work-requirements-self-advocacy-tool/.github/workflows/deploy.yaml at 1a19c304a01f2f664b8011753b884d0d9cc479dd · codeforamerica/work-requirements-self-advocacy-tool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: Deploy to AWS

on:
  workflow_dispatch:
    inputs:
      environment:
        description: The environment to deploy to
        required: true
        type: environment
        default: staging
      infra_branch:
        description: The branch of the infrastructure repository to deploy
        required: true
        type: string
        default: main
  workflow_call:
    inputs:
      environment:
        description: The environment to deploy to
        required: true
        type: string
        default: staging
      infra_branch:
        description: The branch of the infrastructure repository to deploy
        required: true
        type: string
        default: main
    secrets:
      AWS_ACCESS_KEY_ID:
      AWS_SECRET_ACCESS_KEY:
      DEPLOYMENT_APP_ID:
      DEPLOYMENT_APP_KEY:

permissions:
  contents: read

jobs:
  ci:
    name: Verify code is valid
    permissions:
      checks: write
      contents: write
    uses: ./.github/workflows/ci.yml

  deploy:
    name: Deploy to ${{ inputs.environment }}
    needs: ci
    environment: ${{ inputs.environment }}
    runs-on: ubuntu-latest
    env:
      ENVIRONMENT: ${{ inputs.environment }}
      ECR_REPOSITORY: work-requirements-self-advocacy-tool-${{ inputs.environment }}-web
      IMAGE_TAG: ${{ github.sha }}
      INFRA_REPO: work-requirements-self-advocacy-tool-infra

    steps:
      - name: Check out code
        uses: actions/checkout@v6
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}
      - name: Log in to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      - name: Check if the image exists
        id: image_exists
        uses: k4kratik/container-image-check-custom-action@v4
        with:
          type: ecr
          container_repo_name: ${{ env.ECR_REPOSITORY }}
          image_tag: ${{env.IMAGE_TAG}}
      - name: Build and push Docker image
        if: ${{ steps.image_exists.outputs.image_exists == 'false' }}
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:${{env.IMAGE_TAG}} --platform linux/amd64 .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{env.IMAGE_TAG}}
      - name: Update SSM Version Parameter
        run: |
          echo "tag:$IMAGE_TAG"
          aws ssm put-parameter \
            --name  /work-requirements-self-advocacy-tool/$ENVIRONMENT/web/version \
            --value "$IMAGE_TAG" \
            --overwrite
      - name: Get a deployment token
        uses: actions/create-github-app-token@v3
        id: token
        with:
          app-id: ${{ secrets.DEPLOYMENT_APP_ID }}
          private-key: ${{ secrets.DEPLOYMENT_APP_KEY }}
          owner: codeforamerica
          repositories: ${{ env.INFRA_REPO }}
      - name: Trigger deployment from work requirements self advocacy infra
        uses: codex-/return-dispatch@v3
        id: dispatch
        with:
          token: ${{ steps.token.outputs.token }}
          ref: ${{ inputs.infra_branch }}
          repo: ${{ env.INFRA_REPO }}
          owner: codeforamerica
          workflow: 'deploy.yml'
          workflow_inputs: |
            {
              "environment": "${{ env.ENVIRONMENT }}",
              "config": "application"
            }
      - name: Wait on Workflow
        uses: lucasssvaz/wait-on-workflow@v1
        id: waiter
        with:
          github-token: ${{ steps.token.outputs.token }}
          repository: codeforamerica/${{ env.INFRA_REPO }}
          workflow: ${{ steps.dispatch.outputs.run_id }}
      - name: Fail unless the workflow succeeded
        if: ${{ steps.waiter.outputs.conclusion != 'success' }}
        uses: actions/github-script@v8
        with:
          script: |
            core.setFailed('Deployment workflow completed with stats: ${{ steps.waiter.outputs.conclusion }}')