Merge branch 'dev' into LEGLINK-186-KafkaRetryImplementation

Author: arianamihailescu

Azure_Pipelines/_deploy_all_services.yml

@@ -9,7 +9,7 @@ pool:
 
 parameters:
   - name: environment
-    displayName: Which environment is this for? (DEV | TEST | QA)
+    displayName: Which environment is this for? (DEV | TEST | QA | QA2)
     type: string
     values:
       - dev-scale
@@ -80,9 +80,140 @@ jobs:
         artifact: 'deploy-changes-$(kube_namespace)'
         publishLocation: 'pipeline'
 
-- job: Deploy
+- job: ValidateImages
   dependsOn: Summarize
   condition: succeeded()
+  displayName: Validate all container images
+  pool:
+    vmImage: 'ubuntu-latest'
+
+  strategy:
+    matrix:
+      account:
+        serviceName: account
+        repoName: account
+
+      admin:
+        serviceName: admin
+        repoName: admin
+
+      admin-ui:
+        serviceName: admin-ui
+        repoName: admin-ui
+
+      audit:
+        serviceName: audit
+        repoName: audit
+
+      automation:
+        serviceName: automation
+        repoName: automation
+
+      census:
+        serviceName: census
+        repoName: census
+
+      data-acquisition:
+        serviceName: data-acquisition
+        repoName: dataacquisition
+
+      data-acquisition-worker:
+        serviceName: data-acquisition-worker
+        repoName: dataacquisition-worker
+
+      measure-eval:
+        serviceName: measure
+        repoName: measureeval
+
+      normalization:
+        serviceName: normalization
+        repoName: normalization
+
+      query-dispatch:
+        serviceName: query-dispatch
+        repoName: querydispatch
+
+      report:
+        serviceName: report
+        repoName: report
+
+      submission:
+        serviceName: submission
+        repoName: submission
+
+      tenant:
+        serviceName: tenant
+        repoName: tenant
+
+      terminology:
+        serviceName: terminology
+        repoName: terminology
+
+      validation:
+        serviceName: validation
+        repoName: validation
+
+      mock-dmrp:
+        serviceName: mock-dmrp
+        repoName: mock-dmrp
+
+  steps:
+
+  - task: Bash@3
+    displayName: 'Determine image tag'
+    inputs:
+      targetType: inline
+      script: |
+        set -e
+
+        GIT_COMMIT=$(git rev-parse --short HEAD)
+        IMAGE_TAG="$(Build.SourceBranchName)-${GIT_COMMIT}"
+
+        echo "Git commit: ${GIT_COMMIT}"
+        echo "Image tag:  ${IMAGE_TAG}"
+
+        echo "##vso[task.setvariable variable=GIT_COMMIT]${GIT_COMMIT}"
+        echo "##vso[task.setvariable variable=IMAGE_TAG]${IMAGE_TAG}"
+
+  - task: AzureCLI@2
+    displayName: 'Validate image exists for $(serviceName)'
+    inputs:
+      azureSubscription: 'NHSNLink-RG ARM'
+      scriptType: bash
+      scriptLocation: inlineScript
+      inlineScript: |
+        set -e
+
+        IMAGE_REPO="link-$(repoName)"
+        IMAGE_TAG="$(IMAGE_TAG)"
+
+        echo "=========================================="
+        echo "Validating container image"
+        echo "=========================================="
+        echo "Service:    $(serviceName)"
+        echo "Repository: ${IMAGE_REPO}"
+        echo "Tag:        ${IMAGE_TAG}"
+        echo "Full image: $(containerRegistry)/${IMAGE_REPO}:${IMAGE_TAG}"
+        echo "=========================================="
+
+        if ! az acr repository show \
+          --name "$(containerRegistry)" \
+          --image "${IMAGE_REPO}:${IMAGE_TAG}" \
+          --output none; then
+
+          echo "##vso[task.logissue type=error]Image does NOT exist in ACR:"
+          echo "##vso[task.logissue type=error]$(containerRegistry)/${IMAGE_REPO}:${IMAGE_TAG}"
+          echo "##vso[task.logissue type=error]Deployment has been stopped for $(serviceName)."
+
+          exit 1
+        fi
+
+        echo "Image exists in ACR."
+
+
+- job: Deploy
+  dependsOn: ValidateImages
+  condition: succeeded()
   displayName: Deploy multiple services
   pool:
     vmImage: 'ubuntu-latest'

Scripts/README.md

@@ -34,7 +34,7 @@ subfolder and is summarised at the end.
 | `set_kubernetes_services.bat <namespace> <registry> <image>` | Points a Kubernetes namespace at a registry and image. |
 | `aca-container-statuses.ps1` | Lists Azure Container App running state and replica bounds. |
 | `aca-logs.bat <container> rep\|rev <id>` | Tails Container App logs for a replica or revision. |
-| `get_deployed_commit.py <environment>` | Reports the commit currently deployed to `dev-scale`, `scale-test` or `scale-qa`. |
+| `get_deployed_commit.py <environment>` | Reports the commit currently deployed to `dev-scale`, `scale-test`, `scale-qa` or `scale-qa2`. |
 | `list-deploy-changes.py <from> <to>` | Lists the deployment-relevant changes between two git refs. |
 | `upload_to_share.py` | Uploads a directory to an Azure File Share. |
 

Scripts/get_deployed_commit.py

@@ -6,10 +6,10 @@
     python3 scripts/get_deployed_commit.py <environment>
 
 Arguments:
-    environment: One of dev-scale | scale-test | scale-qa
+    environment: One of dev-scale | scale-test | scale-qa | scale-qa2
 
 Environment variables expected:
-    DEV_BASE_URL, TEST_BASE_URL, QA_BASE_URL  (from your Azure DevOps variable group)
+    DEV_BASE_URL, TEST_BASE_URL, QA_BASE_URL, QA2_BASE_URL  (from your Azure DevOps variable group)
 
 Purpose:
     - Determines the correct BASE_URL from the environment.
@@ -22,7 +22,11 @@
 import json
 import urllib.request
 
-REPO_COMMIT_ROOT = 'https://github.com/lantanagroup/link-cloud/commit/'
+REPO_COMMITS_API_ROOT = 'https://api.github.com/repos/lantanagroup/link-cloud/commits/'
+
+# urlopen blocks indefinitely by default, which would hang the pipeline job rather than
+# fail it. Bound every HTTP call to the same budget.
+HTTP_TIMEOUT_SECONDS = 30
 
 def fail(msg: str):
     print(f"ERROR: {msg}", file=sys.stderr)
@@ -43,6 +47,7 @@ def main():
     dev_url = os.getenv("DEV_BASE_URL", "")
     test_url = os.getenv("TEST_BASE_URL", "")
     qa_url = os.getenv("QA_BASE_URL", "")
+    qa2_url = os.getenv("QA2_BASE_URL", "")
 
     base_url = ""
     if input_value.startswith("https://"):
@@ -56,12 +61,14 @@ def main():
             base_url = test_url
         elif environment == "scale-qa":
             base_url = qa_url
+        elif environment == "scale-qa2":
+            base_url = qa2_url
         else:
-            fail(f"Unknown environment '{environment}'. Expected one of: dev-scale | scale-test | scale-qa, or a direct https:// URL")
+            fail(f"Unknown environment '{environment}'. Expected one of: dev-scale | scale-test | scale-qa | scale-qa2, or a direct https:// URL")
 
     if not base_url:
         fail(f"BASE_URL is empty for environment '{environment}'. "
-             f"Ensure DEV_BASE_URL / TEST_BASE_URL / QA_BASE_URL are defined.")
+             f"Ensure DEV_BASE_URL / TEST_BASE_URL / QA_BASE_URL / QA2_BASE_URL are defined.")
 
     print(f"Environment: {environment}")
     print(f"BASE_URL: {base_url}")
@@ -75,7 +82,7 @@ def main():
             info_url,
             headers={'Accept': 'application/json'}
         )
-        with urllib.request.urlopen(request) as response:
+        with urllib.request.urlopen(request, timeout=HTTP_TIMEOUT_SECONDS) as response:
             body = response.read().decode("utf-8")
     except Exception as e:
         fail(f"Failed to GET {info_url}: {e}")
@@ -96,20 +103,34 @@ def main():
     if not commit:
         fail("Could not find 'Commit' in /api/info response.")
 
-    # If we got a short hash, try to match it with the full hash from git log
+    # If we got a short hash, resolve it to the full hash. list-deploy-changes.py fetches both
+    # refs with 'git fetch origin <ref>', and GitHub only serves unadvertised objects by full SHA.
+    # The 'sha' media type returns the 40-character hash as plain text.
     if len(commit) < 40:  # Full SHA-1 hash is 40 characters
         print(f"Attempting to translate short commit hash {commit} to full commit hash")
         try:
             request = urllib.request.Request(
-                f"{REPO_COMMIT_ROOT}{commit}",
-                headers={'Accept': 'application/json'}
+                f"{REPO_COMMITS_API_ROOT}{commit}",
+                headers={'Accept': 'application/vnd.github.sha'}
             )
-            with urllib.request.urlopen(request) as response:
-                full_commit_data = json.loads(response.read().decode("utf-8"))
-                commit = full_commit_data.get('payload', {}).get('commit', {}).get("sha2", commit)
+            with urllib.request.urlopen(request, timeout=HTTP_TIMEOUT_SECONDS) as response:
+                full_commit = response.read().decode("utf-8").strip()
+
+            if len(full_commit) == 40:
+                commit = full_commit
+            else:
+                print(f"Warning: Unexpected response resolving full commit hash: '{full_commit[:100]}'", file=sys.stderr)
         except Exception as e:
             print(f"Warning: Could not resolve full commit hash: {e}", file=sys.stderr)
 
+    # A short hash breaks the downstream fetch in list-deploy-changes.py: 'git fetch origin
+    # <ref>' is rejected for anything but a full SHA, and that failure is swallowed, so the
+    # summary comes out empty with nothing in the log to explain it. Stop here instead of
+    # publishing a FromCommit that cannot be used.
+    if len(commit) < 40:
+        fail(f"'{commit}' is not a full commit hash and could not be resolved to one. "
+             f"'git fetch origin {commit}' would fail and the deployment summary would be empty.")
+
     print(f"FromCommit: {commit}")
 
     # 5. Emit Azure DevOps logging command