districtr-v2/.github/workflows/infra.yml at 912d2d3df966830305d829b5531384b6a6d4adc9 · districtr/districtr-v2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: AWS Infrastructure (Pulumi)
on:
  push:
    branches:
      - main
      - dev
    paths:
      - "infra/**"
      - ".github/workflows/infra.yml"
  # No pull_request trigger: previews execute the PR's code, which must not
  # hold the (admin) deploy role. Preview locally per infra/README.md.
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ${{ vars.AWS_REGION || 'us-east-2' }}
  PULUMI_BACKEND_URL: s3://districtr-v2-pulumi-state?region=${{ vars.AWS_REGION || 'us-east-2' }}
  # Maintenance-mode flag read by infra/config.ts. Must be set in every
  # workflow that runs `pulumi up`, or an unrelated deploy flips it back.
  UNDER_CONSTRUCTION: ${{ vars.UNDER_CONSTRUCTION || 'false' }}

# Per-workflow group: concurrent `pulumi up`s across workflows are handled by
# retrying on the S3 state lock (a shared group would silently cancel pending
# runs once a third workflow queues).
concurrency:
  group: infra-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  pulumi:
    name: Apply
    runs-on: ubuntu-latest
    # Runs only on dev/main (other branches can't assume the deploy role via
    # OIDC anyway). On push, gated by the per-stack repo var (AWS_DEPLOY_DEV /
    # AWS_DEPLOY_PROD); workflow_dispatch runs on dev/main without the var.
    if: >-
      (github.ref_name == 'dev'  && (github.event_name == 'workflow_dispatch' || vars.AWS_DEPLOY_DEV  == 'true')) ||
      (github.ref_name == 'main' && (github.event_name == 'workflow_dispatch' || vars.AWS_DEPLOY_PROD == 'true'))
    steps:
      - uses: actions/checkout@v4
      - name: Set stack
        id: cfg
        run: |
          if [ "${{ github.ref_name }}" = "dev" ]; then
            echo "stack=dev" >> "$GITHUB_OUTPUT"
          else
            echo "stack=prod" >> "$GITHUB_OUTPUT"
          fi
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ env.AWS_REGION }}
          # First apply can wait on ACM validation + RDS for over an hour.
          role-duration-seconds: 7200
      - name: Install Pulumi
        uses: pulumi/actions@v7
        with:
          # Exact pin (not the default ^3 range) so a Pulumi release can't
          # silently change deploys; keep ~in sync with infra/package.json.
          pulumi-version: 3.242.0
      - name: Install dependencies
        working-directory: infra
        run: npm ci
      - name: Pulumi up
        working-directory: infra
        run: |
          set -euo pipefail
          pulumi stack select "${{ steps.cfg.outputs.stack }}"
          # Retry: another workflow's `pulumi up` may hold the state lock.
          for attempt in 1 2 3; do
            if pulumi up --yes --diff; then exit 0; fi
            echo "pulumi up failed (attempt $attempt); retrying in 60s in case of state-lock contention"
            sleep 60
          done
          exit 1