputs.job_id }}" \
146+
--region eu-west-2 \
147+
--query 'signedObject.s3.bucketName' \
148+
--output text)
149+
150+
SIGNED_KEY=$(aws signer describe-signing-job \
151+
--job-id "${{ steps.signing.outputs.job_id }}" \
152+
--region eu-west-2 \
153+
--query 'signedObject.s3.key' \
154+
--output text)
155+
156+
echo "bucket_name=$SIGNED_BUCKET" >> $GITHUB_OUTPUT
157+
echo "object_key=$SIGNED_KEY" >> $GITHUB_OUTPUT
158+
159+
- name: "Download signed lambda artifact"
160+
run: |
161+
aws s3 cp \
162+
"s3://${{ steps.signed_object.outputs.bucket_name }}/${{ steps.signed_object.outputs.object_key }}" \
163+
./dist/lambda.zip \
164+
--region eu-west-2
165+
166+
- name: "Upload signed lambda artifact for current workflow"
167+
uses: actions/upload-artifact@v6
168+
with:
169+
name: lambda-${{ needs.metadata.outputs.tag }}
170+
path: ./dist/lambda.zip
171+
172+
deploy:
173+
name: "Deploy to TEST (approval required)"
174+
runs-on: ubuntu-latest
175+
needs: [metadata, sign-lambda-artifact]
176+
environment: test
177+
timeout-minutes: 10080
178+
permissions:
179+
id-token: write
180+
contents: read
181+
steps:
182+
- name: "Checkout selected ref"
183+
uses: actions/checkout@v6
184+
with:
185+
ref: ${{ inputs.ref }}
186+
187+
- name: "Setup Terraform"
188+
uses: hashicorp/setup-terraform@v3
189+
with:
190+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
191+
192+
- name: "Download signed lambda artefact"
193+
uses: actions/download-artifact@v7
194+
with:
195+
name: lambda-${{ needs.metadata.outputs.tag }}
196+
path: ./dist
197+
198+
- name: "Configure AWS Credentials"
199+
uses: aws-actions/configure-aws-credentials@v6
200+
with:
201+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
202+
aws-region: eu-west-2

0 commit comments

Comments
 (0)