feat: sentry

.circleci/config.yml

@@ -0,0 +1,232 @@
+version: 2.1
+orbs:
+  hmpps: ministryofjustice/hmpps@10
+  slack: circleci/[email protected]
+  codecov: codecov/codecov@3 # v4 doesnt upload coverage, complaining about a lack of token
+
+parameters:
+  alerts-slack-channel:
+    type: string
+    # Normally team specific alert channel e.g. hmpps_tech_alerts, syscon-alerts, dps_sed_alerts
+    # This is to avoid a general alert dumping ground that no-one then monitors
+    default: dps_alerts_security
+
+  releases-slack-channel:
+    type: string
+    # Normally dps-releases for most teams / projects
+    default: dps-releases
+
+  node-version:
+    type: string
+    default: 22.10-browsers
+
+jobs:
+  build:
+    executor:
+      name: hmpps/node
+      tag: << pipeline.parameters.node-version >>
+    steps:
+      - checkout
+      - run:
+          name: Update npm
+          command: 'sudo npm install -g npm@latest'
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package-lock.json" }}
+      - run:
+          name: Install Dependencies
+          command: npm ci --no-audit
+      - save_cache:
+          key: dependency-cache-{{ checksum "package-lock.json" }}
+          paths:
+            - node_modules
+            - ~/.cache
+      - run:
+          command: |
+            npm run build
+      - run: # Run linter after build because the integration test code depend on compiled typescript...
+          name: Linter check
+          command: npm run lint
+      - persist_to_workspace:
+          root: .
+          paths:
+            - node_modules
+            - build
+            - dist
+            - assets
+
+  unit_test:
+    executor:
+      name: hmpps/node
+      tag: << pipeline.parameters.node-version >>
+    steps:
+      - checkout
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package-lock.json" }}
+      - run:
+          name: unit tests
+          command: npm run test:ci
+      - store_test_results:
+          path: test_results
+      - store_artifacts:
+          path: test_results/unit-test-reports.html
+      - persist_to_workspace:
+          root: .
+          paths: test_results
+
+  integration_tests:
+    executor:
+      name: hmpps/node_redis
+      node_tag: << pipeline.parameters.node-version >>
+      redis_tag: "6.2"
+    parallelism: 4
+    resource_class: large
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/app
+      - run:
+          name: Install missing OS dependency
+          command: sudo apt-get install libxss1
+      - restore_cache:
+          key: dependency-cache-{{ checksum "package-lock.json" }}
+      - run:
+          name: Get wiremock
+          command: curl -o wiremock.jar https://repo1.maven.org/maven2/org/wiremock/wiremock-standalone/3.9.1/wiremock-standalone-3.9.1.jar
+      - run:
+          name: Run wiremock
+          command: java -jar wiremock.jar --port 9091
+          background: true
+      - run:
+          name: Run the node app.
+          command: npm run start-e2e
+          background: true
+      - run:
+          name: Wait for node app to start
+          command: ./node_modules/wait-on/bin/wait-on -t 30s http://localhost:3007/ping
+      - run:
+          name: Integration tests
+          command: circleci tests glob "**/*.cy.ts" | circleci tests run --command="xargs npx cypress run --reporter cypress-circleci-reporter --spec" --verbose --split-by=timings
+      - store_test_results:
+          path: test_results
+      - store_artifacts:
+          path: integration_tests/videos
+      - store_artifacts:
+          path: integration_tests/screenshots
+      - codecov/upload
+
+workflows:
+  version: 2
+  build-test-and-deploy:
+    jobs:
+      - build:
+          filters:
+            tags:
+              ignore: /.*/
+      - unit_test:
+          requires:
+            - build
+      - integration_tests:
+          requires:
+            - build
+            - unit_test
+      - hmpps/helm_lint:
+          name: helm_lint
+      - hmpps/build_docker:
+          name: build_docker
+          additional_docker_build_args: --secret id=sentry,env=SENTRY_AUTH_TOKEN
+          filters:
+            branches:
+              only:
+                - main
+      - hmpps/deploy_env:
+          name: deploy_dev
+          env: "dev"
+          jira_update: true
+          pipeline_id: <<pipeline.id>>
+          pipeline_number: <<pipeline.number>>
+          context: hmpps-common-vars
+          filters:
+            branches:
+              only:
+                - main
+          requires:
+            - helm_lint
+            - integration_tests
+            - build_docker
+          helm_timeout: 5m
+      - request-preprod-approval:
+          type: approval
+          requires:
+            - deploy_dev
+      - hmpps/deploy_env:
+          name: deploy_preprod
+          env: "preprod"
+          jira_update: true
+          jira_env_type: staging
+          pipeline_id: <<pipeline.id>>
+          pipeline_number: <<pipeline.number>>
+          slack_notification: true
+          slack_channel_name: move-and-improve-alerts-non-prod
+          context:
+            - hmpps-common-vars
+            - hmpps-allocate-key-workers-preprod
+          requires:
+            - request-preprod-approval
+          helm_timeout: 5m
+      - request-prod-approval:
+          type: approval
+          requires:
+            - deploy_preprod
+      - hmpps/deploy_env:
+          name: deploy_prod
+          env: "prod"
+          jira_update: true
+          jira_env_type: production
+          pipeline_id: <<pipeline.id>>
+          pipeline_number: <<pipeline.number>>
+          slack_notification: true
+          slack_channel_name: move-and-improve-alerts
+          context:
+            - hmpps-common-vars
+            - hmpps-allocate-key-workers-prod
+          requires:
+            - request-prod-approval
+          helm_timeout: 5m
+
+  security:
+    triggers:
+      - schedule:
+          cron: "37 7 * * 1-5"
+          filters:
+            branches:
+              only:
+                - main
+    jobs:
+      - hmpps/npm_security_audit:
+          slack_channel: move-and-improve-alerts-non-prod
+          node_tag: << pipeline.parameters.node-version >>
+          context:
+            - hmpps-common-vars
+      - hmpps/trivy_latest_scan:
+          slack_channel: move-and-improve-alerts-non-prod
+          context:
+            - hmpps-common-vars
+      - hmpps/veracode_pipeline_scan:
+          slack_channel: move-and-improve-alerts-non-prod
+          context:
+            - veracode-credentials
+            - hmpps-common-vars
+  security-weekly:
+    triggers:
+      - schedule:
+          cron: "5 7 * * 1"
+          filters:
+            branches:
+              only:
+                - main
+    jobs:
+      - hmpps/veracode_policy_scan:
+          slack_channel: move-and-improve-alerts-non-prod
+          context:
+            - veracode-credentials
+            - hmpps-common-vars

Dockerfile

@@ -42,7 +42,7 @@ RUN CYPRESS_INSTALL_BINARY=0 npm ci --no-audit
 ENV NODE_ENV='production'
 
 COPY . .
-RUN npm run build
+RUN --mount=type=secret,id=sentry SENTRY_AUTH_TOKEN=$(cat /run/secrets/sentry) npm run build
 
 RUN npm prune --no-audit --omit=dev
 

helm_deploy/hmpps-allocate-key-workers-ui/values.yaml

@@ -45,12 +45,16 @@ generic-service:
       AUTH_CODE_CLIENT_SECRET: 'AUTH_CODE_CLIENT_SECRET'
       CLIENT_CREDS_CLIENT_ID: 'CLIENT_CREDS_CLIENT_ID'
       CLIENT_CREDS_CLIENT_SECRET: 'CLIENT_CREDS_CLIENT_SECRET'
+      SENTRY_AUTH_TOKEN: SENTRY_AUTH_TOKEN
       SESSION_SECRET: 'SESSION_SECRET'
     elasticache-redis:
       REDIS_HOST: 'primary_endpoint_address'
       REDIS_AUTH_TOKEN: 'auth_token'
     application-insights:
       APPLICATIONINSIGHTS_CONNECTION_STRING: "APPLICATIONINSIGHTS_CONNECTION_STRING"
+    hmpps-allocate-key-workers-sentry:
+      SENTRY_DSN: "SENTRY_DSN"
+      SENTRY_LOADER_SCRIPT_ID: "SENTRY_LOADER_SCRIPT_ID"
     # This secret will need to be created in your namespace (note it isn't in hmpps-templates-dev)
     # IRSA configuration in your namespace will also be required, and then uncomment serviceAccountName above.
     # sqs-hmpps-audit-secret: