|
name: Deploy to Test
|
|
|
|
# Per SOP Part 2 §1: merging a PR into `test` deploys to the Test/Pre-Prod
|
|
# stack automatically.
|
|
on:
|
|
push:
|
|
branches: [test]
|
|
|
|
permissions:
|
|
id-token: write # required for AWS OIDC role assumption
|
|
contents: read
|
|
|
|
jobs:
|
|
validate-and-deploy:
|
|
runs-on: ubuntu-latest
|
|
environment: test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
# SOP Part 1 §3: Ruff must pass with zero errors before anything is
|
|
# allowed to deploy.
|
|
- name: Install Ruff
|
|
run: pip install ruff
|
|
|
|
- name: Ruff check
|
|
run: ruff check .
|
|
|
|
- name: Ruff format check
|
|
run: ruff format --check .
|
|
|
|
- name: Set up AWS SAM CLI
|
|
uses: aws-actions/setup-sam@v2
|
|
|
|
# OIDC role assumption -- no long-lived AWS keys stored in GitHub.
|
|
# AWS_DEPLOY_ROLE_ARN is a repo/environment secret set after the IAM
|
|
# role (see infra/github-oidc-role.yaml) is deployed.
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@v4
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
|
|
aws-region: ap-south-1
|
|
|
|
# SOP Part 1 §3: template.yaml changes must pass sam validate before
|
|
# committing/deploying.
|
|
- name: sam validate
|
|
run: sam validate --lint
|
|
|
|
- name: sam build
|
|
run: sam build
|
|
|
|
# Deploys to the same nsdl-sez-boe-automation-test stack already
|
|
# verified by hand -- same parameters as that real deploy.
|
|
#
|
|
# The artifact bucket and image repositories are passed explicitly
|
|
# (the ones created by that first manual deploy) instead of
|
|
# --resolve-s3 / --resolve-image-repos. Those flags make SAM create or
|
|
# update helper stacks (aws-sam-cli-managed-default and the
|
|
# <stack>-<hash>-CompanionStack), which the least-privilege deploy role
|
|
# is deliberately NOT allowed to touch -- its CloudFormation access is
|
|
# scoped to the nsdl-sez-boe-automation-test stack only.
|
|
- name: sam deploy
|
|
run: |
|
|
sam deploy \
|
|
--stack-name nsdl-sez-boe-automation-test \
|
|
--capabilities CAPABILITY_IAM \
|
|
--s3-bucket aws-sam-cli-managed-default-samclisourcebucket-rfupfwdltjdf \
|
|
--image-repositories PhaseAFunction=<ACCOUNT_ID>.dkr.ecr.ap-south-1.amazonaws.com/nsdlsezboeautomationtest885ce73b/phaseafunction0838d0carepo \
|
|
--image-repositories PhaseBFunction=<ACCOUNT_ID>.dkr.ecr.ap-south-1.amazonaws.com/nsdlsezboeautomationtest885ce73b/phasebfunctionae2b77bbrepo \
|
|
--region ap-south-1 \
|
|
--no-confirm-changeset \
|
|
--no-fail-on-empty-changeset \
|
|
--parameter-overrides Environment=TEST S3RetentionDays=90 'DailyScheduleCronExpression="cron(0 1 * * ? *)"'
|