Skip to content

Commit f27eeaa

Browse files
mattdean3-nhsmattdean3-nhs
committed
[NRL-793] Complete update-lambda-permissions workflow and pull-lambda-code-for-stack.sh script
1 parent a80f2b3 commit f27eeaa

File tree

2 files changed

+135
-13
lines changed

2 files changed

+135
-13
lines changed

‎.github/workflows/update-lambda-permissions.yml‎

Lines changed: 111 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ permissions:
2626

2727
jobs:
2828
build-permissions:
29-
name: Building permissions package for ${{ inputs.environment }}
29+
name: Build permissions for ${{ inputs.environment }}
3030
runs-on: [self-hosted, ci]
3131
environment: ${{ inputs.environment }}
3232

@@ -73,35 +73,140 @@ jobs:
7373
key: ${{ github.run_id }}-nrlf-permissions
7474
path: dist/nrlf_permissions.zip
7575

76-
apply-permissions:
77-
name: Applying permissions to ${{ inputs.environment }}
76+
pull-deployed-lambdas:
77+
name: Pull deployed lambdas for ${{ inputs.environment }}
7878
runs-on: [self-hosted, ci]
7979
environment: ${{ inputs.environment }}
8080

81-
needs: build-permissions
81+
steps:
82+
- name: Git clone - ${{ github.ref }}
83+
uses: actions/checkout@v4
84+
with:
85+
ref: ${{ github.ref }}
86+
87+
- name: Configure Management Credentials
88+
uses: aws-actions/configure-aws-credentials@v4
89+
with:
90+
aws-region: eu-west-2
91+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
92+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
93+
94+
- name: Configure Account Role
95+
uses: aws-actions/configure-aws-credentials@v4
96+
with:
97+
aws-region: eu-west-2
98+
role-chaining: true
99+
role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
100+
role-session-name: github-actions-ci-acc-${{ inputs.environment }}-${{ github.run_id }}
101+
102+
- name: Pull deployed lambda artifacts
103+
run: |
104+
account=$(echo '${{ inputs.environment }}' | cut -d '-' -f1)
105+
./scripts/pull-lambda-code-for-stack.sh ${{ inputs.stack_name }}
106+
107+
- name: Save lambda artifacts in cache
108+
uses: actions/cache/save@v4
109+
with:
110+
key: ${{ github.run_id }}-pulled-lambda-artifacts
111+
path: dist/*.zip
112+
113+
terraform-plan:
114+
name: Plan changes to ${{ inputs.environment }}
115+
runs-on: [self-hosted, ci]
116+
environment: ${{ inputs.environment }}
117+
118+
needs: [build-permissions, pull-deployed-lambdas]
82119

83120
steps:
84121
- name: Git clone - ${{ github.ref }}
85122
uses: actions/checkout@v4
86123
with:
87124
ref: ${{ github.ref }}
88125

126+
- name: Restore pulled lambda artifacts
127+
uses: actions/cache/restore@v4
128+
with:
129+
key: ${{ github.run_id }}-pulled-lambda-artifacts
130+
path: ./dist
131+
fail-on-cache-miss: true
132+
89133
- name: Restore NRLF permissions cache
90134
uses: actions/cache/restore@v4
91135
with:
92136
key: ${{ github.run_id }}-nrlf-permissions
93137
path: dist/nrlf_permissions.zip
94138
fail-on-cache-miss: true
95139

140+
- name: Configure Management Credentials
141+
uses: aws-actions/configure-aws-credentials@v4
142+
with:
143+
aws-region: eu-west-2
144+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
145+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
146+
96147
- name: Terraform Init
97148
run: |
98149
terraform -chdir=terraform/infrastructure init
99150
terraform -chdir=terraform/infrastructure workspace new ${{ inputs.stack_name }} || \
100151
terraform -chdir=terraform/infrastructure workspace select ${{ inputs.stack_name }}
101152
102-
- name: Terraform Apply
153+
- name: Terraform Plan
103154
run: |
104-
terraform -chdir=terraform/infrastructure apply -auto-approve \
155+
terraform -chdir=terraform/infrastructure plan \
105156
--var-file=etc/${{ vars.ACCOUNT_NAME }}.tfvars \
106157
--var assume_role_arn=${{ secrets.DEPLOY_ROLE_ARN }} \
107158
--var use_shared_resources=$(poetry run python scripts/are_resources_shared_for_stack.py ${{ inputs.stack_name }}) \
159+
--out tfplan
160+
161+
- name: Save Terraform Plan
162+
run: |
163+
terraform -chdir=terraform/infrastructure show -no-color tfplan > terraform/infrastructure/tfplan.txt
164+
aws s3 cp terraform/infrastructure/tfplan s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan
165+
aws s3 cp terraform/infrastructure/tfplan.txt s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan.txt
166+
167+
terraform-apply:
168+
name: Apply permissions to ${{ inputs.environment }}
169+
runs-on: [self-hosted, ci]
170+
environment: ${{ inputs.environment }}
171+
172+
needs: terraform-plan
173+
174+
steps:
175+
- name: Git clone - ${{ github.ref }}
176+
uses: actions/checkout@v4
177+
with:
178+
ref: ${{ github.ref }}
179+
180+
- name: Restore pulled lambda artifacts
181+
uses: actions/cache/restore@v4
182+
with:
183+
key: ${{ github.run_id }}-pulled-lambda-artifacts
184+
path: ./dist
185+
fail-on-cache-miss: true
186+
187+
- name: Restore NRLF permissions cache
188+
uses: actions/cache/restore@v4
189+
with:
190+
key: ${{ github.run_id }}-nrlf-permissions
191+
path: dist/nrlf_permissions.zip
192+
fail-on-cache-miss: true
193+
194+
- name: Configure Management Credentials
195+
uses: aws-actions/configure-aws-credentials@v4
196+
with:
197+
aws-region: eu-west-2
198+
role-to-assume: ${{ secrets.MGMT_ROLE_ARN }}
199+
role-session-name: github-actions-ci-${{ inputs.environment }}-${{ github.run_id }}
200+
201+
- name: Download Terraform Plan artifact
202+
run: aws s3 cp s3://nhsd-nrlf--mgmt--github-ci-logging/${{ inputs.environment }}/${{ github.run_id }}/tfplan terraform/infrastructure/tfplan
203+
204+
- name: Terraform Init
205+
run: |
206+
terraform -chdir=terraform/infrastructure init
207+
terraform -chdir=terraform/infrastructure workspace new ${{ inputs.stack_name }} || \
208+
terraform -chdir=terraform/infrastructure workspace select ${{ inputs.stack_name }}
209+
210+
- name: Terraform Apply
211+
run: |
212+
terraform -chdir=terraform/infrastructure apply tfplan

‎scripts/pull-lambda-code-for-stack.sh‎

100644100755
Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,40 +9,57 @@ stack_name="$1"
99
function pull_lambda_code(){
1010
local api_name="$1"
1111
local endpoint_name="$2"
12-
local lambda_name="nhds-nrlf--${stack_name}--API-${api_name}--${endpoint_name}"
12+
local lambda_name="nhsd-nrlf--${stack_name}--api--${api_name}--${endpoint_name}"
1313

14-
echo "Downloading code for lambda ${lambda_name}...."
14+
echo -n "- Downloading code for lambda ${lambda_name}.... "
1515
code_url="$(aws lambda get-function --function-name ${lambda_name} | jq -r .Code.Location)"
16-
curl "${code_url}" > "${DIST_DIR}/${api_name}-${endpoint_name}.zip"
16+
curl "${code_url}" 2>/dev/null > "${DIST_DIR}/${api_name}-${endpoint_name}.zip"
17+
echo "✅"
1718
}
1819

1920
function pull_layer_code(){
2021
local name="$1"
21-
local layer_name="nhds-nrlf--${stack_name}--${name}"
22+
local layer_name="nhsd-nrlf--${stack_name}--${name}"
2223
local layer_version="$(aws lambda list-layer-versions --layer-name ${layer_name} | jq -r '.LayerVersions[0].Version')"
23-
local layer_pkg_name="$(echo ${layer_name} | tr '-' '_').zip"
24+
local layer_pkg_name="$(echo ${name} | tr '-' '_').zip"
2425

25-
echo "Downloading code for layer ${layer_name} version ${layer_version}...."
26+
echo -n "- Downloading code for layer ${layer_name} version ${layer_version}...."
2627
code_url="$(aws lambda get-layer-version --layer-name ${layer_name} --version-number ${layer_version} | jq -r .Content.Location)"
27-
curl "${code_url}" > "${DIST_DIR}/${layer_pkg_name}"
28+
curl "${code_url}" 2>/dev/null > "${DIST_DIR}/${layer_pkg_name}"
29+
echo "✅"
2830
}
2931

3032
mkdir -p "${DIST_DIR}"
3133

34+
echo
3235
echo "Pulling code for consumer API lambdas...."
3336
for endpoint_name in $(ls api/consumer)
3437
do
38+
if [ ! -d "api/consumer/${endpoint_name}" ]; then
39+
continue
40+
fi
41+
3542
pull_lambda_code "consumer" "${endpoint_name}"
3643
done
3744

45+
echo
3846
echo "Pulling code for producer API lambdas...."
3947
for endpoint_name in $(ls api/producer)
4048
do
49+
if [ ! -d "api/producer/${endpoint_name}" ]; then
50+
continue
51+
fi
52+
4153
pull_lambda_code "producer" "${endpoint_name}"
4254
done
4355

56+
echo
4457
echo "Pulling code for layers...."
4558
for layer_name in nrlf dependency-layer nrlf-permissions
4659
do
4760
pull_layer_code "${layer_name}"
4861
done
62+
63+
echo
64+
echo "✅ Done. Code is in ${DIST_DIR}"
65+
echo

0 commit comments

Comments
 (0)