deploy-roles-org-sink-bus-roles.yml

name: Deploy org sink bus roles

on:
  push:
    branches:
      - main
    paths:
      - iam-roles/org-sink-bus-roles/template.yml

concurrency:
  group: ${{ github.workflow }}

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-2
          role-to-assume: arn:aws:iam::048723829744:role/PRX-GHA-AccessRole
          role-session-name: gha-deploy-org-sink-roles

      - name: Deploy to management account
        working-directory: iam-roles/org-sink-bus-roles
        run: |
          aws cloudformation deploy \
            --region us-east-2 \
            --stack-name org-sink-bus-roles \
            --template-file template.yml \
            --capabilities CAPABILITY_NAMED_IAM \
            --no-fail-on-empty-changeset \
            --role-arn arn:aws:iam::048723829744:role/PRX-GHA-ServiceRoleForCloudFormation

      # - name: Update stack set
      #   working-directory: iam-roles/org-sink-bus-roles
      #   run: |
      #     template_body=$(cat template.yml)

      #     aws cloudformation update-stack-set \
      #       --stack-set-name org-sink-bus-roles \
      #       --capabilities CAPABILITY_NAMED_IAM \
      #       --template-body "$template_body" \
      #       --operation-preferences FailureTolerancePercentage=100,MaxConcurrentPercentage=100,ConcurrencyMode=SOFT_FAILURE_TOLERANCE,RegionConcurrencyType=PARALLEL \
      #       --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false