IPS-1104 GHA workflow for test pipeline and test-image ecr

.github/workflows/post-merge-deploy-to-dev-TESTING.yml

@@ -0,0 +1,69 @@
+name: Deploy Passport API to Passport Dev TESTING
+on:
+  push:
+    branches:
+      - IPS-1104-dev-testing
+  workflow_dispatch: # deploy manually
+
+jobs:
+  deploy:
+    name: Deploy to dev TESTING
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      AWS_REGION: eu-west-2
+      STACK_NAME: passport-api-pl-testing
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: 17
+          distribution: zulu
+
+      - uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: wrapper
+
+      - name: Setup SAM
+        uses: aws-actions/setup-sam@v2
+        with:
+          use-installer: true
+
+      - name: Assume temporary AWS role
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.DEV_GHA_ROLE_ARN_TESTING }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: SAM Validate
+        run: sam validate --region ${{ env.AWS_REGION }} -t infrastructure/lambda/template.yaml --lint
+
+      - name: SAM build
+        run: |
+          mkdir out
+          sam build -t infrastructure/lambda/template.yaml -b out
+
+      - name: Deploy SAM app
+        uses: govuk-one-login/[email protected]
+        with:
+          artifact-bucket-name: "${{ secrets.DEV_ARTIFACT_SOURCE_BUCKET_NAME_TESTING }}"
+          signing-profile-name: "${{ secrets.DEV_SIGNING_PROFILE_NAME }}"
+          working-directory: ./out
+
+      - name: Build, tag, and push testing images to Amazon ECR
+        env:
+          CONTAINER_SIGN_KMS_KEY: ${{ secrets.CONTAINER_SIGN_KMS_KEY }}
+          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
+          ECR_REPOSITORY_DEV_TESTING: ${{ secrets.ECR_REPOSITORY_DEV_TESTING }}
+          IMAGE_TAG: latest
+        run: |
+          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY_DEV_TESTING:$IMAGE_TAG acceptance-tests
+          docker push $ECR_REGISTRY/$ECR_REPOSITORY_DEV_TESTING:$IMAGE_TAG
+          cosign sign --key awskms:///${CONTAINER_SIGN_KMS_KEY} $ECR_REGISTRY/$ECR_REPOSITORY_DEV_TESTING:$IMAGE_TAG