Update CI/CD pipeline fixes for CDK paths and envs #9
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: deploy | |
| on: | |
| push: | |
| branches: [ 'main', 'develop'] | |
| env: | |
| AWS_DEFAULT_REGION: us-east-1 | |
| AWS_DEFAULT_OUTPUT: json | |
| jobs: | |
| code-quality: | |
| name: Check coding standards | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - run: echo "Job triggered by ${{ github.event_name }} event." | |
| - run: echo "Job running on a ${{ runner.os }} server hosted by GitHub." | |
| - run: echo "Branch name is ${{ github.ref }} and repository is ${{ github.repository }}." | |
| - name: Set up NodeJs | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: "20" | |
| - name: Run Prettier and Lint | |
| run: | | |
| cd src | |
| npm ci | |
| npm run prettier-check | |
| npm run lint | |
| build-nextjs: | |
| name: Build NextJS Application | |
| runs-on: ubuntu-latest | |
| needs: code-quality | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Set up NodeJs | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: "20" | |
| - name: Build NextJs App to Output folder | |
| run: bash build.sh | |
| - name: Archive NextJS Output dir | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: nextjs-output-dir | |
| path: src/out | |
| cdk-synth-diff: | |
| name: CDK Synth & Diff | |
| runs-on: ubuntu-latest | |
| needs: build-nextjs | |
| permissions: | |
| id-token: write # This is required for requesting the JWT | |
| contents: read # This is required for actions/checkout | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Set up NodeJs | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: "20" | |
| - name: Install CDK and Modules | |
| run: | | |
| npm install -g aws-cdk | |
| cd ./cdk | |
| npm ci | |
| # Same task with different secrets depending on the branch ref (dev vs prod deployments) | |
| # Note: there might be better alternatives, but this is a workaround to deploy to both envs | |
| - name: Configure AWS Credentials (DEV) | |
| if: github.ref != 'refs/heads/main' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-region: ${{ env.AWS_DEFAULT_REGION }} | |
| role-to-assume: arn:aws:iam::${{ secrets.DEV_AWS_ACCOUNT_ID }}:role/${{ secrets.DEV_AWS_DEPLOY_ROLE }} | |
| role-session-name: myGitHubActions | |
| - name: Configure AWS Credentials (PROD) | |
| if: github.ref == 'refs/heads/main' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-region: ${{ env.AWS_DEFAULT_REGION }} | |
| role-to-assume: arn:aws:iam::${{ secrets.PROD_AWS_ACCOUNT_ID }}:role/${{ secrets.PROD_AWS_DEPLOY_ROLE }} | |
| role-session-name: myGitHubActions | |
| - run: aws sts get-caller-identity | |
| # Not 100% optimal, but does the work for setting deployment environments from branch | |
| - name: Setup Deployment Environment from Branch | |
| run: | | |
| # To update the deployment environment based on the git branch | |
| if [[ $GITHUB_REF == 'refs/heads/main' ]]; then | |
| echo "DEPLOYMENT_ENVIRONMENT=prod" >> "$GITHUB_ENV" | |
| echo "Deployment environment is PROD" | |
| else | |
| echo "DEPLOYMENT_ENVIRONMENT=dev" >> "$GITHUB_ENV" | |
| echo "Deployment environment is DEV" | |
| fi | |
| - name: CDK Synth | |
| run: | | |
| cd ./cdk | |
| cdk synth | |
| - name: CDK Diff | |
| run: | | |
| cd ./cdk | |
| cdk diff | |
| - name: Archive CDK Synth results (no assets) | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: cdk-synth-folder | |
| path: | | |
| ./cdk.out | |
| !./cdk.out/asset.* | |
| retention-days: 1 | |
| iac-checkov: | |
| name: IaC Checkov Validations | |
| runs-on: ubuntu-latest | |
| needs: cdk-synth-diff | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Dowload CDK Synth results | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: cdk-synth-folder | |
| path: ./cdk-synth-output-folder | |
| - name: Display files in the output folder | |
| run: ls -lrta | |
| working-directory: ./cdk-synth-output-folder | |
| - name: Run Checkov action | |
| id: checkov | |
| uses: bridgecrewio/checkov-action@v12 | |
| with: | |
| directory: cdk-synth-output-folder/ | |
| framework: cloudformation | |
| soft_fail: true # optional: do not return an error code if there are failed checks | |
| skip_check: CKV_AWS_2 # optional: skip a specific check_id. can be comma separated list | |
| quiet: true # optional: display only failed checks | |
| cdk-deploy: | |
| name: Deploy CDK | |
| runs-on: ubuntu-latest | |
| needs: | |
| - iac-checkov | |
| permissions: | |
| id-token: write # This is required for requesting the JWT | |
| contents: read # This is required for actions/checkout | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Set up NodeJs | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: "20" | |
| - name: Install CDK and Modules | |
| run: | | |
| npm install -g aws-cdk | |
| cd ./cdk | |
| npm ci | |
| # Same task with different secrets depending on the branch ref (dev vs prod deployments) | |
| # Note: there might be better alternatives, but this is a workaround to deploy to both envs | |
| - name: Configure AWS Credentials (DEV) | |
| if: github.ref != 'refs/heads/main' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-region: ${{ env.AWS_DEFAULT_REGION }} | |
| role-to-assume: arn:aws:iam::${{ secrets.DEV_AWS_ACCOUNT_ID }}:role/${{ secrets.DEV_AWS_DEPLOY_ROLE }} | |
| role-session-name: myGitHubActions | |
| - name: Configure AWS Credentials (PROD) | |
| if: github.ref == 'refs/heads/main' | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-region: ${{ env.AWS_DEFAULT_REGION }} | |
| role-to-assume: arn:aws:iam::${{ secrets.PROD_AWS_ACCOUNT_ID }}:role/${{ secrets.PROD_AWS_DEPLOY_ROLE }} | |
| role-session-name: myGitHubActions | |
| - name: Dowload NextJS output folder | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: nextjs-output-dir | |
| path: ./src/out | |
| # Not 100% optimal, but does the work for setting deployment environments from branch | |
| - name: Setup Deployment Environment from Branch | |
| run: | | |
| # To update the deployment environment based on the git branch | |
| if [[ $GITHUB_REF == 'refs/heads/main' ]]; then | |
| echo "DEPLOYMENT_ENVIRONMENT=prod" >> "$GITHUB_ENV" | |
| echo "Deployment environment is PROD" | |
| else | |
| echo "DEPLOYMENT_ENVIRONMENT=dev" >> "$GITHUB_ENV" | |
| echo "Deployment environment is DEV" | |
| fi | |
| # NOTE: for now no manual approvals are required | |
| - name: Deploy to AWS | |
| run: bash deploy.sh $DEPLOYMENT_ENVIRONMENT |