Skip to content

Commit c9c0a60

Browse files
CCM-14029 Centralise Precommits & GHAs
1 parent 3a3e525 commit c9c0a60

5 files changed

Lines changed: 208 additions & 10 deletions

File tree

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: "Sync Repository Template"
2+
description: "Synchronise changes from the nhs-notify-repository-template"
3+
inputs:
4+
github_token:
5+
description: "GitHub token for checking out the template repository"
6+
required: true
7+
runs:
8+
using: "composite"
9+
steps:
10+
- name: "Check out template repository"
11+
uses: actions/checkout@v4
12+
with:
13+
repository: NHSDigital/nhs-notify-repository-template
14+
path: nhs-notify-repository-template
15+
token: ${{ inputs.github_token }}
16+
17+
- name: "Run synchronisation script"
18+
shell: bash
19+
run: |
20+
./nhs-notify-repository-template/scripts/maintenance/sync-template-repo.sh
21+
22+
- name: "Clean up template repository"
23+
shell: bash
24+
run: |
25+
rm -rf ./nhs-notify-repository-template
Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: "Trivy IaC Scan"
2+
description: "Scan Terraform IaC using Trivy"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Trivy Terraform IaC Scan"
7+
shell: bash
8+
run: |
9+
components_exit_code=0
10+
modules_exit_code=0
11+
asdf plugin add trivy || true
12+
asdf install trivy || true
13+
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
14+
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
15+
16+
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
17+
echo "Trivy misconfigurations detected."
18+
exit 1
19+
fi
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: "Trivy Package Scan"
2+
description: "Scan project packages using Trivy"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Trivy Package Scan"
7+
shell: bash
8+
run: |
9+
exit_code=0
10+
asdf plugin add trivy || true
11+
asdf install trivy || true
12+
./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
13+
14+
if [ $exit_code -ne 0 ]; then
15+
echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
16+
exit 1
17+
fi

.github/workflows/scheduled-repository-template-sync.yaml

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,10 @@ jobs:
1818
- name: Check out the repository
1919
uses: actions/checkout@v4
2020

21-
- name: Check out external repository
22-
uses: actions/checkout@v4
21+
- name: Sync repository template
22+
uses: ./.github/actions/sync-template-repo
2323
with:
24-
repository: NHSDigital/nhs-notify-repository-template
25-
path: nhs-notify-repository-template
26-
token: ${{ github.token }}
27-
28-
- name: Run syncronisation script
29-
run: |
30-
./nhs-notify-repository-template/scripts/githooks/sync-template-repo.sh
31-
rm -Rf ./nhs-notify-repository-template
24+
github_token: ${{ github.token }}
3225

3326
- name: Create Pull Request
3427
if: ${{ !env.ACT }}
Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
# Script to synchronise the nhs-notify-template-repository with this repository
6+
#
7+
# Usage:
8+
# $ [options] ./sync-template-repo.sh
9+
#
10+
# Options:
11+
# new_only=true # Only identify new files from the template-repository
12+
# changes_only=true # Only identify files which have drifted from the template-repository
13+
14+
# ==============================================================================
15+
16+
scriptdir=$(realpath "$(dirname "$0")")
17+
18+
# Command line parameters
19+
new_only=${new_only:-false}
20+
changes_only=${changes_only:-false}
21+
22+
# Set variables
23+
TEMPLATE_REPO_DIR="nhs-notify-repository-template"
24+
IGNORE_FILE="scripts/config/.repository-template-sync-ignore"
25+
MERGE_FILE="scripts/config/.repository-template-sync-merge"
26+
27+
# Check if the template directory exists
28+
if [ ! -d "${TEMPLATE_REPO_DIR}" ]; then
29+
echo "Template directory ${TEMPLATE_REPO_DIR} not found!"
30+
exit 1
31+
fi
32+
33+
# Check if the .template-ignore file exists, create an empty one if not
34+
if [ ! -f "${IGNORE_FILE}" ]; then
35+
echo "# Files and folders to ignore when syncing ${TEMPLATE_REPO_DIR} back in to this repository" > ${IGNORE_FILE}
36+
echo "# Files and Folders in this repository to ignore" >> ${IGNORE_FILE}
37+
echo "# Files and Folders in the template repository to disregard" >> ${IGNORE_FILE}
38+
fi
39+
40+
# Check if the .template-merge file exists, create an empty one if not
41+
if [ ! -f "${MERGE_FILE}" ]; then
42+
echo "# Files and folders to merge when syncing ${TEMPLATE_REPO_DIR} back in to this repository" > ${MERGE_FILE}
43+
fi
44+
45+
TMP_SYNC_IGNORE=${PWD}/tmp-sync-ignore
46+
mkdir -p "${TMP_SYNC_IGNORE}"
47+
cp "${IGNORE_FILE}" "${TMP_SYNC_IGNORE}/.gitignore"
48+
49+
TMP_SYNC_MERGE=${PWD}/tmp-sync-merge
50+
mkdir -p "${TMP_SYNC_MERGE}"
51+
cp "${MERGE_FILE}" "${TMP_SYNC_MERGE}/.gitignore"
52+
53+
# Check if a file is ignored.
54+
is_ignored() {
55+
local file=${1}
56+
57+
# Ignore .git directories and files
58+
if [[ "$file" == *.git/* ]]; then
59+
return 0
60+
fi
61+
62+
pushd "${TMP_SYNC_IGNORE}" > /dev/null
63+
git check-ignore -q "${file}"
64+
R=$?
65+
popd > /dev/null
66+
return $R
67+
}
68+
69+
is_merge() {
70+
local file=${1}
71+
72+
pushd "${TMP_SYNC_MERGE}" > /dev/null
73+
git check-ignore -q "${file}"
74+
R=$?
75+
popd > /dev/null
76+
return $R
77+
}
78+
79+
# Navigate to the template directory
80+
pushd "${TEMPLATE_REPO_DIR}" || exit
81+
FILES_ADDED=()
82+
FILES_WITH_CHANGES=()
83+
84+
# Loop through all files in the template directory
85+
while IFS= read -r -d '' file || [[ -n $file ]]; do
86+
relative_path="${file#./}" # Remove leading './'
87+
88+
# Check if the file is ignored
89+
if is_ignored "$relative_path"; then
90+
echo "Ignoring $relative_path"
91+
continue
92+
fi
93+
94+
target_path="../$relative_path"
95+
mkdir -p "$(dirname "$target_path")"
96+
97+
# Copy the file to the root directory if it doesn't exist or is different
98+
if [ ! -f "$target_path" ] && [ "$changes_only" == false ]; then
99+
echo "Copying $relative_path to the repository"
100+
FILES_ADDED+=("${relative_path}")
101+
cp "$file" "$target_path"
102+
103+
else
104+
# If the file exists, check if it's different
105+
if [ "$new_only" == false ]; then
106+
if ! diff -q "$file" "$target_path" > /dev/null 2>&1; then
107+
if is_merge "$relative_path"; then
108+
echo "Merging changes from $relative_path"
109+
cp "$target_path" "${target_path}.bak"
110+
node "${scriptdir}/merge.js" "$target_path" "$file" > "${target_path}.merged"
111+
if ! cmp -s "${target_path}.merged" "${target_path}.bak"; then
112+
FILES_WITH_CHANGES+=("${relative_path}")
113+
mv "${target_path}.merged" "$target_path"
114+
fi
115+
rm -f "${target_path}.merged" "${target_path}.bak"
116+
else
117+
echo "Copying changes from $relative_path"
118+
cp "$file" "$target_path"
119+
FILES_WITH_CHANGES+=("${relative_path}")
120+
fi
121+
fi
122+
fi
123+
fi
124+
done < <(find . -type f -print0)
125+
126+
popd
127+
rm -rf "${TMP_SYNC_IGNORE}" "${TMP_SYNC_MERGE}"
128+
129+
echo ------------------------------------------
130+
echo "${#FILES_ADDED[@]} files added, ${#FILES_WITH_CHANGES[@]} files with changes detected."
131+
132+
if [[ "$changes_only" == false && ${#FILES_ADDED[@]} -gt 0 ]]; then
133+
echo ------------------------------------------
134+
echo "New files added:"
135+
printf ' - %s\n' "${FILES_ADDED[@]}"
136+
fi
137+
138+
if [[ "$new_only" == false && ${#FILES_WITH_CHANGES[@]} -gt 0 ]]; then
139+
echo ------------------------------------------
140+
echo "Changed files:"
141+
printf ' - %s\n' "${FILES_WITH_CHANGES[@]}"
142+
fi
143+
144+
echo ------------------------------------------

0 commit comments

Comments
 (0)