Release Request

.github/workflows/build_and_deploy.yml

@@ -190,4 +190,11 @@ jobs:
       - run: echo VERSION_REF=$(aws cloudformation list-exports --query "Exports[?Name=='${{ inputs.app_name }}-${{ inputs.env_type }}-${{ inputs.account_type }}-backend-version'].Value" --output text) | tee -a $GITHUB_ENV
       - run: echo RUNNING_VERSION_REF=$(aws elasticbeanstalk describe-environments | jq -r '.Environments | map(select(.EnvironmentName == "${{ inputs.app_name }}-${{ inputs.env_type }}")) | .[] | .VersionLabel') | tee -a $GITHUB_ENV
       - if: env.VERSION_REF != env.RUNNING_VERSION_REF
-        run: echo "current version does not match deployed version"; exit 1
+        run: echo "current version does not match deployed version"; exit 1
+
+  call-deployment-tests:
+    needs: [ deploy ]
+    uses: ./.github/workflows/test_deployment.yml
+    with:
+      execution-environment: ${{ inputs.env_type }}
+    secrets: inherit

.github/workflows/test_deployment.yml

@@ -0,0 +1,48 @@
+
+# This waits for the backend to be available and then performs the deployment tests.
+# The deployment tests are available in the 'deployment' folder in the root of the project.
+
+name: Test Deployment
+run-name: "Test deployment for the ${{ inputs.execution-environment }} environment"
+
+on:
+  workflow_call:
+    inputs:
+      execution-environment:
+        description: "Environment"
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      execution-environment:
+        type: choice
+        description: "Environment"
+        required: true
+        default: 'BETA'
+        options:
+        - BETA
+        - PROD
+
+jobs:
+  deployment-tests:
+    # Only run the checks when on the default or release branch
+    if: github.ref_name == 'master' || github.ref_name == 'release' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    environment: ${{ inputs.execution-environment }}
+    env:
+      URL: ${{ vars.URL }}
+    defaults:
+      run:
+        working-directory: deployment
+    steps:
+      - uses: actions/checkout@v6
+      - name: Wait for the backend to start up and serve the index
+        run: curl -I --show-error --silent --retry 10 --retry-connrefused --retry-delay 10 ${{ env.URL }}
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: 'deployment/.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: '**/package-lock.json'
+      - run: npm ci
+      - run: npm test

aws/eb-env.yaml

@@ -319,9 +319,6 @@ Resources:
         - Namespace: "aws:autoscaling:launchconfiguration"
           OptionName: "InstanceType"
           Value: !Ref instanceSize
-        - Namespace: "aws:autoscaling:launchconfiguration"
-          OptionName: "SSHSourceRestriction"
-          Value: "tcp,22,22,0.0.0.0/0"
         - ResourceName: "AWSEBEC2LaunchTemplate"
           Namespace: "aws:autoscaling:launchconfiguration"
           OptionName: "SecurityGroups"
@@ -357,10 +354,6 @@ Resources:
         - Namespace: "aws:elasticbeanstalk:command"
           OptionName: "DeploymentPolicy"
           Value: !If [isProd, "Immutable", "AllAtOnce"]
-        - Namespace: "aws:elasticbeanstalk:control"
-          OptionName: "DefaultSSHPort"
-          Value: "22"
-          #  Fn::ImportValue: !Sub "${orgName}-${accountType}-ssh-port"
         ## LOad Balancer bits
         - Namespace: "aws:elasticbeanstalk:environment"
           OptionName: "EnvironmentType"

deployment/.env.example

@@ -0,0 +1 @@
+URL=<tool support url e.g. https://tools.canvas.ox.ac.uk/>

deployment/.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+.env
+playwright-report/
+test-results/

deployment/.nvmrc

@@ -0,0 +1 @@
+24

deployment/README.md

@@ -0,0 +1,16 @@
+# Deployment Playwright Tests
+
+This directory contains Playwright smoke tests for deployment checks.
+
+## Install
+
+```bash
+cd deployment
+npm install
+```
+
+## Run
+
+```bash
+npm test
+```

deployment/deployment.test.js

@@ -0,0 +1,32 @@
+import { test, expect } from '@playwright/test'
+import 'dotenv/config'
+
+test('smoke check: JWKS endpoint returns a valid JWK Set', async ({ request }) => {
+  const url = process.env.URL
+  if (!url) {
+    throw new Error("URL not configured.")
+  }
+
+  const jwksUrl = new URL('/.well-known/jwks.json', url).toString()
+
+  const response = await request.get(jwksUrl)
+  expect(response.ok()).toBeTruthy()
+
+  const body = await response.json()
+  expect(body).toEqual(expect.objectContaining({ keys: expect.any(Array) }))
+  expect(body.keys.length).toBeGreaterThan(0)
+
+  for (const key of body.keys) {
+    expect(key).toEqual(expect.objectContaining({
+      kty: 'RSA',
+      kid: expect.any(String),
+      use: 'sig',
+      alg: 'RS256',
+      n: expect.any(String),
+      e: expect.any(String),
+    }))
+
+    expect(key.n).toEqual(expect.any(String))
+    expect(key.e).toEqual(expect.any(String))
+  }
+})

deployment/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "tool-support-deployment-tests",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Playwright smoke tests for deployed tool-support endpoints",
+  "scripts": {
+    "install-browsers": "npx playwright install --with-deps chromium",
+    "test": "playwright test",
+    "test:ci": "CI=true npm test",
+    "test:report": "npx playwright show-report"
+  },
+  "devDependencies": {
+    "@playwright/test": "^1.60.0",
+    "dotenv": "^17.4.2"
+  }
+}

deployment/playwright.config.js

@@ -0,0 +1,6 @@
+import { defineConfig } from '@playwright/test'
+
+export default defineConfig({
+  timeout: 60000,
+  retries: 2
+})