cleanup-appconfig-and-lambda-layer-versions.yml

name: 'Cleanup Untracked App Config Profiles and Lambda Layer Versions'

on:
  workflow_call:
    inputs:
      build_branch:
        description: 'Feature branch to push to sandbox.'
        required: true
        type: 'string'
      sandbox:
        description: 'Which Sandbox to push to.'
        required: true
        type: 'string'
      environment:
        description: "Which environment should this run against"
        required: true
        type: "string"
      python_version:
        description: "Version of Python to run the cleanup script against"
        required: true
        type: "string"
    secrets:
      AWS_ASSUME_ROLE:
        required: true


permissions:
  pull-requests: write
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

jobs:
  view_action_parameters:
    name: View Deploy all input variables
    runs-on: ubuntu-latest
    steps:
      - name: Display client passed variables
        run: |
          echo Python Version: ${{ inputs.python_version }}
          echo Build Branch: ${{ inputs.build_branch }}
          echo Environment: ${{ inputs.environment }}
          echo Sandbox: ${{ inputs.sandbox }}

  cleanup_process:
    name: Run Cleanup Versions script
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          repository: 'nhsconnect/national-document-repository-infrastructure'
          ref: ${{ inputs.build_branch }}
          fetch-depth: '0'

      - name: Set up Python ${{ inputs.python_version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ inputs.python_version }}

      - name: Make virtual environment
        run: |
          python3 -m venv ./venv
          ./venv/bin/pip3 install --upgrade pip
          ./venv/bin/pip3 install boto3==1.33.11

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
          role-skip-session-tagging: true
          aws-region: ${{ vars.AWS_REGION }}

      - name: Run Version Cleanup Script
        run: |
          ./venv/bin/python3 scripts/cleanup_versions.py ${{ inputs.sandbox }}