TEST - Deploy ECS #157
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: TEST - Deploy ECS | |
| permissions: | |
| id-token: write | |
| contents: read | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| FORCE_DEPLOY_SERVICES: | |
| description: | | |
| Comma-separated list of services to force redeploy: | |
| pfda-pfda-db-migrate, pfda-docs, pfda-nodejs-api, pfda-nodejs-api-internal, pfda-nodejs-worker, pfda-nodejs-admin-platform-client, pfda-web, pfda-nginx | |
| required: false | |
| default: "" | |
| FORCE_REBUILD: | |
| description: "Force a fresh Docker image build even if a matching image already exists in ECR" | |
| type: boolean | |
| required: false | |
| default: false | |
| schedule: | |
| - cron: '0 2 * * *' # Daily at 02:00 UTC = 04:00 Prague (during DST) | |
| concurrency: | |
| group: test-deploy-ecs | |
| cancel-in-progress: false | |
| # if another run with the same group is in progress, | |
| # the new one will wait until it's finished (no overlap) | |
| jobs: | |
| build-and-push-images: | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: test_4711 | |
| outputs: | |
| web_image_tag: ${{ steps.set_output.outputs.web_image_tag }} | |
| nginx_image_tag: ${{ steps.set_output.outputs.nginx_image_tag }} | |
| server_image_tag: ${{ steps.set_output.outputs.server_image_tag }} | |
| docs_image_tag: ${{ steps.set_output.outputs.docs_image_tag }} | |
| strategy: | |
| matrix: | |
| include: | |
| - package: web | |
| dockerfile: packages/rails/docker/images/Dockerfile | |
| - package: nginx | |
| - package: server | |
| - package: docs | |
| context: "packages/docs" | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: ./.github/actions/build-docker-images | |
| id: build_image | |
| with: | |
| environment: ${{ vars.ENVIRONMENT }} | |
| region: ${{ vars.REGION }} | |
| role-arn: ${{ vars.ROLE_ECS_GITHUB_ARN }} | |
| orchestration-account-id: ${{ vars.ORCHESTRATION_ACCOUNT_ID }} | |
| package: ${{ matrix.package }} | |
| dockerfile: ${{ matrix.dockerfile }} | |
| context: ${{ matrix.context }} | |
| force-rebuild: ${{ inputs.FORCE_REBUILD }} | |
| - name: Set matrix job output | |
| id: set_output | |
| run: | | |
| echo "${{ matrix.package }}_image_tag=${{ steps.build_image.outputs.image-tag }}" >> $GITHUB_OUTPUT | |
| - name: Write build summary | |
| run: | | |
| { | |
| echo "### 📦 Built Image" | |
| echo "- **Component:** ${{ matrix.package }}" | |
| echo "- **Tag:** ${{ steps.build_image.outputs.image-tag }}" | |
| } >> $GITHUB_STEP_SUMMARY | |
| deploy: | |
| needs: build-and-push-images | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: test_4711 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: '3.11' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install boto3 pyaml | |
| - name: Get Image Tags | |
| id: aggregate | |
| run: | | |
| echo "WEB_TAG=${{ needs.build-and-push-images.outputs.web_image_tag }}" >> $GITHUB_ENV | |
| echo "NGINX_TAG=${{ needs.build-and-push-images.outputs.nginx_image_tag }}" >> $GITHUB_ENV | |
| echo "SERVER_TAG=${{ needs.build-and-push-images.outputs.server_image_tag }}" >> $GITHUB_ENV | |
| echo "DOCS_TAG=${{ needs.build-and-push-images.outputs.docs_image_tag }}" >> $GITHUB_ENV | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0 | |
| with: | |
| aws-region: ${{ vars.REGION }} | |
| role-to-assume: ${{ vars.ROLE_ECS_GITHUB_ARN }} | |
| - name: Get AWS Account ID | |
| id: get_account_id | |
| run: | | |
| ACCOUNT_ID=$(aws sts get-caller-identity --query "Account" --output text) | |
| echo "AWS Account ID: $ACCOUNT_ID" | |
| echo "ACCOUNT_ID=$ACCOUNT_ID" >> $GITHUB_ENV | |
| - name: Invoke SSM backup Lambda | |
| env: | |
| REF_NAME: ${{ github.ref_name }} | |
| run: | | |
| FILE_NAME="ssm_deployment_backup_${REF_NAME}" | |
| echo "Triggering SSM parameter backup (file_name=${FILE_NAME})..." | |
| PAYLOAD=$(jq -n --arg name "$FILE_NAME" '{"file_name": $name}') | |
| aws lambda invoke \ | |
| --function-name pfda_ssm_backup \ | |
| --payload "$PAYLOAD" \ | |
| --cli-binary-format raw-in-base64-out \ | |
| response.json | |
| cat response.json | |
| # Fail the deploy unless the Lambda explicitly returns ok=true | |
| if ! jq -e '.ok == true' response.json > /dev/null 2>&1; then | |
| echo "Lambda backup reported a failure" && exit 1 | |
| fi | |
| - name: Deploy ECS Service | |
| working-directory: infra/ecs | |
| env: | |
| AWS_REGION: ${{ vars.REGION }} | |
| ENVIRONMENT: ${{ vars.ENVIRONMENT }} | |
| WEB_TAG: ${{ env.WEB_TAG }} | |
| NGINX_TAG: ${{ env.NGINX_TAG }} | |
| SERVER_TAG: ${{ env.SERVER_TAG }} | |
| DOCS_TAG: ${{ env.DOCS_TAG }} | |
| FORCE_DEPLOY_SERVICES: ${{ inputs.FORCE_DEPLOY_SERVICES }} | |
| GIT_BRANCH: ${{ github.ref_name }} | |
| PYTHONUNBUFFERED: "1" | |
| run: | | |
| echo "Deploying ECS to $ENVIRONMENT..." | |
| echo "WEB_TAG=$WEB_TAG" | |
| echo "NGINX_TAG=$NGINX_TAG" | |
| echo "SERVER_TAG=$SERVER_TAG" | |
| echo "DOCS_TAG=$DOCS_TAG" | |
| python deploy-ecs-service.py | |
| shell: bash |