engiflow/.github/workflows/deploy.yml at main · emanuellcs/engiflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
name: Deploy EngiFlow AWS

on:
  workflow_dispatch:
  push:
    branches:
      - main

permissions:
  contents: read
  id-token: write

env:
  AWS_REGION: ${{ vars.AWS_REGION || 'us-east-1' }}
  TF_WORKING_DIR: infra/terraform
  TF_STATE_KEY: ${{ vars.TF_STATE_KEY || 'engiflow/prod.tfstate' }}
  TF_VAR_api_image_tag: ${{ github.sha }}
  TF_VAR_web_image_tag: ${{ github.sha }}
  TF_VAR_frontend_public_base_url: ${{ vars.FRONTEND_PUBLIC_BASE_URL }}
  TF_VAR_budget_alert_email: ${{ vars.BUDGET_ALERT_EMAIL }}
  TF_VAR_ses_smtp_username: ${{ secrets.SES_SMTP_USERNAME }}
  TF_VAR_ses_smtp_password: ${{ secrets.SES_SMTP_PASSWORD }}

jobs:
  production-release:
    name: Production Artifact Shipping and Terraform Apply
    runs-on: ubuntu-latest
    steps:
      - name: Checkout release source
        uses: actions/checkout@v6

      - name: Configure AWS deployment credentials with OIDC
        uses: aws-actions/configure-aws-credentials@v6.1.1
        with:
          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
          role-session-name: engiflow-production-release-${{ github.run_id }}
          aws-region: ${{ env.AWS_REGION }}
          mask-aws-account-id: true

      - name: Setup Terraform CLI
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_wrapper: false

      - name: Initialize production remote state backend
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: |
          terraform init \
            -backend-config="bucket=${{ vars.TF_STATE_BUCKET }}" \
            -backend-config="key=${{ env.TF_STATE_KEY }}" \
            -backend-config="region=${{ env.AWS_REGION }}" \
            -backend-config="dynamodb_table=${{ vars.TF_STATE_LOCK_TABLE }}" \
            -backend-config="encrypt=true"

      - name: Hydrate ECR registry control plane
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform apply -target=module.compute_registry -auto-approve

      - name: Capture ECR repository endpoints
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: |
          {
            echo "API_REPOSITORY_URL=$(terraform output -raw api_ecr_repository_url)"
            echo "WEB_REPOSITORY_URL=$(terraform output -raw web_ecr_repository_url)"
          } >> "$GITHUB_ENV"

      - name: Authenticate Docker to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push API production image
        uses: docker/build-push-action@v7
        with:
          context: ./api
          file: ./api/Dockerfile
          push: true
          tags: |
            ${{ env.API_REPOSITORY_URL }}:${{ github.sha }}
            ${{ env.API_REPOSITORY_URL }}:latest
          cache-from: type=gha,scope=engiflow-api
          cache-to: type=gha,scope=engiflow-api,mode=max

      - name: Deploy API service and runtime environment contract
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: terraform apply -target=module.compute_services.aws_ecs_express_gateway_service.api -auto-approve

      - name: Capture public API gateway URI for browser runtime baking
        working-directory: ${{ env.TF_WORKING_DIR }}
        run: |
          api_service_url="$(terraform output -raw api_service_url)"
          {
            echo "API_SERVICE_URL=$api_service_url"
            echo "NEXT_PUBLIC_API_BASE_URL=$api_service_url"
            echo "NEXT_PUBLIC_API_URL=$api_service_url"
          } >> "$GITHUB_ENV"

      - name: Build and push web production image
        uses: docker/build-push-action@v7
        with:
          context: ./web
          file: ./web/Dockerfile
          push: true
          build-args: |
            NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }}
            NEXT_PUBLIC_API_URL=${{ env.NEXT_PUBLIC_API_URL }}
          tags: |
            ${{ env.WEB_REPOSITORY_URL }}:${{ github.sha }}
            ${{ env.WEB_REPOSITORY_URL }}:latest
          cache-from: type=gha,scope=engiflow-web
          cache-to: type=gha,scope=engiflow-web,mode=max

      - name: Apply ECS Express, RDS, S3, SES, and FinOps production stack
        working-directory: ${{ env.TF_WORKING_DIR }}
        env:
          ASPNETCORE_ENVIRONMENT: Production
          NODE_ENV: production
          NEXT_PUBLIC_API_BASE_URL: ${{ env.NEXT_PUBLIC_API_BASE_URL }}
          NEXT_PUBLIC_API_URL: ${{ env.NEXT_PUBLIC_API_URL }}
        run: terraform apply -auto-approve