sts-mock-dev-deploy.yml

name: STS Mock - Manual Deployment to Dev

on:
  workflow_dispatch:
    inputs:
      gitRef:
        description: Input branch name or commit SHA
        required: true
        type: string
        default: main

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      id-token: write
      contents: read
    env:
      SAM_CLI_TELEMETRY: 0
    defaults:
      run:
        working-directory: ./sts-mock
    steps:
      - name: Check out repository code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          # Check out the repository at the specific branch, tag, or commit
          ref: ${{ inputs.gitRef }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
        with:
          role-to-assume: ${{ secrets.DEV_STS_MOCK_GH_ACTIONS_ROLE_ARN }}
          aws-region: eu-west-2

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419 # v2.1.5

      - name: Set GIT_REF_SHA
        # Set GIT_REF_SHA to the checked-out commit SHA
        run: echo "GIT_REF_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV

      - name: Build, tag and push image to ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ secrets.DEV_STS_MOCK_ECR_REPOSITORY_NAME }}
          IMAGE_TAG: ${{ env.GIT_REF_SHA }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

      - name: Set up SAM CLI
        uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
        with:
          version: 1.155.2
          use-installer: true

      - name: Update SAM template with ECR image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ secrets.DEV_STS_MOCK_ECR_REPOSITORY_NAME }}
          IMAGE_TAG: ${{ env.GIT_REF_SHA }}
        run: sed -i "s|CONTAINER-IMAGE-PLACEHOLDER|$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG|" template.yaml

      - name: Validate SAM template
        run: sam validate --lint

      - name: Build SAM template
        run: sam build

      - name: Zip SAM template
        run: |
          mv .aws-sam/build/template.yaml cf-template.yaml
          zip template.zip cf-template.yaml

      - name: Deploy SAM app
        env:
          ARTIFACT_BUCKET_NAME: ${{ secrets.DEV_STS_MOCK_GH_ARTIFACT_SOURCE_BUCKET_NAME }}
          IMAGE_TAG: ${{ env.GIT_REF_SHA }}
        run: |
          aws s3 cp template.zip "s3://$ARTIFACT_BUCKET_NAME/template.zip" --metadata "repository=$GITHUB_REPOSITORY,commitsha=$IMAGE_TAG"