Merge pull request #15 from emanuellcs/dependabot/devcontainers/ghcr.… #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy EngiFlow AWS | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| id-token: write | |
| env: | |
| AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }} | |
| TF_WORKING_DIR: infra/terraform | |
| TF_STATE_KEY: ${{ vars.TF_STATE_KEY || 'engiflow/prod.tfstate' }} | |
| TF_VAR_api_image_tag: ${{ github.sha }} | |
| TF_VAR_web_image_tag: ${{ github.sha }} | |
| TF_VAR_frontend_public_base_url: ${{ vars.FRONTEND_PUBLIC_BASE_URL }} | |
| TF_VAR_budget_alert_email: ${{ vars.BUDGET_ALERT_EMAIL }} | |
| TF_VAR_ses_smtp_username: ${{ secrets.SES_SMTP_USERNAME }} | |
| TF_VAR_ses_smtp_password: ${{ secrets.SES_SMTP_PASSWORD }} | |
| jobs: | |
| production-release: | |
| name: Production Artifact Shipping and Terraform Apply | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout release source | |
| uses: actions/checkout@v6 | |
| - name: Configure AWS deployment credentials with OIDC | |
| uses: aws-actions/configure-aws-credentials@v6.1.1 | |
| with: | |
| role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }} | |
| role-session-name: engiflow-production-release-${{ github.run_id }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| mask-aws-account-id: true | |
| - name: Setup Terraform CLI | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_wrapper: false | |
| - name: Initialize production remote state backend | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| run: | | |
| terraform init \ | |
| -backend-config="bucket=${{ vars.TF_STATE_BUCKET }}" \ | |
| -backend-config="key=${{ env.TF_STATE_KEY }}" \ | |
| -backend-config="region=${{ env.AWS_REGION }}" \ | |
| -backend-config="dynamodb_table=${{ vars.TF_STATE_LOCK_TABLE }}" \ | |
| -backend-config="encrypt=true" | |
| - name: Hydrate ECR registry control plane | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| run: terraform apply -target=module.compute_registry -auto-approve | |
| - name: Capture ECR repository endpoints | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| run: | | |
| { | |
| echo "API_REPOSITORY_URL=$(terraform output -raw api_ecr_repository_url)" | |
| echo "WEB_REPOSITORY_URL=$(terraform output -raw web_ecr_repository_url)" | |
| } >> "$GITHUB_ENV" | |
| - name: Authenticate Docker to Amazon ECR | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build and push API production image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: ./api | |
| file: ./api/Dockerfile | |
| push: true | |
| tags: | | |
| ${{ env.API_REPOSITORY_URL }}:${{ github.sha }} | |
| ${{ env.API_REPOSITORY_URL }}:latest | |
| cache-from: type=gha,scope=engiflow-api | |
| cache-to: type=gha,scope=engiflow-api,mode=max | |
| - name: Deploy API service and runtime environment contract | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| run: terraform apply -target=module.compute_services.aws_ecs_express_gateway_service.api -auto-approve | |
| - name: Capture public API gateway URI for browser runtime baking | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| run: | | |
| api_service_url="$(terraform output -raw api_service_url)" | |
| { | |
| echo "API_SERVICE_URL=$api_service_url" | |
| echo "NEXT_PUBLIC_API_BASE_URL=$api_service_url" | |
| echo "NEXT_PUBLIC_API_URL=$api_service_url" | |
| } >> "$GITHUB_ENV" | |
| - name: Build and push web production image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: ./web | |
| file: ./web/Dockerfile | |
| push: true | |
| build-args: | | |
| NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }} | |
| NEXT_PUBLIC_API_URL=${{ env.NEXT_PUBLIC_API_URL }} | |
| tags: | | |
| ${{ env.WEB_REPOSITORY_URL }}:${{ github.sha }} | |
| ${{ env.WEB_REPOSITORY_URL }}:latest | |
| cache-from: type=gha,scope=engiflow-web | |
| cache-to: type=gha,scope=engiflow-web,mode=max | |
| - name: Apply ECS Express, RDS, S3, SES, and FinOps production stack | |
| working-directory: ${{ env.TF_WORKING_DIR }} | |
| env: | |
| ASPNETCORE_ENVIRONMENT: Production | |
| NODE_ENV: production | |
| NEXT_PUBLIC_API_BASE_URL: ${{ env.NEXT_PUBLIC_API_BASE_URL }} | |
| NEXT_PUBLIC_API_URL: ${{ env.NEXT_PUBLIC_API_URL }} | |
| run: terraform apply -auto-approve |