Merge pull request #1156 from DFE-Digital/update-rubocop #4765
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| types: | |
| - labeled | |
| - synchronize | |
| - reopened | |
| - opened | |
| - converted_to_draft | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| required: true | |
| type: choice | |
| options: | |
| - dev | |
| - test | |
| - preprod | |
| jobs: | |
| build_image: | |
| name: Image build and push | |
| if: contains(github.event.pull_request.labels.*.name, 'deploy') || github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| image_name_tag: ${{ steps.build_image.outputs.ghcr_image_name_tag }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/build-image | |
| id: build_image | |
| with: | |
| github_username: ${{ github.actor }} | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| registry: ghcr.io | |
| deploy_review_app: | |
| name: Deploy to review environment | |
| runs-on: ubuntu-latest | |
| if: contains(github.event.pull_request.labels.*.name, 'deploy') | |
| concurrency: deploy_review_${{ github.event.pull_request.number }} | |
| needs: [build_image] | |
| environment: | |
| name: review | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/deploy-environment | |
| id: deploy | |
| with: | |
| environment_name: review | |
| image_name_tag: ${{ needs.build_image.outputs.image_name_tag }} | |
| image_tag: ${{ github.sha }} | |
| azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} | |
| site_up_retries: 300 | |
| startup_command: "sh /app/bin/start-review-app.sh" | |
| - name: Post URL to Pull Request comment | |
| uses: marocchino/sticky-pull-request-comment@v2 | |
| with: | |
| message: | | |
| Review app deployed to <${{ steps.deploy.outputs.environment_url }}> | |
| - uses: ./.github/actions/smoke-test | |
| id: smoke-test | |
| with: | |
| environment: review | |
| azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} | |
| url: ${{ steps.deploy.outputs.environment_url }} | |
| set_matrix: | |
| name: Set deployment matrix | |
| runs-on: ubuntu-latest | |
| needs: [build_image] | |
| outputs: | |
| deployment_matrix: ${{ steps.set-matrix.outputs.deployment_matrix }} | |
| steps: | |
| - id: set-matrix | |
| run: | | |
| if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then | |
| DEPLOYMENT_MATRIX="{ 'environment': ['${{ github.event.inputs.environment }}'] }" | |
| else | |
| DEPLOYMENT_MATRIX="{ 'environment': ['dev', 'test', 'preprod'] }" | |
| fi | |
| echo "deployment_matrix=$DEPLOYMENT_MATRIX" >> $GITHUB_OUTPUT | |
| deploy_non_prod: | |
| name: Deploy to ${{ matrix.environment }} environment | |
| runs-on: ubuntu-latest | |
| if: (github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event_name == 'workflow_dispatch' | |
| concurrency: deploy_${{ matrix.environment }} | |
| needs: [build_image, set_matrix] | |
| strategy: | |
| fail-fast: false # this is necessary to prevent early terminiation of terraform deployments that will result in tfstate locks | |
| max-parallel: 3 | |
| matrix: ${{ fromJson(needs.set_matrix.outputs.deployment_matrix) }} | |
| environment: | |
| name: ${{ matrix.environment }} | |
| url: ${{ steps.deploy.outputs.environment_url }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/deploy-environment | |
| id: deploy | |
| with: | |
| environment_name: ${{ matrix.environment }} | |
| image_name_tag: ${{ needs.build_image.outputs.image_name_tag }} | |
| image_tag: ${{ github.sha }} | |
| azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} | |
| - uses: ./.github/actions/smoke-test | |
| id: smoke-test | |
| with: | |
| environment: ${{ matrix.environment }} | |
| azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} | |
| url: ${{ steps.deploy.outputs.environment_url }} | |
| deploy_prod: | |
| name: Deploy to production environment | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| concurrency: deploy_prod | |
| needs: [build_image, deploy_non_prod] | |
| environment: | |
| name: production | |
| url: ${{ steps.deploy.outputs.environment_url }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/deploy-environment | |
| id: deploy | |
| with: | |
| environment_name: production | |
| image_name_tag: ${{ needs.build_image.outputs.image_name_tag }} | |
| image_tag: ${{ github.sha }} | |
| azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} | |
| notify_slack_of_failures: | |
| name: Notify Slack of failures | |
| runs-on: ubuntu-latest | |
| needs: [build_image, deploy_review_app, set_matrix, deploy_non_prod, deploy_prod] | |
| environment: ${{ needs.deploy_nonprod.outputs.environment_name || 'dev' }} | |
| env: | |
| ENVIRONMENT_NAME: ${{ needs.deploy_nonprod.outputs.environment_name || 'dev' }} | |
| if: failure() | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set Environment variables | |
| shell: bash | |
| working-directory: terraform | |
| run: | | |
| if ${{ needs.build_image.result == 'failure' }} | |
| then | |
| job=build_image | |
| elif ${{ needs.deploy_review_app.result == 'failure' }} | |
| then | |
| job=deploy_review_app | |
| review=true | |
| elif ${{ needs.set_matrix.result == 'failure' }} | |
| then | |
| job=set_matrix | |
| elif ${{ needs.deploy_non_prod.result == 'failure' }} | |
| then | |
| job=deploy_non_prod | |
| elif ${{ needs.deploy_prod.result == 'failure' }} | |
| then | |
| job=deploy_prod | |
| fi | |
| tf_vars_file=workspace_variables/${{ env.ENVIRONMENT_NAME }}.tfvars.json | |
| echo "KEY_VAULT_NAME=$(jq -r '.key_vault_name' ${tf_vars_file})" >> $GITHUB_ENV | |
| echo "JOB=${job}" >> $GITHUB_ENV | |
| echo "REVIEW=${review}" >> $GITHUB_ENV | |
| - uses: Azure/login@v2 | |
| with: | |
| creds: ${{ secrets.AZURE_CREDENTIALS }} | |
| - uses: DfE-Digital/keyvault-yaml-secret@v1 | |
| id: get_monitoring_secret | |
| with: | |
| keyvault: ${{ env.KEY_VAULT_NAME }} | |
| secret: MONITORING | |
| key: SLACK_WEBHOOK | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Notify Slack channel on job failure | |
| uses: rtCamp/action-slack-notify@v2 | |
| env: | |
| SLACK_USERNAME: CI Deployment | |
| SLACK_TITLE: Deployment of refer-serious-misconduct ${{ env.REVIEW && 'review' }} failed | |
| SLACK_MESSAGE: Job ${{ env.JOB }} failed | |
| SLACK_WEBHOOK: ${{ steps.get_monitoring_secret.outputs.SLACK_WEBHOOK }} | |
| SLACK_COLOR: failure | |
| SLACK_FOOTER: Sent from Build and Deploy workflow |