generated from dxw/rails-template
-
Notifications
You must be signed in to change notification settings - Fork 1
123 lines (102 loc) · 4.93 KB
/
support-update-ssl-cert-validation-implementation.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: "Support - Update SSL Cert Validation - Implementation"
on:
workflow_call:
inputs:
chosen_environment:
required: true
type: string
env:
RESOURCE_GROUP_NAME: ${{ secrets.RESOURCE_GROUP_NAME }}
jobs:
check_need_for_validation_update:
runs-on: ubuntu-20.04
environment: ${{ inputs.chosen_environment == 'az-production' && 'az-production-read-only' || inputs.chosen_environment }}
outputs:
customDomainName: ${{ steps.vars.outputs.customDomainName }}
profileName: ${{ steps.vars.outputs.profileName }}
zoneName: ${{ steps.vars.outputs.zoneName }}
needsToReEvaluate: ${{ steps.checkValidationState.outputs.needsToReEvaluate }}
steps:
- name: Setup variables
id: vars
run: |
# To avoid adding multiple variables into the environment when the names
# are based on convention and therefor can be built programmatically
if [[ "${{ inputs.chosen_environment }}" == "az-dev" ]]; then
customDomainName="devghbscustom-domain0"
profileName="devghbscdn"
zoneName="dev.get-help-buying-for-schools.service.gov.uk"
elif [[ "${{ inputs.chosen_environment }}" == "az-staging" ]]; then
customDomainName="stagghbscustom-domain0"
profileName="stagghbscdn"
zoneName="staging.get-help-buying-for-schools.service.gov.uk"
elif [[ "${{ inputs.chosen_environment }}" == "az-production" ]]; then
customDomainName="prodghbscustom-domain0"
profileName="prodghbscdn"
zoneName="www.get-help-buying-for-schools.service.gov.uk"
fi
echo customDomainName=$customDomainName >> $GITHUB_OUTPUT
echo profileName=$profileName >> $GITHUB_OUTPUT
echo zoneName=$zoneName >> $GITHUB_OUTPUT
- name: Azure login
uses: azure/[email protected]
with:
creds: ${{ secrets.AZURE_SP_CREDENTIALS }}
- name: Check need for validation
id: checkValidationState
uses: azure/[email protected]
with:
azcliversion: 2.51.0
inlineScript: |
domainValidationState=$(az afd custom-domain show \
--profile-name ${{ steps.vars.outputs.profileName }} \
--resource-group ${{ env.RESOURCE_GROUP_NAME }} \
--custom-domain-name ${{ steps.vars.outputs.customDomainName }} \
--only-show-errors | jq --raw-output .domainValidationState)
needsToReEvaluate=$([ -z "$(echo $domainValidationState | grep "PendingRevalidation")" ] && echo "no" || echo "yes")
echo needsToReEvaluate=$needsToReEvaluate >> $GITHUB_OUTPUT
update_validation:
runs-on: ubuntu-20.04
needs: [check_need_for_validation_update]
environment: ${{ inputs.chosen_environment }}
if: needs.check_need_for_validation_update.outputs.needsToReEvaluate == 'yes'
steps:
- name: Setup variables
id: vars
run: |
# Just to shorten the variable name paths
echo customDomainName=${{ needs.check_need_for_validation_update.outputs.customDomainName }} >> $GITHUB_OUTPUT
echo profileName=${{ needs.check_need_for_validation_update.outputs.profileName }} >> $GITHUB_OUTPUT
echo zoneName=${{ needs.check_need_for_validation_update.outputs.zoneName }} >> $GITHUB_OUTPUT
echo needsToReEvaluate=${{ needs.check_need_for_validation_update.outputs.needsToReEvaluate }} >> $GITHUB_OUTPUT
- name: Azure login
uses: azure/[email protected]
with:
creds: ${{ secrets.AZURE_SP_CREDENTIALS }}
- name: Regenerate validation token
id: regenerateValidationToken
uses: azure/[email protected]
with:
azcliversion: 2.51.0
inlineScript: |
az afd custom-domain regenerate-validation-token \
--profile-name ${{ steps.vars.outputs.profileName }} \
--resource-group ${{ env.RESOURCE_GROUP_NAME }} \
--custom-domain-name ${{ steps.vars.outputs.customDomainName }} \
--only-show-errors
newValidationToken=$(az afd custom-domain show \
--profile-name ${{ steps.vars.outputs.profileName }} \
--resource-group ${{ env.RESOURCE_GROUP_NAME }} \
--custom-domain-name ${{ steps.vars.outputs.customDomainName }} \
--only-show-errors | jq --raw-output .validationProperties.validationToken)
echo newValidationToken=$newValidationToken >> $GITHUB_OUTPUT
- name: Update dns auth TXT record
uses: azure/[email protected]
with:
azcliversion: 2.51.0
inlineScript: |
az network dns record-set txt update \
--zone-name ${{ steps.vars.outputs.zoneName }} \
--name "_dnsauth" \
--resource-group ${{ env.RESOURCE_GROUP_NAME }} \
--set "txt_records[0].value=['${{ steps.regenerateValidationToken.outputs.newValidationToken }}']"