[feature/PI-311-account_wide_smoke_tests] smoke tests account wide

.github/actions/components/caching/action.yml

@@ -18,22 +18,13 @@ inputs:
     default: |
       .venv
       .timestamp
-      **/.terraform
-      **/dist/*zip
-      **/tfplan
-      **/swagger.yaml
-      **/infrastructure/terraform/**/output.json
       .downloads
-      **/fhir/r4/*models.py
       .tool-versions
       pyproject.toml
       poetry.lock
-      **/make.py
-      **/infrastructure/swagger/*.yaml
-      **/infrastructure/swagger/**/*.yaml
-      **/fhir-base/*json
-      **/.proxygen/*
-      **/infrastructure/terraform/**/*.asl.json
+      src
+      infrastructure
+      !**/.terraform/modules/**/*
 
 runs:
   using: "composite"
@@ -51,6 +42,11 @@ runs:
         restore-keys: |
           ${{ env.GITHUB_SHA_SHORT }}-${{ inputs.cache-suffix == '' && 'head' || inputs.cache-suffix }}
 
+    # # For debugging, uncomment the following:
+    # - id: tree
+    #   shell: bash
+    #   run: tree -D -I '__pycache__|.git|.venv|.hypothesis|.pytest_cache'
+
     - if: ${{ inputs.save-or-restore == 'save' }}
       id: save-cache
       uses: actions/cache/save@v3

.github/workflows/_deploy.yml

@@ -55,26 +55,23 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
-      - uses: ./.github/actions/make/
+      - if: ${{ env.SCOPE == 'per_workspace'}}
+        uses: ./.github/actions/make/
         with:
           command: build
           save-to-cache: "true"
           restore-from-cache: "false"
           cache-suffix: ${{ env.CACHE_NAME }}
-
-  helpers--truststore-pull:
-    needs: [get-branch-from-workflow-file, build]
-    runs-on: [self-hosted, ci]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
-      - uses: ./.github/actions/make/
+      - if: ${{ env.SCOPE != 'per_workspace'}}
+        uses: ./.github/actions/make/
         with:
-          command: helpers--truststore-pull WORKSPACE=${{ env.WORKSPACE }}
+          command: poetry--update
+          save-to-cache: "true"
+          restore-from-cache: "false"
+          cache-suffix: ${{ env.CACHE_NAME }}
 
   terraform--init:
-    needs: [get-branch-from-workflow-file, helpers--truststore-pull]
+    needs: [get-branch-from-workflow-file, build]
     runs-on: [self-hosted, ci]
     steps:
       - uses: actions/checkout@v4
@@ -161,6 +158,7 @@ jobs:
           command: test--smoke
           workspace: ${{ env.WORKSPACE }}
           requires-aws: true
+          restore-from-cache: "true"
           cache-suffix: ${{ env.CACHE_NAME }}
 
   set-success:

.github/workflows/pull-requests.yml

@@ -112,25 +112,8 @@ jobs:
         with:
           command: test--feature--local
 
-  helpers--truststore-pull:
-    runs-on: [self-hosted, ci]
-    needs: [workflow--check--branch-name]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ env.BRANCH_NAME }}
-      - uses: ./.github/actions/make/
-        with:
-          command: helpers--truststore-pull WORKSPACE=ref
-
   terraform-base-build:
-    needs:
-      [
-        create-workspace-name,
-        build-base,
-        helpers--truststore-pull,
-        parse-secrets,
-      ]
+    needs: [create-workspace-name, build-base, parse-secrets]
     runs-on: [self-hosted, ci]
     steps:
       - uses: actions/checkout@v4
@@ -157,7 +140,6 @@ jobs:
         workflow--codebase-checks,
         test--unit,
         test--feature--local,
-        helpers--truststore-pull,
         parse-secrets,
         terraform-base-build,
       ]
@@ -233,6 +215,26 @@ jobs:
           command: test--feature--integration
           requires-aws: true
 
+  test--smoke:
+    needs:
+      [
+        build-head,
+        workflow--codebase-checks,
+        test--unit,
+        test--feature--local,
+        terraform-head-build,
+        apigee--deploy,
+      ]
+    runs-on: [self-hosted, ci]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ env.BRANCH_NAME }}
+      - uses: ./.github/actions/make/
+        with:
+          command: test--smoke
+          requires-aws: true
+
   destroy-redundant-workspaces:
     runs-on: [self-hosted, ci]
     needs: [build-head]

infrastructure/terraform/per_account/mgmt/modules/route53/main.tf

@@ -54,10 +54,10 @@ resource "aws_route53_record" "dev_zone" {
   zone_id = module.zones.route53_zone_zone_id["cpm.dev.national.nhs.uk"]
   name    = "api.cpm.dev.national.nhs.uk"
   records = [
-    "ns-81.awsdns-10.com.",
-    "ns-1238.awsdns-26.org.",
-    "ns-776.awsdns-33.net.",
-    "ns-1540.awsdns-00.co.uk."
+    "ns-821.awsdns-38.net.",
+    "ns-1945.awsdns-51.co.uk.",
+    "ns-366.awsdns-45.com.",
+    "ns-1311.awsdns-35.org.",
   ]
   ttl  = 300
   type = "NS"

pyproject.toml

@@ -51,7 +51,6 @@ boto3-stubs = { extras = [
     "secretsmanager",
     "stepfunctions",
 ], version = "^1.34.37" }
-pytest-lazy-fixture = "^0.6.3"
 pytest-timeout = "^2.2.0"
 
 [tool.poetry.group.local]

scripts/infrastructure/terraform.mk

@@ -2,7 +2,7 @@
 
 AWS_ACCOUNT =
 TERRAFORM_WORKSPACE =
-TERRAFORM_SCOPE = "per_workspace"
+TERRAFORM_SCOPE = per_workspace
 TERRAFORM_ARGS =
 
 PREFIX =
@@ -11,15 +11,15 @@ VERSION =
 WORKSPACE_OUTPUT_JSON = $(CURDIR)/infrastructure/terraform/per_workspace/output.json
 TERRAFORM_PLAN_TIMESTAMP = $(TIMESTAMP_DIR)/tfplan.timestamp
 BUILD_TIMESTAMP = $(TIMESTAMP_DIR)/.build.timestamp
-TERRAFORM_FILES = $(shell find infrastructure/terraform -type f -name "*.tf*") $(shell find infrastructure/terraform -type f -name "*.asl.json")
+TERRAFORM_FILES = $(shell find infrastructure/terraform/per_workspace -type f -name "*.tf*") $(shell find infrastructure/terraform -type f -name "*.asl.json")
 
 terraform--clean:
 	[[ -f $(TERRAFORM_PLAN_TIMESTAMP) ]] && rm $(TERRAFORM_PLAN_TIMESTAMP) || :
 	[[ -f $(WORKSPACE_OUTPUT_JSON) ]] && rm $(WORKSPACE_OUTPUT_JSON) || :
 	$(MAKE) _terraform--clean
 terraform--validate: _terraform--validate ## Run terraform validate
 terraform--init: _terraform--init ## Run terraform init
-terraform--plan: $(TERRAFORM_PLAN_TIMESTAMP)  ## Run terraform plan
+terraform--plan: $(TERRAFORM_PLAN_TIMESTAMP)--$(TERRAFORM_SCOPE)  ## Run terraform plan
 terraform--apply: $(WORKSPACE_OUTPUT_JSON) ## Run terraform apply
 terraform--apply--force: terraform--clean terraform--apply ## Run terraform apply
 terraform--destroy: _terraform--destroy ## Run terraform destroy
@@ -38,10 +38,13 @@ _terraform--%: aws--login
 	AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) \
 	bash $(PATH_TO_INFRASTRUCTURE)/terraform/terraform-commands.sh $* "${AWS_ACCOUNT}" "$(TERRAFORM_WORKSPACE)" "$(TERRAFORM_SCOPE)" "$(TERRAFORM_ARGS)"
 
-$(TERRAFORM_PLAN_TIMESTAMP): $(BUILD_TIMESTAMP) $(TERRAFORM_FILES)
+$(TERRAFORM_PLAN_TIMESTAMP)--per_workspace: $(BUILD_TIMESTAMP) $(TERRAFORM_FILES)
 	$(MAKE) _terraform--plan
-	touch $(TERRAFORM_PLAN_TIMESTAMP)
+	touch $(TERRAFORM_PLAN_TIMESTAMP)--per_workspace
 
+$(TERRAFORM_PLAN_TIMESTAMP)--%: $(TOOL_VERSIONS_COPY)
+	$(MAKE) _terraform--plan
+	bash $(PATH_TO_INFRASTRUCTURE)/terraform/touch.sh $(TERRAFORM_PLAN_TIMESTAMP)--$*
 
-$(WORKSPACE_OUTPUT_JSON): $(TERRAFORM_PLAN_TIMESTAMP)
+$(WORKSPACE_OUTPUT_JSON): $(TERRAFORM_PLAN_TIMESTAMP)--$(TERRAFORM_SCOPE)
 	$(MAKE) _terraform--apply

scripts/infrastructure/terraform/touch.sh

@@ -0,0 +1 @@
+mkdir -p "$(dirname "$1")" && touch "$1"

scripts/local-development/dependencies.mk

@@ -4,12 +4,11 @@ PATH_TO_DEPS = $(CURDIR)/scripts/local-development
 TIMESTAMP_DIR = $(CURDIR)/.timestamp
 TOOL_VERSIONS = $(CURDIR)/.tool-versions
 TOOL_VERSIONS_COPY = $(TIMESTAMP_DIR)/tool-versions.copy
+INIT_TIMESTAMP = $(CURDIR)/.timestamp/init.timestamp
 
 development--install: $(TOOL_VERSIONS_COPY) ## Install local development tools
 
-## NEED TO ADD A PROXY TO TOOL_VERSIONS HERE, WHICH CHECKS FOR CONTENT CHANGES
-
-$(TOOL_VERSIONS_COPY): $(TOOL_VERSIONS)
+$(TOOL_VERSIONS_COPY): $(INIT_TIMESTAMP) $(TOOL_VERSIONS)
 	touch $(TOOL_VERSIONS_COPY)
 	diff -q $(TOOL_VERSIONS_COPY) $(TOOL_VERSIONS) || exit 0
 	@bash $(PATH_TO_DEPS)/install.sh

scripts/test/test.mk

@@ -20,7 +20,7 @@ test--s3: aws--login ## Run (pytest) tests that require s3 downloads
 	$(MAKE) _pytest _INTERNAL_FLAGS="-m 's3'" _CACHE_CLEAR=$(_CACHE_CLEAR) AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN)
 
 test--smoke: aws--login ## Run end-to-end smoke tests (pytest)
-	$(MAKE) _pytest _INTERNAL_FLAGS="-m 'smoke'" _CACHE_CLEAR=$(_CACHE_CLEAR) AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN)
+	$(MAKE) _pytest _INTERNAL_FLAGS="-m 'smoke' --ignore=src/layers --ignore=src/etl" _CACHE_CLEAR=$(_CACHE_CLEAR) AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN)
 
 test--%--rerun: ## Rerun failed integration or unit (pytest) tests
 	$(MAKE) test--$* _INTERNAL_FLAGS="--last-failed --last-failed-no-failures none" _CACHE_CLEAR=

src/api/tests/smoke_tests/test_smoke.py

@@ -1,4 +1,5 @@
 import json
+import os
 
 import pytest
 import requests
@@ -45,8 +46,10 @@ def read_organization(base_url: str, headers: dict):
 
 @pytest.mark.smoke
 def test_smoke_tests():
-    workspace = read_terraform_output("workspace.value")
-    environment = read_terraform_output("environment.value")
+    workspace = os.environ.get("WORKSPACE") or read_terraform_output("workspace.value")
+    environment = os.environ.get("ACCOUNT") or read_terraform_output(
+        "environment.value"
+    )
     app_key = get_app_key(environment=environment)
     headers = get_headers(app_key=app_key)
     base_url = get_base_url(workspace=workspace, environment=environment)

src/layers/etl_utils/ldif/tests/test_ldif.py

@@ -1,5 +1,4 @@
 from io import BytesIO, StringIO
-from tempfile import NamedTemporaryFile
 from unittest import mock
 
 import boto3
@@ -11,7 +10,6 @@
     parse_ldif,
 )
 from moto import mock_aws
-from pytest_lazyfixture import lazy_fixture
 
 # Lifted from https://ldap.com/ldif-the-ldap-data-interchange-format/
 SAMPLE_LDIF_DATA = """
@@ -105,14 +103,6 @@
 ]
 
 
-@pytest.fixture
-def sample_ldif_data_as_filepath():
-    with NamedTemporaryFile() as f:
-        f.write(SAMPLE_LDIF_DATA.encode())
-        f.seek(0)
-        yield f.name
-
-
 @pytest.mark.parametrize(
     ("raw_distinguished_name", "parsed_distinguished_name"),
     (
@@ -143,11 +133,7 @@ def test_distinguished_name(raw_distinguished_name, parsed_distinguished_name):
 
 @pytest.mark.parametrize(
     ("file_opener", "path_or_data"),
-    (
-        [StringIO, SAMPLE_LDIF_DATA],
-        [BytesIO, SAMPLE_LDIF_DATA.encode()],
-        [open, lazy_fixture("sample_ldif_data_as_filepath")],
-    ),
+    ([StringIO, SAMPLE_LDIF_DATA], [BytesIO, SAMPLE_LDIF_DATA.encode()]),
 )
 def test_parse_ldif(file_opener, path_or_data):
     parsed_ldif = list(parse_ldif(file_opener=file_opener, path_or_data=path_or_data))

src/test_helpers/aws_session.py

@@ -34,7 +34,7 @@ def _get_access_token(account_id: str = None):
 
 @cache
 def aws_session_env_vars() -> boto3.Session:
-    env = read_terraform_output("environment.value")
+    env = os.environ.get("ACCOUNT") or read_terraform_output("environment.value")
     account_id = _aws_account_id_from_secret(env=env)
     access_key_id, secret_access_key, session_token = _get_access_token(
         account_id=account_id