Skip to content

Commit b23f847

Browse files
RohoolioRohoolio
authored
Merge pull request #225 from NHSDigital/release/2024-06-14
Release/2024-06-14
2 parents 5c4692c + 0959243 commit b23f847

File tree

19 files changed

+295
-69
lines changed

19 files changed

+295
-69
lines changed

‎.github/actions/catch-failed-step/Dockerfile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
FROM python:3.8-slim
2+
3+
ADD requirements.txt /requirements.txt
4+
RUN pip install -r /requirements.txt
5+
6+
ADD entrypoint.py /entrypoint.py
7+
ENTRYPOINT ["python", "/entrypoint.py"]

‎.github/actions/catch-failed-step/action.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
name: "Catch failed step"
2+
description: "Catches the name of the final failed step in the current workflow"
3+
runs:
4+
using: "docker"
5+
image: "Dockerfile"

‎.github/actions/catch-failed-step/entrypoint.py

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
"""Gets the final failed step in a given workflow"""
2+
3+
import os
4+
5+
from github import Github
6+
7+
DEFAULT_STEP_NAME_WHEN_NO_STEP_FAILED = "No failed steps"
8+
9+
10+
def main():
11+
token = os.getenv("INPUT_GITHUB_TOKEN")
12+
repo_name = os.getenv("GITHUB_REPOSITORY")
13+
run_id = int(os.getenv("GITHUB_RUN_ID"))
14+
15+
github_client = Github(token)
16+
repo = github_client.get_repo(repo_name)
17+
workflow_run = repo.get_workflow_run(run_id)
18+
19+
failed_step_name = DEFAULT_STEP_NAME_WHEN_NO_STEP_FAILED
20+
for job in workflow_run.jobs():
21+
if job.conclusion == "failure":
22+
failed_step_name = job.name
23+
print(f"::set-output name=failed-step-name::{failed_step_name}") # noqa
24+
25+
26+
if __name__ == "__main__":
27+
main()

‎.github/actions/catch-failed-step/requirements.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
PyGithub

‎.github/workflows/_deploy.yml

Lines changed: 11 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ env:
2424
WORKSPACE: ${{ inputs.workspace }}
2525
CACHE_NAME: ${{ inputs.workspace }}-${{ inputs.account }}-${{ inputs.scope }}
2626
SCOPE: ${{ inputs.scope }}
27-
# SLACK_WEBHOOK_URL: ${{ secrets.DEPLOY_ENV_SLACK_HOOK_URL }}
2827
CI_ROLE_NAME: ${{ secrets.CI_ROLE_NAME }}
2928

3029
jobs:
@@ -74,9 +73,6 @@ jobs:
7473
needs: [get-branch-from-workflow-file, build]
7574
runs-on: [self-hosted, ci]
7675
steps:
77-
- uses: actions/checkout@v4
78-
with:
79-
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
8076
- uses: ./.github/actions/terraform/
8177
with:
8278
command: init
@@ -91,9 +87,6 @@ jobs:
9187
needs: [get-branch-from-workflow-file, terraform--init]
9288
runs-on: [self-hosted, ci]
9389
steps:
94-
- uses: actions/checkout@v4
95-
with:
96-
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
9790
- uses: ./.github/actions/terraform/
9891
with:
9992
command: plan
@@ -109,9 +102,6 @@ jobs:
109102
environment: ${{ inputs.account }}
110103
runs-on: [self-hosted, ci]
111104
steps:
112-
- uses: actions/checkout@v4
113-
with:
114-
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
115105
- uses: ./.github/actions/terraform/
116106
with:
117107
command: apply
@@ -126,9 +116,6 @@ jobs:
126116
needs: [get-branch-from-workflow-file, terraform--apply]
127117
runs-on: [self-hosted, ci]
128118
steps:
129-
- uses: actions/checkout@v4
130-
with:
131-
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
132119
- uses: ./.github/actions/make/
133120
if: ${{ env.SCOPE == 'per_workspace'}}
134121
with:
@@ -150,9 +137,6 @@ jobs:
150137
needs: [get-branch-from-workflow-file, apigee--deploy]
151138
runs-on: [self-hosted, ci]
152139
steps:
153-
- uses: actions/checkout@v4
154-
with:
155-
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
156140
- uses: ./.github/actions/make/
157141
with:
158142
command: test--smoke WORKSPACE="${{ env.WORKSPACE }}" ACCOUNT="${{ env.ACCOUNT }}"
@@ -177,16 +161,24 @@ jobs:
177161
runs-on: [self-hosted, ci]
178162

179163
steps:
164+
- name: Catch failed steps
165+
id: catch-failed-step
166+
uses: ./.github/actions/catch-failed-step
180167
- name: Send job result to slack
181168
id: slack
182169
uses: slackapi/[email protected]
183170
with:
184171
payload: |
185172
{
173+
"action_url": "${{ format('{0}/{1}/actions/runs/{2}/attempts/{3}', github.server_url, github.repository, github.run_id, github.run_attempt) }}",
174+
"attempt": ${{ github.run_attempt }},
186175
"account": "${{ env.ACCOUNT }}",
187-
"environment": "${{ env.WORKSPACE }}",
188-
"result": "${{ needs.set-success.outputs.success && needs.set-success.outputs.success || 'failed' }}",
189-
"branch": "${{ needs.get-branch-from-workflow-file.outputs.branch_name }}"
176+
"workspace": "${{ env.WORKSPACE }}",
177+
"caller": "${{ github.triggering_actor }}",
178+
"scope": "${{ env.SCOPE }}",
179+
"branch": "${{ needs.get-branch-from-workflow-file.outputs.branch_name }}",
180+
"result": "${{ needs.set-success.outputs.success && needs.set-success.outputs.success || 'failed' }}",
181+
"result_detail": "${{ needs.set-success.outputs.success && 'None' || steps.catch-failed-step.outputs.failed-step-name }}"
190182
}
191183
env:
192184
SLACK_WEBHOOK_URL: ${{ secrets.DEPLOY_ENV_SLACK_HOOK_URL }}

‎.github/workflows/merge.yml

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,18 @@ permissions:
1111
actions: write
1212

1313
jobs:
14+
get-branch-from-workflow-file:
15+
runs-on: [self-hosted, ci]
16+
outputs:
17+
branch_name: ${{ steps.get_branch.outputs.branch_name }}
18+
steps:
19+
- id: get_branch
20+
run: |
21+
workflow_ref=${{ github.workflow_ref }}
22+
branch_name=${workflow_ref#*refs/heads/}
23+
branch_name=${branch_name#*refs/tags/}
24+
echo "branch_name=${branch_name}" >> $GITHUB_OUTPUT
25+
1426
make-tag:
1527
runs-on: [self-hosted, ci]
1628
permissions: write-all
@@ -36,18 +48,36 @@ jobs:
3648
outputs:
3749
tag: ${{ env.tag }}
3850

51+
set-success:
52+
name: Set Success
53+
needs: [make-tag, get-branch-from-workflow-file]
54+
runs-on: [self-hosted, ci]
55+
steps:
56+
- name: Set success env var
57+
run: echo "success"
58+
outputs:
59+
success: "succeeded"
60+
3961
message-slack:
4062
name: Notify slack of merge to main
41-
needs: [make-tag]
63+
needs: [make-tag, get-branch-from-workflow-file, set-success]
4264
runs-on: [self-hosted, ci]
4365
steps:
66+
- name: Catch failed steps
67+
id: catch-failed-step
68+
uses: ./.github/actions/catch-failed-step
4469
- name: Send merge result to slack
4570
id: slack
4671
uses: slackapi/[email protected]
4772
with:
4873
payload: |
4974
{
50-
"tag": "${{ needs.make-tag.outputs.tag}}"
75+
"tag": "${{ needs.make-tag.outputs.tag}}",
76+
"branch": "${{ needs.get-branch-from-workflow-file.outputs.branch_name }}",
77+
"caller": "${{ github.triggering_actor }}",
78+
"result": "${{ needs.set-success.outputs.success && needs.set-success.outputs.success || 'failed' }}",
79+
"result_detail": "${{ needs.set-success.outputs.success && 'None' || steps.catch-failed-step.outputs.failed-step-name }}",
80+
"action_url": "${{ format('{0}/{1}/actions/runs/{2}/attempts/{3}', github.server_url, github.repository, github.run_id, github.run_attempt) }}"
5181
}
5282
env:
5383
SLACK_WEBHOOK_URL: ${{ secrets.MAIN_MERGE_SLACK_HOOK_URL }}

‎CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Changelog
22

3+
## 2024-06-14
4+
- [PI-179] Improve Slack messaging for deployments
5+
- [PI-385] PENTEST - reject HTTP and enable access logs on S3 buckets
6+
37
## 2024-06-04
48
- [PI-322] State machine lambda error messages truncated
59
- [PI-346] Update now includes modify changes, plus testing suite

‎VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2024.06.04
1+
2024.06.14

‎changelog/2024-06-14.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- [PI-179] Improve Slack messaging for deployments
2+
- [PI-385] PENTEST - reject HTTP and enable access logs on S3 buckets

‎infrastructure/terraform/per_account/dev/main.tf

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,27 @@ module "iam__api-gateway-to-cloudwatch" {
3232
project = local.project
3333
}
3434

35+
module "bucket_access_logs" {
36+
source = "terraform-aws-modules/s3-bucket/aws"
37+
version = "3.15.2"
38+
bucket = "${local.project}--${replace(terraform.workspace, "_", "-")}--s3-access-logs"
39+
attach_deny_insecure_transport_policy = true
40+
attach_access_log_delivery_policy = true
41+
force_destroy = true
42+
versioning = {
43+
enabled = true
44+
}
45+
tags = {
46+
Name = "${local.project}--${replace(terraform.workspace, "_", "-")}--s3-access-logs"
47+
}
48+
}
49+
3550
module "bucket" {
36-
source = "terraform-aws-modules/s3-bucket/aws"
37-
version = "3.15.2"
38-
bucket = "${local.project}--${replace(terraform.workspace, "_", "-")}--test-data"
39-
force_destroy = true
51+
source = "terraform-aws-modules/s3-bucket/aws"
52+
version = "3.15.2"
53+
bucket = "${local.project}--${replace(terraform.workspace, "_", "-")}--test-data"
54+
attach_deny_insecure_transport_policy = true
55+
force_destroy = true
4056
versioning = {
4157
enabled = true
4258
}
@@ -46,10 +62,12 @@ module "bucket" {
4662
}
4763

4864
module "truststore_bucket" {
49-
source = "terraform-aws-modules/s3-bucket/aws"
50-
version = "3.15.2"
51-
bucket = "${local.project}--${replace(terraform.workspace, "_", "-")}--truststore"
52-
force_destroy = true
65+
source = "terraform-aws-modules/s3-bucket/aws"
66+
version = "3.15.2"
67+
bucket = "${local.project}--${replace(terraform.workspace, "_", "-")}--truststore"
68+
attach_deny_insecure_transport_policy = true
69+
attach_access_log_delivery_policy = true
70+
force_destroy = true
5371
versioning = {
5472
enabled = true
5573
}
@@ -58,6 +76,13 @@ module "truststore_bucket" {
5876
}
5977
}
6078

79+
resource "aws_s3_bucket_logging" "truststore_to_access_logs" {
80+
bucket = module.truststore_bucket.s3_bucket_id
81+
82+
target_bucket = module.bucket_access_logs.s3_bucket_id
83+
target_prefix = "truststore/log/"
84+
}
85+
6186
module "vpc" {
6287
source = "../modules/vpc"
6388
environment = terraform.workspace

0 commit comments

Comments
 (0)