cdk_release_code.yml

name: cdk release code

on:
  workflow_call:
    inputs:
      STACK_NAME:
        required: true
        type: string
      STATEFUL_STACK_NAME:
        required: true
        type: string
      AWS_ENVIRONMENT:
        required: true
        type: string
      APIGEE_ENVIRONMENT:
        required: true
        type: string
      ENABLE_MUTUAL_TLS:
        required: true
        type: boolean
      TRUSTSTORE_FILE:
        required: true
        type: string
      VERSION_NUMBER:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      LOG_LEVEL:
        required: true
        type: string
      VALIDATOR_LOG_LEVEL:
        required: false
        type: string
        default: INFO
      LOG_RETENTION_DAYS:
        required: true
        type: string
      # CREATE_INT_RELEASE_NOTES:
      #   type: boolean
      #   default: false
      # CREATE_INT_RC_RELEASE_NOTES:
      #   type: boolean
      #   default: false
      # CREATE_PROD_RELEASE_NOTES:
      #   type: boolean
      #   default: false
      # MARK_JIRA_RELEASED:
      #   type: boolean
      #   default: false
      DEPLOY_APIGEE:
        type: boolean
        default: true
      TARGET_SPINE_SERVER:
        required: true
        type: string
      DOCKER_IMAGE_TAG:
        required: true
        type: string
      RUN_REGRESSION_TEST:
        required: true
        type: boolean
      TO_ASID:
        required: true
        type: string
      TO_PARTY_KEY:
        required: true
        type: string
      IS_PULL_REQUEST:
        type: boolean
        default: true
      ENABLE_DEFAULT_ASID_PARTY_KEY:
        type: boolean
      SHA1_ENABLED_APPLICATION_IDS:
        type: string
        required: true
      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION:
        type: boolean
        required: true
      SANDBOX_MODE_ENABLED:
        type: string
        required: true
      DESIRED_FHIR_FACADE_COUNT:
        type: number
        required: true
      DESIRED_CLAIMS_COUNT:
        type: number
        required: true
      DESIRED_PEAK_CLAIMS_COUNT:
        type: number
        required: true
      DESIRED_OFF_PEAK_CLAIMS_COUNT:
        type: number
        required: true
      SERVICE_CPU:
        type: number
        required: true
      SERVICE_MEMORY:
        type: number
        required: true
      MTLS_KEY:
        type: string
        required: true
      FORWARD_CSOC_LOGS:
        type: boolean
        required: true
      pinned_image:
        type: string
        required: true
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE:
        required: true
      DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      INT_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
        required: false
      PROXYGEN_ROLE:
        required: false
      REGRESSION_TESTS_PEM:
        required: false
      API_CLIENT_ID:
        required: false
      API_CLIENT_SECRET:
        required: false
      SIGNING_PRIVATE_KEY:
        required: false
      SIGNING_CERT:
        required: false
      DEFAULT_PTL_ASID:
        required: false
      DEFAULT_PTL_PARTY_KEY:
        required: false

env:
  AWS_MAX_ATTEMPTS: 20

permissions: {}

jobs:
  release_code_and_api:
    runs-on: ubuntu-22.04
    container:
      image: ${{ inputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    environment: ${{ inputs.AWS_ENVIRONMENT }}
    name: deploy to ${{ inputs.AWS_ENVIRONMENT }}
    permissions:
      id-token: write
      contents: write

    steps:
      - name: copy .tool-versions
        run: |
          cp /home/vscode/.tool-versions "$HOME/.tool-versions"
      - name: Checkout local github actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
          fetch-depth: 0
          sparse-checkout: |
            .github

      - name: build_artifact download
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: cdk_artifact

      - name: docker_artifact download
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: docker_artifact
          path: .

      - name: Extract FHIR Facade docker image
        id: extract-FHIR-facade-image
        run: |
          docker load -i FHIR_facade_docker.img

      - name: Extract validator docker image
        id: extract-validator-image
        run: |
          docker load -i validator_docker.img

      - name: extract build_artifact
        run: |
          mkdir -p .build
          tar -xf artifact.tar -C .build

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@4ce2bbcf5d401e557e0537d863a6aced08605794
        id: connect-aws-deploy
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
          role-session-name: fhir-facade-cloud-formation-deploy

      - name: Retrieve AWS Account ID
        id: retrieve-deploy-account-id
        run: echo "ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"

      - name: Login to Amazon ECR
        id: login-ecr-push-image
        run: |
          aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com"
        env:
          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.ACCOUNT_ID }}

      - name: Push FHIR Facade image to Amazon ECR
        run: |
          docker tag "fhir-facade-repo:${VERSION_NUMBER}" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/fhir-facade-repo:${DOCKER_IMAGE_TAG}"
          docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/fhir-facade-repo:${DOCKER_IMAGE_TAG}"
        env:
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          DOCKER_IMAGE_TAG: ${{ inputs.DOCKER_IMAGE_TAG }}
          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.ACCOUNT_ID }}

      - name: Push Validator image to Amazon ECR
        run: |
          docker tag "validator-repo:${VERSION_NUMBER}" "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/validator-repo:${DOCKER_IMAGE_TAG}"
          docker push "${ACCOUNT_ID}.dkr.ecr.eu-west-2.amazonaws.com/validator-repo:${DOCKER_IMAGE_TAG}"
        env:
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          DOCKER_IMAGE_TAG: ${{ inputs.DOCKER_IMAGE_TAG }}
          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.ACCOUNT_ID }}

      - name: fix cdk.json for deployment
        run: |
          ./.github/scripts/fix_cdk_json.sh
        env:
          ACCOUNT_ID: ${{ steps.retrieve-deploy-account-id.outputs.ACCOUNT_ID }}
          TRUSTSTORE_FILE: ${{ inputs.TRUSTSTORE_FILE }}
          SERVICE_NAME: "${{ inputs.STACK_NAME }}"
          STATEFUL_STACK_NAME: "${{ inputs.STATEFUL_STACK_NAME }}"
          VERSION_NUMBER: "${{ inputs.VERSION_NUMBER }}"
          LOG_RETENTION_IN_DAYS: "${{ inputs.LOG_RETENTION_DAYS }}"
          COMMIT_ID: "${{ inputs.COMMIT_ID }}"
          DOCKER_IMAGE_TAG: "${{ inputs.DOCKER_IMAGE_TAG }}"
          TARGET_SPINE_SERVER: "${{ inputs.TARGET_SPINE_SERVER }}"
          LOG_LEVEL: "${{ inputs.LOG_LEVEL }}"
          TO_ASID: "${{ inputs.TO_ASID }}"
          TO_PARTY_KEY: "${{ inputs.TO_PARTY_KEY }}"
          VALIDATOR_LOG_LEVEL: "${{ inputs.VALIDATOR_LOG_LEVEL }}"
          ENABLE_DEFAULT_ASID_PARTY_KEY: "${{ inputs.ENABLE_DEFAULT_ASID_PARTY_KEY }}"
          DEFAULT_PTL_ASID: "${{ secrets.DEFAULT_PTL_ASID }}"
          DEFAULT_PTL_PARTY_KEY: "${{ secrets.DEFAULT_PTL_PARTY_KEY }}"
          SANDBOX_MODE_ENABLED: "${{ inputs.SANDBOX_MODE_ENABLED }}"
          ENABLE_MUTUAL_TLS: "${{ inputs.ENABLE_MUTUAL_TLS }}"
          SHA1_ENABLED_APPLICATION_IDS: "${{ inputs.SHA1_ENABLED_APPLICATION_IDS }}"
          ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: "${{ inputs.ENABLE_PRESCRIBING_SIGNATURE_VALIDATION }}"
          DESIRED_FHIR_FACADE_COUNT: "${{ inputs.DESIRED_FHIR_FACADE_COUNT }}"
          DESIRED_CLAIMS_COUNT: "${{ inputs.DESIRED_CLAIMS_COUNT }}"
          DESIRED_PEAK_CLAIMS_COUNT: "${{ inputs.DESIRED_PEAK_CLAIMS_COUNT }}"
          DESIRED_OFF_PEAK_CLAIMS_COUNT: "${{ inputs.DESIRED_OFF_PEAK_CLAIMS_COUNT }}"
          SERVICE_CPU: "${{ inputs.SERVICE_CPU }}"
          SERVICE_MEMORY: ${{ inputs.SERVICE_MEMORY }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
          FORWARD_CSOC_LOGS: ${{ inputs.FORWARD_CSOC_LOGS }}
          AWS_MAX_ATTEMPTS: 5

      - name: Deploy API code
        run: |
          cd .build
          npx cdk deploy prescribe-dispense \
          --app "npx ts-node --prefer-ts-exts packages/cdk/bin/PrescribeDispenseApp.ts" \
          --require-approval=never \
          --ci true
        shell: bash

      - name: Deploy Prescriptions code
        run: |
          cd .build
          npx cdk deploy stateful-resources \
          --app "npx ts-node --prefer-ts-exts packages/cdk/bin/PrescribeDispenseApp.ts" \
          --require-approval=never \
          --ci true
        shell: bash

      - name: Get mtls secrets
        shell: bash
        run: |
          mkdir -p ~/.proxygen/tmp
          client_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:FhirFacadeClientKeySecret'].Value" --output text)
          client_cert_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:FhirFacadeClientCertSecret'].Value" --output text)
          aws secretsmanager get-secret-value --secret-id "${client_private_key_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_private_key
          aws secretsmanager get-secret-value --secret-id "${client_cert_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_cert

      - name: Configure AWS Credentials for API release
        uses: aws-actions/configure-aws-credentials@4ce2bbcf5d401e557e0537d863a6aced08605794
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.PROXYGEN_ROLE }}
          role-session-name: proxygen-ptl

      - name: Deploy fhir-prescribing API
        shell: bash
        if: ${{ inputs.DEPLOY_APIGEE == true && always() && !failure() && !cancelled() }}
        env:
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          SPEC_PATH: ./.build/packages/specification/dist/fhir-prescribing.resolved.json
          STACK_NAME: ${{ inputs.STACK_NAME }}
          AWS_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          PROXYGEN_PRIVATE_KEY_NAME: FhirPrescribingProxygenPrivateKey
          PROXYGEN_KID: fhir-prescribing
          DRY_RUN: false
          ENABLE_MUTUAL_TLS: ${{ inputs.ENABLE_MUTUAL_TLS }}
          IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
          MTLS_KEY: ${{ inputs.MTLS_KEY }}
        run: ./.github/scripts/deploy_api.sh

      - name: Deploy fhir-dispensing API
        shell: bash
        if: ${{ inputs.DEPLOY_APIGEE == true && always() && !failure() && !cancelled() }}
        env:
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          SPEC_PATH: ./.build/packages/specification/dist/fhir-dispensing.resolved.json
          STACK_NAME: ${{ inputs.STACK_NAME }}
          AWS_ENVIRONMENT: ${{ inputs.AWS_ENVIRONMENT }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          PROXYGEN_PRIVATE_KEY_NAME: FhirDispensingProxygenPrivateKey
          PROXYGEN_KID: fhir-dispensing
          DRY_RUN: false
          ENABLE_MUTUAL_TLS: ${{ inputs.ENABLE_MUTUAL_TLS }}
          IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
          MTLS_KEY: ${{ inputs.MTLS_KEY }}
        run: ./.github/scripts/deploy_api.sh

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
        name: Upload specs
        with:
          name: ${{ inputs.APIGEE_ENVIRONMENT }}-specs
          path: |
            ./.build/packages/specification/dist/fhir-dispensing.resolved.json
            ./.build/packages/specification/dist/fhir-prescribing.resolved.json

      - name: Checkout gh-pages
        if: ${{ !startsWith(inputs.STACK_NAME, 'prescribe-dispense-pr-') }}
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: gh-pages
          path: gh-pages
          persist-credentials: true
  
      - name: Update release tag in github pages
        if: ${{ !startsWith(inputs.STACK_NAME, 'prescribe-dispense-pr-') }}
        run: |
          cd gh-pages
          NOW=$(date +'%Y-%m-%dT%H:%M:%S')
          echo "tag,release_datetime" > "_data/${APIGEE_ENVIRONMENT}_latest.csv"
          echo "${VERSION_NUMBER},${NOW}" >> "_data/${APIGEE_ENVIRONMENT}_latest.csv"
          echo "${VERSION_NUMBER},${NOW}" >> "_data/${APIGEE_ENVIRONMENT}_deployments.csv"
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add "_data/${APIGEE_ENVIRONMENT}_latest.csv"
          git add "_data/${APIGEE_ENVIRONMENT}_deployments.csv"
          git commit -m "update releases for ${APIGEE_ENVIRONMENT}"
          parallel --retries 10 --delay 3 ::: "git pull --rebase && git push"
        env:
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
  
  prescribing_regression_tests:
    if: ${{ inputs.RUN_REGRESSION_TEST == true && always() && !failure() && !cancelled() }}
    permissions:
      id-token: write
      contents: write
    name: Prescribing Regression Tests
    uses: ./.github/workflows/run_regression_tests.yml
    needs: release_code_and_api
    with:
      ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
      VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
      PRODUCT: EPS-FHIR-PRESCRIBING
      pinned_image: ${{ inputs.pinned_image }}
    secrets:
      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}

  dispensing_regression_tests:
    if: ${{ inputs.RUN_REGRESSION_TEST == true && always() && !failure() && !cancelled() }}
    permissions:
      id-token: write
      contents: write
    name: Dispensing Regression Tests
    uses: ./.github/workflows/run_regression_tests.yml
    needs: release_code_and_api
    with:
      ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
      VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
      PRODUCT: EPS-FHIR-DISPENSING
      pinned_image: ${{ inputs.pinned_image }}
    secrets:
      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}

  pact_tests:
    if: ${{ inputs.RUN_REGRESSION_TEST == true && always() && !failure() && !cancelled() }}
    name: Pact Tests
    permissions:
      id-token: write
      contents: read
      packages: read
    uses: ./.github/workflows/run_pact_tests.yml
    needs: release_code_and_api
    with:
      APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
      VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
      IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: ${{ inputs.ENABLE_PRESCRIBING_SIGNATURE_VALIDATION }}
      pinned_image: ${{ inputs.pinned_image }}
    secrets:
      API_CLIENT_ID: ${{ secrets.API_CLIENT_ID }}
      API_CLIENT_SECRET: ${{ secrets.API_CLIENT_SECRET }}
      SIGNING_PRIVATE_KEY: ${{ secrets.SIGNING_PRIVATE_KEY }}
      SIGNING_CERT: ${{ secrets.SIGNING_CERT }}