[9700] Bulk change status read-only user bulk write privilege escalation - add authorization #23651
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Deploy | |
| concurrency: build_and_deploy_${{ github.ref_name }} | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| types: [opened, reopened, synchronize, labeled] | |
| permissions: | |
| contents: write | |
| deployments: write | |
| packages: write | |
| pull-requests: write | |
| id-token: write | |
| jobs: | |
| build: | |
| name: Build | |
| env: | |
| DOCKER_IMAGE: ghcr.io/dfe-digital/register-trainee-teachers | |
| DB_USERNAME: postgres | |
| DB_PASSWORD: postgres | |
| DB_HOSTNAME: localhost | |
| outputs: | |
| docker-image: ${{ steps.build-image.outputs.image }} | |
| image-tag: ${{ steps.build-image.outputs.tag }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Build and push docker image | |
| id: build-image | |
| uses: DFE-Digital/github-actions/build-docker-image@master | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| snyk-token: ${{ secrets.SNYK_TOKEN }} | |
| teams-webhook-url: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| service: ${{ vars.TEAMS_MSG_SERVICE_NAME }} | |
| context: "" | |
| lint: | |
| name: Lint | |
| needs: [build] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| linter-type: [rubocop, scss, dfe_analytics, javascript_lint_and_test] | |
| include: | |
| - linter-type: rubocop | |
| command: docker compose exec -T web /bin/sh -c 'bundle exec rubocop app config db lib spec Gemfile --format clang' | |
| - linter-type: scss | |
| command: | | |
| docker compose exec -T web /bin/sh -c "yarn install --immutable" | |
| docker compose exec -T web /bin/sh -c "yarn run scss:lint" | |
| - linter-type: dfe_analytics | |
| command: | | |
| docker compose exec -T web /bin/sh -c "bundle exec rails db:setup" | |
| docker compose exec -T web /bin/sh -c 'bundle exec rake dfe:analytics:check' | |
| - linter-type: javascript_lint_and_test | |
| command: | | |
| docker compose exec -T web /bin/sh -c "yarn install --immutable" | |
| docker compose exec -T web /bin/sh -c "yarn run standard $(git ls-files '**.js' | tr '\n' ' ')" | |
| docker compose exec -T web /bin/sh -c 'yarn run test' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: ${{ matrix.linter-type }} | |
| uses: ./.github/actions/lint/ | |
| with: | |
| linter-type: ${{ matrix.linter-type }} | |
| command: ${{ matrix.command }} | |
| docker-image: ${{ needs.build.outputs.docker-image }} | |
| image-tag: ${{ needs.build.outputs.image-tag }} | |
| teams-webhook: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| test: | |
| name: Test | |
| needs: [build] | |
| uses: ./.github/workflows/tests.yml | |
| secrets: inherit | |
| with: | |
| docker-image: ${{ needs.build.outputs.docker-image }} | |
| image-tag: ${{ needs.build.outputs.image-tag }} | |
| use-next-academic-year: false | |
| next_academic_year_test: | |
| name: Next academic year tests | |
| needs: [build] | |
| uses: ./.github/workflows/tests.yml | |
| secrets: inherit | |
| with: | |
| docker-image: ${{ needs.build.outputs.docker-image }} | |
| image-tag: ${{ needs.build.outputs.image-tag }} | |
| use-next-academic-year: true | |
| deploy-review-app: | |
| name: Deployment To Review | |
| concurrency: deploy_review_${{ github.event.pull_request.number }} | |
| if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'deploy') || contains(github.event.pull_request.labels.*.name, 'dependencies')) }} | |
| needs: [build] | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: review | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Set Airbyte | |
| if: (contains(github.event.pull_request.labels.*.name, 'airbyte')) | |
| run: | | |
| echo "TF_VAR_pg_airbyte_enabled=true" >> $GITHUB_ENV | |
| echo "TF_VAR_airbyte_enabled=true" >> $GITHUB_ENV | |
| echo "TF_VAR_connection_status=active" >> $GITHUB_ENV | |
| - name: Deploy App to Review | |
| id: deploy_review | |
| uses: ./.github/actions/deploy/ | |
| with: | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| environment: review | |
| pr-number: ${{ github.event.pull_request.number }} | |
| sha: ${{ needs.build.outputs.image-tag }} | |
| teams-webhook: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| - name: Post comment to Pull Request ${{ github.event.number }} | |
| uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # Pinned at v3.0.5 | |
| with: | |
| header: aks | |
| message: | | |
| Review app deployed to ${{ steps.deploy_review.outputs.deploy-url }} | |
| merge-dependabot: | |
| name: Merge dependabot | |
| if: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'dependencies') }} | |
| needs: [lint, test, next_academic_year_test, deploy-review-app] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Merge minor dependency updates | |
| uses: fastify/github-action-merge-dependabot@73ec4cbb5e56df5591eae286972d5b2201ffe90f # Pinned at v3.15.0 | |
| with: | |
| github-token: ${{ secrets.API_TOKEN_FOR_GITHUB_ACTION }} | |
| target: minor | |
| exclude: 'govuk-components,govuk_design_system_formbuilder,govuk-frontend,@ministryofjustice/frontend,dfe-analytics' | |
| merge-method: squash | |
| deploy-before-production: | |
| name: Parallel deployment before production | |
| environment: | |
| name: ${{ matrix.environment }} | |
| url: ${{ steps.deploy_app_before_production.outputs.deploy-url }} | |
| if: ${{ success() && github.ref == 'refs/heads/main' }} | |
| needs: [test, next_academic_year_test] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| environment: [qa, staging] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Deploy app to ${{ matrix.environment }} | |
| id: deploy_app_before_production | |
| uses: ./.github/actions/deploy/ | |
| with: | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| environment: ${{ matrix.environment }} | |
| sha: ${{ github.sha }} | |
| teams-webhook: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| smoke-test-username: ${{ secrets.SMOKE_TEST_USERNAME }} | |
| smoke-test-password: ${{ secrets.SMOKE_TEST_PASSWORD }} | |
| basic-auth-username: ${{ secrets.BASIC_AUTH_USERNAME }} | |
| basic-auth-password: ${{ secrets.BASIC_AUTH_PASSWORD }} | |
| deploy-production: | |
| name: Production deployment | |
| environment: | |
| name: production | |
| url: ${{ steps.deploy_app.outputs.deploy-url }} | |
| if: ${{ success() && github.ref == 'refs/heads/main' }} | |
| needs: [deploy-before-production] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Deploy app to production | |
| id: deploy_app | |
| uses: ./.github/actions/deploy/ | |
| with: | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| environment: production | |
| sha: ${{ github.sha }} | |
| teams-webhook: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| smoke-test-username: ${{ secrets.SMOKE_TEST_USERNAME }} | |
| smoke-test-password: ${{ secrets.SMOKE_TEST_PASSWORD }} | |
| basic-auth-username: ${{ secrets.BASIC_AUTH_USERNAME }} | |
| basic-auth-password: ${{ secrets.BASIC_AUTH_PASSWORD }} | |
| update-fauapi-catalogue: | |
| name: Update FauAPI catalogue (pre-prod) | |
| if: ${{ success() && github.ref == 'refs/heads/main' }} | |
| needs: [deploy-production] | |
| uses: ./.github/workflows/update-fauapi-catalogue.yml | |
| secrets: | |
| fauapi_token: ${{ secrets.FAUAPI_PP_AUTOMATION_TOKEN }} | |
| deploy-after-production: | |
| name: Parallel deployment after production | |
| environment: | |
| name: ${{ matrix.environment }} | |
| url: ${{ steps.deploy_app_after_production.outputs.deploy-url }} | |
| if: ${{ success() && github.ref == 'refs/heads/main' }} | |
| needs: [deploy-production] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| environment: [sandbox] # productiondata temporarily disabled for testing new academic year | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Deploy app to ${{ matrix.environment }} | |
| id: deploy_app_after_production | |
| uses: ./.github/actions/deploy/ | |
| with: | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| environment: ${{ matrix.environment }} | |
| sha: ${{ github.sha }} | |
| teams-webhook: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| smoke-test-username: ${{ secrets.SMOKE_TEST_USERNAME }} | |
| smoke-test-password: ${{ secrets.SMOKE_TEST_PASSWORD }} | |
| basic-auth-username: ${{ secrets.BASIC_AUTH_USERNAME }} | |
| basic-auth-password: ${{ secrets.BASIC_AUTH_PASSWORD }} | |
| deploy_domains_infra: | |
| name: Deploy Domains Infrastructure | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| concurrency: deploy_production | |
| needs: [deploy-after-production] | |
| environment: | |
| name: production | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: azure/login@v3 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: Deploy Domains Infrastructure | |
| id: deploy_domains_infra | |
| uses: DFE-Digital/github-actions/deploy-domains-infra@master | |
| with: | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| teams-webhook-url: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| service: ${{ vars.TEAMS_MSG_SERVICE_NAME }} | |
| terraform-base: terraform/custom_domains/infrastructure | |
| deploy_domains_env: | |
| name: Deploy Domains to ${{ matrix.domain_environment }} environment | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| concurrency: deploy_${{ matrix.domain_environment }} | |
| needs: [deploy_domains_infra] | |
| strategy: | |
| max-parallel: 1 | |
| matrix: | |
| domain_environment: [qa, staging, sandbox, production] | |
| environment: | |
| name: production | |
| permissions: | |
| id-token: write | |
| steps: | |
| - uses: azure/login@v3 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - name: Deploy Domains Environment | |
| id: deploy_domains_env | |
| uses: DFE-Digital/github-actions/deploy-domains-env@master | |
| with: | |
| azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| environment: ${{ matrix.domain_environment }} | |
| healthcheck: healthcheck | |
| teams-webhook-url: ${{ secrets.TEAMS_WEBHOOK_URL }} | |
| service: ${{ vars.TEAMS_MSG_SERVICE_NAME }} | |
| terraform-base: terraform/custom_domains/environment_domains |