pull_request.yml

name: deploy_pr
on:
  pull_request:
    branches: [master]
  merge_group:
    branches: [master]
permissions: {}
jobs:
  get_config_values:
    uses: NHSDigital/eps-common-workflows/.github/workflows/get-repo-config.yml@e798d5aee897de6f7dc387dd5623fcd9ba4c8929
    with:
      verify_published_from_main_image: false
    permissions:
      attestations: read
      contents: read
      packages: read
  quality_checks:
    uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks-devcontainer.yml@76baf9dd964311c337af3ec78e8cb1e915c006ce
    needs: [get_config_values]
    permissions:
      contents: read
      id-token: write
      packages: read
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      run_docker_scan: true
      docker_images: fhir-facade,validator
    secrets:
      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  pr_title_format_check:
    if: github.event_name != 'merge_group'
    uses: NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@76baf9dd964311c337af3ec78e8cb1e915c006ce
    permissions:
      pull-requests: write
  get_issue_number:
    runs-on: ubuntu-22.04
    needs: quality_checks
    outputs:
      issue_number: ${{ steps.get_issue_number.outputs.result }}
      version: ${{ steps.get_issue_number.outputs.version_number }}
    steps:
      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
        name: get issue number
        id: get_issue_number
        with:
          result-encoding: string
          script: |
            // 1. Normal pull_request event
            if (context.eventName === 'pull_request' && context.payload.pull_request) {
              return context.payload.pull_request.number;
            }

            // 2. merge_group event
            if (context.eventName === 'merge_group') {
              const queueRef = context.ref; // refs/heads/gh-readonly-queue/main/pr-142-abc
              const match = queueRef.match(/pr-(\d+)/);

              if (match) {
                return String(match[1]);
              }

              // Fallback to commit association using the synthetic SHA
              const sha = context.payload.merge_group.head_sha;

              const { data } =
                await github.rest.repos.listPullRequestsAssociatedWithCommit({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  commit_sha: sha,
                });

              if (!data.length) {
                core.setFailed(`No PR associated with commit ${sha}`);
              }

              // Strict match: PR head SHA must match original PR head
              const pr = data.find(pr => pr.head.sha === data[0].head.sha);

              return String(pr.number);
            }
  get_commit_id:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
    outputs:
      commit_id: ${{ steps.commit_id.outputs.commit_id }}
      sha_short: ${{ steps.commit_id.outputs.sha_short }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
      - name: Get Commit ID
        id: commit_id
        run: |
          #  echo "commit_id=${{ github.sha }}" >> "$GITHUB_ENV"
          echo "commit_id=${{ github.sha }}" >> "$GITHUB_OUTPUT"
          echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
  package_code:
    needs: [get_issue_number, get_commit_id, get_config_values]
    permissions:
      id-token: write
      contents: read
      packages: read
    uses: ./.github/workflows/cdk_package_code.yml
    with:
      VERSION_NUMBER: PR-${{ needs.get_issue_number.outputs.issue_number }}
      COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
  release_code:
    needs: [get_issue_number, package_code, get_commit_id, get_config_values]
    uses: ./.github/workflows/cdk_release_code.yml
    permissions:
      id-token: write
      contents: write
      packages: read
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      STACK_NAME: prescribe-dispense-pr-${{needs.get_issue_number.outputs.issue_number}}
      STATEFUL_STACK_NAME: prescriptions-stateful-resources-pr-${{needs.get_issue_number.outputs.issue_number}}
      AWS_ENVIRONMENT: dev
      APIGEE_ENVIRONMENT: internal-dev
      ENABLE_MUTUAL_TLS: false
      TRUSTSTORE_FILE: fhirfacade-truststore.pem
      VERSION_NUMBER: PR-${{ needs.get_issue_number.outputs.issue_number }}
      COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
      LOG_LEVEL: debug
      VALIDATOR_LOG_LEVEL: INFO
      LOG_RETENTION_DAYS: 30
      DEPLOY_APIGEE: true
      TARGET_SPINE_SERVER: msg.veit07.devspineservices.nhs.uk
      DOCKER_IMAGE_TAG: PR-${{ needs.get_issue_number.outputs.issue_number }}-${{ needs.get_commit_id.outputs.sha_short }}
      RUN_REGRESSION_TEST: true
      TO_ASID: 567456789789
      TO_PARTY_KEY: YES-0000806
      IS_PULL_REQUEST: true
      ENABLE_DEFAULT_ASID_PARTY_KEY: true
      SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
      SANDBOX_MODE_ENABLED: 0
      DESIRED_FHIR_FACADE_COUNT: 1
      DESIRED_CLAIMS_COUNT: 1
      DESIRED_PEAK_CLAIMS_COUNT: 1
      DESIRED_OFF_PEAK_CLAIMS_COUNT: 1
      SERVICE_CPU: 2048
      SERVICE_MEMORY: 4096
      MTLS_KEY: fhir-facade-mtls-1
      FORWARD_CSOC_LOGS: false
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
      PROXYGEN_ROLE: ${{ secrets.PROXYGEN_PTL_ROLE }}
      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}
      API_CLIENT_ID: ${{ secrets.DEV_API_CLIENT_ID }}
      API_CLIENT_SECRET: ${{ secrets.DEV_API_CLIENT_SECRET }}
      SIGNING_PRIVATE_KEY: ${{ secrets.DEV_SIGNING_PRIVATE_KEY }}
      SIGNING_CERT: ${{ secrets.DEV_SIGNING_CERT }}
      DEFAULT_PTL_ASID: ${{ secrets.DEFAULT_PTL_ASID }}
      DEFAULT_PTL_PARTY_KEY: ${{ secrets.DEFAULT_PTL_PARTY_KEY }}
  release_sandbox_code:
    needs: [get_issue_number, package_code, get_commit_id, get_config_values]
    uses: ./.github/workflows/cdk_release_code.yml
    permissions:
      id-token: write
      contents: write
      packages: read
    with:
      pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
      STACK_NAME: prescribe-dispense-pr-${{needs.get_issue_number.outputs.issue_number}}-sandbox
      STATEFUL_STACK_NAME: prescriptions-stateful-resources-pr-${{needs.get_issue_number.outputs.issue_number}}-sandbox
      AWS_ENVIRONMENT: dev
      APIGEE_ENVIRONMENT: internal-dev-sandbox
      ENABLE_MUTUAL_TLS: false
      TRUSTSTORE_FILE: fhirfacade-sandbox-truststore.pem
      VERSION_NUMBER: PR-${{ needs.get_issue_number.outputs.issue_number }}
      COMMIT_ID: ${{ needs.get_commit_id.outputs.commit_id }}
      LOG_LEVEL: debug
      VALIDATOR_LOG_LEVEL: INFO
      LOG_RETENTION_DAYS: 30
      DEPLOY_APIGEE: true
      TARGET_SPINE_SERVER: unused
      DOCKER_IMAGE_TAG: PR-${{ needs.get_issue_number.outputs.issue_number }}-${{ needs.get_commit_id.outputs.sha_short }}
      RUN_REGRESSION_TEST: false
      TO_ASID: unused
      TO_PARTY_KEY: unused
      IS_PULL_REQUEST: true
      ENABLE_DEFAULT_ASID_PARTY_KEY: true
      SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
      SANDBOX_MODE_ENABLED: 1
      DESIRED_FHIR_FACADE_COUNT: 1
      DESIRED_CLAIMS_COUNT: 1
      DESIRED_PEAK_CLAIMS_COUNT: 1
      DESIRED_OFF_PEAK_CLAIMS_COUNT: 1
      SERVICE_CPU: 2048
      SERVICE_MEMORY: 4096
      MTLS_KEY: fhir-facade-mtls-1
      FORWARD_CSOC_LOGS: false
    secrets:
      CLOUD_FORMATION_DEPLOY_ROLE: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
      PROXYGEN_ROLE: ${{ secrets.PROXYGEN_PTL_ROLE }}
      REGRESSION_TESTS_PEM: ${{ secrets.REGRESSION_TESTS_PEM }}
      API_CLIENT_ID: ${{ secrets.DEV_API_CLIENT_ID }}
      API_CLIENT_SECRET: ${{ secrets.DEV_API_CLIENT_SECRET }}
      SIGNING_PRIVATE_KEY: ${{ secrets.DEV_SIGNING_PRIVATE_KEY }}
      SIGNING_CERT: ${{ secrets.DEV_SIGNING_CERT }}
      DEFAULT_PTL_ASID: unused
      DEFAULT_PTL_PARTY_KEY: unused