ecdsa_default.yml

name: Deploy default ECDSA CA with no public CRL
on:
  workflow_dispatch:
  push:
    paths:
      - "**/*.py"
      - "**/*.tf"
      - "**/*.txt"
      - ".github/workflows/ecdsa_default.yml"
    branches:
      - main

jobs:
  terraform_validate:
    name: Terraform validate
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: read
      checks: write
    steps:
      - name: Terraform setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.1

      - name: Checkout
        uses: actions/checkout@v4

      - name: Terraform format
        run: terraform fmt -check -recursive

      - name: Terraform init
        run: terraform init -get -backend=false

      - name: Terraform validate
        run: terraform validate

  secret_scan:
    name: Secret scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Install GitLeaks
        run: |
          wget https://github.com/gitleaks/gitleaks/releases/download/v8.16.1/gitleaks_8.16.1_linux_x64.tar.gz && \
          tar -xf gitleaks_8.16.1_linux_x64.tar.gz
          sudo mv gitleaks /usr/local/bin/gitleaks && \
          sudo chmod +x /usr/local/bin/gitleaks
      - name: Run GitLeaks Scan
        run: |
          gitleaks detect --source . -v

  terraform_plan_apply:
    name: Terraform plan & apply
    runs-on: ubuntu-latest
    environment: 'ecdsa'
    needs:
      - terraform_validate
      - secret_scan
    defaults:
      run:
        working-directory: ./examples/default

    permissions:
      id-token: write
      contents: read
      pull-requests: read
      checks: write
    steps:
      - name: Terraform setup
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.1

      - name: checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.12
        id: setup_python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Display Python version
        run: python -c "import sys; print(sys.version)"

      - name: Install virtualenv
        run: pip install virtualenv

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Terraform initialise
        run: >
          terraform init
          -backend-config=bucket=${{ secrets.TERRAFORM_STATE_BUCKET}}
          -backend-config=key=${{ secrets.TERRAFORM_STATE_KEY}}
          -backend-config=region=${{ secrets.TERRAFORM_STATE_REGION}}

      - name: cache built python modules
        uses: actions/cache@v4
        with:
          key: modules_terraform-aws-ca-lambda_build_${{ hashFiles('./modules/terraform-aws-ca-lambda/lambda_code/**') }}_${{ hashFiles('./modules/terraform-aws-ca-lambda/utils/**') }}_${{ github.job }}_py${{ steps.setup_python.outputs.python-version }}
          path: ./modules/terraform-aws-ca-lambda/build

      - name: terraform plan
        run: terraform plan -out tfplan

      - name: terraform apply
        run: terraform apply -auto-approve tfplan

  delete_dynamo_db_items:
    # deletes Certificate Authority - only use for testing
    name: Delete all DynamoDB items
    runs-on: ubuntu-latest
    needs:
      - terraform_plan_apply
    permissions:
      id-token: write
      contents: read
      checks: write
    steps:
      - name: checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Display Python version
        run: python -c "import sys; print(sys.version)"

      - name: Install dependencies
        run: |
          pip install -r scripts/requirements.txt

      - name: Configure AWS Credentials - Dev
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Delete all DynamoDB items
        run: |
          python scripts/delete_db_table_items.py

  start_ca:
    name: Start CA
    runs-on: ubuntu-latest
    needs:
      - delete_dynamo_db_items
    permissions:
      id-token: write
      contents: read
      checks: write
    steps:
      - name: checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Display Python version
        run: python -c "import sys; print(sys.version)"

      - name: Install dependencies
        run: |
          pip install -r scripts/requirements.txt

      - name: Configure AWS Credentials - Dev
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Start CA
        run: |
          python scripts/start_ca_step_function.py

  integration_tests:
    name: Integration Tests
    runs-on: ubuntu-latest
    needs: start_ca
    permissions:
      id-token: write
      contents: read
      checks: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: |
          pip install -r requirements-dev.txt

      - name: Configure AWS Credentials - Dev
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN}}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Integration tests
        run: |
          pytest -v tests