Skip to content

[DTOSS-12358] - feat(ci): add smoke test token parameter and configuration#1085

Open
josielsouzanordcloud wants to merge 9 commits intomainfrom
DTOSS-12358-waf-smoke-test-issue
Open

[DTOSS-12358] - feat(ci): add smoke test token parameter and configuration#1085
josielsouzanordcloud wants to merge 9 commits intomainfrom
DTOSS-12358-waf-smoke-test-issue

Conversation

@josielsouzanordcloud
Copy link
Contributor

Description

This pull request adds a smoke test token parameter and configuration to the deployment pipeline and Terraform setup. The changes include:

  • Adding a smokeTestToken parameter to both Azure DevOps and GitHub CI pipelines.
  • Updating the .github/workflows/stage-4-deploy.yaml file to generate a random smoke test token during the deployment process and pass it to the pipeline.
  • Modifying the infrastructure/modules/container-apps/front_door.tf file to include a custom WAF rule that allows requests with a specific User-Agent header (containing the smoke test token) to bypass the firewall.
  • Adding variables enable_smoke_test_bypass and smoke_test_token to both Terraform and module variable files, and propagating them through the infrastructure setup.
  • Updating the scripts/bash/container_app_smoke_test.sh script to include the smoke test token in the User-Agent header of requests.

These changes are necessary to enable a more secure smoke testing process while allowing specific test requests to bypass the firewall rules in development and review environments.

Type of change

  • Bug fix
  • New feature
  • Breaking change
  • Infrastructure change
  • Pipeline / CI
  • Documentation update
  • Refactor

Jira link

DTOSS-12358

Review notes

  • Pipeline Configuration: Ensure that the smokeTestToken parameter is correctly passed through all deployment stages and environments.
  • Terraform Variable Propagation: Verify that the enable_smoke_test_bypass and smoke_test_token variables are correctly set in all environment variable files (variables.tfvars) and propagated to the Terraform modules.
  • WAF Rule Addition: Check that the custom WAF rule is correctly configured to allow smoke test requests based on the User-Agent header.

Breaking changes

None

Impact

  • Deployment: The deployment pipeline now includes a step for generating a random smoke test token during the GitHub Actions workflow.
  • Services: The smoke testing process will use a specific User-Agent header containing the token to bypass WAF rules in dev and review environments.
  • Security: Adds an additional layer of security by allowing controlled access to certain resources for smoke tests.
  • Cost: No impact on cost; changes are within existing infrastructure.

Review checklist

  • Check database queries are correctly scoped to current_provider

Adds a `smokeTestToken` parameter to the Azure DevOps pipeline and GitHub Actions workflow, allowing for a dynamic token in the deployment process. Updates the Terraform configuration to include this token and adds a WAF rule in the container apps module to bypass firewall rules using this token. Also, modifies the smoke test script to use this token.

Refs: DTOSS-12358
…): increase smoke test timeout for PR environments

Increase the smoke test timeout to accommodate Front Door certificate provisioning in PR environments. Add masking of the SMOKE_TEST_TOKEN in the CI workflow.

Refs: DTOSS-12358
…policy

Adds a conditional configuration to enable or disable the smoke test bypass rule in the CDN front door firewall policy.

Refs: DTOSS-12358
@github-actions
Copy link

github-actions bot commented Mar 4, 2026

The review app is available at this URL:
https://pr-1085.manage-breast-screening.non-live.screening.nhs.uk
You must authenticate with HTTP basic authentication. Ask the team for credentials.

@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 4, 2026

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 4, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant