pipeline.yaml

# Generated from:
# - https://catalog.workshops.aws/complete-aws-sam/en-US/module-4-cicd/module-4-cicd-gh
name: CI/CD pipeline

on:
  push:
    branches:
      - 'main'
      - 'feature**'
  workflow_dispatch:
  delete:
    branches:
      - 'feature**'

env:
  SAM_CLI_TELEMETRY: 0
  SAM_TEMPLATE: template.yml
  DEV_PIPELINE_EXECUTION_ROLE: arn:aws:iam::644638186133:role/aws-sam-cli-managed-dev-pipe-PipelineExecutionRole-J2LGXGU6FKGQ
  DEV_CLOUDFORMATION_EXECUTION_ROLE: arn:aws:iam::644638186133:role/aws-sam-cli-managed-dev-p-CloudFormationExecutionR-11UYGVKBD8Y55
  DEV_ARTIFACTS_BUCKET: aws-sam-cli-managed-dev-pipeline-artifactsbucket-1vfto7gbbtkx4
  # If there are functions with "Image" PackageType in your template,
  # uncomment the line below and add "--image-repository ${DEV_IMAGE_REPOSITORY}" to
  # testing "sam package" and "sam deploy" commands.
  # DEV_IMAGE_REPOSITORY = '0123456789.dkr.ecr.region.amazonaws.com/repository-name'
  DEV_REGION: us-east-1
  PROD_PIPELINE_EXECUTION_ROLE: arn:aws:iam::644638186133:role/aws-sam-cli-managed-prod-pip-PipelineExecutionRole-XHO6D5U48XQ5
  PROD_CLOUDFORMATION_EXECUTION_ROLE: arn:aws:iam::644638186133:role/aws-sam-cli-managed-prod-CloudFormationExecutionR-1038CJYRMPFSZ
  PROD_ARTIFACTS_BUCKET: aws-sam-cli-managed-prod-pipeline-artifactsbucket-rjp2ckr5021b
  # If there are functions with "Image" PackageType in your template,
  # uncomment the line below and add "--image-repository ${PROD_IMAGE_REPOSITORY}" to
  # prod "sam package" and "sam deploy" commands.
  # PROD_IMAGE_REPOSITORY = '0123456789.dkr.ecr.region.amazonaws.com/repository-name'
  PROD_REGION: us-east-1
  GOEXPERIMENT: loopvar

# https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers
permissions:
  id-token: write
  contents: read

jobs:
  test:
    if: github.event_name == 'push'
    uses: mbland/elistman/.github/workflows/run-tests.yaml@main

  delete-feature:
    if: startsWith(github.event.ref, 'feature') && github.event_name == 'delete'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true

      - name: Assume the testing pipeline user role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.DEV_REGION }}
          role-to-assume: ${{ env.DEV_PIPELINE_EXECUTION_ROLE }}
          role-session-name: testing-packaging
          role-duration-seconds: 3600
          role-skip-session-tagging: true

      - name: Delete feature branch stack
        env:
          FEATURE_BRANCH_NAME: ${{ github.event.ref }}
        run: |
          sam delete \
            --stack-name $(echo ${FEATURE_BRANCH_NAME##*/} | tr -cd '[a-zA-Z0-9-]') \
            --region ${DEV_REGION} \
            --no-prompts

  build-and-deploy-feature:
    # this stage is triggered only for feature branches (feature*),
    # which will build the stack and deploy to a stack named with branch name.
    # https://github.com/actions/setup-python
    if: startsWith(github.ref, 'refs/heads/feature')
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true
      - uses: actions/setup-go@v5
        with:
          go-version: 1.21.x
          check-latest: true
      - run: sam build --template ${SAM_TEMPLATE}

      - name: Assume the testing pipeline user role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.DEV_REGION }}
          role-to-assume: ${{ env.DEV_PIPELINE_EXECUTION_ROLE }}
          role-session-name: feature-deployment
          role-duration-seconds: 3600
          role-skip-session-tagging: true

      - name: Deploy to feature stack in the testing account
        shell: bash
        run: |
          tr -d '\r' > .env <<EOF
          ${{ vars.DEV_ENV_FILE }}
          EOF
          STACK_NAME="$(echo ${GITHUB_REF##*/} | tr -cd '[a-zA-Z0-9-]')" \
            ./bin/sam-with-env.sh .env deploy \
            --capabilities CAPABILITY_IAM \
            --region ${DEV_REGION} \
            --s3-bucket ${DEV_ARTIFACTS_BUCKET} \
            --no-fail-on-empty-changeset \
            --no-confirm-changeset \
            --role-arn ${DEV_CLOUDFORMATION_EXECUTION_ROLE}

  build-and-package:
    if: github.ref == 'refs/heads/main'
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true
      - uses: actions/setup-go@v5
        with:
          go-version: 1.21.x
          check-latest: true

      - name: Assume the testing pipeline user role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.DEV_REGION }}
          role-to-assume: ${{ env.DEV_PIPELINE_EXECUTION_ROLE }}
          role-session-name: testing-packaging
          role-duration-seconds: 3600
          role-skip-session-tagging: true

      - name: Validate SAM template
        run: |
          sam validate --template ${SAM_TEMPLATE}
          sam validate --lint --template ${SAM_TEMPLATE}

      - name: Build resources
        run: sam build --template ${SAM_TEMPLATE}

      - name: Upload artifacts to testing artifact buckets
        run: |
          sam package \
            --s3-bucket ${DEV_ARTIFACTS_BUCKET} \
            --region ${DEV_REGION} \
            --output-template-file packaged-testing.yaml

      - uses: actions/upload-artifact@v4
        with:
          name: packaged-testing.yaml
          path: packaged-testing.yaml

      - name: Assume the prod pipeline user role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.PROD_REGION }}
          role-to-assume: ${{ env.PROD_PIPELINE_EXECUTION_ROLE }}
          role-session-name: prod-packaging
          role-duration-seconds: 3600
          role-skip-session-tagging: true

      - name: Upload artifacts to production artifact buckets
        run: |
          sam package \
            --s3-bucket ${PROD_ARTIFACTS_BUCKET} \
            --region ${PROD_REGION} \
            --output-template-file packaged-prod.yaml

      - uses: actions/upload-artifact@v4
        with:
          name: packaged-prod.yaml
          path: packaged-prod.yaml

  deploy-testing:
    if: github.ref == 'refs/heads/main'
    needs: [build-and-package]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true
      - uses: actions/download-artifact@v4
        with:
          name: packaged-testing.yaml

      - name: Assume the testing pipeline user role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.DEV_REGION }}
          role-to-assume: ${{ env.DEV_PIPELINE_EXECUTION_ROLE }}
          role-session-name: testing-deployment
          role-duration-seconds: 3600
          role-skip-session-tagging: true

      - name: Deploy to testing account
        run: |
          tr -d '\r' > .env <<EOF
          ${{ vars.DEV_ENV_FILE }}
          EOF
          ./bin/sam-with-env.sh .env deploy \
            --template packaged-testing.yaml \
            --capabilities CAPABILITY_IAM \
            --region ${DEV_REGION} \
            --s3-bucket ${DEV_ARTIFACTS_BUCKET} \
            --no-fail-on-empty-changeset \
            --no-confirm-changeset \
            --role-arn ${DEV_CLOUDFORMATION_EXECUTION_ROLE}

  integration-test:
    if: github.ref == 'refs/heads/main'
    needs: [deploy-testing]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run smoke tests
        run: |
          tr -d '\r' > .env <<EOF
          ${{ vars.DEV_ENV_FILE }}
          EOF
          SMOKE_TEST_USE_COLOR=1 ./bin/smoke-test.sh .env

  deploy-prod:
    if: github.ref == 'refs/heads/main'
    needs: [integration-test]
    runs-on: ubuntu-latest
    # Configure GitHub Action Environment to have a manual approval step before deployment to production
    # https://docs.github.com/en/actions/reference/environments
    # environment: <configured-environment>
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/setup-sam@v2
        with:
          use-installer: true
      - uses: actions/download-artifact@v4
        with:
          name: packaged-prod.yaml

      - name: Assume the prod pipeline user role
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ env.PROD_REGION }}
          role-to-assume: ${{ env.PROD_PIPELINE_EXECUTION_ROLE }}
          role-session-name: prod-deployment
          role-duration-seconds: 3600
          role-skip-session-tagging: true

      - name: Deploy to production account
        run: |
          tr -d '\r' > .env <<EOF
          ${{ vars.PROD_ENV_FILE }}
          EOF
          ./bin/sam-with-env.sh .env deploy \
            --template packaged-prod.yaml \
            --capabilities CAPABILITY_IAM \
            --region ${PROD_REGION} \
            --s3-bucket ${PROD_ARTIFACTS_BUCKET} \
            --no-fail-on-empty-changeset \
            --no-confirm-changeset \
            --role-arn ${PROD_CLOUDFORMATION_EXECUTION_ROLE}