diff --git a/.github/workflows/ci_mongo_to_pg.yml b/.github/workflows/ci_mongo_to_pg.yml new file mode 100644 index 000000000..2c374188e --- /dev/null +++ b/.github/workflows/ci_mongo_to_pg.yml @@ -0,0 +1,30 @@ +name: CI + +on: + workflow_dispatch: {} + push: + branches: + - publisher-on-postgres-branch + paths-ignore: + - "Jenkinsfile" + - ".git**" + +jobs: + codeql-sast: + name: CodeQL SAST scan + uses: alphagov/govuk-infrastructure/.github/workflows/codeql-analysis.yml@main + permissions: + security-events: write + + dependency-review: + name: Dependency Review scan + uses: alphagov/govuk-infrastructure/.github/workflows/dependency-review.yml@main + + security-analysis: + name: Security Analysis + uses: alphagov/govuk-infrastructure/.github/workflows/brakeman.yml@main + secrets: inherit + permissions: + contents: read + security-events: write + actions: read \ No newline at end of file diff --git a/.github/workflows/deploy_mongo_to_pg.yml b/.github/workflows/deploy_mongo_to_pg.yml new file mode 100644 index 000000000..c158553b0 --- /dev/null +++ b/.github/workflows/deploy_mongo_to_pg.yml @@ -0,0 +1,51 @@ +name: Deploy + +run-name: Deploy ${{ inputs.gitRef || github.event.release.tag_name }} to ${{ inputs.environment || 'integration' }} + +on: + workflow_dispatch: + inputs: + gitRef: + description: 'Commit, tag or branch name to deploy' + required: true + type: string + environment: + description: 'Environment to deploy to' + required: true + type: choice + options: + - integration + default: 'integration' + ecrRepositoryName: + description: 'ECR repo name to push image to' + required: true + type: choice + options: + - publisher-on-postgres-branch + default: 'mainstream-on-postgres-branch' + release: + types: [released] + +jobs: + build-and-publish-image: + if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'v') + name: Build and publish image + uses: alphagov/govuk-infrastructure/.github/workflows/build-and-push-multiarch-image.yml@main + with: + gitRef: ${{ inputs.gitRef || github.event.release.tag_name }} + ecrRepositoryName: ${{ inputs.ecrRepositoryName }} + permissions: + id-token: write + contents: read + packages: write + trigger-deploy: + name: Trigger deploy to ${{ inputs.environment || 'integration' }} + needs: build-and-publish-image + uses: alphagov/govuk-infrastructure/.github/workflows/deploy.yml@main + with: + imageTag: ${{ needs.build-and-publish-image.outputs.imageTag }} + environment: ${{ inputs.environment || 'integration' }} + secrets: + WEBHOOK_TOKEN: ${{ secrets.GOVUK_ARGO_EVENTS_WEBHOOK_TOKEN }} + WEBHOOK_URL: ${{ secrets.GOVUK_ARGO_EVENTS_WEBHOOK_URL }} + GH_TOKEN: ${{ secrets.GOVUK_CI_GITHUB_API_TOKEN }}