submit-social-housing-lettings-and-sales-data/.github/workflows/production_pipeline.yml

name: Production CI/CD Pipeline

on:
  release:
    types: [released]
  workflow_dispatch:

env:
  REPO_URL: communitiesuk/submit-social-housing-lettings-and-sales-data
  CLOUDFOUNDRY_KEY_BASE64: LS0tLS1CRUdJTiBQR1AgUFVCTElDIEtFWSBCTE9DSy0tLS0tCgptUUlOQkZ1YXFiMEJFQURQSGlOeUFGNFhuZUNOTGN1c210dzNTTHlLaGhNbTgzNm9WOVBhSk4xUkE2emFxbFlqCmFDZUYyVDhCcmd2a2MwSXNxTzdCUVBQZW53M0RnZWZKNG1NR2tCTHRhODJwcGNDYkRCaFo2bXpRV3V2bmZhRGgKZ3JmdE5obVoyY09PSkdkNE5TdVdUYWQ0bkZiL1lESkJuVTB0UXc4cW5jYlVrd3RQbGZ5MkRjaXd3SHpNZFJGYwpWSnlWVjY5S2orWDVTUWhlZDBQSFdOTG1yVVRHOGw3MVpUMVhPTWZmekFURHFRN2JaTFlobExCOVFWVEx0UUJFCm9nU1pndXVZNXhHZStDZnE2SWJPaHVtMjFpTkxnKzJ0RGxldkdrV0RCWFFDU29kZFlyY2ZOM0t2R0NOZW5vclMKNEQ0VHp5M1Ric0p4eWcxM1YwYWc1c1lWYnBCZ3hzeFVsSXJLcE1uWjNHUDEvclRyVXY5MWxmbFIrWlpqanNqYwpnS2VnNHEwUWh3M291L2xlL2lkSERkNXlxZ3NidjIwZXc3dkxyelZucEdZanZHMHk4bEZ1MlFQRDl6alRvKzVMCnFWS0RCL0JZWi9zOUxybzhGZ1dleFlxTkZXSHhBUVk1Y28vbVlldkFIM3VHNzVDNTRXV2t3RWgyRjlYRHNMbEIKRWFYeXdDMGs2Q09rb3RHdit1V29HWWtUeUF2eWYydkE0TGFRMURVZWJHT3dyTEJpYnVmbjRVdTRQWHYxVThuRwpaV0JxazRyNFhtbEVvZU5nMDZaSWNLQllURlJrRDBZUEwvTGhtTHVvNmVSVzdpeWpHQllmUHc5cmo1eDU3SURPCjhsSWI4RFBrRE82SFBRQkE0V0tOVTV4YitlSlJYZkZMeVFyQkFTUEFSSDRYNVUxb3ZyYkdkVXUvcFFBUkFRQUIKdENORFJpQkRURWtnVkdWaGJTQThZMll0WTJ4cExXVnVaMEJ3YVhadmRHRnNMbWx2UG9rQ1ZBUVRBUWdBUGdJYgpBd1VMQ1FnSEFnWVZDZ2tJQ3dJRUZnSURBUUllQVFJWGdCWWhCTUdjQkhTTDh6c3VGNFkxVnhjcldZbjgwaDc0CkJRSmpIQXNHQlFrSllwVEpBQW9KRUJjcldZbjgwaDc0Njg4UUFLaW5qZXZIbHV6dWZFZWVIVlhHclVHSHNVSzEKdHNRQTJGb1Y1WlV1ZGduOVlYUlYvU3NzSVpPM2dJZVFiei8xTWZQaW54b0dYbThsMC8rYjhhOXVDZTRGSUdMegpIWkd5ZWU5TWlGZHdIMmZJWGgwT2xvVldSaHFlZ21SU3N3TTVpNEZ0L0xzK09pQWMyTStJaU0vUG1SRGhxTlNXCkZsWXM1eXRsYTc4Ym9vNkZZVDRKd3pGMEVoUm1BRnFWL2pxcVFYbzdWYXVJb0dyQjYwR1FuSWsxSGVBeXV5c1kKaGpGbnprT2gvY0FzNFZlMndUNUpDYjhjM1BEcGR0WWhiWUVHYmtZUTJDQjlDUmNOd2lRMnlnZWh3bmQvS05LSQpwTUwzL0hNQTBobWY1WWU5NDV3ODAxV1Q2V2RCbGF5dW1RVTVkM3BJTk02dlFkTnJML3dqN2c5d2xVcE1wU3BVCkU4RHNKV0ZEM2RyZWEvY0dmaUVFMVFHWUhld3hGWDVJTE50Z0VUbEFMNWtyWEUyWGVVTXJTRmNjUlRMZ2VTV20KbDBPNEZ0TG9ralFzUmNaRU1YN1ZmSFovWnB5dGMzMW15RmZjWm9YSkpFMDJUdXZlNVNVaThWTG1oZEk3Sk1SLwpXcmNkbHZhZDZ6WXQ2WU02MzhzQUpIcWIvWnVDY253WlphaTQrTFFtWGRvTmtSc3RkR0NvVXRkbVYyNFBZUHY5CnpROUNRcjRPdWJxaFJvRjFNS2FGRXl4S0p5dThETWhIUE15eC8xSUlBUitRRis5QnNKck82eHJ2dTAydTJraXYKR3QrVkFpaWdBSXRqSk9xNng3RHhVc1htcW0zSkIyN3gyRkh4R3VLd1dKTEZRbGdMZDVmNVlpNFpGZ3JzOHMxYQpORXFvakNtbWo5MU9zQytPaVFKVUJCTUJDQUErRmlFRXdad0VkSXZ6T3k0WGhqVlhGeXRaaWZ6U0h2Z0ZBbHVhCnFiMENHd01GQ1FQQ1p3QUZDd2tJQndJR0ZRb0pDQXNDQkJZQ0F3RUNIZ0VDRjRBQUNna1FGeXRaaWZ6U0h2aGgKSXhBQXhnQmp2bXBoNTBUQ3JkVUpZWUoyZ3Nsdy9YSG1ZaXFYNnpVbHFvRTk4ekR5NVRXNFEySFNBTW1YQWc5RgpRL3JiYlRjWFFmd0dad2NHaE1lZjVrTE1OVEhUNDNvdUIrTGFYRFhwZ1QwdmFHb3NBWmtGLytLb0l2REZHaERuCkwwTUtpTFNnYTFOYWVYd0Z0dGREV1l0M2d3UENzSWFrcUY0eEdCUDdkZTVnZ0t2K0dyKzdXWHBKUkxWeEdSd1IKNVBSVG0rR2ZrM0pldzRWdHNRTXlSMkNhZytzSVB0WmFGcXRlSjhidlYyU2ZaME8rTFp1bFNabDdEMjhYZW12Qwpubmt0cC9YNXJpZjgvMmEyWWgwS1I2RFluRTlVVHgyV3YybzZzWDJOb0o2UkRJMSsyVjhPOUpIK3dCR3Y4dXo1CkdlSFZ5elliTnN6dDR1N0kwdklHRzhhZUw4VXEycTlxWWZGakNGNVFBajZ0WkZLUUZCYkpRZGZKSGh3ZGFGMDQKNTlzQzNpYkpYTmpTWTV1M3h3WDJtUlFTVjVnOW16Z1RsbDQ5Q2swRU5CYmVKWm5PM3AybXc4Q1pEZHg2bjAxTwpJNlowTVl6NjBXSmQrMU5oSjc1VHlSNG9oRGZvNE1SemZCSTE2RjZZb0RxUUNUVURUdU92TzlVSlY0Qm5qRktJCi9HMFloUjJWTEhoVWFxRlVmaHQ1WlhNaGVWaEU3WTY5MHdtUlNSTi9QTFlYb3pydDNMNWEzMFkxcDlhTjRvSDkKRDI3Y1V6MFpja2tXbkRrSEVqZm5rOEVwMGZNVi9Nd2hpQ3NnZnZZcXlLMDZTbmJWbEhKa1BBWlAxR3VaeVVWMgpVRjMvRlUvZVdzSkRsV0ViRFJqWUMxM3dhQ2dMbk85MEM1bFJYbnJYWE5DNGdJYTVBZzBFVzVxcHZRRVFBTWhKCitTNmxrdG1yV3o5S1RaREs1ZkhGZHg2aEJxQTNSOU5EKzU1VkhLTDFESnpSVkc4TU9vTnFLb3NjT1NNVTY0cnYKN3RudWlSdm1YekhVSVg5ZVNKQTQzVXhkcnhSdXovNEYxMkl4YU5CSEh1dEhEalpMM1RTN1VFSmQ4anh5d1c0UQpwWnZQWGVpMUdTTTVJV3ZvelJiY0NkbUlyZEY2OXJnYkhucThVNVNmZlVUQWQwYU1DK0FtRDdMdUtkRFBCS1lNCjIwTGZsUEF4WWxwU0xmbVJ5SjNQQTI2c0Zhb2JJWTQyRTdVRFptMkhFc1JBTXd0Q29DYXVWK3VkUk40MmRwYUEKKzZXVXFld0JoS05LZHNVa1pMa2hBL2hvVHRMampodHQ5cVNYYVhENTJVSTFGcFZpcTVjSmREL2dJdjlNUUk3cgowc3Q5emtzT00xcEtaQXN6ZWJiaFUxUUlwQmdjZXQvNFZMeHlkbEdhS2RiQy9kOU9jZmlPMWFKa0dZalM1WVVYCjNuSVdDbVl4ak8vTE5mQmVod3F2Wk9UZUlraTkwTUk5bElERVRtY3lQN080Q2d6WjJqdFByQzJ0VzFqcUpHaFMKVzZaanhGZE9jYkFZdlZCNElncHNzeENWeXl5djBDb1hYaFVPc0RRWTM2alBHMnY1Q0pZTGRZVGRQdHgvZzB5MwpzSndYb3hhUCs0bEh1OUVzYW5tbHZMdGsvaWxHVllpNFlaZ2Zad2dDbnNBSTZTRXpLU1NRNTV5M1grTzNiSHQ1CnMzemp3akgwMmNpMXBHZUpDYmZ1YnBD

defaults:
  run:
    shell: bash

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:13.5
        env:
          POSTGRES_PASSWORD: password
          POSTGRES_USER: postgres
          POSTGRES_DB: data_collector
        ports:
          - 5432:5432
        # Needed because the Postgres container does not provide a health check
        # tmpfs makes database faster by using RAM
        options: >-
          --mount type=tmpfs,destination=/var/lib/postgresql/data
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      RAILS_ENV: test
      GEMFILE_RUBY_VERSION: 3.1.1
      DB_HOST: localhost
      DB_DATABASE: data_collector
      DB_USERNAME: postgres
      DB_PASSWORD: password
      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
      PARALLEL_TEST_PROCESSORS: 4

    steps:
      - name: Get latest release with tag
        id: latestrelease
        run: |
          echo "::set-output name=releasetag::$(curl -s https://api.github.com/repos/${REPO_URL}/releases/latest | jq '.tag_name' | sed 's/\"//g')"

      - name: Confirm release tag
        run: |
          echo ${{ steps.latestrelease.outputs.releasetag }}

      - name: Checkout tag
        uses: actions/checkout@v3
        with:
          ref: ${{ steps.latestrelease.outputs.releasetag }}

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Set up node
        uses: actions/setup-node@v3
        with:
          cache: yarn
          node-version: 16

      - name: Create database
        run: |
          bundle exec rake parallel:setup

      - name: Compile Assets
        run: |
          bundle exec rake assets:precompile

      - name: Run tests
        run: |
          bundle exec rake parallel:spec['spec\/(?!features)']

  feature_test:
    name: Feature Tests
    if: '!github.event.pull_request.draft'
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:13.5
        env:
          POSTGRES_PASSWORD: password
          POSTGRES_USER: postgres
          POSTGRES_DB: data_collector
        ports:
          - 5432:5432
        # Needed because the Postgres container does not provide a health check
        # tmpfs makes database faster by using RAM
        options: >-
          --mount type=tmpfs,destination=/var/lib/postgresql/data
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      RAILS_ENV: test
      GEMFILE_RUBY_VERSION: 3.1.1
      DB_HOST: localhost
      DB_DATABASE: data_collector
      DB_USERNAME: postgres
      DB_PASSWORD: password
      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Set up Node.js
        uses: actions/setup-node@v3
        with:
          cache: yarn
          node-version: 16

      - name: Create database
        run: |
          bundle exec rake db:prepare

      - name: Compile assets
        run: |
          bundle exec rake assets:precompile

      - name: Run tests
        run: |
          bundle exec rspec spec/features --fail-fast

  lint:
    name: Lint
    runs-on: ubuntu-latest

    steps:
      - name: Get latest release with tag
        id: latestrelease
        run: |
          echo "::set-output name=releasetag::$(curl -s https://api.github.com/repos/${REPO_URL}/releases/latest | jq '.tag_name' | sed 's/\"//g')"

      - name: Confirm release tag
        run: |
          echo ${{ steps.latestrelease.outputs.releasetag }}

      - name: Checkout tag
        uses: actions/checkout@v3
        with:
          ref: ${{ steps.latestrelease.outputs.releasetag }}

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Rubocop
        run: |
          bundle exec rubocop

  audit:
    name: Audit dependencies
    runs-on: ubuntu-latest

    steps:
      - name: Get latest release with tag
        id: latestrelease
        run: |
          echo "::set-output name=releasetag::$(curl -s https://api.github.com/repos/${REPO_URL}/releases/latest | jq '.tag_name' | sed 's/\"//g')"

      - name: Confirm release tag
        run: |
          echo ${{ steps.latestrelease.outputs.releasetag }}

      - name: Checkout tag
        uses: actions/checkout@v3
        with:
          ref: ${{ steps.latestrelease.outputs.releasetag }}

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - name: Audit
        run: |
          bundle exec bundler-audit

  deploy:
    name: Deploy
    concurrency: "production"
    runs-on: ubuntu-latest
    environment: "production"
    needs: [lint, test, feature_test, audit]

    steps:
      - name: Get latest release with tag
        id: latestrelease
        run: |
          echo "::set-output name=releasetag::$(curl -s https://api.github.com/repos/${REPO_URL}/releases/latest | jq '.tag_name' | sed 's/\"//g')"

      - name: Confirm release tag
        run: |
          echo ${{ steps.latestrelease.outputs.releasetag }}

      - name: Checkout tag
        uses: actions/checkout@v3
        with:
          ref: ${{ steps.latestrelease.outputs.releasetag }}

      - name: Install Cloud Foundry CLI
        run: |
          echo $CLOUDFOUNDRY_KEY_BASE64 | base64 -d | sudo apt-key add -
          echo "deb https://packages.cloudfoundry.org/debian stable main" | sudo tee /etc/apt/sources.list.d/cloudfoundry-cli.list
          sudo apt-get update
          sudo apt-get install cf8-cli

      - name: Deploy
        env:
          CF_USERNAME: ${{ secrets.CF_USERNAME }}
          CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
          CF_API_ENDPOINT: ${{ secrets.CF_API_ENDPOINT }}
          CF_SPACE: ${{ secrets.CF_SPACE }}
          CF_ORG: ${{ secrets.CF_ORG }}
          APP_NAME: dluhc-core-production
          GOVUK_NOTIFY_API_KEY: ${{ secrets.GOVUK_NOTIFY_API_KEY }}
          APP_HOST: ${{ secrets.APP_HOST }}
          RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
          OS_DATA_KEY: ${{ secrets.OS_DATA_KEY }}
          IMPORT_PAAS_INSTANCE: ${{ secrets.IMPORT_PAAS_INSTANCE }}
          EXPORT_PAAS_INSTANCE: ${{ secrets.EXPORT_PAAS_INSTANCE }}
          S3_CONFIG: ${{ secrets.S3_CONFIG }}
          CSV_DOWNLOAD_PAAS_INSTANCE: ${{ secrets.CSV_DOWNLOAD_PAAS_INSTANCE }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
        run: |
          cf api $CF_API_ENDPOINT
          cf auth
          cf target -o $CF_ORG -s $CF_SPACE
          cf set-env $APP_NAME GOVUK_NOTIFY_API_KEY $GOVUK_NOTIFY_API_KEY
          cf set-env $APP_NAME APP_HOST $APP_HOST
          cf set-env $APP_NAME RAILS_MASTER_KEY $RAILS_MASTER_KEY
          cf set-env $APP_NAME OS_DATA_KEY $OS_DATA_KEY
          cf set-env $APP_NAME IMPORT_PAAS_INSTANCE $IMPORT_PAAS_INSTANCE
          cf set-env $APP_NAME EXPORT_PAAS_INSTANCE $EXPORT_PAAS_INSTANCE
          cf set-env $APP_NAME S3_CONFIG $S3_CONFIG
          cf set-env $APP_NAME CSV_DOWNLOAD_PAAS_INSTANCE $CSV_DOWNLOAD_PAAS_INSTANCE
          cf set-env $APP_NAME SENTRY_DSN $SENTRY_DSN
          cf push $APP_NAME --strategy rolling