fix: preprod gateway deployment and GitHub API rate limiting

- Add GATEWAY_RINGS="ring1" to preprod so VMs tagged DeploymentRing=ring1
  are targeted by the pipeline (default is ring0 only, skipping all
  preprod machines)
- Pass secrets.GITHUB_TOKEN from GitHub Actions to the ADO pipeline as
  a parameter, exposed as GITHUB_TOKEN env var for deploy_arc_ring.sh,
  raising the GitHub API rate limit from 60 to 5000 requests/hour
- Surface x-ratelimit-reset in the error message when the rate limit is
  hit so operators know the exact local time to retry

Author: josielsouzanordcloud

.azuredevops/pipelines/deploy-app.yml

@@ -14,6 +14,11 @@ parameters:
     displayName: ADO management pool
     type: string
 
+  - name: githubToken
+    displayName: GitHub token for release downloads
+    type: string
+    default: ""
+
 
 stages:
   - stage: ${{ parameters.environment }}
@@ -46,4 +51,5 @@ stages:
                       export ARM_OIDC_TOKEN="$idToken"
                       export ARM_USE_OIDC=true
                       export ARM_USE_AZUREAD=true
+                      export GITHUB_TOKEN="${{ parameters.githubToken }}"
                       make ci ${{ parameters.environment }} deploy-app RELEASE_TAG="${{ parameters.releaseTag }}"

.github/workflows/stage-4-deploy-app.yaml

@@ -47,6 +47,7 @@ jobs:
           RELEASE_TAG: ${{ inputs.release_tag }}
           COMMIT_SHA: ${{ inputs.commit_sha }}
           ADO_PROJECT: ${{ github.event.repository.name }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
 
@@ -56,7 +57,7 @@ jobs:
             --name "Deploy Gateway App - ${ENVIRONMENT}" \
             --org https://dev.azure.com/nhse-dtos \
             --project "${ADO_PROJECT}" \
-            --parameters releaseTag="${RELEASE_TAG}" environment="${ENVIRONMENT}" pool="${ADO_MANAGEMENT_POOL}" \
+            --parameters releaseTag="${RELEASE_TAG}" environment="${ENVIRONMENT}" pool="${ADO_MANAGEMENT_POOL}" githubToken="${GITHUB_TOKEN}" \
             --output tsv --query id)
 
           echo "See pipeline run in Azure DevOps: https://dev.azure.com/nhse-dtos/${ADO_PROJECT}/_build/results?buildId=${RUN_ID}&view=results"

infrastructure/environments/preprod/variables.sh

@@ -7,3 +7,4 @@ TERRAFORM_MODULES_REF=main
 ENABLE_SOFT_DELETE=true
 ADO_MANAGEMENT_POOL=private-pool-prod-uks
 CLOUD_API_HOSTNAME=preprod.manage-breast-screening.nhs.uk
+GATEWAY_RINGS="ring1"

scripts/powershell/deploy.ps1

@@ -240,9 +240,18 @@ if (-not $ZipPath) {
     Write-Log "Querying release: $apiUrl" "INFO"
     try {
         [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
-        $release = Invoke-RestMethod -Uri $apiUrl -Headers $headers -ErrorAction Stop
+        $response = Invoke-WebRequest -Uri $apiUrl -Headers $headers -UseBasicParsing -ErrorAction Stop
+        $release = $response.Content | ConvertFrom-Json
     } catch {
-        throw "Could not retrieve release from $apiUrl. If the repo is private, supply -GitHubToken. Error: $_"
+        $rateLimitMsg = ""
+        try {
+            $resetHeader = $_.Exception.Response.Headers["x-ratelimit-reset"]
+            if ($resetHeader) {
+                $resetTime = [System.DateTimeOffset]::FromUnixTimeSeconds([long]$resetHeader).ToLocalTime().ToString("yyyy-MM-dd HH:mm:ss")
+                $rateLimitMsg = " Rate limit resets at $resetTime (local time)."
+            }
+        } catch {}
+        throw "Could not retrieve release from $apiUrl. If the repo is private, supply -GitHubToken.$rateLimitMsg Error: $_"
     }
 
     Write-Log "Release found: $($release.tag_name) - $($release.name)" "INFO"