Skip to content

Use AWS tools for deployment. #2126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Use AWS tools for deployment. #2126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
138 changes: 96 additions & 42 deletions .github/workflows/cicd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,33 @@

name: CI/CD

permissions:
contents: read

on:
push:
branches: ["master"]
pull_request:
branches: ["master"]


defaults:
run:
shell: bash


env:
AWS_DEPLOY_ROLE: "arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/ranger-gha-deploy"
AWS_ECR_IMAGE_PREFIX: "/${{ vars.DEPARTMENT_ID }}/"
AWS_ECR_IMAGE_NAME: "${{ vars.PROJECT_ID }}"
AWS_ECS_CLUSTER: ${{ vars.DEPARTMENT_ID }}
AWS_ECS_CONTAINER_NAME: ${{ vars.PROJECT_ID }}
AWS_ECS_SERVICE_STAGING: ${{ vars.PROJECT_ID }}-staging-fg
AWS_ECS_TASK_DEFINITION_ARN_STAGING: "arn:aws:ecs:us-west-2:${{ secrets.AWS_ACCOUNT_ID }}:task-definition/${{ vars.PROJECT_ID }}-staging-fg"
AWS_ECS_TASK_DEFINITION_FAMILY_STAGING: ${{ vars.PROJECT_ID }}-staging-fg
AWS_REGION: us-west-2


jobs:

check-syntax:
Expand All @@ -19,7 +39,7 @@ jobs:
timeout-minutes: 5

steps:
- name: Harden CI
- name: Harden Runner
uses: step-security/[email protected]
with:
egress-policy: audit
Expand All @@ -44,7 +64,7 @@ jobs:

steps:

- name: Harden CI
- name: Harden Runner
uses: step-security/[email protected]
with:
egress-policy: audit
Expand All @@ -68,7 +88,7 @@ jobs:
run: ./bin/build

- name: Save Docker image
run: docker image save ranger-clubhouse-api:dev | gzip -9 > docker_image.tgz
run: docker image save "${{ vars.PROJECT_ID }}:dev" | gzip -9 > docker_image.tgz

- name: Upload Docker image artifacts
uses: actions/upload-artifact@v5
Expand All @@ -86,7 +106,7 @@ jobs:

steps:

- name: Harden CI
- name: Harden Runner
uses: step-security/[email protected]
with:
egress-policy: audit
Expand Down Expand Up @@ -115,7 +135,7 @@ jobs:

steps:

- name: Harden CI
- name: Harden Runner
uses: step-security/[email protected]
with:
egress-policy: audit
Expand All @@ -136,23 +156,26 @@ jobs:


deploy-staging:
name: Deploy code from master branch to the staging environment
name: Deploy to staging

needs: [check-syntax, unit, docker-build, docker-test]
if: github.ref == 'refs/heads/master'

runs-on: ubuntu-latest
timeout-minutes: 5
timeout-minutes: 30

permissions:
id-token: write

steps:

- name: Harden CI
- name: Harden Runner
uses: step-security/[email protected]
with:
egress-policy: audit

- name: Checkout source code
uses: actions/checkout@v5
egress-policy: block
allowed-endpoints: >
*.amazonaws.com:443
*.docker.io:443

- name: Download Docker image artifacts
uses: actions/download-artifact@v6
Expand All @@ -162,34 +185,65 @@ jobs:
- name: Load Docker image
run: gzip --uncompress --stdout docker_image.tgz | docker image load

- name: Install Python
uses: actions/setup-python@v6
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v5
with:
aws-region: ${{ env.AWS_REGION }}
role-to-assume: ${{ env.AWS_DEPLOY_ROLE }}
role-session-name: ranger-gha-${{ github.repository_id }}-${{ github.job }}-${{ github.run_id }}

- name: Login to AWS ECR
id: aws-login-ecr
uses: aws-actions/amazon-ecr-login@v2

- name: Push docker image to Amazon ECR
run: |
image_repository="${{ steps.aws-login-ecr.outputs.registry }}${{ env.AWS_ECR_IMAGE_NAME }}"
docker login
# Push SHA tag
docker tag "${{ vars.PROJECT_ID }}:${{ github.sha }}" "${image_repository}:${{ github.sha }}"
docker push "${image_repository}:${{ github.sha }}"
# Push staging rollback tag
if docker pull "${image_repository}:staging"; then
echo "Pushing rollback tag for staging"
docker tag "${image_repository}:staging" "${image_repository}:staging_rollback"
docker push "${image_repository}:staging_rollback"
fi
# Push staging tag
echo "Pushing staging tag"
docker tag "${image_repository}:${{ github.sha }}" "${image_repository}:staging"
docker push "${image_repository}:staging"

- name: Get current date
id: date
run: echo "date=$(date "+%Y-%m-%dT%H:%M:%S")" >> "${GITHUB_OUTPUT}"

- name: Fetch and update current task definition
id: new-task-definition
uses: aws-actions/amazon-ecs-render-task-definition@v1
with:
task-definition-arn: "${{ env.AWS_ECS_TASK_DEFINITION_ARN_STAGING }}"
task-definition-family: "${{ env.AWS_ECS_TASK_DEFINITION_FAMILY_STAGING }}"
container-name: "${{ env.AWS_ECS_CONTAINER_NAME }}"
image: "${{ steps.aws-login-ecr.outputs.registry }}${{ env.AWS_ECR_IMAGE_NAME }}:${{ github.sha }}"
environment-variables: |
GHA_ACTOR_ID=${{ github.actor_id }}
GHA_ACTOR=${{ github.actor }}
GHA_EVENT_NAME=${{ github.event_name }}
GHA_JOB=${{ github.job }}
GHA_REF=${{ github.ref }}
GHA_RUN_ATTEMPT=${{ github.run_attempt }}
GHA_RUN_ID=${{ github.run_id }}
GHA_RUN_NUMBER=${{ github.run_number }}
GHA_TRIGGERING_ACTOR=${{ github.triggering_actor }}
GHA_WORKFLOW=${{ github.workflow }}
GIT_SHA=${{ github.sha }}
TASK_UPDATED=${{ steps.date.outputs.date }}

- name: Update task definition and ECS service
uses: aws-actions/amazon-ecs-deploy-task-definition@v2
with:
python-version: "3.12"

- name: Deploy to staging
run: ./bin/deploy staging
env:
# https://github.com/burningmantech/ranger-secret-clubhouse/settings/secrets
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
AWS_ECR_IMAGE_NAME: ${{ secrets.AWS_ECR_IMAGE_NAME }}
AWS_ECS_CLUSTER_STAGING: rangers
AWS_ECS_SERVICE_STAGING: ${{ secrets.AWS_ECS_SERVICE_STAGING }}
NOTIFY_SMTP_HOST: ${{ secrets.NOTIFY_SMTP_HOST }}
NOTIFY_SMTP_USER: ${{ secrets.NOTIFY_SMTP_USER }}
NOTIFY_SMTP_PASSWORD: ${{ secrets.NOTIFY_SMTP_PASSWORD }}
NOTIFY_EMAIL_RECIPIENT: ${{ secrets.NOTIFY_EMAIL_RECIPIENT }}
NOTIFY_EMAIL_SENDER: ${{ secrets.NOTIFY_EMAIL_SENDER }}
CI: true
PROJECT_NAME: Ranger Secret Clubhouse API Service
REPOSITORY_ID: ${{ github.repository }}
BUILD_NUMBER: 0
BUILD_URL: https://github.com/burningmantech/ranger-secret-clubhouse/commit/${{ github.sha }}/checks
COMMIT_ID: ${{ github.event.head_commit.id }}
COMMIT_URL: ${{ github.event.head_commit.url }}
COMMIT_AUTHOR_USER: ${{ github.event.head_commit.author.username }}
COMMIT_AUTHOR_NAME: ${{ github.event.head_commit.author.name }}
COMMIT_AUTHOR_EMAIL: ${{ github.event.head_commit.author.email }}
COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
task-definition: "${{ steps.new-task-definition.outputs.task-definition }}"
service: "${{ env.AWS_ECS_SERVICE_STAGING }}"
cluster: "${{ env.AWS_ECS_CLUSTER }}"
wait-for-service-stability: true
Loading