serverlessops-api-authnz/.github/workflows/main.yml at main · ServerlessOpsIO/serverlessops-api-authnz · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: Main

on:
  workflow_dispatch:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1

      - name: Assume AWS Credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}

      - name: Install AWS SAM
        uses: aws-actions/setup-sam@v2


      - name: Validate template
        run: sam validate --lint

      - name: Validate template (userpool stackset)
        run: sam validate --lint --template ./stacksets/userpool/stackset.yaml

      - name: Validate template (products stackset)
        run: sam validate --lint --template ./products/stackset.yaml

      - name: Validate template (client product)
        run: sam validate --lint --template ./products/client/product.yaml

      - name: Validate template (server product)
        run: sam validate --lint --template ./products/server/product.yaml

      - name: Synethsize StackSet templates
        run: |
          for _f in $(find . -type f -name 'template.yaml'); do
            _dir="$(dirname $_f)/" \
            yq \
              -i \
              '(.. | select(has("localTemplateFile")) | .localTemplateFile) |= load_str(strenv(_dir) + .)' \
              $_f;
          done

      - name: Store Artifacts
        uses: ServerlessOpsIO/gha-store-artifacts@v1
        with:
          use_aws_sam: true

  deploy:
    needs:
      - build
    environment: production
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1
        with:
          checkout_artifact: true

      - name: Assume AWS Credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
          deploy_aws_account_id: ${{ secrets.AWS_MANAGEMENT_ACCOUNT_ID }}

      - name: Sync product templates to S3
        id: sync-templates
        shell: bash
        env:
          AWS_ACCOUNT_ID: ${{ secrets.AWS_MANAGEMENT_ACCOUNT_ID }}
        run: aws s3 sync products/ s3://aws-service-catalog-templates-${AWS_ACCOUNT_ID}-${AWS_REGION}/serverlessops-api-authnz/${GITHUB_SHA}/

      - name: Deploy via AWS SAM
        uses: ServerlessOpsIO/gha-deploy-aws-sam@v1
        with:
          aws_account_id: ${{ secrets.AWS_MANAGEMENT_ACCOUNT_ID }}
          env_json: ${{ toJson(env) }}
          secrets_json: ${{ toJson(secrets) }}