ipv-cri-ob-api/.github/workflows/deploy-preview.yml at 4f1a6212336e0d9fffc6ee2999220e1fe0cfbec9 · govuk-one-login/ipv-cri-ob-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
name: Deploy preview

on:
  workflow_dispatch:
  workflow_call:
    outputs:
      stack-name:
        description: The deployed stack name # need?
        value: ${{ jobs.deploy.outputs.stack-name }}
      aws-region:
        description: The region the stack was deployed into #need?
        value: ${{ jobs.deploy.outputs.aws-region}}
      secrets:
        role_arn:
          required: true
      # stack-outputs:
      #   descriptioon: The deployed stack outputs
      #   value: $ {{ jobs.deploy.outputs.aws-region }}
      # sha_short: ${{ steps.vars.outputs.sha_short }}
      # is this for the name? so they're not too long
      # passport also has base dir? not sure why
    # secrets: are these the stack outputs? like role arn, s3 premerge bucket name, parameter prefix???

permissions:
  id-token: write
  contents: read

jobs:
  build-preview:
    name: Build app
    permissions:
      id-token: write
      contents: read
    runs-on: ubuntu-latest
    # permissions: {}

    # concurrency:
    #   group: build-development-${{ github.head_ref || github.ref_name }}
    outputs:
      # repo_base_dir
      sha_short: ${{ steps.vars.outputs.sha_short }}
      # cache-key: ${{ steps.build.outputs.cache-key }}
      # cache-restore-keys: ${{ steps.build.outputs.cache-restore-keys }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up AWS creds
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.role_arn }}
          aws-region: eu-west-2

      # - name: Install SAM
      #   uses: aws-actions/setup-sam@v2
      # # need env for AWS_REGION??
      # - name: SAM validate
      #     run: sam validate --region ${{ env.AWS_REGION }} -t deploy/template.yaml --lint

      - name: Get short sha
        id: vars
        run: |
          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Build app
        # uses: govuk-one-login/github-actions/sam/build-application@b2f2c762e88ff7b5656d87c733c57871997e350f
        uses: govuk-one-login/github-actions/sam/build-serverless-application@24304059124dff39f9c5c837e1c25b8d2500a903
        id: build
        with:
          template: deploy/template.yaml
          cache-name: ipv-cri-ob-api-${{ steps.vars.outputs.sha_short }}
          pull-repository: true
          role-to-assume-arn: ${{ secrets.DEV_GHA_ROLE_ARN }}

  deploy-preview:
    name: Deploy stack
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    timeout-minutes: 15
    needs: build-preview
    # concurrency:
    #   group: deploy-development-${{ github.head_ref || github.ref_name }}
    environment:
      name: development
      # url: ${{ steps.deploy.outputs.stack-url }}
    # do we need outputs if they're out puts of the deploy action below?
    outputs:
      aws-region: ${{ steps.deploy.outputs.aws-region }}
      stack-name: ${{ steps.deploy.outputs.stack-name }}
      # no other stack outputs?
      # stack-url
    steps:
      - name: Deploy stack
        uses: govuk-one-login/github-actions/sam/deploy-stack@a069a5f73bbfeea0e71901cee95c441f018e83cb
        id: deploy
        with:
          aws-role-arn: ${{ vars.DEPLOYMENT_ROLE_ARN }}
          s3-prefix: preview
          sam-deployment-bucket: ${{ vars.DEPLOYMENT_ARTIFACTS_BUCKET }}
          stack-name: preview-${{ needs.build.outputs.sha_short}}
          cache-name: ipv-cri-ob-api-${{ needs.build.outputs.sha_short}}
          delete-failed-stack: true
          # do we want disable rollback? I reckon so...

          tags: |
            cri:component=ipv-cri-ob-api
            cri:stack-type=preview
            cri:application=Lime
            cri:deployment-source=github-actions
          # parameters: |
          #   DeploymentType=pre-merge-integration
          #   ParameterPrefix=${{ secrets.PREMERGE_PARAMETER_PREFIX_STACK_NAME }}
          #   Environment=dev
          #   CommonStackName=passport-common-cri-api-local

          #   ParameterPrefix=ob-cri-api
          #   Environment=dev or local dev?
          #   CommonStackName=ob-common-cri-api-local
          #   DeploymentType=pre-merge-integration