ScheduleV2 #26
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pipeline | |
| permissions: | |
| id-token: write # required to use OIDC authentication | |
| contents: read # required to checkout the code from the repo | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| - 'feature**' | |
| delete: | |
| branches: | |
| - 'feature**' | |
| env: | |
| PIPELINE_USER_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| PIPELINE_USER_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| SAM_TEMPLATE: template.yml | |
| TESTING_STACK_NAME: awswhatsnew-dev | |
| TESTING_PIPELINE_EXECUTION_ROLE: arn:aws:iam::718974227478:role/aws-sam-cli-managed-dev-pipe-PipelineExecutionRole-1PKCNR3HDSDTF | |
| TESTING_CLOUDFORMATION_EXECUTION_ROLE: arn:aws:iam::718974227478:role/aws-sam-cli-managed-dev-p-CloudFormationExecutionR-1HWGPXS43XB77 | |
| TESTING_ARTIFACTS_BUCKET: aws-sam-cli-managed-dev-pipeline-artifactsbucket-bo0ti1ks1pxg | |
| # If there are functions with "Image" PackageType in your template, | |
| # uncomment the line below and add "--image-repository ${TESTING_IMAGE_REPOSITORY}" to | |
| # testing "sam package" and "sam deploy" commands. | |
| # TESTING_IMAGE_REPOSITORY = '0123456789.dkr.ecr.region.amazonaws.com/repository-name' | |
| TESTING_REGION: af-south-1 | |
| PROD_STACK_NAME: awswhatsnew-prod | |
| PROD_PIPELINE_EXECUTION_ROLE: arn:aws:iam::718974227478:role/aws-sam-cli-managed-prod-pip-PipelineExecutionRole-1XWYJCQP86T4Z | |
| PROD_CLOUDFORMATION_EXECUTION_ROLE: arn:aws:iam::718974227478:role/aws-sam-cli-managed-prod-CloudFormationExecutionR-1ZAG5DIZ98PN | |
| PROD_ARTIFACTS_BUCKET: aws-sam-cli-managed-prod-pipeline-artifactsbucket-15fp2sendtr8f | |
| # If there are functions with "Image" PackageType in your template, | |
| # uncomment the line below and add "--image-repository ${PROD_IMAGE_REPOSITORY}" to | |
| # prod "sam package" and "sam deploy" commands. | |
| # PROD_IMAGE_REPOSITORY = '0123456789.dkr.ecr.region.amazonaws.com/repository-name' | |
| PROD_REGION: af-south-1 | |
| jobs: | |
| test: | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - run: | | |
| # trigger the tests here | |
| delete-feature: | |
| if: startsWith(github.event.ref, 'feature') && github.event_name == 'delete' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - uses: actions/setup-python@v2 | |
| - uses: aws-actions/setup-sam@v1 | |
| - name: Assume the testing pipeline user role | |
| uses: aws-actions/configure-aws-credentials@v1 | |
| with: | |
| aws-access-key-id: ${{ env.PIPELINE_USER_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ env.PIPELINE_USER_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ env.TESTING_REGION }} | |
| role-to-assume: ${{ env.TESTING_PIPELINE_EXECUTION_ROLE }} | |
| role-session-name: testing-packaging | |
| role-duration-seconds: 3600 | |
| role-skip-session-tagging: true | |
| - name: Delete feature branch stack | |
| env: | |
| FEATURE_BRANCH_NAME: ${{ github.event.ref }} | |
| run: | | |
| sam delete \ | |
| --stack-name $(echo ${FEATURE_BRANCH_NAME##*/} | tr -cd '[a-zA-Z0-9-]') \ | |
| --region ${TESTING_REGION} \ | |
| --no-prompts | |
| build-and-deploy-feature: | |
| # this stage is triggered only for feature branches (feature*), | |
| # which will build the stack and deploy to a stack named with branch name. | |
| if: startsWith(github.ref, 'refs/heads/feature') | |
| needs: [test] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - uses: actions/setup-python@v2 | |
| - uses: aws-actions/setup-sam@v1 | |
| - run: sam build --template ${SAM_TEMPLATE} --use-container | |
| - name: Assume the testing pipeline user role | |
| uses: aws-actions/configure-aws-credentials@v1 | |
| with: | |
| aws-access-key-id: ${{ env.PIPELINE_USER_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ env.PIPELINE_USER_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ env.TESTING_REGION }} | |
| role-to-assume: ${{ env.TESTING_PIPELINE_EXECUTION_ROLE }} | |
| role-session-name: feature-deployment | |
| role-duration-seconds: 3600 | |
| role-skip-session-tagging: true | |
| - name: Deploy to feature stack in the testing account | |
| shell: bash | |
| run: | | |
| sam deploy --stack-name $(echo ${GITHUB_REF##*/} | tr -cd '[a-zA-Z0-9-]') \ | |
| --capabilities CAPABILITY_IAM \ | |
| --region ${TESTING_REGION} \ | |
| --s3-bucket ${TESTING_ARTIFACTS_BUCKET} \ | |
| --no-fail-on-empty-changeset \ | |
| --role-arn ${TESTING_CLOUDFORMATION_EXECUTION_ROLE} | |
| build-and-package: | |
| if: github.ref == 'refs/heads/main' | |
| needs: [test] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - uses: actions/setup-python@v2 | |
| - uses: aws-actions/setup-sam@v1 | |
| # docker setup for ARM/Graviton | |
| - name: Setup Docker for cross architecture build | |
| run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes | |
| - name: Build resources | |
| run: sam build --template ${SAM_TEMPLATE} --use-container | |
| - name: configure aws credentials | |
| uses: aws-actions/configure-aws-credentials@v1 | |
| with: | |
| role-to-assume: arn:aws:iam::718974227478:role/GithubActionsOIDC-Role-FI89LLXFL7RA | |
| role-duration-seconds: 900 # the ttl of the session, in seconds. | |
| aws-region: af-south-1 # use your region here. | |
| - name: Upload artifacts to testing artifact buckets | |
| run: | | |
| sam package \ | |
| --s3-bucket ${TESTING_ARTIFACTS_BUCKET} \ | |
| --region ${TESTING_REGION} \ | |
| --output-template-file packaged-testing.yaml | |
| - uses: actions/upload-artifact@v2 | |
| with: | |
| name: packaged-testing.yaml | |
| path: packaged-testing.yaml | |
| - name: Upload artifacts to production artifact buckets | |
| run: | | |
| sam package \ | |
| --s3-bucket ${PROD_ARTIFACTS_BUCKET} \ | |
| --region ${PROD_REGION} \ | |
| --output-template-file packaged-prod.yaml | |
| - uses: actions/upload-artifact@v2 | |
| with: | |
| name: packaged-prod.yaml | |
| path: packaged-prod.yaml | |
| deploy-testing: | |
| if: github.ref == 'refs/heads/main' | |
| needs: [build-and-package] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - uses: actions/setup-python@v2 | |
| - uses: aws-actions/setup-sam@v1 | |
| - uses: actions/download-artifact@v2 | |
| with: | |
| name: packaged-testing.yaml | |
| - name: configure aws credentials | |
| uses: aws-actions/configure-aws-credentials@v1 | |
| with: | |
| role-to-assume: arn:aws:iam::718974227478:role/GithubActionsOIDC-Role-FI89LLXFL7RA | |
| role-duration-seconds: 900 # the ttl of the session, in seconds. | |
| aws-region: af-south-1 # use your region here. | |
| - name: Deploy to testing account | |
| run: | | |
| sam deploy --stack-name ${TESTING_STACK_NAME} \ | |
| --template packaged-testing.yaml \ | |
| --capabilities CAPABILITY_IAM \ | |
| --region ${TESTING_REGION} \ | |
| --s3-bucket ${TESTING_ARTIFACTS_BUCKET} \ | |
| --no-fail-on-empty-changeset \ | |
| --role-arn ${TESTING_CLOUDFORMATION_EXECUTION_ROLE} \ | |
| --parameter-overrides StageEnv=dev | |
| integration-test: | |
| if: github.ref == 'refs/heads/main' | |
| needs: [deploy-testing] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - run: | | |
| # trigger the integration tests here | |
| deploy-prod: | |
| if: github.ref == 'refs/heads/main' | |
| needs: [integration-test] | |
| runs-on: ubuntu-latest | |
| # Configure GitHub Action Environment to have a manual approval step before deployment to production | |
| # https://docs.github.com/en/actions/reference/environments | |
| # environment: <configured-environment> | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - uses: actions/setup-python@v2 | |
| - uses: aws-actions/setup-sam@v1 | |
| - uses: actions/download-artifact@v2 | |
| with: | |
| name: packaged-prod.yaml | |
| - name: configure aws credentials | |
| uses: aws-actions/configure-aws-credentials@v1 | |
| with: | |
| role-to-assume: arn:aws:iam::718974227478:role/GithubActionsOIDC-Role-FI89LLXFL7RA | |
| role-duration-seconds: 900 # the ttl of the session, in seconds. | |
| aws-region: af-south-1 # use your region here. | |
| - name: Deploy to production account | |
| run: | | |
| sam deploy --stack-name ${PROD_STACK_NAME} \ | |
| --template packaged-prod.yaml \ | |
| --capabilities CAPABILITY_IAM \ | |
| --region ${PROD_REGION} \ | |
| --s3-bucket ${PROD_ARTIFACTS_BUCKET} \ | |
| --no-fail-on-empty-changeset \ | |
| --role-arn ${PROD_CLOUDFORMATION_EXECUTION_ROLE} \ | |
| --parameter-overrides StageEnv=prod |