run_release_code_and_api.yml

name: release code and api

on:
  workflow_call:
    inputs:
      STACK_NAME:
        required: true
        type: string
      ARTIFACT_BUCKET_PREFIX:
        required: true
        type: string
      AWS_ENVIRONMENT:
        required: true
        type: string
      APIGEE_ENVIRONMENT:
        required: true
        type: string
      ENABLE_MUTUAL_TLS:
        required: true
        type: boolean
      BUILD_ARTIFACT:
        required: true
        type: string
      TRUSTSTORE_FILE:
        required: true
        type: string
      VERSION_NUMBER:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      LOG_LEVEL:
        required: false
        type: string
        default: INFO
      LOG_RETENTION_DAYS:
        required: true
        type: string
      DEPLOY_APIGEE:
        type: boolean
        default: true
      DYNAMODB_AUTOSCALE:
        type: boolean
        default: true
      DEPLOY_APIGEE_CPSU:
        type: boolean
        default: true
      DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE:
        type: boolean
        default: false
      EXPOSE_GET_STATUS_UPDATES:
        type: boolean
        default: false
      ENABLE_ALERTS:
        type: boolean
        default: true
      REQUIRE_APPLICATION_NAME:
        type: boolean
        default: true
      RUN_REGRESSION_TEST:
        required: true
        type: boolean
      STATE_MACHINE_LOG_LEVEL:
        required: true
        type: string
      ENABLE_BACKUP:
        required: true
        type: string
      ENABLE_NOTIFICATIONS_INTERNAL:
        required: false
        type: boolean
        default: false
      ENABLE_NOTIFICATIONS_EXTERNAL:
        required: false
        type: boolean
        default: false
      ENABLE_POST_DATED_NOTIFICATIONS:
        required: false
        type: boolean
        default: false
      ENABLED_SYSTEMS:
        required: true
        type: string
      BLOCKED_SITE_ODS_CODES:
        required: true
        type: string
      ENABLED_SUPPLIER_APPLICATION_IDS:
        required: true
        type: string
      NOTIFY_ROUTING_PLAN_ID:
        required: true
        type: string
      NOTIFY_API_BASE_URL:
        required: true
        type: string
      IS_PULL_REQUEST:
        type: boolean
        default: true
      MTLS_KEY:
        type: string
        required: true
      TEST_PRESCRIPTIONS_1:
        required: false
        type: string
      TEST_PRESCRIPTIONS_2:
        required: false
        type: string

      TEST_PRESCRIPTIONS_3:
        required: false
        type: string

      TEST_PRESCRIPTIONS_4:
        required: false
        type: string

      FORWARD_CSOC_LOGS:
        required: true
        type: boolean
      pinned_image:
        required: true
        type: string
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE:
        required: true
      DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      INT_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
        required: false
      PROXYGEN_ROLE:
        required: false
      REGRESSION_TESTS_PEM:
        required: true
permissions: {}

jobs:
  release_code_and_api:
    runs-on: ubuntu-22.04
    environment: ${{ inputs.AWS_ENVIRONMENT }}
    container:
      image: ${{ inputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    permissions:
      id-token: write
      contents: write

    steps:
      - name: copy .tool-versions
        run: |
          cp /home/vscode/.tool-versions "$HOME/.tool-versions"
      - name: Checkout local github actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
          fetch-depth: 0
          sparse-checkout: |
            .github

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
          role-session-name: psu-release-code

      - name: Download build artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: ${{ inputs.BUILD_ARTIFACT }}
          path: .

      - name: Export specification paths
        run: |
          SPEC_PATH="$(pwd)/.aws-sam/build/specification/eps-prescription-status-update-api.resolved.json"
          echo "Specification location: $SPEC_PATH"
          echo "SPEC_PATH=${SPEC_PATH}" >> "$GITHUB_ENV"
          CPSU_SPEC_PATH="$(pwd)/.aws-sam/build/specification/eps-custom-prescription-status-update-api.resolved.json"
          echo "CPSU Specification location: $CPSU_SPEC_PATH"
          echo "CPSU_SPEC_PATH=${CPSU_SPEC_PATH}" >> "$GITHUB_ENV"

      - name: read ODS codes
        id: read
        run: |
          set -euo pipefail
          ENABLED_INPUT_FILE="${GITHUB_WORKSPACE}/.github/config/ods_codes_${AWS_ENVIRONMENT}.txt"
          ENABLED_CSV=$(sed ':a;N;$!ba;s/\r\?\n/,/g;s/,$//' < "$ENABLED_INPUT_FILE")

          BLOCKED_INPUT_FILE="${GITHUB_WORKSPACE}/.github/config/blocked_ods_codes_${AWS_ENVIRONMENT}.txt"
          if [[ -f "$BLOCKED_INPUT_FILE" ]]; then
            BLOCKED_CSV=$(sed ':a;N;$!ba;s/\r\?\n/,/g;s/,$//' < "$BLOCKED_INPUT_FILE")
          else
            BLOCKED_CSV="${BLOCKED_SITE_ODS_CODES_INPUT}"
          fi

          echo "ods_csv=${ENABLED_CSV}" >> "$GITHUB_OUTPUT"
          echo "blocked_ods_csv=${BLOCKED_CSV}" >> "$GITHUB_OUTPUT"
        env:
          AWS_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          BLOCKED_SITE_ODS_CODES_INPUT: ${{ inputs.BLOCKED_SITE_ODS_CODES }}

      - name: release code
        shell: bash
        working-directory: .github/scripts
        env:
          ARTIFACT_BUCKET_PREFIX: prescription_status_update/${{ inputs.ARTIFACT_BUCKET_PREFIX }}
          COMMIT_ID: ${{ inputs.COMMIT_ID }}
          ENABLE_MUTUAL_TLS: ${{ inputs.ENABLE_MUTUAL_TLS }}
          LOG_LEVEL: ${{ inputs.LOG_LEVEL }}
          LOG_RETENTION_DAYS: ${{ inputs.LOG_RETENTION_DAYS }}
          STACK_NAME: ${{ inputs.STACK_NAME }}
          TARGET_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          TEMPLATE_FILE: template.yaml
          TRUSTSTORE_FILE: ${{ inputs.TRUSTSTORE_FILE }}
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          DYNAMODB_AUTOSCALE: ${{ inputs.DYNAMODB_AUTOSCALE }}
          DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE: ${{ inputs.DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE }}
          EXPOSE_GET_STATUS_UPDATES: ${{ inputs.EXPOSE_GET_STATUS_UPDATES }}
          ENABLE_ALERTS: ${{ inputs.ENABLE_ALERTS }}
          STATE_MACHINE_LOG_LEVEL: ${{ inputs.STATE_MACHINE_LOG_LEVEL }}
          ENABLE_BACKUP: ${{ inputs.ENABLE_BACKUP }}
          ENABLE_NOTIFICATIONS_INTERNAL: ${{ inputs.ENABLE_NOTIFICATIONS_INTERNAL }}
          ENABLE_NOTIFICATIONS_EXTERNAL: ${{ inputs.ENABLE_NOTIFICATIONS_EXTERNAL }}
          ENABLE_POST_DATED_NOTIFICATIONS: ${{ inputs.ENABLE_POST_DATED_NOTIFICATIONS }}
          REQUIRE_APPLICATION_NAME: ${{ inputs.REQUIRE_APPLICATION_NAME }}
          ENABLED_SITE_ODS_CODES: ${{ steps.read.outputs.ods_csv }}
          ENABLED_SYSTEMS: ${{ inputs.ENABLED_SYSTEMS }}
          BLOCKED_SITE_ODS_CODES: ${{ steps.read.outputs.blocked_ods_csv }}
          ENABLED_SUPPLIER_APPLICATION_IDS: ${{ inputs.ENABLED_SUPPLIER_APPLICATION_IDS }}
          NOTIFY_ROUTING_PLAN_ID: ${{ inputs.NOTIFY_ROUTING_PLAN_ID }}
          NOTIFY_API_BASE_URL: ${{ inputs.NOTIFY_API_BASE_URL }}
          TEST_PRESCRIPTIONS_1: ${{ inputs.TEST_PRESCRIPTIONS_1 || 'noval' }}
          TEST_PRESCRIPTIONS_2: ${{ inputs.TEST_PRESCRIPTIONS_2 || 'noval' }}
          TEST_PRESCRIPTIONS_3: ${{ inputs.TEST_PRESCRIPTIONS_3 || 'noval' }}
          TEST_PRESCRIPTIONS_4: ${{ inputs.TEST_PRESCRIPTIONS_4 || 'noval' }}
          FORWARD_CSOC_LOGS: ${{ inputs.FORWARD_CSOC_LOGS }}
        run: ./release_code.sh

      - name: get mtls secrets
        shell: bash
        run: |
          mkdir -p ~/.proxygen/tmp
          CF_LONDON_EXPORTS=$(aws cloudformation list-exports --region eu-west-2 --output json)
          client_private_key_arn=$(echo "$CF_LONDON_EXPORTS" | \
              jq \
              --arg EXPORT_NAME "secrets-cdk:Secrets:PsuClientKeySecret:Arn" \
              -r '.Exports[] | select(.Name == $EXPORT_NAME) | .Value')
          client_cert_arn=$(echo "$CF_LONDON_EXPORTS" | \
              jq \
              --arg EXPORT_NAME "secrets-cdk:Secrets:PsuClientCertSecret:Arn" \
              -r '.Exports[] | select(.Name == $EXPORT_NAME) | .Value')
          aws secretsmanager get-secret-value --secret-id "${client_private_key_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_private_key
          aws secretsmanager get-secret-value --secret-id "${client_cert_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_cert
        env:
          AWS_MAX_ATTEMPTS: 20

      - name: Configure AWS Credentials for api release
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.PROXYGEN_ROLE }}
          role-session-name: psu-proxygen-ptl

      - name: Deploy PSU API
        shell: bash
        working-directory: .github/scripts
        if: ${{ inputs.DEPLOY_APIGEE == true && always() && !failure() && !cancelled() }}
        env:
          API_TYPE: standard
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          PROXYGEN_PATH: ${{ env.PROXYGEN_PATH }}
          SPEC_PATH: ${{ env.SPEC_PATH }}
          STACK_NAME: ${{ inputs.STACK_NAME }}
          AWS_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          PROXYGEN_PRIVATE_KEY_NAME: PSUProxygenPrivateKey
          PROXYGEN_KID: "eps-cli-key-1"
          DRY_RUN: false
          DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE: ${{ inputs.DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE }}
          EXPOSE_GET_STATUS_UPDATES: ${{ inputs.EXPOSE_GET_STATUS_UPDATES }}
          IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
          MTLS_KEY: ${{ inputs.MTLS_KEY }}
          ENABLE_MUTUAL_TLS: ${{ inputs.ENABLE_MUTUAL_TLS }}
        run: ./deploy_api.sh

      - name: Deploy CPSU API
        shell: bash
        working-directory: .github/scripts
        if: ${{ inputs.DEPLOY_APIGEE_CPSU == true && always() && !failure() && !cancelled() }}
        env:
          API_TYPE: custom
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          PROXYGEN_PATH: ${{ env.PROXYGEN_PATH }}
          SPEC_PATH: ${{ env.CPSU_SPEC_PATH }}
          STACK_NAME: ${{ inputs.STACK_NAME }}
          AWS_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          PROXYGEN_PRIVATE_KEY_NAME: CPSUProxygenPrivateKey
          PROXYGEN_KID: eps-cli-key-cpsu-1
          DRY_RUN: false
          DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE: ${{ inputs.DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE }}
          EXPOSE_GET_STATUS_UPDATES: ${{ inputs.EXPOSE_GET_STATUS_UPDATES }}
          IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
          MTLS_KEY: ${{ inputs.MTLS_KEY }}
          ENABLE_MUTUAL_TLS: ${{ inputs.ENABLE_MUTUAL_TLS }}
        run: ./deploy_api.sh
      - name: Checkout gh-pages
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: gh-pages
          path: gh-pages
          persist-credentials: true

      - name: update release tag in github pages
        if: ${{ inputs.IS_PULL_REQUEST == false }}
        run: |
          cd gh-pages
          NOW=$(date +'%Y-%m-%dT%H:%M:%S')
          echo "tag,release_datetime" > "_data/${APIGEE_ENVIRONMENT}_latest.csv"
          echo "${VERSION_NUMBER},${NOW}" >> "_data/${APIGEE_ENVIRONMENT}_latest.csv"
          echo "${VERSION_NUMBER},${NOW}" >> "_data/${APIGEE_ENVIRONMENT}_deployments.csv"
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add "_data/${APIGEE_ENVIRONMENT}_latest.csv"
          git add "_data/${APIGEE_ENVIRONMENT}_deployments.csv"
          git commit -m "update releases for ${APIGEE_ENVIRONMENT}"
          parallel --retries 10 --delay 3 ::: "git pull --rebase && git push"
        env:
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}

  regression_tests:
    if: ${{ inputs.RUN_REGRESSION_TEST == true && always() && !failure() && !cancelled() }}
    name: Regression Tests
    uses: ./.github/workflows/run_regression_tests.yml
    needs: release_code_and_api
    permissions:
      id-token: write
      contents: write
    with:
      ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
      VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
      pinned_image: "${{ inputs.pinned_image }}"
    secrets:
      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}