KEH-1670: Update cicd pipeline setup (#28)

mwirikia · web-flow · commit 8e2f04435fdc · 2025-11-18T13:25:33.000Z
* update cicd pipeline setup
* update Makefile for running local
* update the lambda image to latest hash
diff --git a/README.md b/README.md
@@ -65,7 +65,7 @@ cd aws_lambda_script
 
 Run the project locally (with UI)
 ```bash
-make run
+make run-local
 ```
 or
 ```bash
diff --git a/aws_lambda_script/Dockerfile b/aws_lambda_script/Dockerfile
@@ -2,6 +2,9 @@
 FROM public.ecr.aws/lambda/python:3.12
 # Set the working directory in the container
 WORKDIR /var/task
+# Upgrade tooling and awslambdaric
+RUN pip install --no-cache-dir --upgrade pip setuptools wheel && \
+    pip install --no-cache-dir --upgrade awslambdaric
 # Create a non-root user and group manually
 RUN mkdir -p /home/appuser && \
     chown -R 1000:1000 /home/appuser
diff --git a/aws_lambda_script/app/resources.py b/aws_lambda_script/app/resources.py
@@ -457,11 +457,13 @@ def post(self):
                 for user in proj["user"]
                 if user["email"] in new_project_emails
             )
+            logger.error("PROJECT '%s' WITH EMAIL '%s' ALREADY EXISTS", new_project_name, matching_email)
             abort(
                 409,
                 description=f"Project with the same name '{new_project_name}', and owner '{matching_email}' already exists",
             )
         data["projects"].append(new_project)
+        logger.info("PROJECT '%s' ADDED SUCCESSFULLY", new_project_name)
         write_data(data, "new_project_data.json")
 
         return new_project, 201
@@ -559,7 +561,7 @@ def put(self, project_name):
 
         # Update the project details
         project.update(updated_project)
-
+        logger.info("PROJECT '%s' UPDATED SUCCESSFULLY", project_name)
         write_data(data, "duplicates.json")
 
         duplicate_data = read_data("duplicates.json")
diff --git a/aws_lambda_script/requirements.txt b/aws_lambda_script/requirements.txt
@@ -4,5 +4,5 @@ botocore==1.35.38
 flask-restx==1.3.0
 aws-wsgi==0.2.7
 pyjwt>=2.7.0
-requests==2.32.3
-cryptography==43.0.1
+requests==2.32.4
+cryptography==44.0.1
diff --git a/concourse/ci.yml b/concourse/ci.yml
@@ -1,3 +1,9 @@
+resource_types:
+  - name: key-value
+    type: registry-image
+    source:
+      repository: gstack/keyval-resource
+
 resources:
 - name: resource-repo
   type: git
@@ -6,14 +12,112 @@ resources:
     uri: https://github.com/ONS-Innovation/keh-tech-audit-tool-api
     branch: ((branch))
     access_token: ((github_access_token))
+- name: github-release
+  type: github-release
+  source:
+    owner: ONS-Innovation
+    repository: keh-tech-audit-tool-api
+    access_token: ((github_access_token))
+- name: github-release-tag
+  type: key-value
+  source:
+    file: tag-output/tag
+
+# Define the common terraform task as an anchor
+terraform-task: &terraform-task
+  task: terraform-deploy
+  privileged: true
+  config:
+    platform: linux
+    image_resource:
+      type: docker-image
+      source:
+        repository: hashicorp/terraform
+    inputs:
+      - name: resource-repo
+      - name: github-release-tag
+    params:
+      secrets: ((sdp_((env))_secrets_tat_api))
+      github_access_token: ((github_access_token))
+      env: ((env))
+      branch: ((branch))
+    run:
+      path: sh
+      args:
+        - -cx
+        - |
+          echo "DEBUG: Environment is ${env}"
+          echo "DEBUG: Tag is ${tag}"
+          export tag=$(cat github-release-tag/tag)
+          if [[ "$env" == "prod" ]] && [[ "$branch" != "main" && "$branch" != "master" ]]; then
+            echo "Not on main branch, skipping terraform for prod."
+            exit 0
+          fi
+          apk add --no-cache jq curl
+          if [[ "$env" == "prod" && ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "ERROR: Tag '$tag' is not in semantic versioning format (vX.Y.Z)"
+            exit 1
+          fi
+          chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
+          ./resource-repo/concourse/scripts/terraform_infra.sh
+    timeout: 30m
 
 jobs:
-- name:  build-and-push
+- name: calculate-tag
   public: true
   plan:
+    - get: github-release
+      trigger: true
+    - get: resource-repo
+      trigger: false
+    - task: calculate-tag
+      config:
+        platform: linux
+        image_resource:
+          type: docker-image
+          source:
+            repository: alpine
+        inputs:
+          - name: resource-repo
+          - name: github-release
+        outputs:
+          - name: tag-output
+        params:
+          branch: ((branch))
+        run:
+          path: sh
+          args:
+            - -cx
+            - |
+              apk add --no-cache git
+              echo "Calculating tag for branch: ${branch}"
+              if [[ "$branch" == "main" || "$branch" == "master" ]]; then
+                # Get the latest tag that matches the format vX.Y.Z
+                tag=$(git -C resource-repo tag --list 'v[0-9]*.[0-9]*.[0-9]*' | sort -V | tail -n 1)
+                if [[ -z "$tag" ]]; then
+                  echo "No valid semantic versioning tags (vX.Y.Z) found. Cannot set pipeline."
+                  exit 1
+                fi
+              else
+                # Remove non-alphanumeric characters and take the first 7 characters
+                tag=$(echo "${branch}" | tr -cd '[:alnum:]' | cut -c1-7)
+              fi
+              echo "Calculated tag: ${tag}"
+              # Write the tag to a file for output
+              echo "${tag}" > tag-output/tag
+    - put: github-release-tag
+      params:
+        directory: tag-output
+
+- name:  deploy-after-github-release-dev
+  public: true
+  plan:
+  - get: github-release-tag
+    passed: [calculate-tag]
+    trigger: true
   - get: resource-repo
     timeout: 5m
-  - task: build-image
+  - task: deploy-release
     privileged: true
     config:
       platform: linux
@@ -22,56 +126,85 @@ jobs:
         source:
           repository: hashicorp/terraform
       inputs:
-      - name: resource-repo
+        - name: resource-repo
+        - name: github-release-tag
       params:
         aws_account_id: ((aws_account_sdp_((env))))
         aws_role_arn: arn:aws:iam::((aws_account_sdp_((env)))):role/sdp-concourse-((env))
         secrets: ((sdp_((env))_secrets_tat_api))
+        env: dev
+        tag: github-release-tag/tag # Use the release tag from the resource
+        repo_name: ((repo_name))
       run: # binary used to build the image
         path: sh
         args:
         - -cx
         - |
           apk add --no-cache aws-cli podman jq iptables curl
-          
-          if [[ "((env))" == "prod" ]]; then
-            tag=$(curl "https://api.github.com/repos/ONS-Innovation/keh-tech-audit-tool-api/releases" | jq -r '.[0].tag_name')
-            export tag
-          else
-            export tag=((tag))
-          fi
-          git rev-parse --abbrev-ref HEAD
+          export repo_name=((repo_name))
+          export tag=$(cat github-release-tag/tag)
+          # Write the tag to a file for output
+          echo "${tag}" > release-tag-output/tag
+          echo "Using tag: ${tag}"
           chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
           chmod u+x ./resource-repo/concourse/scripts/build_image.sh
           source ./resource-repo/concourse/scripts/assume_role.sh
           ./resource-repo/concourse/scripts/build_image.sh
     timeout: 10m
-  - task: terraform
+  - <<: *terraform-task
+    params:
+      secrets: ((sdp_((env))_secrets_tat_api))
+      github_access_token: ((github_access_token))
+      env: dev
+- name: release-build-and-push-prod
+  public: true
+  plan:
+  - get: resource-repo
+    passed: [deploy-after-github-release-dev]
+    trigger: false # Manual trigger only
+    timeout: 5m
+  - get: github-release-tag
+    passed: [deploy-after-github-release-dev]
+  - task: build-image
     privileged: true
     config:
       platform: linux
       image_resource:
         type: docker-image
-        source: {repository: hashicorp/terraform}
+        source:
+          repository: hashicorp/terraform
       inputs:
-      - name: resource-repo
+        - name: resource-repo
+        - name: github-release-tag
       params:
-        secrets: ((sdp_((env))_secrets_tat_api))
-        github_access_token: ((github_access_token))
+        aws_account_id: ((aws_account_sdp_prod))
+        aws_role_arn: arn:aws:iam::((aws_account_sdp_prod)):role/sdp-concourse-prod
+        secrets: ((sdp_prod_secrets_tat_api))
+        env: prod
+        tag: github-release-tag/tag
+        repo_name: ((repo_name))
+        branch: ((branch))
       run:
         path: sh
         args:
-        - -cx
-        - |
-          apk add --no-cache jq curl
-          if [[ "((env))" == "prod" ]]; then
-            tag=$(curl "https://api.github.com/repos/ONS-Innovation/keh-tech-audit-tool-api/releases" | jq -r '.[0].tag_name')
-            export tag
-          else 
-            export tag=((tag))
-          fi
-          chmod u+x ./resource-repo/concourse/scripts/terraform_infra.sh
-          export env=((env))
-          ./resource-repo/concourse/scripts/terraform_infra.sh
-    timeout: 30m
-            
+          - -cx
+          - |
+            if [[ "$branch" != "main" ]]; then
+              echo "Not on main branch, skipping build."
+              exit 0
+            fi
+            apk add --no-cache aws-cli podman jq iptables curl
+            export repo_name=((repo_name))
+            export tag=$(cat github-release-tag/tag)
+            echo "Using release tag: ${tag}"
+            chmod u+x ./resource-repo/concourse/scripts/assume_role.sh
+            chmod u+x ./resource-repo/concourse/scripts/build_image.sh
+            source ./resource-repo/concourse/scripts/assume_role.sh
+            ./resource-repo/concourse/scripts/build_image.sh
+    timeout: 10m
+  - <<: *terraform-task
+    params:
+      github_access_token: ((github_access_token))
+      env: prod
+      secrets: ((sdp_prod_secrets_tat_api))
+          
diff --git a/concourse/scripts/set_pipeline.sh b/concourse/scripts/set_pipeline.sh
@@ -1,27 +1,26 @@
-repo_name=${1}
+#!/bin/bash
+set -eo pipefail
+# Usage: ./set_pipeline.sh
 
-if [[ $# -gt 1 ]]; then
-    branch=${2}
-    git rev-parse --verify ${branch}
-    if [[ $? -ne 0 ]]; then
-        echo "Branch \"${branch}\" does not exist"
-        exit 1
-    fi
-else
-    branch=$(git rev-parse --abbrev-ref HEAD)
-fi
+# Define repository name
+repo_name="tech-audit-tool-api"
 
-if [[ ${branch} == "main" || ${branch} == "master" ]]; then
-    env="prod"
-else
-    env="dev"
+# Always use the current branch
+branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || { echo "Failed to get branch name"; exit 1; })
+
+if ! git rev-parse --verify "${branch}" >/dev/null 2>&1; then
+    echo "Branch \"${branch}\" does not exist. Cannot set a pipeline without a valid branch."
+    exit 1
 fi
 
-if [[ ${env} == "dev" ]]; then
-    tag=$(git rev-parse HEAD)
+if [[ ${branch} == "main" || ${branch} == "master" ]]; then
+    pipeline_name=${repo_name}
 else
-    tag=$(git tag | tail -n 1)
+    # Remove non-alphanumeric characters and take the first 7 characters
+    sanitized_branch=$(echo "${branch}" | tr -cd '[:alnum:]' | cut -c1-7)
+    pipeline_name=${repo_name}-${sanitized_branch}
 fi
 
-fly -t aws-sdp set-pipeline -c concourse/ci.yml -p ${repo_name}-${branch} -v branch=${branch} -v tag=${tag} -v env=${env}
+fly -t aws-sdp set-pipeline -c concourse/ci.yml -p ${pipeline_name}  -v branch=${branch} -v repo_name=${repo_name} -v env=dev
+echo "Pipeline \"${pipeline_name}\" has been set successfully."
 
diff --git a/terraform/lambda/main.tf b/terraform/lambda/main.tf
@@ -148,8 +148,10 @@ resource "aws_security_group" "lambda_sg" {
 resource "aws_lambda_function" "tech_audit_lambda" {
   function_name = "${var.domain}-${var.service_subdomain}-lambda"
   package_type  = "Image"
-  image_uri     = "${var.aws_account_id}.dkr.ecr.${var.region}.amazonaws.com/${var.ecr_repository}:${var.container_ver}"
-  
+
+  # Use digest instead of tag (immutable)
+  image_uri = "${var.aws_account_id}.dkr.ecr.${var.region}.amazonaws.com/${var.ecr_repository}@${data.aws_ecr_image.lambda_image.image_digest}"
+
   vpc_config {
     subnet_ids          = data.terraform_remote_state.vpc.outputs.private_subnets
     security_group_ids  = [aws_security_group.lambda_sg.id] // Dedicated security group for Lambda function
@@ -162,17 +164,20 @@ resource "aws_lambda_function" "tech_audit_lambda" {
 
   environment {
     variables = {
-      TECH_AUDIT_DATA_BUCKET = data.terraform_remote_state.storage.outputs.tech_audit_data_bucket_name
-      TECH_AUDIT_SECRET_MANAGER = data.terraform_remote_state.secrets.outputs.secret_name
-      AWS_COGNITO_TOKEN_URL = "https://${var.domain}-${var.service_subdomain}.auth.eu-west-2.amazoncognito.com/oauth2/token"
+      TECH_AUDIT_DATA_BUCKET     = data.terraform_remote_state.storage.outputs.tech_audit_data_bucket_name
+      TECH_AUDIT_SECRET_MANAGER  = data.terraform_remote_state.secrets.outputs.secret_name
+      AWS_COGNITO_TOKEN_URL      = "https://${var.domain}-${var.service_subdomain}.auth.eu-west-2.amazoncognito.com/oauth2/token"
+      IMAGE_DIGEST               = data.aws_ecr_image.lambda_image.image_digest
+      IMAGE_TAG                  = var.container_ver
     }
   }
 
   depends_on = [
     aws_iam_role_policy.lambda_s3_access,
     aws_iam_role_policy.lambda_additional_permissions,
     aws_iam_role_policy_attachment.lambda_basic_execution,
-    aws_iam_role_policy_attachment.lambda_vpc_access
+    aws_iam_role_policy_attachment.lambda_vpc_access,
+    data.aws_ecr_image.lambda_image
   ]
 }
 
@@ -181,6 +186,14 @@ resource "aws_iam_role_policy_attachment" "lambda_vpc_access" {
   role       = aws_iam_role.lambda_execution_role.name
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
   depends_on = [aws_iam_role.lambda_execution_role]
+}
+
+# Resolve the pushed image (must exist before terraform apply)
+data "aws_ecr_image" "lambda_image" {
+  repository_name = var.ecr_repository
+  image_tag       = var.container_ver
+}
+
 } 
 
 # CloudWatch log group for the Lambda
@@ -190,4 +203,4 @@ resource "aws_cloudwatch_log_group" "lambda_log_group" {
   tags = {
     Name      = "${var.domain}-${var.service_subdomain}-lambda-log-group"
   }
-}
+}
