@newskit-render/core 0.0.0-d55b7d88

package/infrastructure/.circleci/config.yml

@@ -0,0 +1,1187 @@
+version: 2.1
+
+parameters:
+  run_build_workflow:
+    type: boolean
+    default: true
+  run_deploy_to_dev_workflow:
+    type: boolean
+    default: false
+  run_deploy_to_staging_workflow:
+    type: boolean
+    default: false
+  run_deploy_to_prod_workflow:
+    type: boolean
+    default: false
+
+orbs:
+  slack: circleci/slack@3.4.2
+  browser-tools: circleci/browser-tools@1.3.0
+  release-api: nukengprod/release-api@0.5.8
+  aws-cli: circleci/aws-cli@3.1
+
+executors:
+  helm:
+    docker:
+      - image: nukengprodservice/helm:0.1.181
+        auth:
+          username: ${DOCKER_USERNAME}
+          password: ${DOCKER_PASSWORD}
+    resource_class: xlarge
+
+  node:
+    docker:
+      - image: cimg/node:18.17.0-browsers
+        auth:
+          username: ${DOCKER_USERNAME}
+          password: ${DOCKER_PASSWORD}
+    resource_class: xlarge
+
+  terraform:
+    docker:
+      - image: hashicorp/terraform:1.3.9
+        auth:
+          username: ${DOCKER_USERNAME}
+          password: ${DOCKER_PASSWORD}
+    resource_class: xlarge
+
+commands:
+  aws_assume_role:
+    description: Assume AWS role
+    parameters:
+      aws_access_key_id:
+        description: AWS Access Key Id
+        type: string
+        default: '${AWS_ACCESS_KEY_ID}'
+      aws_secret_key:
+        description: AWS Secret Key
+        type: string
+        default: '${AWS_SECRET_ACCESS_KEY}'
+      aws_assume_role_arn:
+        description: AWS ARN For Assume Role
+        type: string
+        default: '${AWS_ASSUME_ROLE_ARN}'
+      aws_region:
+        description: AWS region
+        type: string
+        default: 'eu-west-1'
+      job_type:
+        description: The job type to be used
+        type: string
+        default: 'default'
+      eks_cluster:
+        description: EKS cluster for kubeconfig
+        type: string
+        default: '${AWS_EKS_CLUSTER}'
+      update_kubeconfig:
+        description: Whether to create a kubeconfig
+        type: boolean
+        default: false
+    steps:
+      - run:
+          name: Assume AWS role
+          command: |
+            export AWS_ACCESS_KEY_ID=<< parameters.aws_access_key_id >>
+            export AWS_SECRET_ACCESS_KEY=<< parameters.aws_secret_key >>
+            export temp_role=$(aws sts assume-role \
+                    --role-arn "<< parameters.aws_assume_role_arn >>" \
+                    --role-session-name "circle-ci-assume")
+            export AWS_ACCESS_KEY_ID_TEMP=$(echo $temp_role | jq .Credentials.AccessKeyId | xargs)
+            export AWS_SECRET_ACCESS_KEY_TEMP=$(echo $temp_role | jq .Credentials.SecretAccessKey | xargs)
+            export AWS_SESSION_TOKEN_TEMP=$(echo $temp_role | jq .Credentials.SessionToken | xargs)
+            echo "export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID_TEMP" >> $BASH_ENV
+            echo "export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY_TEMP" >> $BASH_ENV
+            echo "export AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN_TEMP" >> $BASH_ENV
+            source $BASH_ENV
+            cat $BASH_ENV | grep AWS_ACCESS_KEY_ID >> assume_role_creds_<< parameters.job_type >>.txt
+            cat $BASH_ENV | grep AWS_SECRET_ACCESS_KEY >> assume_role_creds_<< parameters.job_type >>.txt
+            cat $BASH_ENV | grep AWS_SESSION_TOKEN >> assume_role_creds_<< parameters.job_type >>.txt
+      - when:
+          condition: << parameters.update_kubeconfig >>
+          steps:
+            - run:
+                name: Update kubeconfig clustername
+                command: aws --region << parameters.aws_region >> eks update-kubeconfig --name << parameters.eks_cluster >>
+            - run:
+                name: Update kubectl credentials
+                command: cp ~/.kube/config kube_<< parameters.job_type >>.config
+      - persist_to_workspace:
+          root: ./
+          paths:
+            - assume_role_creds_<< parameters.job_type >>.txt
+            - kube_<< parameters.job_type >>.config
+
+  aws_assume_role_file:
+    description: Assume AWS role from the workspace file
+    parameters:
+      job_type:
+        description: The job type to be used
+        type: string
+        default: 'default'
+    steps:
+      - run:
+          name: Assume role from file
+          command: |
+            cat assume_role_creds_<< parameters.job_type >>.txt >> $BASH_ENV
+            source $BASH_ENV
+
+  terraform_init:
+    description: Run Terraform Init
+    parameters:
+      path:
+        type: string
+      terraform_arg:
+        description: provide terraform arguments
+        type: string
+        default: ''
+    steps:
+      - run:
+          name: Terraform init
+          command: |
+            source $BASH_ENV
+            cd << parameters.path >>
+            terraform init << parameters.terraform_arg >>
+
+  terraform_plan:
+    description: Run Terraform Plan
+    parameters:
+      path:
+        type: string
+      terraform_arg:
+        description: provide terraform arguments
+        type: string
+        default: ''
+    steps:
+      - run:
+          name: Terraform plan
+          command: |
+            source $BASH_ENV
+            cd << parameters.path >>
+            terraform plan -out=tfplan -input=false << parameters.terraform_arg >>
+
+  terraform_apply:
+    description: Run Terraform Apply
+    parameters:
+      path:
+        type: string
+    steps:
+      - run:
+          name: Terraform apply
+          command: |
+            source $BASH_ENV
+            cd << parameters.path >>
+            terraform apply -input=false tfplan
+
+  terraform_force_apply:
+    description: Run Terraform Apply
+    parameters:
+      path:
+        type: string
+    steps:
+      - run:
+          name: Terraform forced apply
+          command: |
+            source $BASH_ENV
+            cd << parameters.path >>
+            terraform apply -auto-approve
+
+  git_config_user:
+    description: Configure git user
+    parameters:
+      user:
+        type: string
+        default: ${GIT_USERNAME}
+      email:
+        type: string
+        default: '${GIT_EMAIL}'
+    steps:
+      - run:
+          name: Configure git user
+          command: |
+            git config --global user.email "<< parameters.email >>"
+            git config --global user.name "<< parameters.user >>"
+
+  # This job relies on working with Pull Requests
+  set_helm_environment:
+    description: 'Set environment variables for helm'
+    parameters:
+      environment:
+        type: string
+      release:
+        description: Helm release name i.e ncu-newskit-render
+        type: string
+        default: <% HELM_RELEASE_NAME >
+      namespace:
+        description: Kubernetes namespace
+        type: string
+      node_env:
+        description: Node environment name
+        type: string
+        default: production
+    steps:
+      - run:
+          name: 'Set environment variables for helm'
+          command: |
+            export PKG_VERSION=$(jq -r .version package.json)
+            echo "export PKG_VERSION=$PKG_VERSION" >> $BASH_ENV
+            echo 'export KUBECONFIG=$(pwd)/kube_eks_<< parameters.environment >>.config' >> $BASH_ENV
+            echo 'export HELM_OPT_NAMESPACE="-n << parameters.namespace >>"' >> $BASH_ENV
+            echo 'export HELM_VAL_ENV=<< parameters.environment >>' >> $BASH_ENV
+            echo 'export NODE_ENV=<< parameters.node_env >>' >> $BASH_ENV
+            if [ -n "$CIRCLE_PULL_REQUEST" ]; then
+              export PR_NUMBER=$(echo ${CIRCLE_PULL_REQUEST} |rev | cut -d "/" -f1 |rev)
+              echo "export PR_NUMBER=$PR_NUMBER" >> $BASH_ENV
+              echo 'export HELM_OPT_SET="--set alb.prSuffix=pr-$PR_NUMBER"' >> $BASH_ENV
+              echo 'export HELM_OPT_SET="$HELM_OPT_SET --set image.tag=PR-$PR_NUMBER "' >> $BASH_ENV
+              echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.NEWSKIT_API_X_API_KEY=${NEWSKIT_API_X_API_KEY}"' >> $BASH_ENV
+              echo 'export HELM_NAME="<< parameters.release >>-pr$PR_NUMBER"' >> $BASH_ENV
+            else
+              export PR_NUMBER=$(git log --format=%B -n 1 HEAD | grep -oE -m 1 '\(#[0-9]+\)' | grep -oE '[0-9]+')
+              echo "export PR_NUMBER=$PR_NUMBER" >> $BASH_ENV
+              echo 'export HELM_OPT_SET="--set image.tag=$PKG_VERSION "' >> $BASH_ENV
+              echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.NEWSKIT_API_X_API_KEY=${NEWSKIT_API_X_API_KEY}"' >> $BASH_ENV
+              if [ "<< parameters.environment >>" = pr  ]; then
+                echo 'export HELM_NAME="<< parameters.release >>-pr$PR_NUMBER"' >> $BASH_ENV
+              else
+                echo 'export HELM_NAME="<< parameters.release >>"' >> $BASH_ENV
+              fi
+            fi
+
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set envs.SOURCEPOINT_ACCOUNT_ID=${SOURCEPOINT_ACCOUNT_ID}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set envs.SOURCEPOINT_PROPERTY_HREF=${SOURCEPOINT_PROPERTY_HREF}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set envs.SOURCEPOINT_PROPERTY_ID=${SOURCEPOINT_PROPERTY_ID}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set envs.EXPERIMENTATION_WEB=${EXPERIMENTATION_WEB}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set envs.TEALIUM_ACCOUNT_ID=${TEALIUM_ACCOUNT_ID}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set envs.TEALIUM_PROFILE_ID=${TEALIUM_PROFILE_ID}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set envs.TEALIUM_ENV=${TEALIUM_ENV}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.NEW_RELIC_LICENSE_KEY=${NEW_RELIC_LICENSE_KEY}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.ACCOUNT_PROVIDER_GRAPHQL_URL=${ACCOUNT_PROVIDER_GRAPHQL_URL}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.ACCOUNT_PROVIDER_INTERNAL_AUTH0_DOMAIN=${ACCOUNT_PROVIDER_INTERNAL_AUTH0_DOMAIN}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.ACCOUNT_PROVIDER_INTERNAL_CONNECTION=${ACCOUNT_PROVIDER_INTERNAL_CONNECTION}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.ACCOUNT_PROVIDER_INTERNAL_CLIENT_ID=${ACCOUNT_PROVIDER_INTERNAL_CLIENT_ID}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.STRIPE_KEY=${STRIPE_KEY}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.LOQACCOUNT_KEY=${LOQACCOUNT_KEY}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.OKTA_CLIENT_ID=${OKTA_CLIENT_ID}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.OKTA_CLIENT_SECRET=${OKTA_CLIENT_SECRET}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.OKTA_DOMAIN=${OKTA_DOMAIN}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.NEXTAUTH_URL=${NEXTAUTH_URL}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.NEXTAUTH_SECRET=${NEXTAUTH_SECRET}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.SN_PASSWORD=${SN_PASSWORD}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.SN_USERNAME=${SN_USERNAME}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.SN_ENVIRONMENT=${SN_ENVIRONMENT}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.ZUORA_PAGE_ID=${ZUORA_PAGE_ID}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.ZUORA_RSA_SIGNATURE_URI=${ZUORA_RSA_SIGNATURE_URI}"' >> $BASH_ENV
+            echo 'export HELM_OPT_SET="$HELM_OPT_SET --set secret.items.OPTIMIZELY_SDK_KEY=${OPTIMIZELY_SDK_KEY}"' >> $BASH_ENV
+            echo 'export HELM_PATH="helm"' >> $BASH_ENV
+            echo 'export HELM_VALUES="--values $HELM_PATH/values-$HELM_VAL_ENV.yaml"' >> $BASH_ENV
+            echo 'export HELM_INSTALL="helm install --atomic $HELM_VALUES $HELM_OPT_SET $HELM_OPT_NAMESPACE"' >> $BASH_ENV
+            echo 'export HELM_UNINSTALL="helm uninstall $HELM_OPT_NAMESPACE"' >> $BASH_ENV
+            echo 'export HELM_LIST="helm list $HELM_OPT_NAMESPACE"' >> $BASH_ENV
+            echo 'export HELM_LIST_ALL="$HELM_LIST --all --short"' >> $BASH_ENV
+            echo 'export HELM_UPGRADE="helm upgrade --atomic $HELM_VALUES $HELM_OPT_SET $HELM_OPT_NAMESPACE"' >> $BASH_ENV
+
+jobs:
+  init_aws:
+    parameters:
+      aws_access_key_id:
+        description: AWS Access Key Id
+        type: string
+        default: '${AWS_ACCESS_KEY_ID}'
+      aws_secret_key:
+        description: AWS Secret Key
+        type: string
+        default: '${AWS_SECRET_ACCESS_KEY}'
+      aws_assume_role_arn:
+        description: AWS ARN For Assume Role
+        type: string
+        default: '${AWS_ASSUME_ROLE_ARN}'
+      job_type:
+        type: string
+        default: 'default'
+      update_kubeconfig:
+        type: boolean
+        default: true
+    working_directory: ~/project
+    executor: helm
+    steps:
+      - run:
+          name: Install openssh client
+          command: apk add openssh-client
+      - checkout
+      - aws_assume_role:
+          aws_access_key_id: << parameters.aws_access_key_id >>
+          aws_secret_key: << parameters.aws_secret_key >>
+          aws_assume_role_arn: << parameters.aws_assume_role_arn >>
+          job_type: << parameters.job_type >>
+          update_kubeconfig: << parameters.update_kubeconfig >>
+  init_aws_oidc:
+    parameters:
+      aws_oidc_role_arn:
+        description: AWS Access Key Id
+        type: string
+        default: ${AWS_OIDC_ROLE_ARN_ECR}
+      job_type:
+        type: string
+        default: 'default'
+    executor: aws-cli/default
+    working_directory: ~/project
+    steps:
+      - checkout
+      - aws-cli/setup:
+          profile-name: cci-ecr
+          role-arn: << parameters.aws_oidc_role_arn >>
+          role-session-name: cci-ecr-session
+      - run:
+          name: save to file
+          command: |
+            source $BASH_ENV
+            cat $BASH_ENV | grep AWS_ACCESS_KEY_ID >> assume_role_creds_<< parameters.job_type >>.txt
+            cat $BASH_ENV | grep AWS_SECRET_ACCESS_KEY >> assume_role_creds_<< parameters.job_type >>.txt
+            cat $BASH_ENV | grep AWS_SESSION_TOKEN >> assume_role_creds_<< parameters.job_type >>.txt
+      - persist_to_workspace:
+          root: ./
+          paths:
+            - assume_role_creds_<< parameters.job_type >>.txt
+
+  deploy_terraform:
+    parameters:
+      team:
+        description: Used to generate the S3 bucket key i.e. product-platforms
+        type: string
+        default: <% TEAM >
+      project:
+        description: Used to generate the S3 bucket key i.e. ncu-newskit-render
+        type: string
+      folder:
+        description: Used to generate the S3 bucket key and navigate to terraform folder i.e. infrastructure-ecr
+        type: string
+      environment:
+        type: string
+        default: dev
+      apply:
+        type: boolean
+        default: false
+    working_directory: ~/project
+    executor: terraform
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - aws_assume_role_file
+      - terraform_init:
+          path: << parameters.folder >>
+          terraform_arg: -backend-config="key=<<parameters.team >>/<< parameters.project >>/<< parameters.folder >>/<< parameters.environment >>/terraform.tfstate"
+      - terraform_plan:
+          path: << parameters.folder >>
+          terraform_arg: -var-file=<< parameters.environment >>.tfvars
+      - when:
+          condition: << parameters.apply >>
+          steps:
+            - terraform_apply:
+                path: << parameters.folder >>
+
+  install_deps:
+    working_directory: ~/project
+    executor: node
+    steps:
+      - checkout
+      - restore_cache:
+          keys:
+            - <% PACKAGE_MANAGER >-build-{{ .Environment.BUILD_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+            - <% PACKAGE_MANAGER >-build-{{ .Environment.BUILD_CACHE_VERSION }}-
+      - restore_cache:
+          keys:
+            - cypress-{{ .Environment.CYPRESS_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+      - run:
+          name: 'Install dependencies'
+          command: <% PACKAGE_INSTALL >
+      - run:
+          name: 'Build the project'
+          command: <% PACKAGE_RUN > build
+      - save_cache:
+          key: <% PACKAGE_MANAGER >-build-{{ .Environment.BUILD_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+          paths:
+            - ~/.cache/yarn
+            - ~/.npm
+            - node_modules
+            - .next/cache
+      - save_cache:
+          key: cypress-{{ .Environment.CYPRESS_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+          paths:
+            - ~/.cache/Cypress
+      - persist_to_workspace:
+          root: ./
+          paths: .next
+
+  lint:
+    executor: node
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - restore_cache:
+          keys:
+            - <% PACKAGE_MANAGER >-build-{{ .Environment.BUILD_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+      - run:
+          name: 'Run lint'
+          command: <% PACKAGE_RUN > lint
+
+  test_unit:
+    executor: node
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - restore_cache:
+          keys:
+            - <% PACKAGE_MANAGER >-build-{{ .Environment.BUILD_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+      - run:
+          name: 'Run tests'
+          command: |
+            mkdir tests
+            <% PACKAGE_RUN > test:unit:ci
+          environment:
+            JEST_JUNIT_OUTPUT_DIR: /home/circleci/project/tests
+      - store_test_results:
+          path: tests
+      - store_artifacts:
+          path: tests
+          destination: tests
+
+  e2e_test:
+    executor: node
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - restore_cache:
+          keys:
+            - <% PACKAGE_MANAGER >-build-{{ .Environment.BUILD_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+      - restore_cache:
+          keys:
+            - cypress-{{ .Environment.CYPRESS_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+      - run:
+          name: 'Export Newskit API variables'
+          command: |
+            echo "export NEWSKIT_API_X_API_KEY=$NEWSKIT_API_X_API_KEY" >> $BASH_ENV
+            echo "export NEWSKIT_API_ENV_URL=$NEWSKIT_API_ENV_URL" >> $BASH_ENV
+      - run:
+          name: 'install cypress dependencies'
+          command: |
+            sudo apt-get update
+            sudo apt-get install libgtk2.0-0 libgtk-3-0 libgbm-dev libnotify-dev libgconf-2-4 libnss3 libxss1 libasound2 libxtst6 xauth xvfb
+      - browser-tools/install-chrome
+      - browser-tools/install-chromedriver
+      - run:
+          name: Check chrome install
+          command: |
+            google-chrome --version
+            chromedriver --version
+      - run:
+          name: 'start server'
+          command: |
+            yarn start:test:server
+          background: true
+      - run:
+          name: 'Wait test server'
+          command: |
+            yarn wait:server
+      - run:
+          name: 'Run e2e tests'
+          command: |
+            <% PACKAGE_RUN > test:e2e
+      - store_artifacts:
+          path: cypress/screenshots
+      - store_artifacts:
+          path: cypress/videos
+
+  publish_docker:
+    parameters:
+      project:
+        description: Project name that will be used to tag docker images i.e ncu-newskit-render
+        type: string
+        default: <% PROJECT_NAME >
+      dockerfile:
+        type: string
+        default: "Dockerfile.withNewRelic"
+    working_directory: ~/project
+    executor: node
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - restore_cache:
+          keys:
+            - <% PACKAGE_MANAGER >-build-{{ .Environment.BUILD_CACHE_VERSION }}-{{ checksum "<% PACKAGE_MANAGER_LOCK_FILE >" }}
+      - setup_remote_docker
+      - run:
+          name: Install aws cli
+          command: |
+            sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4EB27DB2A3B88B8B
+            sudo apt-get update
+            sudo apt-get install python-is-python3 python3-pip
+            sudo pip install awscli
+      - aws_assume_role_file
+      - run:
+          name: Publish Docker containers to AWS ECR
+          command: |
+            if [ -n "$CIRCLE_PULL_REQUEST" ]; then
+              export PR_NUMBER=$(echo ${CIRCLE_PULL_REQUEST} |rev | cut -d "/" -f1 |rev)
+              TAGS="PR-$PR_NUMBER"
+            else
+              TAG_VERSION=$(jq -r .version package.json)
+              TAGS="$TAG_VERSION latest"
+            fi
+            DOCKER_REGISTRY_URL="$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com"
+
+            <% PACKAGE_DOCKER_BUILD >
+
+            echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin
+            docker build -f << parameters.dockerfile >> -t << parameters.project >> .
+            $(aws ecr get-login --no-include-email)
+            for tag in $TAGS; do
+              docker tag << parameters.project >> $DOCKER_REGISTRY_URL/<< parameters.project >>:$tag;
+              docker push $DOCKER_REGISTRY_URL/<< parameters.project >>:$tag;
+            done
+
+  uninstall_helm:
+    parameters:
+      environment:
+        description: Environment name
+        type: string
+      release:
+        description: Helm release name i.e ncu-newskit-render
+        type: string
+        default: <% HELM_RELEASE_NAME >
+      namespace:
+        description: Kubernetes namespace without environment suffix
+        type: string
+        default: <% K8S_NAMESPACE >
+    working_directory: ~/project
+    executor: helm
+    steps:
+      - run:
+          name: Install ssh client
+          command: apk add openssh-client
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - aws_assume_role_file:
+          job_type: eks_<< parameters.environment >>
+      - set_helm_environment:
+          environment: << parameters.environment >>
+          release: << parameters.release >>
+          namespace: << parameters.namespace>>-<< parameters.environment >>
+      - run:
+          name: Helm uninstall
+          command: |
+            source $BASH_ENV
+            if $HELM_LIST | grep -q $HELM_NAME; then $HELM_UNINSTALL $HELM_NAME; fi
+
+  remove_all_pr_environments:
+    parameters:
+      namespace:
+        description: Kubernetes namespace without environment suffix
+        type: string
+        default: <% K8S_NAMESPACE >
+    working_directory: ~/project
+    executor: helm
+    steps:
+      - run:
+          name: Install ssh client
+          command: apk add openssh-client
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - aws_assume_role_file:
+          job_type: eks_pr
+      - set_helm_environment:
+          environment: pr
+          namespace: << parameters.namespace>>-pr
+      - run:
+          name: Remove all PR environments
+          command: |
+            source $BASH_ENV
+            if [ -n "$($HELM_LIST_ALL)" ]; then $HELM_LIST_ALL | xargs $HELM_UNINSTALL; fi
+
+  upgrade_helm:
+    parameters:
+      environment:
+        description: Environment name
+        type: string
+      node_env:
+        description: Node environment name
+        type: string
+        default: production
+      create:
+        description: Whether to create a new Helm package
+        type: boolean
+        default: false
+      release:
+        description: Helm release name i.e ncu-newskit-render
+        type: string
+        default: <% HELM_RELEASE_NAME >
+      helm_repo:
+        description: Helm S3 repo url
+        type: string
+        default: s3://<% HELM_BUCKET_NAME >
+      namespace:
+        description: Kubernetes namespace without environment suffix
+        type: string
+        default: <% K8S_NAMESPACE >
+    working_directory: ~/project
+    executor: helm
+    steps:
+      - run:
+          name: Install ssh client
+          command: apk add openssh-client
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - set_helm_environment:
+          environment: << parameters.environment >>
+          node_env: << parameters.node_env >>
+          release: << parameters.release >>
+          namespace: << parameters.namespace >>-<< parameters.environment >>
+      - run:
+          name: Install helm s3 plugin
+          command: helm plugin install https://github.com/hypnoglow/helm-s3.git
+      - aws_assume_role_file
+      - when:
+          condition: << parameters.create >>
+          steps:
+            - run:
+                name: Helm package and upload
+                command: |
+                  source $BASH_ENV
+                  export HELM_S3_MODE=3
+                  if ! aws s3 ls << parameters.helm_repo >>/<< parameters.release >>/ | grep index.yaml; then
+                    helm s3 init << parameters.helm_repo >>/<< parameters.release >>
+                  else
+                    echo "Repo already initialized";
+                  fi
+                  helm repo add << parameters.release >> << parameters.helm_repo >>/<< parameters.release >>
+                  helm package -u --version $PKG_VERSION --app-version $PKG_VERSION $HELM_PATH;
+                  mv << parameters.release >>-*.tgz << parameters.release >>-$PKG_VERSION.tgz;
+                  if [ "$HELM_VAL_ENV" != "pr" ]; then
+                    helm s3 push --force ./<< parameters.release >>-$PKG_VERSION.tgz << parameters.release >>;
+                  fi
+      - unless:
+          condition: << parameters.create >>
+          steps:
+            - run:
+                name: Download helm chart
+                command: |
+                  source $BASH_ENV
+                  helm repo add << parameters.release >> << parameters.helm_repo >>/<< parameters.release >>
+                  helm pull << parameters.release >>/<< parameters.release >> --version $PKG_VERSION;
+
+      - aws_assume_role_file:
+          job_type: eks_<< parameters.environment >>
+      - run:
+          name: Helm deploy
+          command: |
+            source $BASH_ENV
+            $HELM_UPGRADE --install $HELM_NAME << parameters.release >>-*.tgz --version $PKG_VERSION
+      - when:
+          condition:
+            and:
+              - not:
+                  equal: [pr, << parameters.environment >>]
+          steps:
+            - run:
+                name: Add Deployment Marker to New Relic
+                command: |
+                  CURRENT_VERSION=$(jq -r .version ./package.json)
+                  APP_ID=$(curl -s -X GET "https://api.newrelic.com/v2/applications.json" -H "X-Api-Key:${TF_VAR_newrelic_api_key}" -G -d "filter[name]=<% PROJECT_PREFIX >:<% PROJECT_NAME >:<< parameters.environment >>" | jq -r '.applications[]' | jq -r '.id')
+                  curl -X POST "https://api.newrelic.com/v2/applications/$APP_ID/deployments.json" -H "Api-Key:${TF_VAR_newrelic_api_key}" -i -H "Content-Type: application/json" -d '{ "deployment": { "revision": "'$CURRENT_VERSION'" } }'
+
+  bump_version:
+    executor: node
+    working_directory: ~/project
+    steps:
+      - add_ssh_keys:
+          fingerprints:
+            - '<% SSH_KEY >'
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - git_config_user
+      - run:
+          name: Run standard-version
+          command: |
+            npx standard-version --releaseCommitMessageFormat='chore(release): {{currentTag}} [ci skip]'
+            git push --follow-tags origin master
+      - persist_to_workspace:
+          root: ./
+          paths:
+            - package.json
+
+  add_github_comment:
+    executor: node
+    steps:
+      - run:
+          name: Post a comment to GitHub
+          command: |
+            PR_RESPONSE=$(curl --location --request GET "https://api.github.com/repos/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME/pulls?head=$CIRCLE_PROJECT_USERNAME:$CIRCLE_BRANCH&state=open" \
+            -u $GIT_USERNAME:$GIT_ACCESS_TOKEN)
+
+            if [ $(echo $PR_RESPONSE | jq length) -eq 0 ]; then
+              echo "No PR found to update"
+            else
+              PR_COMMENT_URL=$(echo $PR_RESPONSE | jq -r ".[]._links.comments.href")
+              PR_NUMBER=$(echo ${CIRCLE_PULL_REQUEST##*/})
+            fi
+            curl --location --request POST "$PR_COMMENT_URL" \
+            -u $GIT_USERNAME:$GIT_ACCESS_TOKEN \
+            --header 'Content-Type: application/json' \
+            --data-raw '{
+             "body": "This PR has been automatically deployed [here]('https://pr-${PR_NUMBER}-<% PROJECT_NAME >.ceng-dev.newsuk.tech')."
+            }'
+
+  slack_deploy_approval:
+    parameters:
+      approval:
+        type: boolean
+        default: false
+      version:
+        type: string
+        default: ${CIRCLE_TAG}
+      package_name:
+        type: string
+        default: <% PROJECT_NAME >
+      environment:
+        type: string
+    executor: node
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - when:
+          condition: << parameters.approval >>
+          steps:
+            - slack/approval:
+                message: 'Deployment of << parameters.package_name >>@<< parameters.version >> to << parameters.environment >> requires approval'
+                webhook: ${SLACK_CIRCLECI_DEPLOYMENTS_WEBHOOK}
+                color: '#32a852'
+      - unless:
+          condition: << parameters.approval >>
+          steps:
+            - slack/approval:
+                message: '<< parameters.package_name >>@<< parameters.version >> is being deployed to << parameters.environment >>'
+                webhook: ${SLACK_CIRCLECI_DEPLOYMENTS_WEBHOOK}
+                color: '#32a852'
+
+  trigger_workflow_by_workspace:
+    parameters:
+      workflow:
+        type: string
+    executor: node
+    steps:
+      - checkout
+      - attach_workspace:
+          at: ~/project
+      - run:
+          command: cat package.json | jq -r .version
+      - run:
+          name: Trigger << parameters.workflow >>
+          command: |
+            set -x
+            VERSION=v$(cat package.json | jq -r .version)
+            .ci/trigger-circleci-workflow.sh << parameters.workflow >> $VERSION
+
+  trigger_workflow_by_circle_tag:
+    parameters:
+      workflow:
+        type: string
+    executor: node
+    steps:
+      - checkout
+      - run:
+          name: Trigger << parameters.workflow >>
+          command: |
+            .ci/trigger-circleci-workflow.sh << parameters.workflow >> $CIRCLE_TAG
+
+# Optional filters assuming trunk based development
+## For PR workflow
+only_on_pr_branch: &only_on_pr_branch
+  filters:
+    branches:
+      ignore:
+        - master
+        - main
+        - develop
+        # if you have release branches you might add
+        # - /^release.*/
+
+## For master workflow
+only_on_master_branch: &only_on_master_branch
+  filters:
+    branches:
+      only:
+        - master
+        - main
+
+only_on_tags: &only_on_tags
+  filters:
+    tags:
+      only: /^v.*/
+
+workflows:
+  pull_request:
+    jobs:
+      - install_deps:
+          name: install_deps
+          context: <% PROJECT_NAME >-dev
+          <<: *only_on_pr_branch
+      - lint:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          requires:
+            - install_deps
+      - test_unit:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          requires:
+            - install_deps
+      - e2e_test:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          name: e2e_test
+          requires:
+            - install_deps
+      - init_aws:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          name: init_aws_eks_pr
+          job_type: 'eks_pr'
+          requires:
+            - install_deps
+      - init_aws_oidc:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          name: aws_oidc
+          requires:
+            - install_deps
+            - test_unit
+            - lint
+      - deploy_terraform:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          name: deploy_terraform__<< matrix.folder >>
+          matrix:
+            parameters:
+              folder: [terraform-ecr, terraform-newrelic]
+          project: '<% PROJECT_NAME >'
+          apply: false
+          requires:
+            - aws_oidc
+      - publish_docker:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          name: publish_docker
+          dockerfile: "Dockerfile"
+          requires:
+            - install_deps
+            - aws_oidc
+      - upgrade_helm:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-dev
+          name: deploy_to_pr
+          create: true
+          environment: pr
+          node_env: development
+          requires:
+            - init_aws_eks_pr
+            - publish_docker
+      - add_github_comment:
+          <<: *only_on_pr_branch
+          context: <% PROJECT_NAME >-prod
+          requires:
+            - deploy_to_pr
+
+  remove_pr:
+    when:
+      not:
+        equal: [scheduled_pipeline, << pipeline.trigger_source >>]
+    jobs:
+      - init_aws:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: init_aws_eks_pr
+          job_type: 'eks_pr'
+      - uninstall_helm:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: destroy_pr
+          environment: pr
+          requires:
+            - init_aws_eks_pr
+
+  build_and_deploy:
+    when:
+      and:
+        - equal: [true, << pipeline.parameters.run_build_workflow >>]
+        - not:
+            equal: [scheduled_pipeline, << pipeline.trigger_source >>]
+    jobs:
+      - bump_version:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: bump_version
+      - install_deps:
+          name: install_deps
+          context: <% PROJECT_NAME >-dev
+          <<: *only_on_master_branch
+          requires:
+            - bump_version
+      - e2e_test:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: e2e_test
+          requires:
+            - install_deps
+      - init_aws:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: init_aws_eks_dev
+          job_type: 'eks_dev'
+          requires:
+            - install_deps
+      - init_aws_oidc:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: aws_oidc
+          requires:
+            - install_deps
+      - deploy_terraform:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: deploy_terraform_ecr
+          project: '<% PROJECT_NAME >'
+          folder: 'terraform-ecr'
+          environment: dev
+          apply: true
+          requires:
+            - aws_oidc
+      - publish_docker:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: publish_docker
+          requires:
+            - install_deps
+            - e2e_test
+            - aws_oidc
+            - deploy_terraform_ecr
+      - trigger_workflow_by_workspace:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: trigger_deploy_to_dev_workflow
+          workflow: deploy_to_dev_workflow
+          requires:
+            - publish_docker
+
+  deploy_to_dev_workflow:
+    when:
+      and:
+        - equal: [true, << pipeline.parameters.run_deploy_to_dev_workflow >>]
+        - not:
+            equal: [scheduled_pipeline, << pipeline.trigger_source >>]
+    jobs:
+      - slack_deploy_approval:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-dev
+          approval: false
+          environment: DEV
+      - install_deps:
+          name: install_deps
+          context: <% PROJECT_NAME >-dev
+          <<: *only_on_tags
+      - init_aws:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-dev
+          name: init_aws_eks_dev
+          job_type: 'eks_dev'
+          requires:
+            - install_deps
+      - init_aws_oidc:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-dev
+          name: aws_oidc_dev
+          requires:
+            - slack_deploy_approval
+      - upgrade_helm:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-dev
+          name: deploy_to_dev
+          create: true
+          environment: dev
+          node_env: development
+          requires:
+            - aws_oidc_dev
+            - init_aws_eks_dev
+      - deploy_terraform:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-dev
+          name: deploy_terraform_newrelic_dev
+          project: '<% PROJECT_NAME >'
+          folder: 'terraform-newrelic'
+          environment: dev
+          apply: true
+          requires:
+            - deploy_to_dev
+      - trigger_workflow_by_circle_tag:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-dev
+          name: trigger_deploy_to_staging_workflow
+          workflow: deploy_to_staging_workflow
+          requires:
+            - deploy_terraform_newrelic_dev
+
+  deploy_to_staging_workflow:
+    when:
+      and:
+        - equal:
+            [true, << pipeline.parameters.run_deploy_to_staging_workflow >>]
+        - not:
+            equal: [scheduled_pipeline, << pipeline.trigger_source >>]
+    jobs:
+      - slack_deploy_approval:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-stage
+          name: slack_deploy_approval
+          approval: true
+          environment: STAGING
+      - approve_deploy_to_staging:
+          <<: *only_on_tags
+          type: approval
+      - init_aws_oidc:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-stage
+          name: aws_oidc_staging
+          requires:
+            - approve_deploy_to_staging
+      - init_aws:
+          <<: *only_on_tags
+          name: init_aws_eks_staging
+          context: <% PROJECT_NAME >-stage
+          job_type: 'eks_staging'
+          requires:
+            - aws_oidc_staging
+      - upgrade_helm:
+          <<: *only_on_tags
+          name: deploy_to_staging
+          context: <% PROJECT_NAME >-stage
+          environment: staging
+          requires:
+            - init_aws_eks_staging
+      - deploy_terraform:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-stage
+          name: deploy_terraform_newrelic_staging
+          project: '<% PROJECT_NAME >'
+          folder: 'terraform-newrelic'
+          environment: staging
+          apply: true
+          requires:
+            - deploy_to_staging
+      - trigger_workflow_by_circle_tag:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-stage
+          name: trigger_deploy_to_prod_workflow
+          workflow: deploy_to_prod_workflow
+          requires:
+            - deploy_to_staging
+
+  deploy_to_prod_workflow:
+    when:
+      and:
+        - equal: [true, << pipeline.parameters.run_deploy_to_prod_workflow >>]
+        - not:
+            equal: [scheduled_pipeline, << pipeline.trigger_source >>]
+    jobs:
+      - slack_deploy_approval:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-prod
+          name: slack_deploy_approval
+          approval: true
+          environment: PROD
+      - approve_deploy_to_prod:
+          <<: *only_on_tags
+          type: approval
+      - init_aws_oidc:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-prod
+          name: aws_oidc_prod
+          requires:
+            - approve_deploy_to_prod
+      - release-api/prerelease:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-prod
+          use_specific_github_creds: false #!Comment!Optional - use it only if your team have GitHub user and API token
+          change_request_app_id: ''
+          change_request_description: ''
+          short_description: ''
+          email_address: ''
+          platform: ''
+          os_type: ''
+          partner: ''
+          product_owner: ''
+          priority: ''
+          business_justification: ''
+          testing_method: ''
+          testing_tools: ''
+          requires:
+            - approve_deploy_to_prod
+      - init_aws:
+          <<: *only_on_tags
+          name: init_aws_eks_prod
+          context: <% PROJECT_NAME >-prod
+          job_type: 'eks_prod'
+          requires:
+            - aws_oidc_prod
+      - upgrade_helm:
+          <<: *only_on_tags
+          name: deploy_to_prod
+          context: <% PROJECT_NAME >-prod
+          environment: prod
+          requires:
+            - init_aws_eks_prod
+      - deploy_terraform:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-prod
+          name: deploy_terraform_newrelic_prod
+          project: '<% PROJECT_NAME >'
+          folder: 'terraform-newrelic'
+          environment: prod
+          apply: true
+          requires:
+            - deploy_to_prod
+      - release-api/release:
+          <<: *only_on_tags
+          context: <% PROJECT_NAME >-prod
+          use_specific_github_creds: false #!Comment!Optional - use it only if your team have GitHub user and API token
+          create_newrelic_deployment: false #!Comment! Set this to false, if your application does not have NewRelic App Name
+          requires:
+            - release-api/prerelease
+            - approve_deploy_to_prod
+            - deploy_to_prod
+
+  # You must go to project setting > triggers and add a trigger call remove_old_environments
+  # in CircleCi. This should be set to be triggered at midnight or around that time.
+  remove_old_environments:
+    when:
+      and:
+        - equal: [scheduled_pipeline, << pipeline.trigger_source >>]
+        - equal: ['remove_old_environments', << pipeline.schedule.name >>]
+    jobs:
+      - init_aws:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          name: init_aws_eks_pr
+          job_type: 'eks_pr'
+      - remove_all_pr_environments:
+          <<: *only_on_master_branch
+          context: <% PROJECT_NAME >-dev
+          requires:
+            - init_aws_eks_pr