-
Notifications
You must be signed in to change notification settings - Fork 0
121 lines (117 loc) · 3.85 KB
/
deploy-dev-staging.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
name: Build and Deploy
on:
push:
branches:
- main
jobs:
synth:
name: Synthesize
permissions:
contents: read
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: v18.15.0
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: ${{ secrets.ACTIONS_ROLE_ARN }}
- name: Assume CDK Lookup Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: ${{ secrets.CDK_LOOKUP_ROLE_ARN }}
role-external-id: Pipeline
- name: cdk synth
run: |-
npm ci
npm run build
npm run build:ci
npm run cdk synth -- -c developmentAccountId=${{ secrets.AWS_ACCOUNT_ID_DEVELOPMENT }} -c stagingAccountId=${{ secrets.AWS_ACCOUNT_ID_STAGING }} -c productionAccountId=${{ secrets.AWS_ACCOUNT_ID_STAGING }}
- name: Upload cdk.out
uses: actions/upload-artifact@v3
with:
name: cdk.out
path: cdk.out
deploy:
name: Deploy - Dev/Staging
needs: [synth]
permissions:
contents: read
id-token: write
runs-on: ubuntu-latest
steps:
- name: Download cdk.out
uses: actions/download-artifact@v3
with:
name: cdk.out
path: cdk.out
- uses: actions/setup-node@v3
with:
node-version: v18.15.0
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: ${{ secrets.ACTIONS_ROLE_ARN }}
- name: Deploy - Dev
run: |-
npm install -g aws-cdk
npx cdk deploy --app "./cdk.out/assembly-Dev" --never-approve
- name: Deploy - Staging
run: |-
npx cdk deploy --app 'cdk.out/assembly-Staging' --never-approve
create-release:
name: Create production release
needs: deploy
runs-on: ubuntu-latest
permissions:
contents: write
id-token: write
pull-requests: read
steps:
# need to checkout the repo to get the PR number
- name: Checkout
uses: actions/checkout@v3
- name: Download Artifact
uses: actions/download-artifact@v3
with:
name: cdk.out
path: cdk.out
# we can't attach a folder to a release
- name: Zip Artifact
run: |
zip -r cdk.out.zip cdk.out
- name: Generate release tag
id: generate_release_tag
uses: alexvingg/next-release-tag@v1.0.4
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
tag_prefix: ''
- name: Create Draft Release
uses: softprops/action-gh-release@v1
with:
tag_name: ${{ steps.generate_release_tag.outputs.release_tag }}
name: Release ${{ steps.generate_release_tag.outputs.release_tag }}
body: |
## Info
Commit ${{ github.sha }} was deployed to `staging`. [See code diff](${{ github.event.compare }}).
It was initialized by [${{ github.event.sender.login }}](${{ github.event.sender.html_url }}).
## How to Promote?
In order to promote this to prod, edit the draft and press **"Publish release"**.
draft: true
files: cdk.out.zip