eps-aws-dashboards/.github/workflows/pull_request.yml at main · NHSDigital/eps-aws-dashboards · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: deploy_pr

on:
  pull_request:
    branches: [main]
  merge_group:
    branches: [main]

env:
  BRANCH_NAME: ${{ github.event.pull_request.head.ref }}

jobs:
  get_config_values:
    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@5ac2707dd9cd60ad127275179495b9c890d74711
    with:
      verify_published_from_main_image: false

  dependabot-auto-approve-and-merge:
    uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@5ac2707dd9cd60ad127275179495b9c890d74711
    secrets:
      AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
      AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}

  quality_checks:
    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
    needs: [get_config_values]
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  pr_title_format_check:
    if: github.event_name != 'merge_group'
    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@5ac2707dd9cd60ad127275179495b9c890d74711

  get_issue_number:
    runs-on: ubuntu-22.04
    outputs:
      issue_number: ${{steps.get_issue_number.outputs.result}}

    steps:
      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        name: get issue number
        id: get_issue_number
        with:
          result-encoding: string
          script: |
            // 1. Normal pull_request event
            if (context.eventName === 'pull_request' && context.payload.pull_request) {
              return context.payload.pull_request.number;
            }

            // 2. merge_group event
            if (context.eventName === 'merge_group') {
              const queueRef = context.ref; // refs/heads/gh-readonly-queue/main/pr-142-abc
              const match = queueRef.match(/pr-(\d+)/);

              if (match) {
                return String(match[1]);
              }

              // Fallback to commit association using the synthetic SHA
              const sha = context.payload.merge_group.head_sha;

              const { data } =
                await github.rest.repos.listPullRequestsAssociatedWithCommit({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  commit_sha: sha,
                });

              if (!data.length) {
                core.setFailed(`No PR associated with commit ${sha}`);
              }

              // Strict match: PR head SHA must match original PR head
              const pr = data.find(pr => pr.head.sha === data[0].head.sha);

              return String(pr.number);
            }

  tag_release:
    if: github.event_name != 'merge_group'
    needs: [get_config_values]
    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@5ac2707dd9cd60ad127275179495b9c890d74711
    permissions:
      id-token: 'write'
      contents: 'write'
    with:
      dry_run: true
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      branch_name: ${{ github.event.pull_request.head.ref }}
      tag_format: ${{ needs.get_config_values.outputs.tag_format }}
    secrets: inherit

  get_commit_id:
    runs-on: ubuntu-22.04
    outputs:
      commit_id: ${{ steps.commit_id.outputs.commit_id }}
    steps:
      - name: Get Commit ID
        id: commit_id
        run: |
          echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"

  package_code:
    uses: ./.github/workflows/cdk_package_code.yml
    needs: [get_config_values]
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
  release_code:
    needs:
      [
        get_issue_number,
        package_code,
        get_commit_id,
        quality_checks,
        get_config_values,
      ]
    uses: ./.github/workflows/cdk_release_code.yml
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      STACK_NAME: dashboards-pr-${{needs.get_issue_number.outputs.issue_number}}
      ARTIFACT_BUCKET_PREFIX: PR-${{needs.get_issue_number.outputs.issue_number}}
      TARGET_ENVIRONMENT: dev-pr
      BUILD_ARTIFACT: packaged_code
      VERSION_NUMBER: PR-${{ needs.get_issue_number.outputs.issue_number }}
      COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
      IS_PULL_REQUEST: true
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
      CDK_PULL_IMAGE_ROLE: ${{ secrets.DEV_CDK_PULL_IMAGE_ROLE }}