IPS-1277-add-subenvironment

.github/workflows/sre-secure-post-merge.yml

@@ -0,0 +1,69 @@
+name: SRE dev - Secure Pipeline Test, Build, Package & Ship core-back
+
+on:
+  workflow_dispatch:
+
+jobs:
+
+  deploy:
+    if: '!failure()'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      AWS_REGION: eu-west-2
+      ENVIRONMENT: build
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'adopt'
+          cache: gradle
+
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.8"
+
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: 8.2.1
+
+      - name: Set up SAM cli
+        uses: aws-actions/setup-sam@v2
+
+      - name: sam fix https://github.com/aws/aws-sam-cli/issues/4527
+        run: $(dirname $(readlink $(which sam)))/pip install --force-reinstall "cryptography==38.0.4"
+
+      - name: Set up AWS creds For Pipeline
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.SRE_GH_ACTIONS_ROLE_ARN }}
+          aws-region: eu-west-2
+
+      - name: SAM validate
+        working-directory: ./deploy
+        run: sam validate --region ${{ env.AWS_REGION }}
+
+      - name: SAM build and test
+        working-directory: ./deploy
+        run: sam build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Deploy SAM app
+        uses: govuk-one-login/[email protected]
+        with:
+            artifact-bucket-name: ${{ secrets.SRE_ARTIFACT_BUCKET_NAME }}
+            signing-profile-name: "${{ secrets.SRE_SIGNING_PROFILE_NAME }}"
+            working-directory: ./deploy
+            template-file: .aws-sam/build/template.yaml