Repository navigation
docs: pin CI badges to main branch #414
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build-push-scan and Deploy | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| release: | |
| types: [published] | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| build-scan-push-latest: | |
| if: github.event_name == 'pull_request' | |
| uses: SFOE-prometheon/github-terraform-workflows/.github/workflows/ecr-build-scan-push.yml@v12 | |
| with: | |
| dockerfile: Dockerfile.lambda | |
| build-context: . | |
| ecr-repository: drillapi | |
| image-tag: latest | |
| aws-region: eu-central-1 | |
| secrets: | |
| aws-role: ${{ secrets.SFOE_DRILLAPI_PIPELINE_ROLE_DEV }} | |
| build-scan-push-dev: | |
| if: github.event_name == 'release' | |
| uses: SFOE-prometheon/github-terraform-workflows/.github/workflows/ecr-build-scan-push.yml@v12 | |
| with: | |
| dockerfile: Dockerfile.lambda | |
| build-context: . | |
| ecr-repository: drillapi | |
| image-tag: ${{ github.event.release.tag_name }} | |
| aws-region: eu-central-1 | |
| secrets: | |
| aws-role: ${{ secrets.SFOE_DRILLAPI_PIPELINE_ROLE_DEV }} | |
| build-scan-push-prod: | |
| if: github.event_name == 'release' | |
| uses: SFOE-prometheon/github-terraform-workflows/.github/workflows/ecr-build-scan-push.yml@v12 | |
| with: | |
| dockerfile: Dockerfile.lambda | |
| build-context: . | |
| ecr-repository: drillapi | |
| image-tag: ${{ github.event.release.tag_name }} | |
| aws-region: eu-central-1 | |
| secrets: | |
| aws-role: ${{ secrets.SFOE_DRILLAPI_PIPELINE_ROLE_PROD }} | |
| post-push: | |
| needs: [build-scan-push-latest, build-scan-push-dev, build-scan-push-prod] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Print push summary | |
| run: | | |
| echo "## Push Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| Environment | Image Tag | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|-------------|-----------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| Dev (Latest) | ${{ needs.build-scan-push-latest.outputs.image-tag || 'N/A' }} | ${{ needs.build-scan-push-latest.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Dev (Release) | ${{ needs.build-scan-push-dev.outputs.image-tag || 'N/A' }} | ${{ needs.build-scan-push-dev.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Prod (Release) | ${{ needs.build-scan-push-prod.outputs.image-tag || 'N/A' }} | ${{ needs.build-scan-push-prod.result }} |" >> $GITHUB_STEP_SUMMARY | |
| # ---------------------------------------------------------- | |
| # Automated deployment upon release | |
| # ---------------------------------------------------------- | |
| deploy-image: | |
| name: deploy-image | |
| needs: [build-scan-push-dev, build-scan-push-prod] | |
| runs-on: ubuntu-latest | |
| if: (github.event_name == 'release') | |
| environment: prometheon-access | |
| env: | |
| VERSION_TAG: ${{ github.event.release.tag_name }} | |
| # ---------------------------------------------------------- | |
| # Matrix strategy to differentiate environments | |
| # ---------------------------------------------------------- | |
| strategy: | |
| matrix: | |
| env: | |
| - name: dev | |
| - name: prod | |
| steps: | |
| # ---------------------------------------------------------- | |
| # Authenticate as GitHub App | |
| # ---------------------------------------------------------- | |
| - name: Authenticate as GitHub App | |
| id: app-auth | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ secrets.GH_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | |
| owner: SFOE-Prometheon | |
| # ---------------------------------------------------------- | |
| # Checkout Terraform Repo using GitHub App Token | |
| # ---------------------------------------------------------- | |
| - name: Clone Terraform Repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: SFOE-prometheon/prometheon-drillcheck-${{ matrix.env.name }} | |
| ref: main | |
| token: ${{ steps.app-auth.outputs.token }} | |
| path: tf-repo | |
| # ---------------------------------------------------------- | |
| # Update Version | |
| # ---------------------------------------------------------- | |
| - name: Update version in Terraform repo | |
| run: | | |
| cd tf-repo | |
| sed -i "s/\"backend_app_version\": \".*\"/\"backend_app_version\": \"${{ env.VERSION_TAG }}\"/" deploy.auto.tfvars.json | |
| # ---------------------------------------------------------- | |
| # Commit & Push/PR based on environment | |
| # ---------------------------------------------------------- | |
| - name: Create branch and commit changes | |
| run: | | |
| cd tf-repo | |
| git config user.name "GitHub Actions" | |
| git config user.email "noreply@github.com" | |
| git checkout -b deploy/backend-${{ env.VERSION_TAG }} | |
| git add deploy.auto.tfvars.json | |
| git commit -m "Deploy backend version ${{ env.VERSION_TAG }}" | |
| - name: Push to main (Dev environment) | |
| if: matrix.env.name == 'dev' | |
| run: | | |
| cd tf-repo | |
| git push origin deploy/backend-${{ env.VERSION_TAG }}:main | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-auth.outputs.token }} | |
| - name: Create PR (Prod environment) | |
| if: matrix.env.name == 'prod' | |
| run: | | |
| cd tf-repo | |
| git push origin deploy/backend-${{ env.VERSION_TAG }} | |
| gh pr create \ | |
| --base main \ | |
| --head deploy/backend-${{ env.VERSION_TAG }} \ | |
| --title "Deploy backend version ${{ env.VERSION_TAG }} to prod" \ | |
| --body "Automated deployment PR for backend version ${{ env.VERSION_TAG }}" | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-auth.outputs.token }} |