diff --git a/.github/workflows/actions/build-docker/action.yml b/.github/workflows/actions/build-docker/action.yml deleted file mode 100644 index f332e5dba..000000000 --- a/.github/workflows/actions/build-docker/action.yml +++ /dev/null @@ -1,43 +0,0 @@ -name: Docker build and push - -inputs: - github_username: - description: GitHub Container Registry username - required: true - github_token: - description: GitHub Container Registry token - required: true - -outputs: - docker_image_tag: - description: Docker Container tag - value: ${{ steps.image.outputs.tag }} - -runs: - using: composite - - steps: - - name: Checkout code - uses: actions/checkout@v3 - - - name: Docker image tag - id: image - run: | - echo ::set-output name=tag::$CONTAINER_REGISTRY/$(echo $GITHUB_REPOSITORY | tr '[:upper:]' '[:lower:]'):$GITHUB_SHA - env: - CONTAINER_REGISTRY: ghcr.io - shell: bash - - - name: Login to GitHub Container Registry - uses: docker/login-action@v2 - with: - registry: ghcr.io - username: ${{ inputs.github_username }} - password: ${{ inputs.github_token }} - - - name: Docker build & push - uses: docker/build-push-action@v3 - with: - context: . - push: true - tags: ${{ steps.image.outputs.tag }} diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml index 84be93a24..ab79eed7e 100644 --- a/.github/workflows/build-and-deploy.yml +++ b/.github/workflows/build-and-deploy.yml @@ -31,24 +31,29 @@ env: CONTAINER_REGISTRY: ghcr.io jobs: - docker: - name: Docker build and push + build_image: + name: Image build and push if: contains(github.event.pull_request.labels.*.name, 'deploy') || github.event_name != 'pull_request' runs-on: ubuntu-latest outputs: - docker_image: ${{ steps.dockerimage.outputs.docker_image_tag }} + docker-image: ${{ steps.build-image.outputs.image }} steps: - uses: actions/checkout@v4 - - uses: ./.github/workflows/actions/build-docker - id: dockerimage + + - name: Build and push docker image + id: build-image + uses: DFE-Digital/github-actions/build-docker-image@build-image-lower-case-image-name with: - github_username: ${{ github.actor }} - github_token: ${{ secrets.GITHUB_TOKEN }} + github-token: ${{ secrets.GITHUB_TOKEN }} + context: . + max-cache: true + reuse-cache: true + snyk-token: ${{ secrets.SNYK_TOKEN }} deploy_review: name: Deploy to review environment concurrency: deploy_review_${{ github.event.pull_request.number }} - needs: [docker] + needs: [build_image] runs-on: ubuntu-latest if: contains(github.event.pull_request.labels.*.name, 'deploy') environment: @@ -60,7 +65,7 @@ jobs: id: deploy with: environment: review - docker_image: ${{ needs.docker.outputs.docker_image }} + docker_image: ${{ needs.build_image.outputs.docker-image }} azure-credentials: ${{ secrets.AZURE_CREDENTIALS }} arm-access-key: ${{ secrets.ARM_ACCESS_KEY }} pr-id: ${{ github.event.pull_request.number }} @@ -75,7 +80,7 @@ jobs: set_matrix: name: Set deployment matrix runs-on: ubuntu-latest - needs: [docker] + needs: [build_image] outputs: deployment_matrix: ${{ steps.set_matrix.outputs.deployment_matrix }} steps: @@ -93,7 +98,7 @@ jobs: runs-on: ubuntu-latest if: github.ref == 'refs/heads/main' && github.event_name == 'push' concurrency: deploy_${{ matrix.environment }} - needs: [docker, set_matrix] + needs: [build_image, set_matrix] strategy: fail-fast: false # this is necessary to prevent early terminiation of terraform deployments that will result in tfstate locks max-parallel: 3 @@ -124,7 +129,7 @@ jobs: id: deploy with: environment: ${{ matrix.environment }} - docker_image: ${{ needs.docker.outputs.docker_image }} + docker_image: ${{ needs.build_image.outputs.docker-image }} azure-credentials: ${{ secrets.AZURE_CREDENTIALS }} arm-access-key: ${{ secrets.ARM_ACCESS_KEY }} @@ -140,7 +145,7 @@ jobs: env: SLACK_COLOR: failure SLACK_TITLE: Failure deploying release to ${{ matrix.environment }} - SLACK_MESSAGE: Failure deploying release to ${{ matrix.environment }} - Docker tag ${{ needs.docker.outputs.docker_image }} + SLACK_MESSAGE: Failure deploying release to ${{ matrix.environment }} - Docker image ${{ needs.build_image.outputs.docker-image }} SLACK_WEBHOOK: ${{ steps.keyvault-yaml-secret.outputs.SLACK_WEBHOOK }} deploy_production: @@ -151,7 +156,7 @@ jobs: name: production url: ${{ steps.deploy.outputs.environment_url }} concurrency: deploy_production - needs: [docker, deploy_nonprod] + needs: [build_image, deploy_nonprod] outputs: environment_url: ${{ steps.deploy.outputs.environment_url }} @@ -176,7 +181,7 @@ jobs: id: deploy with: environment: production - docker_image: ${{ needs.docker.outputs.docker_image }} + docker_image: ${{ needs.build_image.outputs.docker-image }} azure-credentials: ${{ secrets.AZURE_CREDENTIALS }} arm-access-key: ${{ secrets.ARM_ACCESS_KEY }} @@ -186,5 +191,5 @@ jobs: env: SLACK_COLOR: failure SLACK_TITLE: Failure deploying release to production - SLACK_MESSAGE: Failure deploying release to production - Docker tag ${{ needs.docker.outputs.docker_image }} + SLACK_MESSAGE: Failure deploying release to production - Docker image ${{ needs.build_image.outputs.docker-image }} SLACK_WEBHOOK: ${{ steps.keyvault-yaml-secret.outputs.SLACK_WEBHOOK }} diff --git a/.github/workflows/build-nocache.yml b/.github/workflows/build-nocache.yml new file mode 100644 index 000000000..b26890a1b --- /dev/null +++ b/.github/workflows/build-nocache.yml @@ -0,0 +1,50 @@ +name: Build No Cache + +on: + workflow_dispatch: + schedule: + - cron: "30 12 * * 0" + # Will run once a week on Sunday afternoon + +jobs: + build-no-cache: + runs-on: ubuntu-latest + environment: + name: development + steps: + - uses: actions/checkout@v4 + name: Checkout + + - uses: azure/login@v2 + with: + creds: ${{ secrets.AZURE_CREDENTIALS }} + + - name: Fetch secrets from key vault + uses: azure/CLI@v2 + id: keyvault-yaml-secret + with: + inlineScript: | + SLACK_WEBHOOK=$(az keyvault secret show --name "SLACK-WEBHOOK" --vault-name "${{ secrets.INF_KEY_VAULT }}" --query "value" -o tsv) + echo "::add-mask::$SLACK_WEBHOOK" + echo "SLACK_WEBHOOK=$SLACK_WEBHOOK" >> $GITHUB_OUTPUT + + - name: Build without cache and push docker image + id: build-image + uses: DFE-Digital/github-actions/build-docker-image@master + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + context: . + max-cache: true + reuse-cache: false + snyk-token: ${{ secrets.SNYK_TOKEN }} + + - name: Notify slack on failure + uses: rtCamp/action-slack-notify@master + if: ${{ failure() }} + with: + SLACK_USERNAME: CI Deployment + SLACK_COLOR: failure + SLACK_ICON_EMOJI: ":github-logo:" + SLACK_TITLE: "Build failure" + SLACK_MESSAGE: ":alert: Rebuild docker cache failure :sadparrot:" + SLACK_WEBHOOK: ${{ steps.keyvault-yaml-secret.outputs.SLACK_WEBHOOK }}