|
name: Deploy to Production
|
|
|
|
# Per SOP Part 2 §2: ONLY publishing a GitHub Release (with an attached git
|
|
# tag, e.g. v1.3.0) on `main` deploys to Production. Merging to `main` alone
|
|
# must never trigger this.
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
permissions:
|
|
id-token: write # required for AWS OIDC role assumption
|
|
contents: read
|
|
|
|
jobs:
|
|
validate-and-deploy:
|
|
# Belt-and-braces: only run for a release whose target branch is main
|
|
# (matches SOP Part 4 step 4's "Target branch is set to main").
|
|
if: github.event.release.target_commitish == 'main'
|
|
runs-on: ubuntu-latest
|
|
environment: production
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.event.release.tag_name }}
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install Ruff
|
|
run: pip install ruff
|
|
|
|
- name: Ruff check
|
|
run: ruff check .
|
|
|
|
# SOP Part 4 step 1 requires the -beta suffix removed before this
|
|
# point -- this check fails loudly instead of silently deploying a
|
|
# mismatched version if that step was skipped.
|
|
- name: Verify VERSION matches the release tag
|
|
run: |
|
|
TAG="${{ github.event.release.tag_name }}"
|
|
TAG_CLEAN="${TAG#v}"
|
|
FILE_VERSION="$(cat VERSION)"
|
|
if [ "$TAG_CLEAN" != "$FILE_VERSION" ]; then
|
|
echo "::error::Release tag ($TAG_CLEAN) does not match VERSION file ($FILE_VERSION) at this ref."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Set up AWS SAM CLI
|
|
uses: aws-actions/setup-sam@v2
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@v4
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN_PROD }}
|
|
aws-region: ap-south-1
|
|
|
|
- name: sam validate
|
|
run: sam validate --lint
|
|
|
|
- name: sam build
|
|
run: sam build
|
|
|
|
# S3RetentionDays / DailyScheduleCronExpression are Repository/
|
|
# Environment "variables" (Settings -> Environments -> production),
|
|
# NOT hardcoded here -- per this project's own established rule,
|
|
# these are business decisions that must never be guessed by an
|
|
# agent or baked into a template. This job will fail until a human
|
|
# sets both for the "production" environment.
|
|
- name: sam deploy
|
|
run: |
|
|
sam deploy \
|
|
--stack-name nsdl-sez-boe-automation-prod \
|
|
--capabilities CAPABILITY_IAM \
|
|
--resolve-s3 \
|
|
--resolve-image-repos \
|
|
--region ap-south-1 \
|
|
--no-confirm-changeset \
|
|
--no-fail-on-empty-changeset \
|
|
--parameter-overrides Environment=PROD S3RetentionDays="${{ vars.PROD_S3_RETENTION_DAYS }}" DailyScheduleCronExpression="${{ vars.PROD_CRON_EXPRESSION }}"
|