pull_request.yml

name: deploy_pr

on:
  pull_request:
    branches: [main]

permissions: {}

jobs:
  get_config_values:
    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
    with:
      verify_published_from_main_image: false
    permissions:
      attestations: read
      contents: read
      packages: read
  dependabot-auto-approve-and-merge:
    needs: quality_checks
    uses: NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
    permissions:
      contents: write
      pull-requests: write
    secrets:
      AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
      AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
  get_commit_message:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    outputs:
      commit_message: ${{ steps.commit_message.outputs.commit_message }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
          fetch-depth: 1
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Get Commit message
        id: commit_message
        run: |
          echo "commit_message=$(git show -s --format=%s)" >> "$GITHUB_OUTPUT"

  quality_checks:
    # always run, but only block in the non-skip case
    needs: [get_commit_message, get_config_values]
    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
    permissions:
      contents: read
      id-token: write
      packages: read
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  quality_gate:
    needs: get_commit_message
    runs-on: ubuntu-22.04
    if: always()
    steps:
      - name: Wait for quality checks to succeed
        if: ${{ ! contains(needs.get_commit_message.outputs.commit_message, '#skip-qc') }}
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          result-encoding: json
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const runId = context.runId;

            // How many times to poll
            const pollTime = 10000; // 10 seconds
            const maxRetries = 120; // 20 minutes at 10 seconds each
            let attempts = 0;

            async function fetchQCJobs() {
              const { data } = await github.rest.actions.listJobsForWorkflowRun({
                owner, repo, run_id: runId
              });
              return data.jobs.filter(job => job.name.startsWith('quality_checks'));
            }

            let qcJobs = await fetchQCJobs();
            while (attempts < maxRetries) {
              const allCompleted = qcJobs.length > 0 && qcJobs.every(qc => qc.status === 'completed');
              if (allCompleted) {
                break;
              }

              attempts++;

              if (qcJobs.length === 0) {
                console.log(`Attempt #${attempts}: no matching quality_checks jobs yet`);
              } else {
                const incompleteJobs = qcJobs
                  .filter(qc => qc.status !== 'completed')
                  .map(qc => `“${qc.name}” status=${qc.status}`)
                  .join(', ');
                console.log(`Attempt #${attempts}: waiting for quality_checks jobs to complete: ${incompleteJobs}`);
              }

              if (attempts >= maxRetries) {
                break;
              }

              await new Promise(r => setTimeout(r, pollTime));
              qcJobs = await fetchQCJobs();
            }

            if (qcJobs.length === 0) {
              core.setFailed(
                `Timed out waiting for a “quality_checks” job (after ${attempts} polls).`
              );
              return;
            }

            for (const qc of qcJobs) {
              if (qc.status !== 'completed') {
                core.setFailed(
                  `Quality checks job ${qc.name} never completed (last status=${qc.status})`
                );
                return;
              }
            }

            for (const qc of qcJobs) {
              if (qc.conclusion !== 'success' && qc.conclusion !== 'skipped') {
                core.setFailed(
                  `Quality checks job ${qc.name} failed (conclusion=${qc.conclusion}).`
                );
                return;
              }
            }

      - name: Bypass QC gate
        if: ${{ contains(needs.get_commit_message.outputs.commit_message, '#skip-qc') }}
        run: echo "Skipping QC gate per commit message."

  pr_title_format_check:
    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
    permissions:
      pull-requests: write

  get_issue_number:
    runs-on: ubuntu-22.04
    outputs:
      issue_number: ${{steps.get_issue_number.outputs.result}}

    steps:
      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
        name: get issue number
        id: get_issue_number
        with:
          script: |
            if (context.issue.number) {
              // Return issue number if present
              return context.issue.number;
            } else {
              // Otherwise return issue number from commit
              return (
                await github.rest.repos.listPullRequestsAssociatedWithCommit({
                commit_sha: context.sha,
                owner: context.repo.owner,
                repo: context.repo.repo,
                })
              ).data[0].number;
            }
          result-encoding: string

  tag_release:
    needs: [get_config_values]
    uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release-devcontainer.yml@c8f899f30a6a726859b0277faa73cd9ff7f4de20
    permissions:
      id-token: write
      contents: write
      packages: write
    with:
      dry_run: true
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      branch_name: ${{ github.event.pull_request.head.ref }}
      tag_format: ${{ needs.get_config_values.outputs.tag_format }}

  get_commit_id:
    runs-on: ubuntu-22.04
    outputs:
      commit_id: ${{ steps.commit_id.outputs.commit_id }}
    steps:
      - name: Get Commit ID
        id: commit_id
        run: |
          echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"

  package_code:
    needs: [get_issue_number, get_commit_id, quality_gate, get_config_values]
    permissions:
      contents: read
      packages: read
      id-token: write
    if: |
      always() &&
      ! contains(needs.*.result, 'failure') &&
      ! contains(needs.*.result, 'cancelled')
    uses: ./.github/workflows/cdk_package_code.yml
    with:
      VERSION_NUMBER: PR-${{ needs.get_issue_number.outputs.issue_number }}
      COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}


  release_code:
    needs: [get_issue_number, package_code, get_commit_id, get_config_values]
    if: |
      always() &&
      ! contains(needs.*.result, 'failure') &&
      ! contains(needs.*.result, 'cancelled')
    uses: ./.github/workflows/release_all_stacks.yml
    permissions:
      contents: write
      id-token: write
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      SERVICE_NAME: cpt-ui-pr-${{needs.get_issue_number.outputs.issue_number}}
      TARGET_ENVIRONMENT: dev-pr
      VERSION_NUMBER: PR-${{ needs.get_issue_number.outputs.issue_number }}
      COMMIT_ID: "static-pr"
      useMockOidc: true
      primaryOidcIssuer: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare"
      primaryOidcAuthorizeEndpoint: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/authorize"
      primaryOidcTokenEndpoint: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/access_token"
      primaryOidcUserInfoEndpoint: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/userinfo"
      primaryOidcjwksEndpoint: "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443/openam/oauth2/realms/root/realms/NHSIdentity/realms/Healthcare/connect/jwk_uri"
      mockOidcIssuer: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev"
      mockOidcAuthorizeEndpoint: "https://internal-dev.api.service.nhs.uk/oauth2-mock/authorize"
      mockOidcTokenEndpoint: "https://internal-dev.api.service.nhs.uk/oauth2-mock/token"
      mockOidcUserInfoEndpoint: "https://internal-dev.api.service.nhs.uk/oauth2-mock/userinfo"
      mockOidcjwksEndpoint: "https://identity.ptl.api.platform.nhs.uk/realms/Cis2-mock-internal-dev/protocol/openid-connect/certs"
      allowLocalhostAccess: true
      useCustomCognitoDomain: false
      APIGEE_CIS2_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2/token"
      APIGEE_MOCK_TOKEN_ENDPOINT: "https://internal-dev.api.service.nhs.uk/oauth2-mock/token"
      APIGEE_PRESCRIPTIONS_ENDPOINT: "https://internal-dev.api.service.nhs.uk/clinical-prescription-tracker/"
      APIGEE_PDS_ENDPOINT: "https://internal-dev.api.service.nhs.uk/personal-demographics/FHIR/R4/"
      APIGEE_DOHS_ENDPOINT: "https://int.api.service.nhs.uk/service-search-api/"
      JWT_KID: "eps-cpt-ui-dev"
      ROLE_ID: "555254242106"
      LOG_LEVEL: "DEBUG"
      RUN_REGRESSION_TESTS: true
      WAF_ALLOW_GA_RUNNER_CONNECTIVITY: true
      USE_ZONE_APEX: false
      ROUTE53_EXPORT_NAME: EPS
      REACT_LOG_LEVEL: "debug"
      LOG_RETENTION_IN_DAYS: 30
      IS_PULL_REQUEST: true
      FORWARD_CSOC_LOGS: false
    secrets: inherit
  report_deployed_url:
    needs: [release_code, get_issue_number]
    if: |
      always() &&
      ! contains(needs.*.result, 'failure') &&
      ! contains(needs.*.result, 'cancelled')
    runs-on: ubuntu-22.04
    steps:
      - name: Report Deployed URL
        run: |
          echo "Deployed URL: https://cpt-ui-pr-${ISSUE_NUMBER}.dev.eps.national.nhs.uk" >> "$GITHUB_STEP_SUMMARY"
        env:
          ISSUE_NUMBER: ${{ needs.get_issue_number.outputs.issue_number }}