sam_release_code.yml

name: sam release code

on:
  workflow_call:
    inputs:
      IS_PULL_REQUEST:
        type: boolean
        default: false
      STACK_NAME:
        required: true
        type: string
      ARTIFACT_BUCKET_PREFIX:
        required: true
        type: string
      TARGET_ENVIRONMENT:
        required: true
        type: string
      APIGEE_ENVIRONMENT:
        required: true
        type: string
      ENABLE_MUTUAL_TLS:
        required: true
        type: boolean
      BUILD_ARTIFACT:
        required: true
        type: string
      TRUSTSTORE_FILE:
        required: true
        type: string
      VERSION_NUMBER:
        required: true
        type: string
      COMMIT_ID:
        required: true
        type: string
      LOG_LEVEL:
        required: true
        type: string
      LOG_RETENTION_DAYS:
        required: true
        type: string
      CREATE_INT_RELEASE_NOTES:
        type: boolean
        default: false
      CREATE_INT_RC_RELEASE_NOTES:
        type: boolean
        default: false
      CREATE_PROD_RELEASE_NOTES:
        type: boolean
        default: false
      MARK_JIRA_RELEASED:
        type: boolean
        default: false
      TOGGLE_GET_STATUS_UPDATES:
        type: boolean
        default: false
      REGRESSION_TESTS_PEM:
        type: string
      RUN_REGRESSION_TESTS:
        type: boolean
        default: true
      ENABLE_ALERTS:
        type: boolean
        default: true
      STATE_MACHINE_LOG_LEVEL:
        type: string
      REGRESSION_TEST_PRODUCT:
        type: string
      FORWARD_CSOC_LOGS:
        required: true
        type: boolean
      TC007_NHS_NUMBERS:
        required: false
        type: string
      TC008_NHS_NUMBERS:
        required: false
        type: string
      TC009_NHS_NUMBERS:
        required: false
        type: string
      DEPLOY_APIGEE:
        type: boolean
        default: true
      MTLS_KEY:
        type: string
        required: true
      ALLOW_NHS_NUMBER_OVERRIDE:
        required: true
        type: boolean
      REGRESSION_TEST_NON_PROXYGEN:
        type: boolean
      pinned_image:
        type: string
        required: true
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE:
        required: true
      TARGET_SPINE_SERVER:
        required: true
      TARGET_SERVICE_SEARCH_SERVER:
        required: true
      DEV_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      INT_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      PROD_CLOUD_FORMATION_CHECK_VERSION_ROLE:
        required: false
      DEV_CLOUD_FORMATION_EXECUTE_LAMBDA_ROLE:
        required: false
      REGRESSION_TESTS_PEM:
        required: true
      PROXYGEN_ROLE:
        required: true

jobs:
  sam_release_code:
    runs-on: ubuntu-22.04
    environment: ${{ inputs.TARGET_ENVIRONMENT }}
    container:
      image: ${{ inputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    permissions:
      id-token: write
      contents: write
    env:
      AWS_MAX_RETRY: 20

    steps:
      - name: copy .tool-versions
        run: |
          cp /home/vscode/.tool-versions "$HOME/.tool-versions"
      - name: Checkout local github actions
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: ${{ env.BRANCH_NAME }}
          fetch-depth: 0
          sparse-checkout: |
            .github

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.CLOUD_FORMATION_DEPLOY_ROLE }}
          role-session-name: aws-pfp-release-code

      - name: download build artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: ${{ inputs.BUILD_ARTIFACT }}
          path: .

      - name: release code
        shell: bash
        working-directory: .github/scripts
        env:
          ARTIFACT_BUCKET_PREFIX: prescriptions_for_patients/${{ inputs.ARTIFACT_BUCKET_PREFIX }}
          COMMIT_ID: ${{ inputs.COMMIT_ID }}
          ENABLE_MUTUAL_TLS: ${{ inputs.ENABLE_MUTUAL_TLS }}
          LOG_LEVEL: ${{ inputs.LOG_LEVEL }}
          LOG_RETENTION_DAYS: ${{ inputs.LOG_RETENTION_DAYS }}
          IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
          STACK_NAME: ${{ inputs.STACK_NAME }}
          TARGET_ENVIRONMENT: ${{ inputs.TARGET_ENVIRONMENT }}
          TARGET_SERVICE_SEARCH_SERVER: ${{ secrets.TARGET_SERVICE_SEARCH_SERVER }}
          TARGET_SPINE_SERVER: ${{ secrets.TARGET_SPINE_SERVER }}
          TEMPLATE_FILE: template.yaml
          TRUSTSTORE_FILE: ${{ inputs.TRUSTSTORE_FILE }}
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          TOGGLE_GET_STATUS_UPDATES: ${{ inputs.TOGGLE_GET_STATUS_UPDATES }}
          ENABLE_ALERTS: ${{ inputs.ENABLE_ALERTS }}
          STATE_MACHINE_LOG_LEVEL: ${{ inputs.STATE_MACHINE_LOG_LEVEL }}
          FORWARD_CSOC_LOGS: ${{ inputs.FORWARD_CSOC_LOGS }}
          TC007_NHS_NUMBERS: ${{ inputs.TC007_NHS_NUMBERS || '9992387920' }}
          TC008_NHS_NUMBERS: ${{ inputs.TC008_NHS_NUMBERS || '9992387920' }}
          TC009_NHS_NUMBERS: ${{ inputs.TC009_NHS_NUMBERS || '9992387920' }}
          ALLOW_NHS_NUMBER_OVERRIDE: ${{ inputs.ALLOW_NHS_NUMBER_OVERRIDE }}
        run: ./release_code.sh

      - name: get mtls secrets
        shell: bash
        run: |
          mkdir -p ~/.proxygen/tmp
          client_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:PfpClientKeySecret'].Value" --output text)
          client_cert_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:PfpClientCertSecret'].Value" --output text)
          aws secretsmanager get-secret-value --secret-id "${client_private_key_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_private_key
          aws secretsmanager get-secret-value --secret-id "${client_cert_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_cert

      - name: Configure AWS Credentials for api release
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.PROXYGEN_ROLE }}
          role-session-name: pfp-api-proxygen

      - name: Deploy PFP API to Apigee
        shell: bash
        if: ${{ inputs.DEPLOY_APIGEE == true && always() && !failure() && !cancelled() }}
        env:
          API_TYPE: standard
          VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
          SPEC_PATH: ./packages/specification/dist/prescriptions-for-patients.resolved.json
          STACK_NAME: ${{ inputs.STACK_NAME }}
          AWS_ENVIRONMENT: ${{ inputs.TARGET_ENVIRONMENT }}
          APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
          PROXYGEN_PRIVATE_KEY_NAME: PrescriptionsForPatientsProxygenPrivateKey
          PROXYGEN_KID: "2026-01-22-PROD-prescriptions-for-patients-v2"
          DRY_RUN: false
          ENABLE_MUTUAL_TLS: ${{ inputs.ENABLE_MUTUAL_TLS }}
          MTLS_KEY: ${{ inputs.MTLS_KEY }}
          IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
        run: ./.github/scripts/deploy_api.sh

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        if: always() && !cancelled()
        name: Upload specs
        with:
          name: ${{ inputs.APIGEE_ENVIRONMENT }}-specs
          path: |
            ./packages/specification/dist/prescriptions-for-patients.resolved.json

      - name: Checkout gh-pages
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          ref: gh-pages
          path: gh-pages

      - name: update release tag in github pages
        if: ${{ inputs.IS_PULL_REQUEST == false }}
        run: |
          cd gh-pages
          NOW=$(date +'%Y-%m-%dT%H:%M:%S')
          echo "tag,release_datetime" > _data/${{ inputs.APIGEE_ENVIRONMENT }}_latest.csv
          echo "${{ inputs.VERSION_NUMBER }},${NOW}" >> _data/${{ inputs.APIGEE_ENVIRONMENT }}_latest.csv
          echo "${{ inputs.VERSION_NUMBER }},${NOW}" >> _data/${{ inputs.APIGEE_ENVIRONMENT }}_deployments.csv
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add _data/${{ inputs.APIGEE_ENVIRONMENT }}_latest.csv
          git add _data/${{ inputs.APIGEE_ENVIRONMENT }}_deployments.csv
          git commit -m 'update releases for ${{ inputs.APIGEE_ENVIRONMENT }}'
          parallel --retries 10 --delay 3 ::: "git pull --rebase && git push"

  regression_tests:
    if: ${{ inputs.RUN_REGRESSION_TESTS == true }}
    name: Regression Tests
    uses: ./.github/workflows/run_regression_tests.yml
    needs: sam_release_code
    with:
      ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
      VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
      REGRESSION_TEST_PRODUCT: ${{ inputs.REGRESSION_TEST_PRODUCT }}
      REGRESSION_TEST_NON_PROXYGEN: ${{ inputs.REGRESSION_TEST_NON_PROXYGEN }}
      pinned_image: "${{ inputs.pinned_image }}"
    secrets:
      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}