run_release_code_and_api.yml

name: release code and api

on:
  workflow_call:
    inputs:
      STACK_NAME:
        required: true
        type: string
      ARTIFACT_BUCKET_PREFIX:
        required: true
        type: string
      AWS_ENVIRONMENT:
        required: true
        type: string
      APIGEE_ENVIRONMENT:
        required: true
        type: string
      ENABLE_MUTUAL_TLS:
        required: true
        type: boolean
      BUILD_ARTIFACT:
        required: true
        type: string
      TRUSTSTORE_FILE:
        required: true
        type: string
      VERSION_NUMBER:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      LOG_LEVEL:
        required: false
        type: string
        default: INFO
      LOG_RETENTION_DAYS:
        required: true
        type: string
      CREATE_INT_RELEASE_NOTES:
        type: boolean
        default: false
      CREATE_INT_RC_RELEASE_NOTES:
        type: boolean
        default: false
      CREATE_PROD_RELEASE_NOTES:
        type: boolean
        default: false
      MARK_JIRA_RELEASED:
        type: boolean
        default: false
      DEPLOY_APIGEE:
        type: boolean
        default: true
      DYNAMODB_AUTOSCALE:
        type: boolean
        default: true
      DEPLOY_APIGEE_CPSU:
        type: boolean
        default: true
      DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE:
        type: boolean
        default: false
      ENABLE_ALERTS:
        type: boolean
        default: true
      RUN_REGRESSION_TEST:
        required: true
        type: boolean
      STATE_MACHINE_LOG_LEVEL:
        required: true
        type: string
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE:
        required: true
      DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      INT_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
        required: false
      PROXYGEN_ROLE:
        required: false
      REGRESSION_TESTS_PEM:
        required: true

jobs:
  release_code_and_api:
    runs-on: ubuntu-22.04
    environment: ${{ inputs.AWS_ENVIRONMENT }}
    permissions:
      id-token: write
      contents: write

    steps:
      - name: Checkout local github actions
        uses: actions/checkout@v4
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0
          sparse-checkout: |
            .github

      - name: create_int_rc_release_notes
        uses: ./.github/actions/update_confluence_jira
        if: ${{ inputs.CREATE_INT_RC_RELEASE_NOTES == true }}
        with:
          TARGET_ENVIRONMENT: int
          RELEASE_TAG: ${{ inputs.VERSION_NUMBER }}
          CONFLUENCE_PAGE_ID: "789747650"
          CREATE_RC_RELEASE_NOTES: true
          DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
          TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.INT_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
          DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
          role-session-name: psu-release-code

      - name: Download build artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ inputs.BUILD_ARTIFACT }}
          path: .

      - name: Export specification paths
        run: |
          SPEC_PATH="$(pwd)/.aws-sam/build/specification/eps-prescription-status-update-api.resolved.json"
          echo "Specification location: $SPEC_PATH"
          echo "SPEC_PATH=${SPEC_PATH}" >> "$GITHUB_ENV"
          CPSU_SPEC_PATH="$(pwd)/.aws-sam/build/specification/eps-custom-prescription-status-update-api.resolved.json"
          echo "CPSU Specification location: $CPSU_SPEC_PATH"
          echo "CPSU_SPEC_PATH=${CPSU_SPEC_PATH}" >> "$GITHUB_ENV"

      - name: release code
        shell: bash
        working-directory: .github/scripts
        env:
          artifact_bucket_prefix: prescription_status_update/${{ inputs.ARTIFACT_BUCKET_PREFIX }}
          COMMIT_ID: ${{ inputs.COMMIT_ID }}
          enable_mutual_tls: ${{ inputs.ENABLE_MUTUAL_TLS }}
          LOG_LEVEL: ${{ inputs.LOG_LEVEL }}
          LOG_RETENTION_DAYS: ${{ inputs.LOG_RETENTION_DAYS }}
          stack_name: ${{ inputs.STACK_NAME }}
          TARGET_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          template_file: template.yaml
          TRUSTSTORE_FILE: ${{ inputs.TRUSTSTORE_FILE }}
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          DYNAMODB_AUTOSCALE: ${{ inputs.DYNAMODB_AUTOSCALE }}
          DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE: ${{ inputs.DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE }}
          ENABLE_ALERTS: ${{ inputs.ENABLE_ALERTS }}
          STATE_MACHINE_LOG_LEVEL: ${{ inputs.STATE_MACHINE_LOG_LEVEL }}
        run: ./release_code.sh

      - name: get mtls secrets
        shell: bash
        run: |
          mkdir -p ~/.proxygen/tmp
          client_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:PsuClientKeySecret'].Value" --output text)
          client_cert_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:PsuClientCertSecret'].Value" --output text)
          aws secretsmanager get-secret-value --secret-id "${client_private_key_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_private_key
          aws secretsmanager get-secret-value --secret-id "${client_cert_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_cert

      - name: Configure AWS Credentials for api release
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.PROXYGEN_ROLE }}
          role-session-name: psu-proxygen-ptl

      - name: Deploy PSU API
        shell: bash
        working-directory: .github/scripts
        if: ${{ inputs.DEPLOY_APIGEE == true && always() && !failure() && !cancelled() }}
        env:
          API_TYPE: standard
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          PROXYGEN_PATH: ${{ env.PROXYGEN_PATH }}
          SPEC_PATH: ${{ env.SPEC_PATH }}
          STACK_NAME: ${{ inputs.STACK_NAME }}
          AWS_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          PROXYGEN_PRIVATE_KEY_NAME: PSUProxygenPrivateKey
          PROXYGEN_KID: "eps-cli-key-1"
          DRY_RUN: false
          DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE: ${{ inputs.DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE }}
        run: ./deploy_api.sh

      - name: Deploy CPSU API
        shell: bash
        working-directory: .github/scripts
        if: ${{ inputs.DEPLOY_APIGEE_CPSU == true && always() && !failure() && !cancelled() }}
        env:
          API_TYPE: custom
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          PROXYGEN_PATH: ${{ env.PROXYGEN_PATH }}
          SPEC_PATH: ${{ env.CPSU_SPEC_PATH }}
          STACK_NAME: ${{ inputs.STACK_NAME }}
          AWS_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          PROXYGEN_PRIVATE_KEY_NAME: CPSUProxygenPrivateKey
          PROXYGEN_KID: eps-cli-key-cpsu-1
          DRY_RUN: false
          DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE: ${{ inputs.DEPLOY_CHECK_PRESCRIPTION_STATUS_UPDATE }}
        run: ./deploy_api.sh

      - name: create_int_release_notes
        uses: ./.github/actions/update_confluence_jira
        if: ${{ inputs.CREATE_INT_RELEASE_NOTES == true && always() && !failure() && !cancelled() }}
        with:
          TARGET_ENVIRONMENT: int
          CONFLUENCE_PAGE_ID: "789747642"
          CREATE_RC_RELEASE_NOTES: false
          DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
          TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.INT_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
          DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}

      - name: create_prod_release_notes
        uses: ./.github/actions/update_confluence_jira
        if: ${{ inputs.CREATE_PROD_RELEASE_NOTES == true && always() && !failure() && !cancelled() }}
        with:
          TARGET_ENVIRONMENT: prod
          CONFLUENCE_PAGE_ID: "789747646"
          CREATE_RC_RELEASE_NOTES: false
          DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
          TARGET_CLOUD_FORMATION_CHECK_VERSION_ROLE: ${{ secrets.PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE }}
          DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}

      - name: mark_released_in_jira
        uses: ./.github/actions/mark_jira_released
        if: ${{ inputs.MARK_JIRA_RELEASED == true && always() && !failure() && !cancelled() }}
        with:
          RELEASE_TAG: ${{ inputs.VERSION_NUMBER }}
          DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE }}

      - name: Checkout gh-pages
        uses: actions/checkout@v4
        with:
          ref: gh-pages
          path: gh-pages

      - name: Update release tag in github pages
        if: ${{ !startsWith(inputs.STACK_NAME, 'psu-pr-') }}
        run: |
          cd gh-pages
          NOW=$(date +'%Y-%m-%dT%H:%M:%S')
          echo "tag,release_datetime" > _data/${{ inputs.APIGEE_ENVIRONMENT }}_latest.csv
          echo "${{ inputs.VERSION_NUMBER }},${NOW}" >> _data/${{ inputs.APIGEE_ENVIRONMENT }}_latest.csv
          echo "${{ inputs.VERSION_NUMBER }},${NOW}" >> _data/${{ inputs.APIGEE_ENVIRONMENT }}_deployments.csv
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add _data/${{ inputs.APIGEE_ENVIRONMENT }}_latest.csv
          git add _data/${{ inputs.APIGEE_ENVIRONMENT }}_deployments.csv
          git commit -m 'update releases for ${{ inputs.APIGEE_ENVIRONMENT }}'
          parallel --retries 10 --delay 3 ::: "git pull --rebase && git push"

  regression_tests:
    if: ${{ inputs.RUN_REGRESSION_TEST == true && always() && !failure() && !cancelled() }}
    name: Regression Tests
    uses: ./.github/workflows/run_regression_tests.yml
    needs: release_code_and_api
    with:
      ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
      VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
    secrets:
      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}