Update deploy workflow to wait for CI

This prevents the deploy workflow from being run before the application
tests have been completed. This is to ensure that the commit passes
application tests before being deployed.

The 'workflow_run' trigger is being used as these events cannot be
triggered directly by users. This is to prevent non-production team
members from deploying. The 'repository_dispatch' and 'deployment'
trigger were also considered, however those events can be directly
created via API calls hence would give deploy access to non-production
users (as we assign them "write" roles to repos and GitHub currently
doesn't provide more fine grained access controls).

.github/workflows/ci.yaml

@@ -9,4 +9,6 @@ on:
 jobs:
   test:
     name: Test
-    uses: alphagov/govuk-infrastructure/.github/workflows/ci.yaml@add-ci-workflow
+    uses: alphagov/govuk-infrastructure/.github/workflows/test-rails.yaml@main
+    with:
+      requiresJavaScript: true

.github/workflows/deploy.yaml

@@ -17,19 +17,18 @@ on:
         - staging
         - production
         default: 'integration'
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "Jenkinsfile"
-      - ".git**"
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
 
 jobs:
   build-and-publish-image:
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
     name: Build and publish image
     uses: alphagov/govuk-infrastructure/.github/workflows/ci-ecr.yaml@main
     with:
-      gitRef: ${{ github.event.inputs.gitRef }}
+      gitRef: ${{ github.event.inputs.gitRef || github.ref }}
     secrets:
       AWS_GOVUK_ECR_ACCESS_KEY_ID: ${{ secrets.AWS_GOVUK_ECR_ACCESS_KEY_ID }}
       AWS_GOVUK_ECR_SECRET_ACCESS_KEY: ${{ secrets.AWS_GOVUK_ECR_SECRET_ACCESS_KEY }}
@@ -39,7 +38,6 @@ jobs:
     uses: alphagov/govuk-infrastructure/.github/workflows/deploy.yaml@main
     with:
       imageTag: ${{ needs.build-and-publish-image.outputs.imageTag }}
-      workflowTrigger: ${{ github.event_name }}
       environment: ${{ github.event.inputs.environment }}
     secrets:
       WEBHOOK_TOKEN: ${{ secrets.GOVUK_INTEGRATION_ARGO_EVENTS_WEBHOOK_TOKEN }}