Skip to content

Commit 82d3efa

Browse files
josielsouzanordcloudjosielsouzanordcloud
committed
feat(iac): add CI/CD pipelines and security templates
Adds Azure DevOps deployment pipelines for Arc infrastructure and gateway test VM. Also includes GitHub issue templates for support requests, feature requests, and bug reports, along with a security policy document. Updates the .gitignore to exclude Terraform state files and adds a new section in the Makefile for deploying applications. Refs: DTOSS-12318
1 parent 1b48d22 commit 82d3efa

50 files changed

Lines changed: 2228 additions & 130 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.azuredevops/pipelines/deploy-app.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
trigger: none
2+
pr: none
3+
4+
parameters:
5+
- name: releaseTag
6+
displayName: Release tag to deploy
7+
type: string
8+
9+
- name: environment
10+
displayName: Environment
11+
type: string
12+
13+
- name: pool
14+
displayName: ADO management pool
15+
type: string
16+
17+
18+
stages:
19+
- stage: ${{ parameters.environment }}
20+
displayName: Deploy gateway app to ${{ parameters.environment }}
21+
pool:
22+
name: ${{ parameters.pool }}
23+
lockBehavior: sequential
24+
isSkippable: false
25+
26+
jobs:
27+
- deployment: DeployGatewayApp
28+
displayName: Deploy gateway app
29+
environment: ${{ parameters.environment }}
30+
strategy:
31+
runOnce:
32+
deploy:
33+
steps:
34+
- checkout: self
35+
36+
- task: AzureCLI@2
37+
displayName: Deploy gateway app to ${{ parameters.environment }}
38+
inputs:
39+
azureSubscription: manbgw-${{ parameters.environment }}
40+
scriptType: bash
41+
scriptLocation: inlineScript
42+
addSpnToEnvironment: true
43+
inlineScript: |
44+
export ARM_TENANT_ID="$tenantId"
45+
export ARM_CLIENT_ID="$servicePrincipalId"
46+
export ARM_OIDC_TOKEN="$idToken"
47+
export ARM_USE_OIDC=true
48+
export ARM_USE_AZUREAD=true
49+
make ci ${{ parameters.environment }} deploy-app RELEASE_TAG="${{ parameters.releaseTag }}"

‎.azuredevops/pipelines/deploy.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
trigger: none
2+
pr: none
3+
4+
parameters:
5+
- name: commitSHA
6+
displayName: Commit SHA
7+
type: string
8+
- name: environment
9+
displayName: Environment
10+
type: string
11+
- name: pool
12+
displayName: ADO management pool
13+
type: string
14+
15+
stages:
16+
- stage: ${{ parameters.environment }}
17+
displayName: Deploy Arc infrastructure to ${{ parameters.environment }}
18+
pool:
19+
name: ${{ parameters.pool }}
20+
lockBehavior: sequential
21+
isSkippable: false
22+
23+
jobs:
24+
- deployment: DeployArcInfra
25+
displayName: Deploy Arc infrastructure
26+
environment: ${{ parameters.environment }}
27+
strategy:
28+
runOnce:
29+
deploy:
30+
steps:
31+
- checkout: self
32+
33+
- bash: |
34+
TF_VERSION=$(grep "^terraform" .tool-versions | awk '{print $2}')
35+
echo "##vso[task.setvariable variable=TF_VERSION]$TF_VERSION"
36+
displayName: Get Terraform version from .tool-versions
37+
38+
- task: TerraformInstaller@1
39+
displayName: Install Terraform
40+
inputs:
41+
terraformVersion: $(TF_VERSION)
42+
43+
- task: AzureCLI@2
44+
displayName: Run Terraform
45+
inputs:
46+
azureSubscription: manbgw-${{ parameters.environment }}
47+
scriptType: bash
48+
scriptLocation: inlineScript
49+
addSpnToEnvironment: true
50+
inlineScript: |
51+
export ARM_TENANT_ID="$tenantId"
52+
export ARM_CLIENT_ID="$servicePrincipalId"
53+
export ARM_OIDC_TOKEN="$idToken"
54+
export ARM_USE_OIDC=true
55+
make ci ${{ parameters.environment }} terraform-apply

‎.github/ISSUE_TEMPLATE/1_support_request.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🔧 Support Request
7+
description: Get help
8+
labels: ['support']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a support request. Please fill out this form as completely as possible.
14+
- type: textarea
15+
attributes:
16+
label: What exactly are you trying to do?
17+
description: Describe in as much detail as possible.
18+
validations:
19+
required: true
20+
- type: textarea
21+
attributes:
22+
label: What have you tried so far?
23+
description: Describe what you have tried so far.
24+
validations:
25+
required: true
26+
- type: textarea
27+
attributes:
28+
label: Output of any commands you have tried
29+
description: Please copy and paste any relevant output. This will be automatically formatted into codeblock.
30+
render: Shell
31+
validations:
32+
required: false
33+
- type: textarea
34+
attributes:
35+
label: Additional context
36+
description: Add any other context about the problem here.
37+
validations:
38+
required: false
39+
- type: checkboxes
40+
attributes:
41+
label: Code of Conduct
42+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
43+
options:
44+
- label: I agree to follow this project's Code of Conduct
45+
required: true
46+
- type: checkboxes
47+
attributes:
48+
label: Sensitive Information Declaration
49+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
50+
options:
51+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
52+
required: true

‎.github/ISSUE_TEMPLATE/2_feature_request.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🚀 Feature Request
7+
description: Suggest an idea for this project
8+
labels: ['feature request']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a feature request. Please fill out this form as completely as possible.
14+
- type: textarea
15+
attributes:
16+
label: What is the problem this feature will solve?
17+
description: Tell us why this change is needed or helpful and what problems it may help solve.
18+
validations:
19+
required: true
20+
- type: textarea
21+
attributes:
22+
label: What is the feature that you are proposing to solve the problem?
23+
description: Provide detailed information for what we should add.
24+
validations:
25+
required: true
26+
- type: textarea
27+
attributes:
28+
label: What alternatives have you considered?
29+
- type: checkboxes
30+
attributes:
31+
label: Code of Conduct
32+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
33+
options:
34+
- label: I agree to follow this project's Code of Conduct
35+
required: true
36+
- type: checkboxes
37+
attributes:
38+
label: Sensitive Information Declaration
39+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
40+
options:
41+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
42+
required: true

‎.github/ISSUE_TEMPLATE/3_bug_report.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🐞 Bug Report
7+
description: File a bug report
8+
labels: ['bug', 'triage']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a bug report. Please fill out this form as completely as possible.
14+
- type: checkboxes
15+
attributes:
16+
label: Is there an existing issue for this?
17+
description: Please, search the Issues to see if an issue already exists for the bug you have encountered.
18+
options:
19+
- label: I have searched the existing Issues
20+
required: true
21+
- type: textarea
22+
attributes:
23+
label: Current Behavior
24+
description: A concise description of what you are experiencing.
25+
validations:
26+
required: true
27+
- type: textarea
28+
attributes:
29+
label: Expected Behavior
30+
description: A concise description of what you expect to happen.
31+
validations:
32+
required: true
33+
- type: textarea
34+
attributes:
35+
label: Steps To Reproduce
36+
description: Steps to reproduce the behavior
37+
placeholder: |
38+
1. In this environment...
39+
2. With this config...
40+
3. Run `...`
41+
validations:
42+
required: false
43+
- type: textarea
44+
attributes:
45+
label: Output
46+
description: Please copy and paste any relevant output. This will be automatically formatted into codeblock.
47+
render: Shell
48+
validations:
49+
required: false
50+
- type: checkboxes
51+
attributes:
52+
label: Code of Conduct
53+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
54+
options:
55+
- label: I agree to follow this project's Code of Conduct
56+
required: true
57+
- type: checkboxes
58+
attributes:
59+
label: Sensitive Information Declaration
60+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
61+
options:
62+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
63+
required: true

‎.github/SECURITY.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Security
2+
3+
NHS England takes security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems and/or private data managed by our systems, please do not hesitate to contact us using the methods outlined below.
4+
5+
## Table of Contents
6+
7+
- [Security](#security)
8+
- [Table of Contents](#table-of-contents)
9+
- [Reporting a vulnerability](#reporting-a-vulnerability)
10+
- [Email](#email)
11+
- [NCSC](#ncsc)
12+
- [General Security Enquiries](#general-security-enquiries)
13+
14+
## Reporting a vulnerability
15+
16+
Please note, email is our preferred method of receiving reports.
17+
18+
### Email
19+
20+
If you wish to notify us of a vulnerability via email, please include detailed information on the nature of the vulnerability and any steps required to reproduce it.
21+
22+
You can reach us at:
23+
24+
- [cybersecurity@nhs.net](cybersecurity@nhs.net)
25+
26+
### NCSC
27+
28+
You can send your report to the National Cyber Security Centre, who will assess your report and pass it on to NHS England if necessary.
29+
30+
You can report vulnerabilities here: [https://www.ncsc.gov.uk/information/vulnerability-reporting](https://www.ncsc.gov.uk/information/vulnerability-reporting)
31+
32+
## General Security Enquiries
33+
34+
If you have general enquiries regarding our cybersecurity, please reach out to us at [cybersecurity@nhs.net](cybersecurity@nhs.net)

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,17 @@ name: "CI/CD: Pull Request"
22

33
on:
44
pull_request:
5+
types: [opened, synchronize, reopened, labeled]
56

67
concurrency:
7-
group: cicd-${{ github.ref }}
8+
group: pr-${{ github.ref }}
89
cancel-in-progress: true
910

1011
permissions:
11-
contents: read
12+
contents: write # needed to create pre-releases
13+
id-token: write
1214
security-events: write
15+
attestations: write # needed by stage-3-build (attest-build-provenance)
1316

1417
jobs:
1518
commit-stage:
@@ -20,3 +23,38 @@ jobs:
2023
needs: commit-stage
2124
uses: ./.github/workflows/stage-2-test.yaml
2225
secrets: inherit
26+
27+
deploy-stage:
28+
name: Deploy stage
29+
needs: [commit-stage, test-stage]
30+
permissions:
31+
id-token: write
32+
uses: ./.github/workflows/stage-4-deploy.yaml
33+
with:
34+
environments: '["review"]'
35+
commit_sha: ${{ github.event.pull_request.head.sha }}
36+
secrets: inherit
37+
38+
# Build and publish a pre-release when the 'deploy' label is present.
39+
# Runs on every push while the label is active (synchronize re-triggers this).
40+
build-for-deploy:
41+
name: Build for deploy
42+
needs: [commit-stage, test-stage]
43+
if: contains(github.event.pull_request.labels.*.name, 'deploy')
44+
uses: ./.github/workflows/stage-3-build.yaml
45+
with:
46+
pr_number: ${{ github.event.pull_request.number }}
47+
secrets: inherit
48+
49+
deploy-app-stage:
50+
name: Deploy app stage
51+
needs: [build-for-deploy, deploy-stage]
52+
if: contains(github.event.pull_request.labels.*.name, 'deploy')
53+
permissions:
54+
id-token: write
55+
uses: ./.github/workflows/stage-4-deploy-app.yaml
56+
with:
57+
environments: '["review"]'
58+
release_tag: pr-${{ github.event.pull_request.number }}
59+
commit_sha: ${{ github.event.pull_request.head.sha }}
60+
secrets: inherit

0 commit comments

Comments
 (0)