oracle-db-backup.yml

name: "Oracle: Backup"
run-name: "Oracle: ${{ github.event_name == 'workflow_dispatch' && format('{0}_{1}_{2}', github.event.inputs.TargetEnvironment, github.event.inputs.Period, github.event.inputs.TargetHost) }}_database_backup"
on:
  workflow_dispatch:
    inputs:
      TargetEnvironment:
        description: "Target environment"
        required: true
        type: choice
        options:
          - "delius-core-dev"
          - "delius-core-test"
          - "delius-core-training"
          - "delius-core-stage"
          - "delius-core-pre-prod"
          - "delius-core-prod"
      TargetHost:
        description: "Backup target host"
        required: true
        type: choice
        options: 
          - "delius_primarydb"
          - "mis_primarydb"
          - "misboe_primarydb"
          - "misdsd_primarydb"
          - "delius_standbydb1"
          - "mis_standbydb1"
          - "misboe_standbydb1"
          - "misdsd_standbydb1"
          - "delius_standbydb2"
      TargetHostList:
        description: "INTERNAL USE ONLY"
        type: string
        default: "delius_primarydb, mis_primarydb, misboe_primarydb, misdsd_primarydb, delius_standbydb1, mis_standbydb1,misboe_standbydb1,misdsd_standbydb1,delius_standbydb2"
      Period: 
        description: "Is this a daily or weekly backup?"
        required: true
        type: choice
        options: 
          - "daily"
          - "weekly"
      FixAbsentChunks:
        description: "Validate and fix absent S3 missing backup chunks"
        type: choice
        default: "yes"
        options: 
          - "yes"
          - "no"
      DeleteDefunct:
        description:  "Delete backups for DBIDs no longer in use"
        type: choice
        default: "no"
        options: 
          - "yes"
          - "no"
      EnableTrace:
        description: "Enable RMAN trace for debugging"
        required: false
        type: choice
        default: "no"
        options: 
          - "yes" 
          - "no"     
      VerboseOutput: 
        description: "Verbose Output level"
        type: choice
        options:
          - ""
          - "-v"
          - "-vv"
          - "-vvv"
          - "-vvvv"
      SourceCodeVersion:
        description: "Source version for the hmpps-delius-operation-automation. Enter a pull request, branch, commit ID, tag, or reference."
        type: string
        default: "main"
      SourceConfigVersion:
        description: "Source version for the modernisation-platform-configuration-management. Enter a pull request, branch, commit ID, tag, or reference."
        type: string
        default: "main"

  workflow_call:
    inputs:
      TargetEnvironment:
        description: "Target environment"
        required: true
        type: string
      TargetHost:
        description: "Backup target host"
        required: true
        type: string
      Period:
        description: "Is this a daily or weekly backup?"
        required: true
        type: string
      DeleteDefunct:
        description:  "Delete backups for DBIDs no longer in use"
        required: false
        type: string
        default: "no"

# Allow permissions on repository and docker image and OIDC token
permissions:
  contents: read
  packages: read
  id-token: write  # This is required for requesting the JWT

jobs:
  build_rman_target_name:
    runs-on: ubuntu-latest
    outputs:
      RmanTarget: ${{ steps.preparermantargetname.outputs.RmanTarget }}
      TargetEnvironment: ${{ steps.preparermantargetname.outputs.TargetEnvironment }}-preapproved
    steps:
      - name: Prepare Rman Target
        id: preparermantargetname
        run: |
          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]
          then
            TargetHost="${{ github.event.inputs.TargetHost }}"
            TargetEnvironment="${{ github.event.inputs.TargetEnvironment }}"
          elif [[ "${{ github.event_name }}" == "schedule" ]]
          then
            TargetHost="${{ inputs.TargetHost }}"
            TargetEnvironment="${{ inputs.TargetEnvironment }}"
          fi;
          RmanTarget="environment_name_$(echo $TargetEnvironment | sed 's/delius-core-dev/delius_core_development_dev/;s/delius-core-test/delius_core_test_test/;s/delius-core-training/delius_core_test_training/;s/delius-core-stage/delius_core_preproduction_stage/;s/delius-core-pre-prod/delius_core_preproduction_pre_prod/;s/delius-core-prod/delius_core_production_prod/')_$TargetHost"
          echo "RmanTarget=$RmanTarget" >> $GITHUB_OUTPUT
          echo "TargetEnvironment=$TargetEnvironment" >> $GITHUB_OUTPUT

  # Start deployment container job based on the build delius-ansible-aws image
  deployment:
    name: oracle-backup
    needs: build_rman_target_name
    environment: ${{needs.build_rman_target_name.outputs.TargetEnvironment}}
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/ministryofjustice/hmpps-delius-operational-automation:0.41.0
    timeout-minutes: 1440
    env:
      backup_command: ansible-playbook operations/playbooks/oracle_backup/backup.yml
      validate_command: ansible-playbook operations/playbooks/oracle_backup/validate.yml
      delete_dbids_command: ansible-playbook operations/playbooks/oracle_backup/delete_dbids_not_in_use.yml
      inventory: inventory/ansible
      Period: "${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.Period || (github.event_name == 'schedule' && inputs.Period ))  }}"
      FixAbsentChunks: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.FixAbsentChunks || 'yes' }}"
      DeleteDefunct: "${{ (github.event_name == 'workflow_dispatch' && github.event.inputs.DeleteDefunct || (github.event_name == 'schedule' && inputs.DeleteDefunct )) }}"
      EnableTrace: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.EnableTrace || 'no' }}"
      VerboseOutput: "${{ github.event_name == 'workflow_dispatch' && github.event.inputs.VerboseOutput || '' }}"
      RmanTarget: "${{needs.build_rman_target_name.outputs.RmanTarget}}"
      ansible_config: operations/playbooks/ansible.cfg
    continue-on-error: false
    steps:

      - name: Checkout hmpps-delius-operation-automation
        uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            playbooks/oracle_backup
            playbooks/ansible.cfg
          path: operations
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.SourceCodeVersion || 'main' }}
          fetch-depth: 0

      - name: Checkout Ansible Inventory From modernisation-platform-configuration-management
        uses: actions/checkout@v4
        with:
          repository: ministryofjustice/modernisation-platform-configuration-management
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            ansible/hosts
            ansible/group_vars
          path: inventory
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.SourceConfigVersion || 'main' }}
          fetch-depth: 0

      - name: Checkout Ansible Required Roles From modernisation-platform-configuration-management
        uses: actions/checkout@v4
        with:
          repository: ministryofjustice/modernisation-platform-configuration-management
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            ansible/roles/secretsmanager-passwords
            ansible/roles/get-modernisation-platform-facts
          path: roles
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.SourceConfigVersion || 'main' }}
          fetch-depth: 0

      - name: Configure AWS Credentials
        id: login-aws
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/modernisation-platform-oidc-cicd"
          role-session-name: "hmpps-delius-operational-automation-${{ github.run_number }}"
          aws-region: "eu-west-2"

      - name: Start Ansible Backup On Primary
        id: backup
        continue-on-error: true
        run: |
          echo "Using bucket ${{ vars.ANSIBLE_AWS_SSM_BUCKET_NAME }}"
          echo "Not using bucket ${ANSIBLE_AWS_SSM_BUCKET_NAME}"
          env
          export ANSIBLE_CONFIG=$ansible_config
          ln -s $PWD/roles/ansible/roles $PWD/operations/playbooks/oracle_backup/roles
          $backup_command -i $inventory -e ansible_aws_ssm_bucket_name=${{ vars.ANSIBLE_AWS_SSM_BUCKET_NAME }} -e rman_target=$RmanTarget -e daily_weekly=$Period -e enable_trace=$EnableTrace $VerboseOutput

      - name: Start Ansible Backup On First Standby (If Exists) If Primary Backup Failed
        if: ${{ steps.backup.outcome == 'failure' && contains(env.RmanTarget,'primarydb') }}
        shell: bash
        run: |
          if [[ -e ${inventory}/group_vars/${RmanTarget/primarydb/standbydb1}.yml ]]
          then
            export ANSIBLE_CONFIG=$ansible_config
            ln -s $PWD/roles/ansible/roles $PWD/operations/playbooks/oracle_backup/roles
            $backup_command -i $inventory -e ansible_aws_ssm_bucket_name=${{ vars.ANSIBLE_AWS_SSM_BUCKET_NAME }} -e rman_target=${RmanTarget/primarydb/standbydb1} -e daily_weekly=$Period -e enable_trace=$EnableTrace $VerboseOutput
          else
            echo "Standby Not Configured"
          fi

      - name: Start Ansible Validate And Fix Absent Chunks
        run: |
          export ANSIBLE_CONFIG=$ansible_config
          ln -s $PWD/roles/ansible/roles $PWD/operations/playbooks/oracle_backup/roles
          $validate_command -i $inventory -e ansible_aws_ssm_bucket_name=${{ vars.ANSIBLE_AWS_SSM_BUCKET_NAME }} -e rman_target=$RmanTarget -e fix_absent_chunks=$FixAbsentChunks $VerboseOutput

      - name: Start Ansible Delete DBIDs Not In Use
        if: ${{ env.DeleteDefunct == 'yes' }}
        run: |
          export ANSIBLE_CONFIG=$ansible_config
          ln -s $PWD/roles/ansible/roles $PWD/operations/playbooks/oracle_backup/roles
          $delete_dbids_command -i $inventory -e ansible_aws_ssm_bucket_name=${{ vars.ANSIBLE_AWS_SSM_BUCKET_NAME }} -e rman_target=$RmanTarget $VerboseOutput