Skip to content

Commit 5fac493

Browse files
nickclydenickclyde
authored
Move terraform code into this repo (#353)
## Description Move Terraform code over from https://github.com/skylight-hq/dibbs-tf-envs. Makes a few changes, including changing tfstate backend from Azure to AWS, and adding a bootstrapping step to set up the state.
1 parent 4b83fe8 commit 5fac493

File tree

17 files changed

+1231
-30
lines changed

17 files changed

+1231
-30
lines changed

‎.dockerignore‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,11 @@ frontend/dist
33
frontend/.vite
44
frontend/coverage
55
**/.DS_Store
6-
**/node_modules
6+
**/node_modules
7+
.git
8+
.venv
9+
.ruff_cache
10+
e2e
11+
docs
12+
terraform
13+
**/__pycache__

‎.github/workflows/bootstrap.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Bootstrap Terraform State Backend
2+
run-name: Bootstrap Terraform State Backend by @${{ github.actor }}
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
apply:
8+
description: "Apply changes (if false, only runs plan)"
9+
type: boolean
10+
default: false
11+
destroy:
12+
description: "Destroy state backend resources (WARNING: irreversible)"
13+
type: boolean
14+
default: false
15+
16+
concurrency:
17+
group: bootstrap-terraform-state
18+
cancel-in-progress: false
19+
20+
permissions:
21+
id-token: write
22+
contents: read
23+
24+
jobs:
25+
bootstrap:
26+
name: Bootstrap
27+
runs-on: ubuntu-latest
28+
steps:
29+
- name: Checkout
30+
uses: actions/checkout@v4
31+
32+
- name: Setup Terraform
33+
uses: hashicorp/setup-terraform@v4
34+
with:
35+
terraform_version: 1.14.7
36+
terraform_wrapper: false
37+
38+
- name: Configure AWS credentials
39+
uses: aws-actions/configure-aws-credentials@v4
40+
with:
41+
role-to-assume: ${{ secrets.TERRAFORM_ROLE_ARN }}
42+
role-session-name: githubBootstrapWorkflow
43+
aws-region: ${{ vars.AWS_REGION }}
44+
45+
- name: Terraform Init
46+
working-directory: terraform/bootstrap
47+
run: terraform init
48+
49+
- name: Terraform Format Check
50+
working-directory: terraform/bootstrap
51+
run: terraform fmt -check -recursive
52+
53+
- name: Terraform Validate
54+
working-directory: terraform/bootstrap
55+
run: terraform validate
56+
57+
- name: Terraform Plan
58+
if: ${{ !inputs.apply && !inputs.destroy }}
59+
working-directory: terraform/bootstrap
60+
run: terraform plan
61+
62+
- name: Terraform Apply
63+
if: ${{ inputs.apply && !inputs.destroy }}
64+
working-directory: terraform/bootstrap
65+
run: terraform apply -auto-approve
66+
67+
- name: Terraform Destroy
68+
if: ${{ inputs.destroy }}
69+
working-directory: terraform/bootstrap
70+
run: terraform destroy -auto-approve

‎.github/workflows/deploy.yaml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
name: Deploy Text-to-Code AWS demo
2+
run-name: Deploy Text-to-Code AWS demo by @${{ github.actor }}
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
apply:
8+
description: "Apply changes (if false, only runs plan)"
9+
type: boolean
10+
default: false
11+
destroy:
12+
description: "Destroy all resources (WARNING: irreversible)"
13+
type: boolean
14+
default: false
15+
16+
concurrency:
17+
group: deploy-text-to-code-aws-demo
18+
cancel-in-progress: false
19+
20+
permissions:
21+
id-token: write
22+
contents: read
23+
24+
jobs:
25+
deploy_text_to_code:
26+
name: Terraform
27+
runs-on: ubuntu-latest
28+
steps:
29+
- name: Checkout
30+
uses: actions/checkout@v4
31+
32+
- name: Setup Terraform
33+
uses: hashicorp/setup-terraform@v4
34+
with:
35+
terraform_version: 1.14.7
36+
terraform_wrapper: false
37+
38+
- name: Configure AWS credentials
39+
uses: aws-actions/configure-aws-credentials@v4
40+
with:
41+
role-to-assume: ${{ secrets.TERRAFORM_ROLE_ARN }}
42+
role-session-name: githubDeploymentWorkflow
43+
aws-region: ${{ vars.AWS_REGION }}
44+
45+
- name: Terraform Init
46+
working-directory: terraform
47+
run: terraform init
48+
49+
- name: Terraform Format Check
50+
working-directory: terraform
51+
run: terraform fmt -check -recursive
52+
53+
- name: Terraform Validate
54+
working-directory: terraform
55+
run: terraform validate
56+
57+
- name: Create ECR repositories
58+
if: ${{ inputs.apply && !inputs.destroy }}
59+
working-directory: terraform
60+
run: terraform apply -auto-approve -target=aws_ecr_repository.index_lambda -target=aws_ecr_repository.ttc_lambda
61+
62+
- name: Login to Amazon ECR
63+
if: ${{ inputs.apply && !inputs.destroy }}
64+
id: ecr-login
65+
uses: aws-actions/amazon-ecr-login@v2
66+
67+
- name: Get ECR repository URLs
68+
if: ${{ inputs.apply && !inputs.destroy }}
69+
id: ecr-url
70+
working-directory: terraform
71+
run: |
72+
INDEX_ECR_URL=$(terraform output -raw index_ecr_repository_url)
73+
echo "index_ecr_url=$INDEX_ECR_URL" >> "$GITHUB_OUTPUT"
74+
ECR_URL=$(terraform output -raw ecr_repository_url)
75+
echo "ecr_url=$ECR_URL" >> "$GITHUB_OUTPUT"
76+
77+
- name: Build and push Index Docker image
78+
if: ${{ inputs.apply && !inputs.destroy }}
79+
run: |
80+
INDEX_ECR_URL="${{ steps.ecr-url.outputs.index_ecr_url }}"
81+
docker build -f Dockerfile.index -t "$INDEX_ECR_URL:${{ github.sha }}" -t "$INDEX_ECR_URL:latest" .
82+
docker push "$INDEX_ECR_URL:${{ github.sha }}"
83+
docker push "$INDEX_ECR_URL:latest"
84+
85+
- name: Build and push TTC Docker image
86+
if: ${{ inputs.apply && !inputs.destroy }}
87+
run: |
88+
ECR_URL="${{ steps.ecr-url.outputs.ecr_url }}"
89+
docker build -f Dockerfile.ttc -t "$ECR_URL:${{ github.sha }}" -t "$ECR_URL:latest" .
90+
docker push "$ECR_URL:${{ github.sha }}"
91+
docker push "$ECR_URL:latest"
92+
93+
- name: Terraform Plan
94+
if: ${{ !inputs.apply && !inputs.destroy }}
95+
working-directory: terraform
96+
run: terraform plan
97+
98+
- name: Terraform Apply
99+
if: ${{ inputs.apply && !inputs.destroy }}
100+
working-directory: terraform
101+
run: terraform apply -auto-approve -var="index_lambda_image_tag=${{ github.sha }}" -var="ttc_lambda_image_tag=${{ github.sha }}"
102+
103+
- name: Terraform Destroy
104+
if: ${{ inputs.destroy }}
105+
working-directory: terraform
106+
run: terraform destroy -auto-approve

‎.github/workflows/docker-image-push.yml‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ jobs:
2828
include:
2929
- name: index
3030
dockerfile: Dockerfile.index
31-
- name: lambda
32-
dockerfile: Dockerfile.lambda
31+
- name: ttc
32+
dockerfile: Dockerfile.ttc
3333
- name: augmentation
3434
dockerfile: Dockerfile.augmentation
3535

@@ -85,3 +85,23 @@ jobs:
8585
labels: ${{ steps.meta.outputs.labels }}
8686
cache-from: type=gha
8787
cache-to: type=gha,mode=max
88+
89+
- name: Configure APHL AWS credentials
90+
if: ${{ matrix.name != 'index' }}
91+
uses: aws-actions/configure-aws-credentials@v4
92+
with:
93+
aws-access-key-id: ${{ secrets.APHL_AWS_ACCESS_KEY_ID }}
94+
aws-secret-access-key: ${{ secrets.APHL_AWS_SECRET_ACCESS_KEY }}
95+
aws-region: us-east-1
96+
97+
- name: Login to APHL ECR
98+
if: ${{ matrix.name != 'index' }}
99+
id: aphl-ecr
100+
uses: aws-actions/amazon-ecr-login@v2
101+
102+
- name: Push to APHL ECR
103+
if: ${{ matrix.name != 'index' }}
104+
run: |
105+
GHCR_IMAGE="ghcr.io/${{ steps.repo.outputs.owner }}/dibbs-text-to-code/${{ matrix.name }}:latest"
106+
ECR_IMAGE="${{ secrets.APHL_ECR_REPOSITORY_URL }}/${{ matrix.name }}:latest"
107+
docker buildx imagetools create --tag "$ECR_IMAGE" "$GHCR_IMAGE"

‎Dockerfile.lambda‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

‎Dockerfile.ttc‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
FROM public.ecr.aws/lambda/python:3.12
2+
3+
LABEL org.opencontainers.image.source=https://github.com/CDCgov/dibbs-text-to-code
4+
LABEL org.opencontainers.image.licenses=Apache-2.0
5+
6+
# Install build tools for C++ extensions
7+
RUN microdnf install -y gcc-c++ make && microdnf clean all
8+
9+
# Copy and install workspace packages in dependency order
10+
COPY ./packages/shared-models ${LAMBDA_TASK_ROOT}/shared-models
11+
RUN pip install --no-cache-dir "${LAMBDA_TASK_ROOT}/shared-models"
12+
13+
COPY ./packages/lambda-handler ${LAMBDA_TASK_ROOT}/lambda-handler
14+
RUN pip install --no-cache-dir "${LAMBDA_TASK_ROOT}/lambda-handler"
15+
16+
COPY ./packages/text-to-code ${LAMBDA_TASK_ROOT}/text-to-code
17+
RUN pip install --no-cache-dir "${LAMBDA_TASK_ROOT}/text-to-code"
18+
19+
COPY ./packages/text-to-code-lambda ${LAMBDA_TASK_ROOT}/text-to-code-lambda
20+
RUN pip install --no-cache-dir "${LAMBDA_TASK_ROOT}/text-to-code-lambda"
21+
22+
# Download model at build time (baked into image)
23+
RUN python -c "\
24+
from huggingface_hub import snapshot_download; \
25+
snapshot_download( \
26+
repo_id='intfloat/e5-large-v2', \
27+
local_dir='/opt/model', \
28+
ignore_patterns=['*.git*', '*.md', 'onnx/*', 'openvino/*', 'pytorch_model.bin'] \
29+
)"
30+
31+
ENV MODEL_PATH="/opt/model"
32+
33+
CMD ["text_to_code_lambda.lambda_function.handler"]

‎terraform/.gitignore‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Local .terraform directories
2+
**/.terraform/*
3+
4+
# .tfstate files
5+
*.tfstate
6+
*.tfstate.*
7+
8+
# Crash log files
9+
crash.log
10+
crash.*.log
11+
12+
# Exclude all .tfvars files, which are likely to contain sensitive data, such as
13+
# password, private keys, and other secrets. These should not be part of version
14+
# control as they are data points which are potentially sensitive and subject
15+
# to change depending on the environment.
16+
*.tfvars
17+
*.tfvars.json
18+
19+
# Ignore override files as they are usually used to override resources locally and so
20+
# are not checked in
21+
override.tf
22+
override.tf.json
23+
*_override.tf
24+
*_override.tf.json
25+
26+
# Ignore transient lock info files created by terraform apply
27+
.terraform.tfstate.lock.info
28+
29+
# Include override files you do wish to add to version control using negated pattern
30+
# !example_override.tf
31+
32+
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
33+
# example: *tfplan*
34+
35+
# Ignore CLI configuration files
36+
.terraformrc
37+
terraform.rc
38+
39+
# Extra Goodies
40+
.terraform.lock.hcl
41+
.infracost
42+
terraform.tfstate
43+
terraform.tfstate.d
44+
terraform.tfstate.backup
45+
*.tfvars
46+
.vscode/settings.json
47+
credentials.json
48+
.bash_profile
49+
awscli-bundle/
50+
.todo
51+
.DS_Store
52+
# Ignore .dot files
53+
**/*.dot
54+

0 commit comments

Comments
 (0)