Skip to content

Commit cf99f37

Browse files
ayeshalshukri1-nhsayeshalshukri1-nhs
authored
Merge branch 'main' into feature/SR-ELI-784-Calculator-Integration
2 parents aced30d + 0fdce5e commit cf99f37

4 files changed

Lines changed: 157 additions & 24 deletions

File tree

‎.github/workflows/cicd-3-test-deploy.yaml‎

Lines changed: 124 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,132 @@ jobs:
4646
echo "name=$TAG" >> $GITHUB_OUTPUT
4747
echo "Resolved tag: $TAG"
4848
49+
sign-lambda-artifact:
50+
name: "Sign lambda artifact for TEST"
51+
runs-on: ubuntu-latest
52+
needs: [metadata]
53+
environment: test
54+
timeout-minutes: 45
55+
permissions:
56+
id-token: write
57+
contents: read
58+
outputs:
59+
bucket_name: ${{ steps.tf_output.outputs.bucket_name }}
60+
steps:
61+
- name: "Checkout same commit"
62+
uses: actions/checkout@v6
63+
with:
64+
ref: ${{ github.event.workflow_run.head_sha }}
65+
66+
- name: "Setup Terraform"
67+
uses: hashicorp/setup-terraform@v3
68+
with:
69+
terraform_version: ${{ needs.metadata.outputs.terraform_version }}
70+
71+
- name: "Configure AWS Credentials"
72+
uses: aws-actions/configure-aws-credentials@v6
73+
with:
74+
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
75+
aws-region: eu-west-2
76+
77+
- name: "Download lambda artefact from dev workflow"
78+
uses: actions/download-artifact@v7
79+
with:
80+
name: lambda-${{ needs.metadata.outputs.tag }}
81+
path: ./dist
82+
run-id: ${{ github.event.workflow_run.id }}
83+
github-token: ${{ github.token }}
84+
85+
- name: "Terraform Init (TEST api-layer)"
86+
env:
87+
ENVIRONMENT: test
88+
WORKSPACE: "default"
89+
run: |
90+
echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init"
91+
make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE
92+
working-directory: ./infrastructure
93+
94+
- name: "Extract Terraform outputs"
95+
id: tf_output
96+
run: |
97+
BUCKET=$(terraform output -raw lambda_artifact_bucket)
98+
PROFILE=$(terraform output -raw signing_profile_name)
99+
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
100+
echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
101+
working-directory: ./infrastructure/stacks/api-layer
102+
103+
- name: "Upload unsigned lambda artifact to S3"
104+
run: |
105+
aws s3 cp ./dist/lambda.zip \
106+
s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
107+
--region eu-west-2
108+
109+
- name: "Get uploaded source object version"
110+
id: source_object
111+
run: |
112+
VERSION_ID=$(aws s3api head-object \
113+
--bucket "${{ steps.tf_output.outputs.bucket_name }}" \
114+
--key "artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip" \
115+
--query 'VersionId' \
116+
--output text \
117+
--region eu-west-2)
118+
echo "version_id=$VERSION_ID" >> $GITHUB_OUTPUT
119+
120+
- name: "Start signing job"
121+
id: signing
122+
env:
123+
SIGNING_PROFILE_NAME: ${{ steps.tf_output.outputs.signing_profile_name }}
124+
run: |
125+
JOB_ID=$(aws signer start-signing-job \
126+
--source "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},key=artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip,version=${{ steps.source_object.outputs.version_id }}}" \
127+
--destination "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},prefix=signed-artifacts/${{ needs.metadata.outputs.tag }}/}" \
128+
--profile-name "$SIGNING_PROFILE_NAME" \
129+
--query 'jobId' \
130+
--output text \
131+
--region eu-west-2)
132+
echo "job_id=$JOB_ID" >> $GITHUB_OUTPUT
133+
134+
- name: "Wait for signing job"
135+
run: |
136+
aws signer wait successful-signing-job \
137+
--job-id "${{ steps.signing.outputs.job_id }}" \
138+
--region eu-west-2
139+
140+
- name: "Resolve signed artifact location"
141+
id: signed_object
142+
run: |
143+
SIGNED_BUCKET=$(aws signer describe-signing-job \
144+
--job-id "${{ steps.signing.outputs.job_id }}" \
145+
--region eu-west-2 \
146+
--query 'signedObject.s3.bucketName' \
147+
--output text)
148+
149+
SIGNED_KEY=$(aws signer describe-signing-job \
150+
--job-id "${{ steps.signing.outputs.job_id }}" \
151+
--region eu-west-2 \
152+
--query 'signedObject.s3.key' \
153+
--output text)
154+
155+
echo "bucket_name=$SIGNED_BUCKET" >> $GITHUB_OUTPUT
156+
echo "object_key=$SIGNED_KEY" >> $GITHUB_OUTPUT
157+
158+
- name: "Download signed lambda artifact"
159+
run: |
160+
aws s3 cp \
161+
"s3://${{ steps.signed_object.outputs.bucket_name }}/${{ steps.signed_object.outputs.object_key }}" \
162+
./dist/lambda.zip \
163+
--region eu-west-2
164+
165+
- name: "Upload signed lambda artifact for current workflow"
166+
uses: actions/upload-artifact@v6
167+
with:
168+
name: lambda-${{ needs.metadata.outputs.tag }}
169+
path: ./dist/lambda.zip
170+
49171
deploy:
50172
name: "Deploy to TEST (approval required)"
51173
runs-on: ubuntu-latest
52-
needs: [metadata]
174+
needs: [metadata, sign-lambda-artifact]
53175
environment: test
54176
timeout-minutes: 10080
55177
permissions:
@@ -83,13 +205,11 @@ jobs:
83205
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role
84206
aws-region: eu-west-2
85207

86-
- name: "Download lambda artefact from dev workflow"
208+
- name: "Download signed lambda artefact"
87209
uses: actions/download-artifact@v7
88210
with:
89211
name: lambda-${{ needs.metadata.outputs.tag }}
90212
path: ./dist
91-
run-id: ${{ github.event.workflow_run.id }}
92-
github-token: ${{ github.token }}
93213

94214
- name: "Terraform Apply (TEST)"
95215
env:
@@ -127,12 +247,6 @@ jobs:
127247
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
128248
working-directory: ./infrastructure/stacks/api-layer
129249

130-
- name: "Upload lambda artifact to S3"
131-
run: |
132-
aws s3 cp ./dist/lambda.zip \
133-
s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \
134-
--region eu-west-2
135-
136250
regression-tests:
137251
name: "Regression Tests"
138252
needs: deploy

‎.github/workflows/signing_test.yaml‎

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,16 @@ on:
1414
description: "Workflow run ID that produced the lambda artifact"
1515
required: true
1616

17-
concurrency:
18-
group: test-deployments
19-
cancel-in-progress: false
20-
2117
permissions:
2218
contents: read
2319
id-token: write
2420
actions: read
2521

22+
env:
23+
SELECTED_REF: feature/ELI-702-code-signing
24+
SELECTED_ARTIFACT_TAG: dev-20260414083041
25+
SELECTED_ARTIFACT_RUN_ID: 24389064472
26+
2627
jobs:
2728
metadata:
2829
name: "Resolve metadata"
@@ -34,18 +35,24 @@ jobs:
3435
- name: "Checkout selected ref"
3536
uses: actions/checkout@v6
3637
with:
37-
ref: ${{ inputs.ref }}
38+
ref: ${{ env.SELECTED_REF }}
39+
40+
- name: "Show checked out commit"
41+
run: |
42+
git branch --show-current || true
43+
git rev-parse HEAD
44+
git log -1 --oneline
3845
3946
- name: "Set CI/CD variables"
4047
id: vars
4148
run: |
4249
echo "terraform_version=$(grep '^terraform' .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
4350
44-
- name: "Use provided artifact tag"
51+
- name: "Use static artifact tag"
4552
id: tag
4653
run: |
47-
echo "name=${{ inputs.artifact_tag }}" >> $GITHUB_OUTPUT
48-
echo "Resolved tag: ${{ inputs.artifact_tag }}"
54+
echo "name=${{ env.SELECTED_ARTIFACT_TAG }}" >> $GITHUB_OUTPUT
55+
echo "Resolved tag: ${{ env.SELECTED_ARTIFACT_TAG }}"
4956
5057
sign-lambda-artifact:
5158
name: "Sign lambda artifact for TEST"
@@ -62,7 +69,13 @@ jobs:
6269
- name: "Checkout selected ref"
6370
uses: actions/checkout@v6
6471
with:
65-
ref: ${{ inputs.ref }}
72+
ref: ${{ env.SELECTED_REF }}
73+
74+
- name: "Show checked out commit"
75+
run: |
76+
git branch --show-current || true
77+
git rev-parse HEAD
78+
git log -1 --oneline
6679
6780
- name: "Setup Terraform"
6881
uses: hashicorp/setup-terraform@v3
@@ -80,7 +93,7 @@ jobs:
8093
with:
8194
name: lambda-${{ needs.metadata.outputs.tag }}
8295
path: ./dist
83-
run-id: ${{ inputs.artifact_run_id }}
96+
run-id: ${{ env.SELECTED_ARTIFACT_RUN_ID }}
8497
github-token: ${{ github.token }}
8598

8699
- name: "Terraform Init (TEST api-layer)"
@@ -96,7 +109,7 @@ jobs:
96109
id: tf_output
97110
run: |
98111
BUCKET=$(terraform output -raw lambda_artifact_bucket)
99-
PROFILE=$(terraform output -raw lambda_signing_profile_name)
112+
PROFILE=$(terraform output -raw signing_profile_name)
100113
echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
101114
echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT
102115
working-directory: ./infrastructure/stacks/api-layer
@@ -182,7 +195,13 @@ jobs:
182195
- name: "Checkout selected ref"
183196
uses: actions/checkout@v6
184197
with:
185-
ref: ${{ inputs.ref }}
198+
ref: ${{ env.SELECTED_REF }}
199+
200+
- name: "Show checked out commit"
201+
run: |
202+
git branch --show-current || true
203+
git rev-parse HEAD
204+
git log -1 --oneline
186205
187206
- name: "Setup Terraform"
188207
uses: hashicorp/setup-terraform@v3

‎infrastructure/modules/lambda/signing.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_signer_signing_profile" "lambda_signing" {
2-
name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityApiLambdaSigningProfile"
2+
name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityLambdaSigningProfile"
33
#aws signer is strict with names, does not like hyphens or underscores
44

55
platform_id = "AWSLambda-SHA384-ECDSA"

‎infrastructure/stacks/iams-developer-roles/locals.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
locals {
22
stack_name = "iams-developer-roles"
33
dev_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/aws-reserved/sso.amazonaws.com/${var.default_aws_region}/AWSReservedSSO_vdselid_${var.environment}_d92ae328ac8d84c7"
4-
lambda_signing_profile_name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityApiLambdaSigningProfile"
4+
lambda_signing_profile_name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityLambdaSigningProfile"
55
lambda_signing_profile_arn = "arn:aws:signer:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:/signing-profiles/${local.lambda_signing_profile_name}"
66
}

0 commit comments

Comments
 (0)