ldap-operational-automation-template.yml

name: "LDAP: Automation Template"
on:
  workflow_dispatch:
    inputs:
        environment:
            required: true
            type: choice
            options:
              - "dev"
        command_args:
            required: true
            type: choice
            options:
              - "test"
            
jobs:
    deploy:
        name: Create ECS Task in delius-core ${{ github.event.inputs.environment }}
        runs-on: ubuntu-latest
        environment: delius-core-${{ github.event.inputs.environment }}
        permissions:
          id-token: write
        steps:
          - name: Checkout code
            uses: actions/checkout@v4
            
          - name: Configure AWS Credentials
            uses: aws-actions/configure-aws-credentials@v4
            with:
              role-to-assume: "arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/modernisation-platform-oidc-cicd"
              role-session-name: "hmpps-delius-operational-automation-${{ github.run_number }}"
              aws-region: "eu-west-2"
          - name: Set cluster ARN
            id: set-cluster-arn
            run: |
                echo "CLUSTER_ARN=delius-core-${{ github.event.inputs.environment }}-cluster" >> $GITHUB_OUTPUT        
          - name: Get security groups and subnet ids
            id: get-ids
            run: |
                echo "SEC_GROUPS=$(aws ec2 describe-security-groups --filters "Name=group-name,Values=*${{ github.event.inputs.environment }}-ldap-sg*" --query "SecurityGroups[].GroupId" --output json | jq -s -c '.[]')" >> $GITHUB_OUTPUT
                echo "SUBNET_IDS=$(aws ec2 describe-subnets --filters "Name=tag:Name,Values=*-general-private-*" --query "Subnets[].SubnetId" --output json | jq -s -c '.[]')" >> $GITHUB_OUTPUT          

          - name: Template task def
            uses: christherama/render-json-template@v1
            id: render
            with:
                # Path to JSON file serving as the template for rendering an output file. Required.
                json-file-path: ./docker/ldap-automation/task-def.json
                # Multi-line string containing key/value pairs of JSON property paths and desired property values
                field-value-pairs: |
                    $.containerDefinitions[0].command: ["ldap-automation", "${{ github.event.inputs.command_args }}"]

                    $.executionRoleArn: "arn:aws:iam::${{vars.AWS_ACCOUNT_ID}}:role/${{ github.event.inputs.environment }}-ldap-ecs-task-exec"
                    $.taskRoleArn: "arn:aws:iam::${{vars.AWS_ACCOUNT_ID}}:role/${{ github.event.inputs.environment }}-ldap-ecs-task"
                  
                    $.containerDefinitions[0].image: "${{ secrets.CORE_SHARED_SERVICES_ACCOUNT }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/delius-core-ldap-automation-ecr-repo:${{ vars.LDAP_AUTOMATION_IMAGE_TAG }}"

                    $.containerDefinitions[0].containerName: "ldap-automation-task-${{ github.run_id }}"

                    $.containerDefinitions[0].secrets: [{"name": "LDAP_HOST", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/LDAP_HOST"}, {"name": "LDAP_USER", "valueFrom": "arn:aws:ssm:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:parameter/delius-core-${{ github.event.inputs.environment }}/LDAP_PRINCIPAL"}, {"name": "LDAP_PASSWORD", "valueFrom": "arn:aws:secretsmanager:${{secrets.AWS_REGION}}:${{vars.AWS_ACCOUNT_ID}}:secret:delius-core-dev-openldap-bind-password-CagKSo"}]

                    $.containerDefinitions[0].logConfiguration.logDriver.options."awslogs-group": "/ecs/ldap-automation"
                    $.containerDefinitions[0].logConfiguration.logDriver.options."awslogs-region": "${{secrets.AWS_REGION}}"
                    $.containerDefinitions[0].logConfiguration.logDriver.options."awslogs-stream-prefix": "${{ github.run_id }}"
                    
          - name: Show rendered user service task
            if: github.ref != 'refs/heads/main'
            run: cat ${{ steps.render.outputs.rendered-json-file }}
          - name: Run Standalone ECS Task
            id: run-task
            run: |
                task_definition=$(aws ecs register-task-definition --cli-input-json file://${{ steps.render.outputs.rendered-json-file }})
                task_definition_arn=$(echo $task_definition | jq -r '.taskDefinition.taskDefinitionArn') 
                echo "TASK_DEF_ARN=$(echo $task_definition | jq -r '.taskDefinition.taskDefinitionArn') " >> $GITHUB_OUTPUT

                aws ecs run-task --cluster ${{ steps.set-cluster-arn.outputs.CLUSTER_ARN }} --task-definition $task_definition_arn --network-configuration "awsvpcConfiguration={subnets=${{ steps.get-ids.outputs.SUBNET_IDS }},securityGroups=${{ steps.get-ids.outputs.SEC_GROUPS }},assignPublicIp=DISABLED}" --launch-type FARGATE --count 1
          - name: Delete Task Definition
            run: |
                aws ecs deregister-task-definition --task-definition ${{steps.run-task.outputs.TASK_DEF_ARN}}
          #- name: Tail aws logs
          #  run: |
          #      aws logs tail --follow --since 1m /ecs/ldap-automation/${{ github.run_id }}