Merge pull request #1934 from ChildMindInstitute/release/2025.08.1

Release/2025.08.1

Author: aweiland

.github/workflows/_build.yaml

@@ -1,5 +1,5 @@
-
 name: Build
+
 on:
   workflow_call:
     inputs:
@@ -8,11 +8,16 @@ on:
         required: false
         default: latest
         type: string
+      git-ref:
+        description: Git Ref to build from
+        required: false
+        type: string
+        default: develop
 
 # Safe to cancel builds in progress
 concurrency:
   cancel-in-progress: true
-  group: api-build
+  group: api-build-${{ inputs.tag-name }}
 
 permissions:
   id-token: write
@@ -41,6 +46,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.git-ref }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -87,6 +94,7 @@ jobs:
             ${{ env.ECR_REPO }}:${{ steps.sha.outputs.SHORT_SHA }}
           platforms: linux/amd64,linux/arm64
 
+      # TODO What is this used for?  Leftover artifact from Jenkins
       - name: Extract Jira ticket numbers from commit message
         run: |
           tickets=$(git log -1 --pretty=%B | grep -io 'M2-[0-9]\+' | tr '[:lower:]' '[:upper:]' | sort | uniq | tr '\n' ' ')

.github/workflows/_deploy.yaml

@@ -28,178 +28,29 @@ on:
         required: true
         type: string
         description: Docker tag
+    secrets:
+      slack-webhook:
+        required: true
 
 # Wait for other deploys to finish
 concurrency:
   cancel-in-progress: false
-  group: api-deploy
+  group: api-deploy-${{ inputs.env-name }}
 
 permissions:
   id-token: write
   contents: read
   issues: write
 
-env:
-  ECR_REPO: 917902836630.dkr.ecr.us-east-1.amazonaws.com/api-server
-  ECR_ADDRESS: 917902836630.dkr.ecr.us-east-1.amazonaws.com
-
 jobs:
   setup-vars:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Map env to AWS Role
-        id: role
-        run: |
-          ENV_NAME="${{ inputs.env-name }}"
-          case "$ENV_NAME" in
-            "dev")
-              echo 'role=arn:aws:iam::017925157769:role/cmiml-dev-oidc-github-role' >> "$GITHUB_OUTPUT"
-            ;;
-            "test")
-              echo 'role=arn:aws:iam::641513112151:role/cmiml-test-oidc-github-role' >> "$GITHUB_OUTPUT"
-            ;;
-            "uat")
-              echo 'role=arn:aws:iam::641513112151:role/cmiml-uat-oidc-github-role' >> "$GITHUB_OUTPUT"
-            ;;
-            "stage")
-              echo 'role=arn:aws:iam::641513112151:role/cmiml-stage-oidc-github-role' >> "$GITHUB_OUTPUT"
-            ;;
-            "prod")
-              echo 'role=arn:aws:iam::410431445687:role/cmiml-prod-oidc-github-role' >> "$GITHUB_OUTPUT"
-            ;;
-            "prod-dr")
-              echo 'role=arn:aws:iam::973422231492:role/cmiml-dr-oidc-github-role' >> "$GITHUB_OUTPUT"
-            ;;
-            *)
-              echo "Bad environment name"
-              exit 1;
-          esac
-
-      - name: Map env to AWS Region
-        id: region
-        run: |
-          ENV_NAME="${{ inputs.env-name }}"
-          case "$ENV_NAME" in
-            "prod-dr")
-              echo "region=us-west-2" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "region=us-east-1" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
-      - name: Map env to ECS cluster
-        id: cluster
-        run: |
-          ENV_NAME="${{ inputs.env-name }}"
-          case "$ENV_NAME" in
-            "prod-dr")
-              echo "cluster=prod-dr-us-west-2" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "cluster=cmiml-${ENV_NAME}" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
-
-    outputs:
-      role: ${{ steps.role.outputs.role }}
-      region: ${{ steps.region.outputs.region }}
-      cluster: ${{ steps.cluster.outputs.cluster }}
-
-
-  run-migration:
-    runs-on: ubuntu-latest
-    needs: [setup-vars]
-    env:
-      AWS_REGION: ${{ needs.setup-vars.outputs.region }}
-    steps:
-      - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ needs.setup-vars.outputs.role }}
-          role-session-name: OIDC-GHA-migration-session
-          aws-region: ${{ needs.setup-vars.outputs.region }}
-      - name: Download task definition
-        run: |
-          aws ecs describe-task-definition --task-definition migration --query taskDefinition > task-definition.json
-
-      - name: Render Amazon ECS task definition
-        id: task-def
-        uses: aws-actions/amazon-ecs-render-task-definition@v1
-        with:
-          task-definition: task-definition.json
-          container-name: migrate
-          image: ${{ env.ECR_REPO }}:${{ inputs.image-tag }}
-          command: /fastapi-migrate
-          environment-variables: |
-            DD_VERSION=${{ inputs.image-tag }}
-          docker-labels: |
-            com.datadoghq.tags.version=${{ inputs.image-tag }}
-      - name: Update Task Definition
-        id: taskdef
-        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
-        with:
-          task-definition: ${{ steps.task-def.outputs.task-definition }}
-      - name: Run migration
-        run: |-
-          CONTAINER_NAME=migrate
-          start=`date +%s`
-
-          echo "Starting migration task"
-          TASK_ID=$(aws ecs run-task --task-definition "${{ steps.taskdef.outputs.task-definition-arn }}" --cluster ${{ needs.setup-vars.outputs.cluster }} | jq -r '.tasks[0].taskArn')
-          
-          echo "Waiting for task ${{ steps.taskdef.outputs.task-definition-arn }} to finish..." 
-          aws ecs wait tasks-stopped --cluster ${{ needs.setup-vars.outputs.cluster }} --tasks "$TASK_ID"
-          
-          TASK_EXIT_CODE=$(aws ecs describe-tasks --cluster ${{ needs.setup-vars.outputs.cluster }} --tasks "$TASK_ID" --query "tasks[0].containers[?name=='$CONTAINER_NAME'].exitCode" --output text)
-          
-          end=`date +%s`
-          runtime=$((end-start))
-          
-          echo "Task finished with exit code $TASK_EXIT_CODE after $runtime"
-          
-          echo "exit-code=${TASK_EXIT_CODE}" >> $GITHUB_OUTPUT
-          echo "task-time=${runtime}" >> $GITHUB_OUTPUT
-          
-          if [ $TASK_EXIT_CODE -gt 0 ]; then
-            exit 1;
-          fi
-
-  on-migration-failure:
-    runs-on: ubuntu-latest
-    if: ${{ !cancelled() && (needs.run-migration.result == 'failure' || needs.run-migration.result == 'timed_out') }}
-    needs:
-      - run-migration
-    steps:
-      - uses: actions/checkout@v4
-      - name: "Send Slack message on failure"
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_COLOR: failure
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_DEPLOY_TO_DEV }}
-          MSG_MINIMAL: actions url
-          SLACK_TITLE: Database Migration in DEV environment
-          SLACK_MESSAGE: '🚨 Error when executing migration!'
-
-  on-migration-success:
-    runs-on: ubuntu-latest
-    if: ${{ !cancelled() && (needs.run-migration.result == 'success') }}
-    needs:
-      - run-migration
-    steps:
-      - uses: actions/checkout@v4
-      - name: "Send Slack message on success"
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_COLOR: success
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_DEPLOY_TO_DEV }}
-          MSG_MINIMAL: actions url
-          SLACK_TITLE: Database Migration in DEV environment
-          SLACK_MESSAGE: '🎉 Migration was successful!'
+    uses: ./.github/workflows/_setup.yaml
+    with:
+      env-name: ${{ inputs.env-name }}
 
   deploy:
     runs-on: ubuntu-latest
-    needs: [setup-vars, run-migration]
+    needs: [setup-vars]
 
     name: Deploy ${{ matrix.apps.name }}
     strategy:
@@ -231,7 +82,7 @@ jobs:
         with:
           task-definition: task-definition.json
           container-name: ${{ matrix.apps.container }}
-          image: ${{ env.ECR_REPO }}:${{ inputs.image-tag }}
+          image: ${{ needs.setup-vars.outputs.ecr-repo }}/api-server:${{ inputs.image-tag }}
 
       - name: Update Task Definition
         uses: aws-actions/amazon-ecs-deploy-task-definition@v2
@@ -253,9 +104,9 @@ jobs:
         uses: rtCamp/action-slack-notify@v2
         env:
           SLACK_COLOR: failure
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_DEPLOY_TO_DEV }}
+          SLACK_WEBHOOK: ${{ secrets.slack-webhook }}
           MSG_MINIMAL: actions url
-          SLACK_TITLE: Deployment to DEV environment
+          SLACK_TITLE: Deployment to ${{ inputs.env-name }} environment
           SLACK_MESSAGE: '🚨 Error when executing deployment!'
 
   on-deploy-success:
@@ -269,7 +120,7 @@ jobs:
         uses: rtCamp/action-slack-notify@v2
         env:
           SLACK_COLOR: success
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_DEPLOY_TO_DEV }}
+          SLACK_WEBHOOK: ${{ secrets.slack-webhook }}
           MSG_MINIMAL: actions url
-          SLACK_TITLE: Deployment to DEV environment
+          SLACK_TITLE: Deployment to ${{ inputs.env-name }} environment
           SLACK_MESSAGE: '🚀 Deployment was successful!'

.github/workflows/_migrations.yaml

@@ -0,0 +1,123 @@
+name: Run Migrations
+
+on:
+  workflow_call:
+    inputs:
+      env-name:
+        required: true
+        type: string
+        description: Environment name
+      image-tag:
+        required: true
+        type: string
+        description: Docker image tag
+    secrets:
+      slack-webhook:
+        required: true
+
+
+concurrency:
+  cancel-in-progress: false
+  group: api-migrations-${{ inputs.env-name }}
+
+permissions:
+  id-token: write
+  contents: read
+
+
+jobs:
+  setup-vars:
+    uses: ./.github/workflows/_setup.yaml
+    with:
+      env-name: ${{ inputs.env-name }}
+
+  run-migration:
+    runs-on: ubuntu-latest
+    needs: [ setup-vars ]
+    env:
+      AWS_REGION: ${{ needs.setup-vars.outputs.region }}
+    steps:
+      - name: configure aws credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ needs.setup-vars.outputs.role }}
+          role-session-name: OIDC-GHA-migration-session
+          aws-region: ${{ needs.setup-vars.outputs.region }}
+      - name: Download task definition
+        run: |
+          aws ecs describe-task-definition --task-definition migration --query taskDefinition > task-definition.json
+
+      - name: Render Amazon ECS task definition
+        id: task-def
+        uses: aws-actions/amazon-ecs-render-task-definition@v1
+        with:
+          task-definition: task-definition.json
+          container-name: migrate
+          image: ${{ needs.setup-vars.outputs.ecr-repo }}/api-server:${{ inputs.image-tag }}
+          command: /fastapi-migrate
+          environment-variables: |
+            DD_VERSION=${{ inputs.image-tag }}
+          docker-labels: |
+            com.datadoghq.tags.version=${{ inputs.image-tag }}
+      - name: Update Task Definition
+        id: taskdef
+        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
+        with:
+          task-definition: ${{ steps.task-def.outputs.task-definition }}
+      - name: Run migration
+        run: |-
+          set -e
+          CONTAINER_NAME=migrate
+          start=`date +%s`
+
+          echo "Starting migration task"
+          TASK_ID=$(aws ecs run-task --task-definition "${{ steps.taskdef.outputs.task-definition-arn }}" --cluster ${{ needs.setup-vars.outputs.cluster }} | jq -r '.tasks[0].taskArn')
+
+          echo "Waiting for task ${{ steps.taskdef.outputs.task-definition-arn }} with ID ${TASK_ID} to finish..." 
+          aws ecs wait tasks-stopped --cluster ${{ needs.setup-vars.outputs.cluster }} --tasks "$TASK_ID"
+
+          TASK_EXIT_CODE=$(aws ecs describe-tasks --cluster ${{ needs.setup-vars.outputs.cluster }} --tasks "$TASK_ID" --query "tasks[0].containers[?name=='$CONTAINER_NAME'].exitCode" --output text)
+
+          end=`date +%s`
+          runtime=$((end-start))
+
+          echo "Task finished with exit code $TASK_EXIT_CODE after ${runtime} seconds."
+
+          echo "exit-code=${TASK_EXIT_CODE}" >> $GITHUB_OUTPUT
+          echo "task-time=${runtime}" >> $GITHUB_OUTPUT
+
+          if [ -z "$TASK_EXIT_CODE" ] || [ "$TASK_EXIT_CODE" -gt "0" ]; then
+            exit 1;
+          fi
+
+  on-migration-failure:
+    runs-on: ubuntu-latest
+    if: ${{ !cancelled() && (needs.run-migration.result == 'failure' || needs.run-migration.result == 'timed_out') }}
+    needs:
+      - run-migration
+    steps:
+      - uses: actions/checkout@v4
+      - name: "Send Slack message on failure"
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_COLOR: failure
+          SLACK_WEBHOOK: ${{ secrets.slack-webhook }}
+          MSG_MINIMAL: actions url
+          SLACK_TITLE: Database Migration in ${{ inputs.env-name }} environment
+          SLACK_MESSAGE: '🚨 Error when executing migration!'
+
+  on-migration-success:
+    runs-on: ubuntu-latest
+    if: ${{ !cancelled() && (needs.run-migration.result == 'success') }}
+    needs:
+      - run-migration
+    steps:
+      - uses: actions/checkout@v4
+      - name: "Send Slack message on success"
+        uses: rtCamp/action-slack-notify@v2
+        env:
+          SLACK_COLOR: success
+          SLACK_WEBHOOK: ${{ secrets.slack-webhook  }}
+          MSG_MINIMAL: actions url
+          SLACK_TITLE: Database Migration in ${{ inputs.env-name }} environment
+          SLACK_MESSAGE: '🎉 Migration was successful!'