Skip to content

[DTOSS-12784] - Tag-driven release pipeline with smoke tests - #102

Merged
josielsouzanordcloud merged 2 commits into
mainfrom
DTOSS-12784-tag-driven-release-pipeline
Apr 29, 2026
Merged

[DTOSS-12784] - Tag-driven release pipeline with smoke tests#102
josielsouzanordcloud merged 2 commits into
mainfrom
DTOSS-12784-tag-driven-release-pipeline

Conversation

@josielsouzanordcloud

@josielsouzanordcloud josielsouzanordcloud commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Description

The previous pipeline used python-semantic-release to automatically cut releases on every main-branch merge based on conventional commit messages. This was never fully wired up and is inappropriate for this service — software deploying to NHS hospital Windows machines needs deliberate, controlled promotion through environments, not automatic releases inferred from commit history.

This PR replaces it with an explicit tag-driven model: a release only happens when an engineer intentionally pushes a v* tag, and each environment must pass a smoke test before the next one is promoted to.

What changed

Replaces the unused python-semantic-release approach with an explicit, deliberate release process. Releases are now triggered by pushing a v* tag rather than inferred from commit messages.

cicd-3-release.yaml (new) — triggered by git tag v1.2.3 && git push origin v1.2.3:

  • Runs commit -> test -> build in sequence
  • Then deploys to each environment sequentially: infra → app → smoke test, before promoting to the next
  • Prod requires a manual approval via GitHub Environments (configure required reviewers in Settings → Environments → prod)

cicd-2-main-branch.yaml (updated) — main-branch merges now:

  • Resolve the latest GitHub Release tag and deploy it (infra + app) to dev and preprod
  • Skip reinstallation if the VM is already on that version (idempotent)
  • Added workflow_dispatch with all / dev / preprod choice for onboarding new VMs without a new release

scripts/bash/smoke_test.sh + scripts/powershell/smoke_test.ps1 (new) — post-deploy smoke test run via az connectedmachine run-command (no direct hospital network access needed):

  • Checks all 4 Windows services are Running
  • Sends a DICOM C-ECHO to 127.0.0.1:4244 to verify the PACS server is accepting connections
  • Skips gracefully if no Arc machines exist in the environment

scripts/powershell/deploy.ps1 (updated):

  • Writes a VERSION file after each successful deployment
  • Skips reinstallation on subsequent runs if the VERSION file already matches the requested tag
  • Uses no-BOM UTF-8 encoding for the VERSION file (same fix as the .env issue)

Jira link

DTOSS-12784

Review notes

Review checklist

  • Check database queries are correctly scoped to current_provider

@josielsouzanordcloud
josielsouzanordcloud requested a deployment to preprod April 28, 2026 09:29 — with GitHub Actions Abandoned
@josielsouzanordcloud
josielsouzanordcloud force-pushed the DTOSS-12784-tag-driven-release-pipeline branch from e378db2 to 4d7a354 Compare April 28, 2026 11:40
@josielsouzanordcloud
DTOSS-12784: Tag-driven release pipeline with smoke tests
6a95cce 
  Replace python-semantic-release with an explicit v* tag trigger.
  Pushing a v* tag runs commit → test → build then deploys infra, app
  and smoke test to each environment in sequence (dev → preprod → prod)
  before promoting to the next. Prod requires a manual approval gate.

  Main-branch merges redeploy the latest release tag to dev then preprod
  in order (infra → app per environment) without triggering a new build.
  The deployment is idempotent — deploy.ps1 writes a VERSION file after
  each successful install and skips reinstallation if the tag matches.

  workflow_dispatch targets a single environment (dev / preprod / review)
  for surgical redeployment, e.g. when onboarding a new Arc-enabled VM.

  Smoke tests run via az connectedmachine run-command (no direct hospital
  network access required): checks all 4 Windows services are Running
  then sends a DICOM C-ECHO to verify the PACS server is accepting
  connections.

  Also fixes:
  - staging directory moved from C:\Windows\Temp to  to
    avoid SYSTEM account access denial on Move-Item across security
    boundaries
  - em dash in a PowerShell string literal caused parse errors on Windows
    when the Arc Run Command handler writes the script without a UTF-8
    BOM and PowerShell 5.1 misreads it as CP1252
  - VERSION file written with no-BOM UTF-8 to avoid idempotency check
    always failing on Windows PowerShell 5.1
@josielsouzanordcloud
josielsouzanordcloud force-pushed the DTOSS-12784-tag-driven-release-pipeline branch from 4764c65 to 6a95cce Compare April 28, 2026 12:32
@josielsouzanordcloud josielsouzanordcloud changed the title DTOSS-12784: Tag-driven release pipeline with smoke tests [DTOSS-12784] - Tag-driven release pipeline with smoke tests Apr 28, 2026
steventux
steventux approved these changes Apr 29, 2026
View reviewed changes

@steventux steventux left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A small suggestion for the c-echo python script

Comment thread scripts/powershell/smoke_test.ps1
Comment thread scripts/powershell/smoke_test.ps1 Outdated
@josielsouzanordcloud @steventux
Apply suggestions from code review
a86ebd0 
Co-authored-by: Steve Laing <steve.laing@gmail.com>
@josielsouzanordcloud
josielsouzanordcloud merged commit 20c50df into main Apr 29, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@steventux steventux steventux approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@josielsouzanordcloud @steventux