Add a test for bug #735 #346
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: deploy-staging-and-create-release | |
| concurrency: | |
| group: deploy-staging | |
| cancel-in-progress: true | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| id-token: write # required for OIDC connectiong to AWS | |
| contents: write # This is required to create a release | |
| jobs: | |
| detect-changes: | |
| runs-on: ubuntu-latest | |
| environment: staging | |
| outputs: | |
| deploy-iac: ${{ steps.check.outputs.deploy-iac }} | |
| deploy-backend: ${{ steps.check.outputs.deploy-backend }} | |
| deploy-frontend: ${{ steps.check.outputs.deploy-frontend }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dorny/paths-filter@v3 | |
| id: check | |
| with: | |
| filters: | | |
| deploy-iac: | |
| - 'tofu/modules/**' | |
| - 'tofu/environments/stage/**' | |
| - '.github/workflows/deploy-staging.yml' | |
| deploy-backend: | |
| - 'backend/**' | |
| - 'tofu/modules/services/backend-service/**' | |
| - 'tofu/environments/stage/services/backend-service/**' | |
| - '.github/workflows/deploy-staging.yml' | |
| deploy-frontend: | |
| - 'frontend/**' | |
| - 'tofu/modules/services/frontend-infra/**' | |
| - 'tofu/environments/stage/services/frontend-infra/**' | |
| - '.github/workflows/deploy-staging.yml' | |
| deploy-stage-iac: | |
| needs: detect-changes | |
| if: needs.detect-changes.outputs.deploy-iac == 'true' | |
| environment: staging | |
| runs-on: ubuntu-latest | |
| env: | |
| TF_VAR_region: ${{ vars.AWS_REGION }} | |
| TF_VAR_environment: ${{ vars.ENV_SHORT_NAME }} | |
| TF_VAR_name_prefix: "tb-${{ vars.PROJECT_SHORT_NAME }}-${{ vars.ENV_SHORT_NAME }}" | |
| TF_VAR_frontend_url: ${{ vars.FRONTEND_URL }} | |
| TF_VAR_ssl_cert_arn: ${{ vars.SSL_CERT_ARN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: install opentofu | |
| uses: opentofu/setup-opentofu@v1 | |
| with: | |
| tofu_version: ${{ vars.TF_VERSION }} | |
| tofu_wrapper: false | |
| - name: install terragrunt | |
| run: | | |
| sudo wget -q -O /bin/terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v${{ vars.TG_VERSION }}/terragrunt_linux_amd64" | |
| sudo chmod +x /bin/terragrunt | |
| terragrunt -v | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.IAM_ROLE }} | |
| role-session-name: Appointment_GitHub_to_AWS_via_FederatedOIDC | |
| aws-region: ${{ vars.AWS_REGION }} | |
| - name: vpc | |
| working-directory: ./tofu/environments/stage/network/vpc | |
| run: | | |
| terragrunt init -upgrade | |
| terragrunt validate | |
| terragrunt plan -out tfplan | |
| terragrunt apply tfplan | |
| - name: backend-infra | |
| working-directory: ./tofu/environments/stage/services/backend-infra | |
| run: | | |
| terragrunt init -upgrade | |
| terragrunt validate | |
| terragrunt plan -out tfplan | |
| terragrunt apply tfplan | |
| - name: cache | |
| working-directory: ./tofu/environments/stage/data-store/cache | |
| run: | | |
| terragrunt init -upgrade | |
| terragrunt validate | |
| terragrunt plan -out tfplan | |
| terragrunt apply tfplan | |
| - name: database | |
| working-directory: ./tofu/environments/stage/data-store/database | |
| run: | | |
| terragrunt init -upgrade | |
| terragrunt validate | |
| terragrunt plan -out tfplan | |
| terragrunt apply tfplan | |
| - name: frontend-infra | |
| working-directory: ./tofu/environments/stage/services/frontend-infra | |
| run: | | |
| terragrunt init -upgrade | |
| terragrunt validate | |
| terragrunt plan -out tfplan | |
| terragrunt apply tfplan | |
| build-and-deploy-stage-frontend: | |
| needs: | |
| - detect-changes | |
| - deploy-stage-iac | |
| if: | | |
| always() && | |
| (needs.deploy-stage-iac.result == 'success' || needs.deploy-stage-iac.result == 'skipped') && | |
| needs.detect-changes.outputs.deploy-frontend == 'true' | |
| environment: staging | |
| runs-on: ubuntu-latest | |
| env: | |
| TF_VAR_region: ${{ vars.AWS_REGION }} | |
| TF_VAR_environment: ${{ vars.ENV_SHORT_NAME }} | |
| TF_VAR_name_prefix: "tb-${{ vars.PROJECT_SHORT_NAME }}-${{ vars.ENV_SHORT_NAME }}" | |
| TF_VAR_frontend_url: ${{ vars.FRONTEND_URL }} | |
| TF_VAR_ssl_cert_arn: ${{ vars.SSL_CERT_ARN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup NPM | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20.x' | |
| - name: Install dependencies | |
| run: cd frontend && npm install | |
| - name: Build stage frontend | |
| run: | | |
| cp frontend/.env.stage.example frontend/.env.stage | |
| cd frontend && npm run build -- --mode ${{ vars.APP_ENV }} | |
| - name: install opentofu | |
| uses: opentofu/setup-opentofu@v1 | |
| with: | |
| tofu_version: ${{ vars.TF_VERSION }} | |
| tofu_wrapper: false | |
| - name: install terragrunt | |
| run: | | |
| sudo wget -q -O /bin/terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v${{ vars.TG_VERSION }}/terragrunt_linux_amd64" | |
| sudo chmod +x /bin/terragrunt | |
| terragrunt -v | |
| - name: Install AWS CLI | |
| uses: unfor19/install-aws-cli-action@v1 | |
| with: | |
| version: 2 | |
| arch: amd64 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.IAM_ROLE }} | |
| role-session-name: Appointment_GitHub_to_AWS_via_FederatedOIDC | |
| aws-region: ${{ vars.AWS_REGION }} | |
| - name: Get frontend bucket & distribution | |
| id: get-frontend-resources | |
| working-directory: ./tofu/environments/stage/services/frontend-infra | |
| run: | | |
| terragrunt init -upgrade | |
| echo "bucket=$(terragrunt output bucket_name | tr -d '"')" >> $GITHUB_OUTPUT | |
| echo "distribution=$(terragrunt output cloudfront_id)" >> $GITHUB_OUTPUT | |
| - name: Deploy frontend to S3 | |
| run: | | |
| aws s3 sync frontend/dist "s3://${{ steps.get-frontend-resources.outputs.bucket }}" | |
| aws cloudfront create-invalidation --distribution-id ${{ steps.get-frontend-resources.outputs.distribution }} --paths "/*" | |
| build-backend-image: | |
| needs: | |
| - detect-changes | |
| environment: staging | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.IAM_ROLE }} | |
| role-session-name: Appointment_GitHub_to_AWS_via_FederatedOIDC | |
| aws-region: ${{ vars.AWS_REGION }} | |
| - name: Login to Amazon ECR | |
| id: login-ecr | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| mask-password: 'true' | |
| - name: Build, tag, and push backend image to Amazon ECR | |
| id: build-backend | |
| env: | |
| ECR_TAG: '${{ steps.login-ecr.outputs.registry }}/${{ vars.PROJECT }}:backend-${{ github.sha }}' | |
| RELEASE_VERSION: ${{ github.sha }} | |
| run: | | |
| # Build a docker container and | |
| # push it to ECR so that it can | |
| # be deployed to ECS. | |
| docker build --build-arg "RELEASE_VERSION=$RELEASE_VERSION" -t $ECR_TAG ./backend -f ./backend/deploy.dockerfile | |
| docker push $ECR_TAG | |
| echo "image_backend=$ECR_TAG" >> $GITHUB_OUTPUT | |
| echo $ECR_TAG > ecr_tag.txt | |
| zip ecr_tag.zip ecr_tag.txt | |
| - name: Archive ECR tag | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ecr_tag | |
| path: ecr_tag.zip | |
| deploy-stage-backend: | |
| needs: | |
| - build-backend-image | |
| - detect-changes | |
| - deploy-stage-iac | |
| if: | | |
| always() && | |
| (needs.deploy-stage-iac.result == 'success' || needs.deploy-stage-iac.result == 'skipped') && | |
| needs.detect-changes.outputs.deploy-backend == 'true' | |
| environment: staging | |
| runs-on: ubuntu-latest | |
| env: | |
| TF_VAR_region: ${{ vars.AWS_REGION }} | |
| TF_VAR_environment: ${{ vars.ENV_SHORT_NAME }} | |
| TF_VAR_name_prefix: "tb-${{ vars.PROJECT_SHORT_NAME }}-${{ vars.ENV_SHORT_NAME }}" | |
| TF_VAR_app_env: ${{ vars.APP_ENV }} | |
| TF_VAR_db_enc_secret: ${{ vars.DB_ENCRYPTED_SECRET }} | |
| TF_VAR_frontend_url: ${{ vars.FRONTEND_URL }} | |
| TF_VAR_fxa_secret: ${{ vars.FXA_SECRET }} | |
| TF_VAR_google_oauth_secret: ${{ vars.GOOGLE_OAUTH_SECRET }} | |
| TF_VAR_log_level: ${{ vars.LOG_LEVEL }} | |
| TF_VAR_short_base_url: ${{ vars.SHORT_BASE_URL }} | |
| TF_VAR_smtp_secret: ${{ vars.SMTP_SECRET }} | |
| TF_VAR_zoom_callback: ${{ vars.ZOOM_CALLBACK }} | |
| TF_VAR_zoom_secret: ${{ vars.ZOOM_SECRET }} | |
| TF_VAR_sentry_dsn: ${{ vars.SENTRY_DSN }} | |
| TF_VAR_ssl_cert_arn: ${{ vars.SSL_CERT_ARN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: install opentofu | |
| uses: opentofu/setup-opentofu@v1 | |
| with: | |
| tofu_version: ${{ vars.TF_VERSION }} | |
| tofu_wrapper: false | |
| - name: install terragrunt | |
| run: | | |
| sudo wget -q -O /bin/terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v${{ vars.TG_VERSION }}/terragrunt_linux_amd64" | |
| sudo chmod +x /bin/terragrunt | |
| terragrunt -v | |
| - name: download ecr tag | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: | |
| ecr_tag | |
| - name: Unzip ECR tag | |
| id: get_ecr_tag | |
| run: | | |
| unzip ecr_tag.zip | |
| output=$(cat ecr_tag.txt) | |
| echo ecr_tag=$output >> $GITHUB_OUTPUT | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ secrets.IAM_ROLE }} | |
| role-session-name: Appointment_GitHub_to_AWS_via_FederatedOIDC | |
| aws-region: ${{ vars.AWS_REGION }} | |
| - name: deploy backend-service | |
| working-directory: ./tofu/environments/stage/services/backend-service | |
| run: | | |
| terragrunt init -upgrade | |
| terragrunt validate | |
| terragrunt plan -var 'image=${{ steps.get_ecr_tag.outputs.ecr_tag }}' -out tfplan | |
| terragrunt apply tfplan | |
| create-release: | |
| needs: | |
| - build-backend-image | |
| - build-and-deploy-stage-frontend | |
| - deploy-stage-iac | |
| - deploy-stage-backend | |
| if: | | |
| always() && | |
| contains(join(needs.*.result, ','), 'success') && | |
| ! contains(join(needs.*.result, ','), 'failure') | |
| environment: production | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup NPM | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20.x' | |
| - name: Install dependencies | |
| run: cd frontend && npm install | |
| - name: Build prod frontend | |
| run: | | |
| cp frontend/.env.prod.example frontend/.env.prod | |
| cd frontend && npm run build -- --mode ${{ vars.APP_ENV }} | |
| zip -r ../frontend.zip dist | |
| - name: download ecr tag | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: | |
| ecr_tag | |
| - name: Zip IaC | |
| run: zip -r iac.zip tofu -x "tofu/environments/stage/*" "tofu/environments/prod/*/*/.terragrunt-cache/*" | |
| - name: create release tag | |
| id: create-release-tag | |
| run: echo "tag_name=r-$(printf %04d $GITHUB_RUN_NUMBER)" >> $GITHUB_OUTPUT | |
| - name: create draft release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ steps.create-release-tag.outputs.tag_name }} | |
| name: Release ${{ steps.create-release-tag.outputs.tag_name }} | |
| body: | | |
| ## Info | |
| Commit ${{ github.sha }} was deployed to `stage`. [See code diff](${{ github.event.compare }}). | |
| It was initialized by [${{ github.event.sender.login }}](${{ github.event.sender.html_url }}). | |
| ## How to Promote? | |
| In order to promote this to prod, edit the draft and press **"Publish release"**. | |
| draft: true | |
| files: | | |
| ecr_tag.zip | |
| frontend.zip | |
| iac.zip |