CDK Deploy #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CDK Deploy | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: 'Branch or tag to deploy' | |
| required: true | |
| default: 'main' | |
| type: string | |
| environment: | |
| description: 'Deployment environment name' | |
| required: true | |
| default: 'dev' | |
| type: string | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| environment: ${{ inputs.environment }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'npm' | |
| - name: Configure AWS credentials | |
| id: aws-creds | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ vars.DEPLOY_IAM_ROLE_ARN }} | |
| aws-region: ${{ vars.AWS_REGION }} | |
| - name: Install Python dependencies | |
| run: uv sync --all-groups | |
| - name: Install Node dependencies | |
| run: npm install | |
| - name: CDK Synth | |
| run: uv run npx cdk synth --all | |
| env: | |
| CDK_DEFAULT_ACCOUNT: ${{ steps.aws-creds.outputs.aws-account-id }} | |
| CDK_DEFAULT_REGION: ${{ vars.AWS_REGION }} | |
| PROJECT_ID: ${{ vars.PROJECT_ID }} | |
| VPC_ID: ${{ vars.VPC_ID }} | |
| WORKSHOP_TOKEN: ${{ vars.WORKSHOP_TOKEN }} | |
| PGSTAC_VERSION: ${{ vars.PGSTAC_VERSION }} | |
| HOSTED_ZONE_ID: ${{ vars.HOSTED_ZONE_ID }} | |
| CERTIFICATE_ARN: ${{ vars.CERTIFICATE_ARN }} | |
| - name: CDK Deploy | |
| run: uv run npx cdk deploy --all --require-approval never | |
| env: | |
| CDK_DEFAULT_ACCOUNT: ${{ steps.aws-creds.outputs.aws-account-id }} | |
| CDK_DEFAULT_REGION: ${{ vars.AWS_REGION }} | |
| PROJECT_ID: ${{ vars.PROJECT_ID }} | |
| VPC_ID: ${{ vars.VPC_ID }} | |
| WORKSHOP_TOKEN: ${{ vars.WORKSHOP_TOKEN }} | |
| PGSTAC_VERSION: ${{ vars.PGSTAC_VERSION }} | |
| HOSTED_ZONE_ID: ${{ vars.HOSTED_ZONE_ID }} | |
| CERTIFICATE_ARN: ${{ vars.CERTIFICATE_ARN }} | |
| - name: Load Workshop Data | |
| run: | | |
| # Get database credentials from config endpoint | |
| CONFIG_URL="https://${{ vars.PROJECT_ID }}-config.eoapi.dev" | |
| echo "Fetching database credentials from: $CONFIG_URL" | |
| CONFIG_RESPONSE=$(curl -s -H "Authorization: Bearer ${{ vars.WORKSHOP_TOKEN }}" "$CONFIG_URL") | |
| export PGHOST=$(echo "$CONFIG_RESPONSE" | jq -r '.pghost') | |
| export PGPORT=$(echo "$CONFIG_RESPONSE" | jq -r '.pgport') | |
| export PGDATABASE=$(echo "$CONFIG_RESPONSE" | jq -r '.pgdatabase') | |
| export PGUSER=$(echo "$CONFIG_RESPONSE" | jq -r '.pguser') | |
| export PGPASSWORD=$(echo "$CONFIG_RESPONSE" | jq -r '.pgpassword') | |
| echo "✓ Database credentials fetched successfully" | |
| # Install PostgreSQL client | |
| sudo apt-get update | |
| sudo apt-get install -y postgresql-client | |
| # Create schema and prepare for data | |
| psql -c "CREATE SCHEMA IF NOT EXISTS features; DROP TABLE IF EXISTS features.ecoregions;" | |
| # Load data using GDAL | |
| docker run --rm ghcr.io/osgeo/gdal:alpine-normal-latest ogr2ogr -f "PostgreSQL" \ | |
| PG:"postgresql://${PGUSER}:${PGPASSWORD}@${PGHOST}:${PGPORT}/${PGDATABASE}" \ | |
| /vsizip/vsicurl/https://dmap-prod-oms-edc.s3.us-east-1.amazonaws.com/ORD/Ecoregions/cec_na/NA_CEC_Eco_Level3.zip/NA_CEC_Eco_Level3.shp \ | |
| -nln features.ecoregions \ | |
| -lco GEOMETRY_NAME=geom \ | |
| -lco FID=id \ | |
| -lco PRECISION=NO \ | |
| -nlt PROMOTE_TO_MULTI \ | |
| -t_srs EPSG:4326 \ | |
| -simplify 0.001 | |
| # load a STAC collection | |
| echo 'fetching collection from MAAP STAC' | |
| curl https://stac.maap-project.org/collections/glad-global-forest-change-1.11 > /tmp/collection.json | |
| echo 'fetching items from MAAP STAC' | |
| uvx rustac search https://stac.maap-project.org /tmp/items.json --collections glad-global-forest-change-1.11 --limit 100 -o json | |
| echo 'loading collection into pgstac database' | |
| uvx --from pypgstac[psycopg]==${{ vars.PGSTAC_VERSION }} pypgstac load collections /tmp/collection.json --method=upsert | |
| echo 'loading items into pgstac database' | |
| uvx --from pypgstac[psycopg]==${{ vars.PGSTAC_VERSION }} pypgstac load items /tmp/items.json --method=upsert |