account-interventions-service/.github/workflows/manual-publish-main-to-dev.yaml at 4ac3f91a48f411278437383a83bf1e0bfd64df3d · govuk-one-login/account-interventions-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
---
name: "Validate & Publish Main SAM Template to Dev Env"

on:
  push:
    paths:
      - "src/**"
      - "!src/infra/core/**" # excluded with !
      - ".github/workflows/manual-publish-main-to-dev.yaml"
    branches:
      - main
  workflow_dispatch:
    inputs:
      gitRef:
        description: "Input branch name, commit SHA, or tag"
        required: true
        type: string
        default: main

permissions:
  id-token: write
  contents: read

jobs:
  validate_deployment:
    name: Deployment Template Checks
    uses: ./.github/workflows/validate-main-sam-template.yaml
    with:
      gitRef: ${{ inputs.gitRef }}
    secrets:
      githubActionsRoleARN: ${{ secrets.DEV_MAIN_GH_ACTIONS_ROLE_ARN }}

  acceptance_checks:
    name: Acceptance Checks
    uses: ./.github/workflows/acceptance-checks.yaml
    secrets: inherit # pragma: allowlist secret
    with:
      gitRef: ${{ inputs.gitRef }}

  publish_artifacts:
    name: "Publish Image & Template"
    runs-on: ubuntu-latest
    timeout-minutes: 60
    needs:
      - validate_deployment
      - acceptance_checks
    steps:
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # pin@v3
        with:
          ref: ${{ inputs.gitRef }}

      - name: Setup NodeJS
        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # pin@v3
        with:
          node-version-file: '.node-version'

      - name: Run yarn install
        run: yarn install --frozen-lockfile

      - name: Run yarn package
        run: yarn package

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # pin@v1-node16
        with:
          role-to-assume: ${{ secrets.DEV_MAIN_GH_ACTIONS_ROLE_ARN }}
          aws-region: eu-west-2

      - name: "Deploy SAM app"
        uses: govuk-one-login/devplatform-upload-action@dc8158079d3976d613515180e543930cdbe73f5f # pin@v3.9.1
        with:
          artifact-bucket-name: ${{ secrets.DEV_MAIN_ARTIFACT_BUCKET_NAME }}
          signing-profile-name: ${{ secrets.DEV_SIGNING_PROFILE_NAME }}
          working-directory: ./.aws-sam/build/
          template-file: template.yaml

      - name: "Delegated Deployment via AWS CodeDeploy"
        run: echo "Deployment has been delegated to AWS CodeDeploy"