Skip to content

Commit 4201ce2

Browse files
josielsouzanordcloudjosielsouzanordcloud
authored
Merge pull request #38 from NHSDigital/DTOSS-12318-add-ado-pipeline-and-terraform-for-arc
[DTOSS-12318] - feat(iac): add ADO pipeline and Terraform for Arc infrastructure
2 parents 1b48d22 + 82d3efa commit 4201ce2

50 files changed

Lines changed: 2228 additions & 130 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.azuredevops/pipelines/deploy-app.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
trigger: none
2+
pr: none
3+
4+
parameters:
5+
- name: releaseTag
6+
displayName: Release tag to deploy
7+
type: string
8+
9+
- name: environment
10+
displayName: Environment
11+
type: string
12+
13+
- name: pool
14+
displayName: ADO management pool
15+
type: string
16+
17+
18+
stages:
19+
- stage: ${{ parameters.environment }}
20+
displayName: Deploy gateway app to ${{ parameters.environment }}
21+
pool:
22+
name: ${{ parameters.pool }}
23+
lockBehavior: sequential
24+
isSkippable: false
25+
26+
jobs:
27+
- deployment: DeployGatewayApp
28+
displayName: Deploy gateway app
29+
environment: ${{ parameters.environment }}
30+
strategy:
31+
runOnce:
32+
deploy:
33+
steps:
34+
- checkout: self
35+
36+
- task: AzureCLI@2
37+
displayName: Deploy gateway app to ${{ parameters.environment }}
38+
inputs:
39+
azureSubscription: manbgw-${{ parameters.environment }}
40+
scriptType: bash
41+
scriptLocation: inlineScript
42+
addSpnToEnvironment: true
43+
inlineScript: |
44+
export ARM_TENANT_ID="$tenantId"
45+
export ARM_CLIENT_ID="$servicePrincipalId"
46+
export ARM_OIDC_TOKEN="$idToken"
47+
export ARM_USE_OIDC=true
48+
export ARM_USE_AZUREAD=true
49+
make ci ${{ parameters.environment }} deploy-app RELEASE_TAG="${{ parameters.releaseTag }}"

‎.azuredevops/pipelines/deploy.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
trigger: none
2+
pr: none
3+
4+
parameters:
5+
- name: commitSHA
6+
displayName: Commit SHA
7+
type: string
8+
- name: environment
9+
displayName: Environment
10+
type: string
11+
- name: pool
12+
displayName: ADO management pool
13+
type: string
14+
15+
stages:
16+
- stage: ${{ parameters.environment }}
17+
displayName: Deploy Arc infrastructure to ${{ parameters.environment }}
18+
pool:
19+
name: ${{ parameters.pool }}
20+
lockBehavior: sequential
21+
isSkippable: false
22+
23+
jobs:
24+
- deployment: DeployArcInfra
25+
displayName: Deploy Arc infrastructure
26+
environment: ${{ parameters.environment }}
27+
strategy:
28+
runOnce:
29+
deploy:
30+
steps:
31+
- checkout: self
32+
33+
- bash: |
34+
TF_VERSION=$(grep "^terraform" .tool-versions | awk '{print $2}')
35+
echo "##vso[task.setvariable variable=TF_VERSION]$TF_VERSION"
36+
displayName: Get Terraform version from .tool-versions
37+
38+
- task: TerraformInstaller@1
39+
displayName: Install Terraform
40+
inputs:
41+
terraformVersion: $(TF_VERSION)
42+
43+
- task: AzureCLI@2
44+
displayName: Run Terraform
45+
inputs:
46+
azureSubscription: manbgw-${{ parameters.environment }}
47+
scriptType: bash
48+
scriptLocation: inlineScript
49+
addSpnToEnvironment: true
50+
inlineScript: |
51+
export ARM_TENANT_ID="$tenantId"
52+
export ARM_CLIENT_ID="$servicePrincipalId"
53+
export ARM_OIDC_TOKEN="$idToken"
54+
export ARM_USE_OIDC=true
55+
make ci ${{ parameters.environment }} terraform-apply

‎.github/ISSUE_TEMPLATE/1_support_request.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🔧 Support Request
7+
description: Get help
8+
labels: ['support']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a support request. Please fill out this form as completely as possible.
14+
- type: textarea
15+
attributes:
16+
label: What exactly are you trying to do?
17+
description: Describe in as much detail as possible.
18+
validations:
19+
required: true
20+
- type: textarea
21+
attributes:
22+
label: What have you tried so far?
23+
description: Describe what you have tried so far.
24+
validations:
25+
required: true
26+
- type: textarea
27+
attributes:
28+
label: Output of any commands you have tried
29+
description: Please copy and paste any relevant output. This will be automatically formatted into codeblock.
30+
render: Shell
31+
validations:
32+
required: false
33+
- type: textarea
34+
attributes:
35+
label: Additional context
36+
description: Add any other context about the problem here.
37+
validations:
38+
required: false
39+
- type: checkboxes
40+
attributes:
41+
label: Code of Conduct
42+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
43+
options:
44+
- label: I agree to follow this project's Code of Conduct
45+
required: true
46+
- type: checkboxes
47+
attributes:
48+
label: Sensitive Information Declaration
49+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
50+
options:
51+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
52+
required: true

‎.github/ISSUE_TEMPLATE/2_feature_request.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🚀 Feature Request
7+
description: Suggest an idea for this project
8+
labels: ['feature request']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a feature request. Please fill out this form as completely as possible.
14+
- type: textarea
15+
attributes:
16+
label: What is the problem this feature will solve?
17+
description: Tell us why this change is needed or helpful and what problems it may help solve.
18+
validations:
19+
required: true
20+
- type: textarea
21+
attributes:
22+
label: What is the feature that you are proposing to solve the problem?
23+
description: Provide detailed information for what we should add.
24+
validations:
25+
required: true
26+
- type: textarea
27+
attributes:
28+
label: What alternatives have you considered?
29+
- type: checkboxes
30+
attributes:
31+
label: Code of Conduct
32+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
33+
options:
34+
- label: I agree to follow this project's Code of Conduct
35+
required: true
36+
- type: checkboxes
37+
attributes:
38+
label: Sensitive Information Declaration
39+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
40+
options:
41+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
42+
required: true

‎.github/ISSUE_TEMPLATE/3_bug_report.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🐞 Bug Report
7+
description: File a bug report
8+
labels: ['bug', 'triage']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a bug report. Please fill out this form as completely as possible.
14+
- type: checkboxes
15+
attributes:
16+
label: Is there an existing issue for this?
17+
description: Please, search the Issues to see if an issue already exists for the bug you have encountered.
18+
options:
19+
- label: I have searched the existing Issues
20+
required: true
21+
- type: textarea
22+
attributes:
23+
label: Current Behavior
24+
description: A concise description of what you are experiencing.
25+
validations:
26+
required: true
27+
- type: textarea
28+
attributes:
29+
label: Expected Behavior
30+
description: A concise description of what you expect to happen.
31+
validations:
32+
required: true
33+
- type: textarea
34+
attributes:
35+
label: Steps To Reproduce
36+
description: Steps to reproduce the behavior
37+
placeholder: |
38+
1. In this environment...
39+
2. With this config...
40+
3. Run `...`
41+
validations:
42+
required: false
43+
- type: textarea
44+
attributes:
45+
label: Output
46+
description: Please copy and paste any relevant output. This will be automatically formatted into codeblock.
47+
render: Shell
48+
validations:
49+
required: false
50+
- type: checkboxes
51+
attributes:
52+
label: Code of Conduct
53+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
54+
options:
55+
- label: I agree to follow this project's Code of Conduct
56+
required: true
57+
- type: checkboxes
58+
attributes:
59+
label: Sensitive Information Declaration
60+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
61+
options:
62+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
63+
required: true

‎.github/SECURITY.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Security
2+
3+
NHS England takes security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems and/or private data managed by our systems, please do not hesitate to contact us using the methods outlined below.
4+
5+
## Table of Contents
6+
7+
- [Security](#security)
8+
- [Table of Contents](#table-of-contents)
9+
- [Reporting a vulnerability](#reporting-a-vulnerability)
10+
- [Email](#email)
11+
- [NCSC](#ncsc)
12+
- [General Security Enquiries](#general-security-enquiries)
13+
14+
## Reporting a vulnerability
15+
16+
Please note, email is our preferred method of receiving reports.
17+
18+
### Email
19+
20+
If you wish to notify us of a vulnerability via email, please include detailed information on the nature of the vulnerability and any steps required to reproduce it.
21+
22+
You can reach us at:
23+
24+
- [cybersecurity@nhs.net](cybersecurity@nhs.net)
25+
26+
### NCSC
27+
28+
You can send your report to the National Cyber Security Centre, who will assess your report and pass it on to NHS England if necessary.
29+
30+
You can report vulnerabilities here: [https://www.ncsc.gov.uk/information/vulnerability-reporting](https://www.ncsc.gov.uk/information/vulnerability-reporting)
31+
32+
## General Security Enquiries
33+
34+
If you have general enquiries regarding our cybersecurity, please reach out to us at [cybersecurity@nhs.net](cybersecurity@nhs.net)

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,17 @@ name: "CI/CD: Pull Request"
22

33
on:
44
pull_request:
5+
types: [opened, synchronize, reopened, labeled]
56

67
concurrency:
7-
group: cicd-${{ github.ref }}
8+
group: pr-${{ github.ref }}
89
cancel-in-progress: true
910

1011
permissions:
11-
contents: read
12+
contents: write # needed to create pre-releases
13+
id-token: write
1214
security-events: write
15+
attestations: write # needed by stage-3-build (attest-build-provenance)
1316

1417
jobs:
1518
commit-stage:
@@ -20,3 +23,38 @@ jobs:
2023
needs: commit-stage
2124
uses: ./.github/workflows/stage-2-test.yaml
2225
secrets: inherit
26+
27+
deploy-stage:
28+
name: Deploy stage
29+
needs: [commit-stage, test-stage]
30+
permissions:
31+
id-token: write
32+
uses: ./.github/workflows/stage-4-deploy.yaml
33+
with:
34+
environments: '["review"]'
35+
commit_sha: ${{ github.event.pull_request.head.sha }}
36+
secrets: inherit
37+
38+
# Build and publish a pre-release when the 'deploy' label is present.
39+
# Runs on every push while the label is active (synchronize re-triggers this).
40+
build-for-deploy:
41+
name: Build for deploy
42+
needs: [commit-stage, test-stage]
43+
if: contains(github.event.pull_request.labels.*.name, 'deploy')
44+
uses: ./.github/workflows/stage-3-build.yaml
45+
with:
46+
pr_number: ${{ github.event.pull_request.number }}
47+
secrets: inherit
48+
49+
deploy-app-stage:
50+
name: Deploy app stage
51+
needs: [build-for-deploy, deploy-stage]
52+
if: contains(github.event.pull_request.labels.*.name, 'deploy')
53+
permissions:
54+
id-token: write
55+
uses: ./.github/workflows/stage-4-deploy-app.yaml
56+
with:
57+
environments: '["review"]'
58+
release_tag: pr-${{ github.event.pull_request.number }}
59+
commit_sha: ${{ github.event.pull_request.head.sha }}
60+
secrets: inherit

0 commit comments

Comments
 (0)