Workflow to deploy images into dev namespce

[alanraju-aot]

User description

📝 Pull Request Summary

Description:

Workflow file to deploy imgaes into dev namespace

Related Jira Ticket: https://aottech.atlassian.net/browse/OPS-242

DEPENDENCY PR:

Type of Change:

• 🚀 Deployment / Config Change / Yaml changes

---

💻 Frontend Changes

Modules/Components Affected:

Summary of Frontend Changes:

UI/UX Review:

• Required
• Not Applicable

Screenshots / Screen Recordings (if applicable):

---

⚙️ Backend Changes (Java / Python)

Modules/Endpoints Affected:

Summary of Backend Changes:

API Testing:

• Done
• Not Applicable

Screenshots / Screen Recordings (if applicable):

✅ Checklist

• Code builds successfully without lint or type errors
• Unit tests added or updated [Backend]
• UI verified [Frontend]
• Documentation updated (README / Confluence / API Docs)
• No sensitive information (keys, passwords, secrets) committed
• I have updated the CHANGELOG with relevant details
• I have given a clear and meaningful PR title and description as per standard format
• I have verified cross-repo dependencies (if any)
• I have confirmed backward compatibility with previous releases

Details:
add these secrets

DEV_EKS_CLUSTER
DEV_OPENSOURCE_NAMESPACE

👥 Reviewer Notes

---

PR Type

Enhancement

---

Description

• Add manual dev deployment GitHub Action

• Compute release version from VERSION

• Configure AWS/EKS access and kubectl

• Patch dev deployments to new images

---

Diagram Walkthrough

flowchart LR
  A["workflow_dispatch trigger"] 
  B["Read VERSION and set env"] 
  C["Configure AWS credentials"] 
  D["Update EKS kubeconfig"] 
  E["kubectl patch deployments with image tags"] 
  F["kubectl rollout status checks"] 
  A -- "starts" --> B
  B -- "prepares" --> C
  C -- "authenticates" --> D
  D -- "enables access" --> E
  E -- "verifies" --> F

Loading

File Walkthrough

	Relevant files
Configuration changes	dev-deployment.yml Add manual dev deployment workflow for EKS                              .github/workflows/dev-deployment.yml Add workflow_dispatch dev deployment workflow Set VERSION differently for master Configure AWS creds and EKS kubeconfig Patch five deployments and wait rollout +69/-0

---

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 Security concerns Credential management: The workflow uses long-lived AWS access keys from GitHub Secrets (AWS_DEPLOYMENT_ACCESS_KEY_ID / AWS_DEPLOYMENT_SECRET_ACCESS_KEY). Consider migrating to GitHub OIDC role assumption to reduce exposure/rotation risk. Also review the requested packages: write permission for necessity to minimize blast radius if the workflow token is abused.

⚡ Recommended focus areas for review Possible Issue The kubectl patch payload sets spec.template.spec.containers to a single-item array. If any of these deployments have multiple containers (sidecars, init patterns converted to containers, etc.), this can unintentionally drop the other containers and break the pod spec. Consider using kubectl set image deployment/<name> <container>=<image>:<tag> (or a patch that only updates the matching container entry without replacing the whole list). - name: Patch Deployments with New Image run: | kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-api -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-api","image":"docker.io/formsflow/forms-flow-webapi:'"${VERSION}"'"}]}}}}' kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-bpm -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-bpm","image":"docker.io/formsflow/forms-flow-bpm:'"${VERSION}"'"}]}}}}' kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-data-layer -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-data-layer","image":"docker.io/formsflow/forms-flow-data-layer:'"${VERSION}"'"}]}}}}' kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-documents-api -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-documents-api","image":"docker.io/formsflow/forms-flow-documents-api:'"${VERSION}"'"}]}}}}' kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-web -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-web","image":"docker.io/formsflow/forms-flow-web:'"${VERSION}"'"}]}}}}' Reproducibility Using version: latest for kubectl and not pinning action versions to immutable SHAs can introduce non-deterministic behavior (sudden workflow breakage or behavior changes). Prefer pinning kubectl to a known version and actions to a commit SHA (or at least a stable major+minor strategy if that is your standard). uses: aws-actions/configure-aws-credentials@v4 with: aws-access-key-id: ${{ secrets.AWS_DEPLOYMENT_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_DEPLOYMENT_SECRET_ACCESS_KEY }} aws-region: ca-central-1 - name: Setup kubectl uses: azure/setup-kubectl@v3 with: version: latest Least Privilege The job requests packages: write but the workflow appears to only deploy to EKS. If not required, drop this permission. Also consider whether static AWS access keys are necessary vs GitHub OIDC (id-token: write) with an assumed role for improved security posture and easier credential rotation. permissions: contents: read packages: write

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Use set-image with rollout timeout The current JSON patch strings rely on fragile shell quoting and are easy to break, which can result in deploying the wrong image or failing silently. Use kubectl set image (built for this use-case) and add a rollout --timeout so the job doesn’t hang indefinitely on a bad deploy. .github/workflows/dev-deployment.yml [58-69] - name: Patch Deployments with New Image run: | - kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-api -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-api","image":"docker.io/formsflow/forms-flow-webapi:'"${VERSION}"'"}]}}}}' - kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-bpm -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-bpm","image":"docker.io/formsflow/forms-flow-bpm:'"${VERSION}"'"}]}}}}' - kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-data-layer -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-data-layer","image":"docker.io/formsflow/forms-flow-data-layer:'"${VERSION}"'"}]}}}}' - kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-documents-api -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-documents-api","image":"docker.io/formsflow/forms-flow-documents-api:'"${VERSION}"'"}]}}}}' - kubectl -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} patch deployment forms-flow-web -p '{"spec":{"template":{"spec":{"containers":[{"name":"forms-flow-web","image":"docker.io/formsflow/forms-flow-web:'"${VERSION}"'"}]}}}}' - kubectl rollout status deployment/forms-flow-api -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} - kubectl rollout status deployment/forms-flow-bpm -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} - kubectl rollout status deployment/forms-flow-data-layer -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} - kubectl rollout status deployment/forms-flow-documents-api -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} - kubectl rollout status deployment/forms-flow-web -n ${{ secrets.DEV_OPENSOURCE_NAMESPACE }} + NS="${{ secrets.DEV_OPENSOURCE_NAMESPACE }}" + kubectl -n "$NS" set image deployment/forms-flow-api forms-flow-api="docker.io/formsflow/forms-flow-webapi:${VERSION}" + kubectl -n "$NS" set image deployment/forms-flow-bpm forms-flow-bpm="docker.io/formsflow/forms-flow-bpm:${VERSION}" + kubectl -n "$NS" set image deployment/forms-flow-data-layer forms-flow-data-layer="docker.io/formsflow/forms-flow-data-layer:${VERSION}" + kubectl -n "$NS" set image deployment/forms-flow-documents-api forms-flow-documents-api="docker.io/formsflow/forms-flow-documents-api:${VERSION}" + kubectl -n "$NS" set image deployment/forms-flow-web forms-flow-web="docker.io/formsflow/forms-flow-web:${VERSION}" + + kubectl -n "$NS" rollout status deployment/forms-flow-api --timeout=10m + kubectl -n "$NS" rollout status deployment/forms-flow-bpm --timeout=10m + kubectl -n "$NS" rollout status deployment/forms-flow-data-layer --timeout=10m + kubectl -n "$NS" rollout status deployment/forms-flow-documents-api --timeout=10m + kubectl -n "$NS" rollout status deployment/forms-flow-web --timeout=10m + Suggestion importance[1-10]: 7 __ Why: The current kubectl patch ... -p '{...'"${VERSION}"'...}' constructs are brittle and easy to break due to complex quoting, so switching to kubectl set image is a solid, purpose-built alternative. Adding --timeout to kubectl rollout status prevents the workflow from hanging indefinitely on failed deployments, improving CI robustness.	Medium
	Fix version string replacement The bash parameter expansion VER=${VER/-alpha/''} is error-prone and can behave unexpectedly because of the embedded quotes. Replace it with the standard “replace with empty string” form to reliably strip -alpha from the version. .github/workflows/dev-deployment.yml [30-35] - name: Set version (master) if: ${{ github.ref == 'refs/heads/master' }} run: | VER=$(cat VERSION) - VER=${VER/-alpha/''} + VER=${VER/-alpha/} echo "VERSION=$VER" >> $GITHUB_ENV Suggestion importance[1-10]: 4 __ Why: Replacing VER=${VER/-alpha/''} with VER=${VER/-alpha/} is a correct, more idiomatic Bash expansion and avoids confusing embedded quotes. Impact is modest since the current form often still works, but it improves reliability/readability of VERSION computation.	Low