eps-aws-dashboards/.github/workflows/pull_request.yml at main · NHSDigital/eps-aws-dashboards · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: deploy_pr

on:
  pull_request:
    branches: [main]
  merge_group:
    branches: [main]

env:
  BRANCH_NAME: ${{ github.event.pull_request.head.ref }}

jobs:
  get_config_values:
    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
    with:
      verify_published_from_main_image: false

  dependabot-auto-approve-and-merge:
    uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
    secrets:
      AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
      AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}

  quality_checks:
    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
    needs: [get_config_values]
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  pr_title_format_check:
    if: github.event_name != 'merge_group'
    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7

  get_issue_number:
    runs-on: ubuntu-22.04
    outputs:
      issue_number: ${{steps.get_issue_number.outputs.result}}

    steps:
      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        name: get issue number
        id: get_issue_number
        with:
          result-encoding: string
          script: |
            // 1. Normal pull_request event
            if (context.eventName === 'pull_request' && context.payload.pull_request) {
              return context.payload.pull_request.number;
            }

            // 2. merge_group event
            if (context.eventName === 'merge_group') {
              const queueRef = context.ref; // refs/heads/gh-readonly-queue/main/pr-142-abc
              const match = queueRef.match(/pr-(\d+)/);

              if (match) {
                return String(match[1]);
              }

              // Fallback to commit association using the synthetic SHA
              const sha = context.payload.merge_group.head_sha;

              const { data } =
                await github.rest.repos.listPullRequestsAssociatedWithCommit({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  commit_sha: sha,
                });

              if (!data.length) {
                core.setFailed(`No PR associated with commit ${sha}`);
              }

              // Strict match: PR head SHA must match original PR head
              const pr = data.find(pr => pr.head.sha === data[0].head.sha);

              return String(pr.number);
            }

  tag_release:
    if: github.event_name != 'merge_group'
    needs: [get_config_values]
    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@f3d19a678a725917a5c59cae4d76db621bb7c9c7
    permissions:
      id-token: 'write'
      contents: 'write'
    with:
      dry_run: true
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      branch_name: ${{ github.event.pull_request.head.ref }}
      tag_format: ${{ needs.get_config_values.outputs.tag_format }}
    secrets: inherit

  get_commit_id:
    runs-on: ubuntu-22.04
    outputs:
      commit_id: ${{ steps.commit_id.outputs.commit_id }}
    steps:
      - name: Get Commit ID
        id: commit_id
        run: |
          echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"

  package_code:
    uses: ./.github/workflows/cdk_package_code.yml
    needs: [get_config_values]
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
  release_code:
    needs:
      [
        get_issue_number,
        package_code,
        get_commit_id,
        quality_checks,
        get_config_values,
      ]
    uses: ./.github/workflows/cdk_release_code.yml
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      STACK_NAME: dashboards-pr-${{needs.get_issue_number.outputs.issue_number}}
      ARTIFACT_BUCKET_PREFIX: PR-${{needs.get_issue_number.outputs.issue_number}}
      TARGET_ENVIRONMENT: dev-pr
      BUILD_ARTIFACT: packaged_code
      VERSION_NUMBER: PR-${{ needs.get_issue_number.outputs.issue_number }}
      COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
      IS_PULL_REQUEST: true
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}