-
Notifications
You must be signed in to change notification settings - Fork 3
350 lines (337 loc) · 14.9 KB
/
deploy.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
on:
# Triggers the workflow on push or pull request events but only for the main branch
workflow_call:
inputs:
app_name:
required: true
type: string
api:
required: false
default: false
type: boolean
assets_required:
required: false
default: false
type: boolean
postgres_unit_testing:
required: false
default: false
type: boolean
db_name:
required: false
default: "postgres_db"
type: string
apply_network_policy:
required: false
default: false
type: boolean
deploy_to_dev:
required: false
default: true
type: boolean
run_performance_tests:
required: false
default: false
type: boolean
run_e2e_tests:
required: false
default: true
type: boolean
include_manifest:
required: false
default: false
type: boolean
# not required when not deploying to cf
secrets:
CF_API:
required: false
CF_ORG:
required: false
CF_SPACE:
required: false
CF_USER:
required: false
CF_PASSWORD:
required: false
RSA256_PUBLIC_KEY_BASE64:
required: false
GOV_NOTIFY_API_KEY:
required: false
SENTRY_DSN:
required: false
FORMS_SERVICE_PRIVATE_HOST:
required: false
RSA256_PRIVATE_KEY_BASE64:
required: false
AZURE_AD_CLIENT_ID:
required: false
AZURE_AD_TENANT_ID:
required: false
AZURE_AD_CLIENT_SECRET:
required: false
SECRET_KEY:
required: false
SESSION_COOKIE_NAME:
required: false
#Needed to clone and execute the e2e tests
E2E_PAT:
required: true
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
jobs:
testing-unit:
runs-on: ubuntu-latest
environment: Dev
if: ${{ inputs.postgres_unit_testing == false }}
steps:
- name: checkout code
uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: 3.10.x
cache: 'pip'
cache-dependency-path: 'requirements-dev.txt'
- name: install dependencies
run: python -m pip install --upgrade pip && python -m pip install -r requirements-dev.txt
- name: build static assets (if frontend)
if: ${{inputs.assets_required == true}}
env:
FLASK_ENV: "development"
run: python build.py
- name: run unit tests
env:
GOV_NOTIFY_API_KEY: ${{ secrets.GOV_NOTIFY_API_KEY }}
# pytest -m "not accessibility" runs every test which is not marked
# accessibility.
run: python -m pip install pytest && python -m pytest -m "not accessibility" .
testing-unit-postgres:
runs-on: ubuntu-latest
environment: Dev
if: ${{ inputs.postgres_unit_testing == true }}
services:
# Label used to access the service containers
postgres:
# Docker Hub image
image: postgres
# Provide the password for postgres
env:
POSTGRES_PASSWORD: postgres
POSTGRES_DB: ${{inputs.db_name}}
# Set health checks to wait until postgres has started
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
# Maps tcp port 5432 on service container to the host
- 5432:5432
steps:
- name: checkout code
uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: 3.10.x
cache: 'pip'
cache-dependency-path: 'requirements-dev.txt'
- name: install dependencies
run: python -m pip install --upgrade pip && python -m pip install -r requirements-dev.txt
- name: run unit tests
run: python -m pip install pytest && python -m pytest -m "not accessibility"
deploy_dev:
if: ${{ always() && github.actor != 'dependabot[bot]' && (needs.testing-unit.result=='success' || needs.testing.result=='success' || needs.testing-unit-postgres.result=='success') && inputs.deploy_to_dev == true}}
concurrency: deploy_dev_${{github.repository}}
needs: [testing-unit, testing-unit-postgres]
runs-on: ubuntu-latest
environment: Dev
steps:
- name: checkout code
uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: 3.10.x
cache: 'pip'
cache-dependency-path: 'requirements.txt'
- name: create python env
run: python -m venv .venv
- name: install dependencies
run: source .venv/bin/activate && python -m pip install --upgrade pip && pip install -r requirements.txt
- name: build static assets (if frontend)
if: ${{inputs.assets_required == true}}
env:
FLASK_ENV: "development"
run: source .venv/bin/activate && python build.py
- name: download previous build
uses: actions/download-artifact@v2
- name: Deploy to Gov PaaS
uses: citizen-of-planet-earth/cf-cli-action@v2
with:
cf_api: ${{secrets.CF_API}}
cf_org: ${{secrets.CF_ORG}}
cf_space: ${{secrets.CF_SPACE}}
cf_username: ${{secrets.CF_USER}}
cf_password: ${{secrets.CF_PASSWORD}}
command: push
${{(inputs.include_manifest) && '-f manifest-dev.yml' || ''}}
${{inputs.app_name}}-dev
--var GITHUB_SHA="${{ github.sha }}"
${{(secrets.RSA256_PUBLIC_KEY_BASE64) && format('--var RSA256_PUBLIC_KEY_BASE64="{0}"', secrets.RSA256_PUBLIC_KEY_BASE64) || ''}}
${{(secrets.SENTRY_DSN) && format('--var SENTRY_DSN={0}', secrets.SENTRY_DSN) || ''}}
${{(secrets.FORMS_SERVICE_PRIVATE_HOST) && format('--var FORMS_SERVICE_PRIVATE_HOST={0}', secrets.FORMS_SERVICE_PRIVATE_HOST) || ''}}
${{(secrets.RSA256_PRIVATE_KEY_BASE64) && format('--var RSA256_PRIVATE_KEY_BASE64="{0}"', secrets.RSA256_PRIVATE_KEY_BASE64) || ''}}
${{(secrets.AZURE_AD_CLIENT_ID) && format('--var AZURE_AD_CLIENT_ID={0}', secrets.AZURE_AD_CLIENT_ID) || ''}}
${{(secrets.AZURE_AD_TENANT_ID) && format('--var AZURE_AD_TENANT_ID={0}', secrets.AZURE_AD_TENANT_ID) || ''}}
${{(secrets.AZURE_AD_CLIENT_SECRET) && format('--var AZURE_AD_CLIENT_SECRET={0}', secrets.AZURE_AD_CLIENT_SECRET) || ''}}
${{(secrets.SECRET_KEY) && format('--var SECRET_KEY={0}', secrets.SECRET_KEY) || ''}}
${{(secrets.SESSION_COOKIE_NAME) && format('--var SESSION_COOKIE_NAME={0}', secrets.SESSION_COOKIE_NAME) || ''}}
${{(secrets.GOV_NOTIFY_API_KEY) && format('--var GOV_NOTIFY_API_KEY={0}', secrets.GOV_NOTIFY_API_KEY) || ''}}
# Action used by Authenticator
- name: Apply network policy for notification service
if: ${{inputs.apply_network_policy == true}}
uses: citizen-of-planet-earth/cf-cli-action@v2
with:
cf_api: ${{secrets.CF_API}}
cf_org: ${{secrets.CF_ORG}}
cf_space: ${{secrets.CF_SPACE}}
cf_username: ${{secrets.CF_USER}}
cf_password: ${{secrets.CF_PASSWORD}}
command: add-network-policy ${{inputs.app_name}}-dev funding-service-design-notification-dev --protocol tcp --port 8080
run_shared_tests_dev:
needs: deploy_dev
concurrency: run_shared_tests_dev
if: ${{ always() && (inputs.deploy_to_dev == true && needs.deploy_dev.result=='success' ) && github.actor != 'dependabot[bot]' }}
uses: ./.github/workflows/run-shared-tests.yml
with:
perf_test_target_url_application_store: https://funding-service-design-application-store-dev.london.cloudapps.digital
perf_test_target_url_fund_store: https://funding-service-design-fund-store-dev.london.cloudapps.digital
perf_test_target_url_assessment_store: https://funding-service-design-assessment-store-dev.london.cloudapps.digital
e2e_tests_target_url_frontend: https://fsd:[email protected]
e2e_tests_target_url_authenticator: https://fsd:[email protected]
e2e_tests_target_url_form_runner: https://fsd:[email protected]
e2e_tests_target_url_assessment: https://fsd:[email protected]
run_performance_tests: ${{inputs.run_performance_tests}}
run_e2e_tests: false
secrets:
E2E_PAT: ${{secrets.E2E_PAT}}
static_security:
if: ${{ always() && (needs.testing-unit.result=='success' || needs.testing.result=='success' || needs.testing-unit-postgres.result=='success')}}
needs: [testing-unit, testing-unit-postgres]
runs-on: ubuntu-latest
environment: Dev
steps:
- name: checkout code
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: 3.10.x
- name: install dependencies
run: python -m pip install --upgrade pip && python -m pip install -r requirements-dev.txt bandit==1.7.4
- name: Bandit
run: bandit -r ./app
- name: ZAP Scan
uses: zaproxy/[email protected]
with:
target: 'https://funding-service-design-assessment-dev.london.cloudapps.digital/'
allow_issue_writing: False
deploy_test:
needs: run_shared_tests_dev
concurrency: deploy_test_${{github.repository}}
if: ${{ always() && (inputs.deploy_to_dev == false || (inputs.deploy_to_dev == true && needs.run_shared_tests_dev.result=='success')) && github.ref == 'refs/heads/main' }}
runs-on: ubuntu-latest
environment: test
steps:
- name: checkout code
uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: 3.10.x
cache: 'pip'
cache-dependency-path: 'requirements-dev.txt'
- name: create python env
run: python -m venv .venv
- name: install dependencies
run: source .venv/bin/activate && python -m pip install --upgrade pip && pip install -r requirements.txt
- name: build static assets (if frontend)
if: ${{inputs.assets_required == true}}
env:
FLASK_ENV: "development"
run: source .venv/bin/activate && python build.py
- name: download previous build
uses: actions/download-artifact@v2
- name: Deploy to Gov PaaS
uses: citizen-of-planet-earth/cf-cli-action@v2
with:
cf_api: ${{secrets.CF_API}}
cf_org: ${{secrets.CF_ORG}}
cf_space: ${{secrets.CF_SPACE}}
cf_username: ${{secrets.CF_USER}}
cf_password: ${{secrets.CF_PASSWORD}}
command: push
${{(inputs.include_manifest) && '-f manifest-test.yml' || ''}}
${{inputs.app_name}}-test
--var GITHUB_SHA="${{ github.sha }}"
${{(secrets.RSA256_PUBLIC_KEY_BASE64) && format('--var RSA256_PUBLIC_KEY_BASE64="{0}"', secrets.RSA256_PUBLIC_KEY_BASE64) || ''}}
${{(secrets.SENTRY_DSN) && format('--var SENTRY_DSN={0}', secrets.SENTRY_DSN) || ''}}
${{(secrets.FORMS_SERVICE_PRIVATE_HOST) && format('--var FORMS_SERVICE_PRIVATE_HOST={0}', secrets.FORMS_SERVICE_PRIVATE_HOST) || ''}}
${{(secrets.RSA256_PRIVATE_KEY_BASE64) && format('--var RSA256_PRIVATE_KEY_BASE64="{0}"', secrets.RSA256_PRIVATE_KEY_BASE64) || ''}}
${{(secrets.AZURE_AD_CLIENT_ID) && format('--var AZURE_AD_CLIENT_ID={0}', secrets.AZURE_AD_CLIENT_ID) || ''}}
${{(secrets.AZURE_AD_TENANT_ID) && format('--var AZURE_AD_TENANT_ID={0}', secrets.AZURE_AD_TENANT_ID) || ''}}
${{(secrets.AZURE_AD_CLIENT_SECRET) && format('--var AZURE_AD_CLIENT_SECRET={0}', secrets.AZURE_AD_CLIENT_SECRET) || ''}}
${{(secrets.SECRET_KEY) && format('--var SECRET_KEY={0}', secrets.SECRET_KEY) || ''}}
${{(secrets.SESSION_COOKIE_NAME) && format('--var SESSION_COOKIE_NAME={0}', secrets.SESSION_COOKIE_NAME) || ''}}
${{(secrets.GOV_NOTIFY_API_KEY) && format('--var GOV_NOTIFY_API_KEY={0}', secrets.GOV_NOTIFY_API_KEY) || ''}}
- name: Apply network policy for notification service
if: ${{inputs.apply_network_policy == true}}
uses: citizen-of-planet-earth/cf-cli-action@v2
with:
cf_api: ${{secrets.CF_API}}
cf_org: ${{secrets.CF_ORG}}
cf_space: ${{secrets.CF_SPACE }}
cf_username: ${{secrets.CF_USER}}
cf_password: ${{secrets.CF_PASSWORD}}
command: add-network-policy ${{inputs.app_name}}-test funding-service-design-notification-test --protocol tcp --port 8080
security-with-zap:
needs: deploy_test
if: ${{ always() && needs.deploy_test.result=='success' && (needs.testing-unit.result=='success' || needs.testing.result=='success' || needs.testing-unit-postgres.result == 'success') && github.ref == 'refs/heads/main' }}
runs-on: ubuntu-latest
environment: test
steps:
- name: checkout code
uses: actions/checkout@v2
- name: Set up Python
uses: actions/setup-python@v2
with:
python-version: 3.10.x
cache: 'pip'
cache-dependency-path: 'requirements.txt'
- name: install dependencies
run: python -m pip install --upgrade pip && python -m pip install -r requirements.txt bandit==1.7.4
- name: Bandit
run: bandit -r ./app
- name: ZAP Scan
uses: zaproxy/[email protected]
with:
target: 'https://${{inputs.app_name}}-test.london.cloudapps.digital/'
allow_issue_writing: False
run_shared_tests_test:
if: ${{ always() && needs.deploy_test.result=='success' && github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/main' }}
concurrency: run_shared_tests_test
uses: ./.github/workflows/run-shared-tests.yml
needs: deploy_test
with:
e2e_tests_target_url_frontend: https://fsd:[email protected]
e2e_tests_target_url_authenticator: https://fsd:[email protected]
e2e_tests_target_url_form_runner: https://fsd:[email protected]
e2e_tests_target_url_assessment: https://fsd:[email protected]
run_performance_tests: ${{inputs.run_performance_tests}}
run_e2e_tests: ${{inputs.run_e2e_tests}}
perf_test_target_url_application_store: https://funding-service-design-application-store-test.london.cloudapps.digital
perf_test_target_url_fund_store: https://funding-service-design-fund-store-test.london.cloudapps.digital
perf_test_target_url_assessment_store: https://funding-service-design-assessment-store-test.london.cloudapps.digital
secrets:
E2E_PAT: ${{secrets.E2E_PAT}}