Skip to content

Commit b403215

Browse files
timirelandtimireland
authored
Feature/ccm 10193 (#202)
* CCM-10193 change to use GitHub app token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 change to use GitHub app token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 change to use GitHub app token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 use GitHub App token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 use GitHub App token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 use GitHub App token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 use GitHub App token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 use GitHub App token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> * CCM-10193 use GitHub App token Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk> --------- Signed-off-by: Tim Ireland <tim.ireland@hscic.gov.uk>
1 parent e430983 commit b403215

File tree

8 files changed

+67
-7
lines changed

8 files changed

+67
-7
lines changed

‎.github/actions/build-proxies/action.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,8 @@ runs:
9898

9999
- name: Trigger deploy proxy
100100
env:
101-
PR_TRIGGER_PAT: ${{ env.PR_TRIGGER_PAT }}
101+
APP_CLIENT_ID: ${{ env.APP_CLIENT_ID }}
102+
APP_PEM_FILE: ${{ env.APP_PEM_FILE }}
102103
shell: bash
103104
run: |
104105
.github/scripts/dispatch_internal_repo_workflow.sh \

‎.github/scripts/dispatch_internal_repo_workflow.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,59 @@ while [[ $# -gt 0 ]]; do
111111
esac
112112
done
113113

114+
if [[ -z "$APP_PEM_FILE" ]]; then
115+
echo "[ERROR] PEM_FILE environment variable is not set or is empty."
116+
exit 1
117+
fi
118+
119+
if [[ -z "$APP_CLIENT_ID" ]]; then
120+
echo "[ERROR] CLIENT_ID environment variable is not set or is empty."
121+
exit 1
122+
fi
123+
124+
now=$(date +%s)
125+
iat=$((${now} - 60)) # Issues 60 seconds in the past
126+
exp=$((${now} + 600)) # Expires 10 minutes in the future
127+
128+
b64enc() { openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n'; }
129+
130+
header_json='{
131+
"typ":"JWT",
132+
"alg":"RS256"
133+
}'
134+
# Header encode
135+
header=$( echo -n "${header_json}" | b64enc )
136+
137+
payload_json="{
138+
\"iat\":${iat},
139+
\"exp\":${exp},
140+
\"iss\":\"${APP_CLIENT_ID}\"
141+
}"
142+
# Payload encode
143+
payload=$( echo -n "${payload_json}" | b64enc )
144+
145+
# Signature
146+
header_payload="${header}"."${payload}"
147+
signature=$(
148+
openssl dgst -sha256 -sign <(echo -n "${APP_PEM_FILE}") \
149+
<(echo -n "${header_payload}") | b64enc
150+
)
151+
152+
# Create JWT
153+
JWT="${header_payload}"."${signature}"
154+
155+
INSTALLATION_ID=$(curl -X GET \
156+
-H "Accept: application/vnd.github+json" \
157+
-H "Authorization: Bearer ${JWT}" \
158+
-H "X-GitHub-Api-Version: 2022-11-28" \
159+
--url "https://api.github.com/app/installations" | jq -r '.[0].id')
160+
161+
PR_TRIGGER_PAT=$(curl --request POST \
162+
--url "https://api.github.com/app/installations/${INSTALLATION_ID}/access_tokens" \
163+
-H "Accept: application/vnd.github+json" \
164+
-H "Authorization: Bearer ${JWT}" \
165+
-H "X-GitHub-Api-Version: 2022-11-28" | jq -r '.token')
166+
114167
# Set default values if not provided
115168
if [[ -z "$PR_TRIGGER_PAT" ]]; then
116169
echo "[ERROR] PR_TRIGGER_PAT environment variable is not set or is empty."

‎.github/workflows/manual-proxy-environment-deploy.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ jobs:
7878
env:
7979
PROXYGEN_API_NAME: nhs-notify-supplier
8080
PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
81-
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}
81+
APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
82+
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
8283
uses: ./.github/actions/build-proxies
8384
with:
8485
environment: "${{ env.ENVIRONMENT }}"

‎.github/workflows/pr_closed.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,8 @@ jobs:
5252

5353
- name: Updating Main Environment
5454
env:
55-
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}
55+
APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
56+
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
5657
run: |
5758
bash .github/scripts/dispatch_internal_repo_workflow.sh \
5859
--releaseVersion "main" \

‎.github/workflows/pr_create_dynamic_env.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ jobs:
2121
- uses: actions/checkout@v5.0.0
2222
- name: Trigger dynamic environment creation
2323
env:
24-
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}
24+
APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
25+
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
2526
shell: bash
2627
run: |
2728
.github/scripts/dispatch_internal_repo_workflow.sh \

‎.github/workflows/pr_destroy_dynamic_env.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ jobs:
1818

1919
- name: Trigger dynamic environment destruction
2020
env:
21-
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}
21+
APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
22+
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
2223
shell: bash
2324
run: |
2425
.github/scripts/dispatch_internal_repo_workflow.sh \

‎.github/workflows/release_created.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ jobs:
2828

2929
- name: Deploy Nonprod Environment
3030
env:
31-
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}
31+
APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
32+
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
3233
run: |
3334
bash .github/scripts/dispatch_internal_repo_workflow.sh \
3435
--releaseVersion "${{ github.event.release.tag_name }}" \

‎.github/workflows/stage-3-build.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,8 @@ jobs:
9595
env:
9696
PROXYGEN_API_NAME: nhs-notify-supplier
9797
PR_NUMBER: ${{ inputs.pr_number }}
98-
PR_TRIGGER_PAT: ${{ secrets.PR_TRIGGER_PAT }}
98+
APP_CLIENT_ID: ${{ secrets.APP_CLIENT_ID }}
99+
APP_PEM_FILE: ${{ secrets.APP_PEM_FILE }}
99100
steps:
100101
- name: "Checkout code"
101102
uses: actions/checkout@v4

0 commit comments

Comments
 (0)