build-and-deploy-all-environments.yml

name: 'Build, Deploy (all environments)'

on:
  workflow_dispatch:
  push:
    branches:
      - '*'

jobs:
  build:
    name: 'Build'
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Code'
        uses: actions/checkout@v4

      - name: 'Install Terraform'
        uses: hashicorp/setup-terraform@v3

      - name: 'Install dotnet 8.0.x'
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'
      
      - name: 'Install Node.JS version 20 (v22 caused an error during npm ci)'
        uses: actions/setup-node@v4
        with:
          node-version: 20
      
      - name: 'Init Terraform (with no backend)'
        run: |
          terraform init -backend=false
        working-directory: ./terraform

      - name: 'Validate Terraform (with no backend)'
        run: |
          terraform validate
        working-directory: ./terraform

      - name: 'Install Node.JS (npm) dependencies'
        run: |
          npm ci
        working-directory: GenderPayGap.WebUI

      - name: 'Build JS and SCSS code'
        run: |
          npm run build
        working-directory: GenderPayGap.WebUI

      - name: 'Install .Net (nuget) dependencies'
        run: |
          dotnet restore GenderPayGap.Core/GenderPayGap.Core.csproj
          dotnet restore GenderPayGap.Database/GenderPayGap.Database.csproj
          dotnet restore GenderPayGap.WebUI/GenderPayGap.WebUI.csproj
          dotnet restore GenderPayGap.UnitTests/GenderPayGap.WebUI.Tests/GenderPayGap.WebUI.Tests.csproj
      
      - name: 'Save build run info to JSON file'
        run: |
          echo '{ "BuildNumber": "${{ github.run_id }}", "git_commit": "${{ github.sha }}", "git_branch": "${{ github.ref_name }}", "github_action_name": "${{ github.workflow }}", "github_action_run_url": "https://github.com/${{github.repository}}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}" }' > build-number.json
        working-directory: GenderPayGap.WebUI

      - name: 'Build .Net code'
        run: |
          dotnet build GenderPayGap.WebUI/GenderPayGap.WebUI.csproj

      - id: test_dotnet_code
        name: 'Test .Net code'
        run: |
          dotnet test GenderPayGap.UnitTests/GenderPayGap.WebUI.Tests/GenderPayGap.WebUI.Tests.csproj --logger "trx;LogFileName=test-results.trx"

      - name: 'Publish .Net test results'
        uses: dorny/test-reporter@v1
        if:
          # Run this step if the tests succeeded or failed (but not if the workflow was cancelled or the step was skipped
          # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs#steps-context
          ${{ steps.test_dotnet_code.outcome == 'success' || steps.test_dotnet_code.outcome == 'failure' }}
        with:
          name: 'test-results'
          path: GenderPayGap.UnitTests/GenderPayGap.WebUI.Tests/TestResults/test-results.trx
          reporter: dotnet-trx

      - name: 'Publish .Net code'
        run: |
          dotnet publish GenderPayGap.WebUI/GenderPayGap.WebUI.csproj -p:Configuration=Release

      - name: 'Zip up the code'
        run: |
          zip -rq build.zip .
        working-directory: GenderPayGap.WebUI/bin/Release/net8.0/publish/

      - name: 'Save build zip as GitHub Actions artifact'
        uses: actions/upload-artifact@v4
        with:
          name: build-zip
          path: GenderPayGap.WebUI/bin/Release/net8.0/publish/build.zip
  
  pause_workflow:
    # For the subsequent jobs, we want to the use 2 GitHub features:
    # - environments: to ensure deployments are manually kicked off (builds can happen automatically, but not deploys)
    # - concurrency: to prevent 2 jobs deploying or terraforming at the same time
    # But the way GitHub has implemented this combination of features means that:
    # - the first workflow/job to get to the manual approval gate waits for approval
    # - any parallel workflows/jobs to get to the manyal approval gate cannot be run until the first job has completed
    #   i.e. we can't start a deployment on workflow run 11 until the same deployment on wofklow run 10 has completed (even if we don't want to deploy workflow run 10 at all!)
    # Cancelling the workflow allows us to run-run any jobs as we like, and takes them all out of the approval queue
    name: 'Pause the workflow here'
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - name: 'Cancel workflow'
        run: |
          curl -L \
          -X POST \
          -H "Accept: application/vnd.github+json" \
          -H "Authorization: Bearer ${{ github.token }}" \
          -H "X-GitHub-Api-Version: 2022-11-28" \
          https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel
  
  start_dev:
    # This "Start" task is to work around a bug in GitHub
    # Without this, when you manually re-run the "Terraform (dev)" job, it also kicks off the "Terraform (prod)" job
    # It only started doing this once we moved the Terraform shared functionality into a sub-workflow
    name: 'Start (dev)'
    runs-on: ubuntu-latest
    needs: [pause_workflow]
    steps:
      - name: 'No-op'
        run: echo "Hello"
  
  terraform_dev:
    name: 'Terraform (dev)'
    concurrency: '${{ github.workflow }}--terraform_dev'  # Prevents more than one instance of this workflow/job running at the same time (to prevent 2 instances deploying or terraforming at the same time)
    needs: [start_dev]
    uses: ./.github/workflows/_terraform-shared.yml
    with:
      GITHUB_ACTIONS_ENVIRONMENT: dev
      TERRAFORM_ENVIRONMENT_NAME: dev
      TERRAFORM_STATE_FILE: gender-pay-gap_dev.tfstate
      TERRAFORM_TFVARS_FILE: dev.tfvars
      OFFSET_CURRENT_DATE_TIME_FOR_SITE: ${{ vars.OFFSET_CURRENT_DATE_TIME_FOR_SITE }}
      MAINTENANCE_MODE: ${{ vars.MAINTENANCE_MODE }}
      MAINTENANCE_MODE_UP_AGAIN_TIME: ${{ vars.MAINTENANCE_MODE_UP_AGAIN_TIME }}
    secrets:
      TERRAFORM_AWS_ACCESS_KEY_ID: ${{ secrets.TERRAFORM_AWS_ACCESS_KEY_ID }}
      TERRAFORM_AWS_SECRET_ACCESS_KEY: ${{ secrets.TERRAFORM_AWS_SECRET_ACCESS_KEY }}
      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
      DEFAULT_ENCRYPTION_KEY: ${{ secrets.DEFAULT_ENCRYPTION_KEY }}
      DEFAULT_ENCRYPTION_IV: ${{ secrets.DEFAULT_ENCRYPTION_IV }}
      DATA_MIGRATION_PASSWORD: ${{ secrets.DATA_MIGRATION_PASSWORD }}
      COMPANIES_HOUSE_API_KEY: ${{ secrets.COMPANIES_HOUSE_API_KEY }}
      GOV_UK_NOTIFY_API_KEY: ${{ secrets.GOV_UK_NOTIFY_API_KEY }}
      BASIC_AUTH_USERNAME: ${{ secrets.BASIC_AUTH_USERNAME }}
      BASIC_AUTH_PASSWORD: ${{ secrets.BASIC_AUTH_PASSWORD }}
      EHRC_API_TOKEN: ${{ secrets.EHRC_API_TOKEN }}
  
  deploy_dev:
    name: 'Deploy (dev)'
    concurrency: '${{ github.workflow }}--deploy_dev'  # Prevents more than one instance of this workflow/job running at the same time (to prevent 2 instances deploying or terraforming at the same time)
    needs: [terraform_dev]
    uses: ./.github/workflows/_deploy-shared.yml
    with:
      GITHUB_ACTIONS_ENVIRONMENT: dev
      EB_APP_NAME: ${{ needs.terraform_dev.outputs.main_app_elastic_beanstalk_application_name }}
      EB_ENVIRONMENT_NAME: ${{ needs.terraform_dev.outputs.main_app_elastic_beanstalk_environment_name }}
      EB_CODE_BUCKET: ${{ needs.terraform_dev.outputs.main_app_elastic_beanstalk_code_s3_bucket }}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.TERRAFORM_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.TERRAFORM_AWS_SECRET_ACCESS_KEY }}
  
  start_prod:
    # This "Start" task is to work around a bug in GitHub
    # Without this, when you manually re-run the "Terraform (dev)" job, it also kicks off the "Terraform (prod)" job
    # It only started doing this once we moved the Terraform shared functionality into a sub-workflow
    name: 'Start (prod)'
    runs-on: ubuntu-latest
    needs: [pause_workflow]
    steps:
      - name: 'No-op'
        run: echo "Hello"
  
  terraform_prod:
    name: 'Terraform (prod)'
    concurrency: '${{ github.workflow }}--terraform_prod'  # Prevents more than one instance of this workflow/job running at the same time (to prevent 2 instances deploying or terraforming at the same time)
    needs: [start_prod]
    uses: ./.github/workflows/_terraform-shared.yml
    with:
      GITHUB_ACTIONS_ENVIRONMENT: prod
      TERRAFORM_ENVIRONMENT_NAME: prod
      TERRAFORM_STATE_FILE: gender-pay-gap_prod.tfstate
      TERRAFORM_TFVARS_FILE: prod.tfvars
      OFFSET_CURRENT_DATE_TIME_FOR_SITE: ${{ vars.OFFSET_CURRENT_DATE_TIME_FOR_SITE }}
      MAINTENANCE_MODE: ${{ vars.MAINTENANCE_MODE }}
      MAINTENANCE_MODE_UP_AGAIN_TIME: ${{ vars.MAINTENANCE_MODE_UP_AGAIN_TIME }}
    secrets:
      TERRAFORM_AWS_ACCESS_KEY_ID: ${{ secrets.TERRAFORM_AWS_ACCESS_KEY_ID }}
      TERRAFORM_AWS_SECRET_ACCESS_KEY: ${{ secrets.TERRAFORM_AWS_SECRET_ACCESS_KEY }}
      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
      DEFAULT_ENCRYPTION_KEY: ${{ secrets.DEFAULT_ENCRYPTION_KEY }}
      DEFAULT_ENCRYPTION_IV: ${{ secrets.DEFAULT_ENCRYPTION_IV }}
      DATA_MIGRATION_PASSWORD: ${{ secrets.DATA_MIGRATION_PASSWORD }}
      COMPANIES_HOUSE_API_KEY: ${{ secrets.COMPANIES_HOUSE_API_KEY }}
      GOV_UK_NOTIFY_API_KEY: ${{ secrets.GOV_UK_NOTIFY_API_KEY }}
      BASIC_AUTH_USERNAME: ${{ secrets.BASIC_AUTH_USERNAME }}
      BASIC_AUTH_PASSWORD: ${{ secrets.BASIC_AUTH_PASSWORD }}
      EHRC_API_TOKEN: ${{ secrets.EHRC_API_TOKEN }}
  
  deploy_prod:
    name: 'Deploy (prod)'
    concurrency: '${{ github.workflow }}--deploy_prod'  # Prevents more than one instance of this workflow/job running at the same time (to prevent 2 instances deploying or terraforming at the same time)
    needs: [terraform_prod]
    uses: ./.github/workflows/_deploy-shared.yml
    with:
      GITHUB_ACTIONS_ENVIRONMENT: prod
      EB_APP_NAME: ${{ needs.terraform_prod.outputs.main_app_elastic_beanstalk_application_name }}
      EB_ENVIRONMENT_NAME: ${{ needs.terraform_prod.outputs.main_app_elastic_beanstalk_environment_name }}
      EB_CODE_BUCKET: ${{ needs.terraform_prod.outputs.main_app_elastic_beanstalk_code_s3_bucket }}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.TERRAFORM_AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.TERRAFORM_AWS_SECRET_ACCESS_KEY }}