-
Notifications
You must be signed in to change notification settings - Fork 0
184 lines (154 loc) · 6.37 KB
/
pipeline.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
name: Project Pipeline
on:
push:
branches:
- 'main'
- 'feature**'
env:
# STUDENTS: Set these environment variables
API_BASE_URL: https://famj5styx3.execute-api.us-east-2.amazonaws.com/Prod/
COGNITO_DOMAIN: project-river-team-chocolate
COGNITO_REDIRECT_SIGNIN: https://dw8pu3rmybtct.cloudfront.net
COGNITO_REDIRECT_SIGNOUT: https://dw8pu3rmybtct.cloudfront.net
COGNITO_USER_POOL_ID: ${{ secrets.COGNITO_USER_POOL_ID }}
COGNITO_USER_POOL_CLIENT_ID: ${{ secrets.COGNITO_USER_POOL_CLIENT_ID }}
GH_PACKAGE_REG_READ_USER: ${{ secrets.GH_PACKAGE_REG_READ_USER }}
GH_PACKAGE_REG_READ_PASS: ${{ secrets.GH_PACKAGE_REG_READ_PASS }}
PIPELINE_USER_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
PIPELINE_USER_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
SAM_TEMPLATE: template.yaml
STACK_NAME: river-pet-sitting-service
PIPELINE_EXECUTION_ROLE: arn:aws:iam::797228321432:role/aws-sam-cli-managed-ServiceS-PipelineExecutionRole-LYFWIM99BYV7
CLOUDFORMATION_EXECUTION_ROLE: arn:aws:iam::797228321432:role/aws-sam-cli-managed-Servi-CloudFormationExecutionR-1BZ91V0FMGSF0
ARTIFACTS_BUCKET: aws-sam-cli-managed-servicestage-artifactsbucket-1bp8adaqjpema
REGION: us-east-2
jobs:
build-feature:
# this stage is triggered only for feature branches (feature*),
# which will build the stack and deploy to a stack named with branch name.
if: startsWith(github.ref, 'refs/heads/feature')
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-python@v2
- uses: aws-actions/setup-sam@v1
- run: sam build --template ${SAM_TEMPLATE}
- name: Assume the pipeline user role
uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ env.PIPELINE_USER_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.PIPELINE_USER_SECRET_ACCESS_KEY }}
aws-region: ${{ env.REGION }}
role-to-assume: ${{ env.PIPELINE_EXECUTION_ROLE }}
role-session-name: feature-deployment
role-duration-seconds: 3600
role-skip-session-tagging: true
- name: Build SAM resources
shell: bash
run: |
sam build --template ${SAM_TEMPLATE}
build-and-package-main:
if: github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-python@v2
- uses: actions/setup-node@v3
- uses: aws-actions/setup-sam@v1
- name: Build SAM resources
run: |
sam build --template ${SAM_TEMPLATE}
- name: Assume the pipeline user role
uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ env.PIPELINE_USER_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.PIPELINE_USER_SECRET_ACCESS_KEY }}
aws-region: ${{ env.REGION }}
role-to-assume: ${{ env.PIPELINE_EXECUTION_ROLE }}
role-session-name: testing-packaging
role-duration-seconds: 3600
role-skip-session-tagging: true
- name: Assume the pipeline user role
uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ env.PIPELINE_USER_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.PIPELINE_USER_SECRET_ACCESS_KEY }}
aws-region: ${{ env.REGION }}
role-to-assume: ${{ env.PIPELINE_EXECUTION_ROLE }}
role-session-name: prod-packaging
role-duration-seconds: 3600
role-skip-session-tagging: true
- name: Upload SAM artifacts to artifact buckets
run: |
sam package \
--s3-bucket ${ARTIFACTS_BUCKET} \
--region ${REGION} \
--output-template-file packaged-prod.yaml
- uses: actions/upload-artifact@v2
with:
name: packaged-prod.yaml
path: packaged-prod.yaml
- name: Install NPM dependencies
working-directory: web
run: npm install
- name: Create .env file for npm build
working-directory: web
run: |
touch .env
echo API_BASE_URL=\"$API_BASE_URL\" >> .env
echo COGNITO_DOMAIN=\"${COGNITO_DOMAIN}.auth.us-east-2.amazoncognito.com\" >> .env
echo COGNITO_USER_POOL_ID=\"$COGNITO_USER_POOL_ID\" >> .env
echo COGNITO_USER_POOL_CLIENT_ID=\"$COGNITO_USER_POOL_CLIENT_ID\" >> .env
echo COGNITO_REDIRECT_SIGNIN=\"$COGNITO_REDIRECT_SIGNIN\" >> .env
echo COGNITO_REDIRECT_SIGNOUT=\"$COGNITO_REDIRECT_SIGNOUT\" >> .env
- name: Build NPM static resources
working-directory: web
run: npm run build
- name: Upload NPM static build output
uses: actions/upload-artifact@v2
with:
name: static-build
path: web/build
deploy-to-aws:
if: github.ref == 'refs/heads/main'
needs: [build-and-package-main]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-python@v2
- uses: actions/setup-node@v3
- uses: aws-actions/setup-sam@v1
- uses: actions/download-artifact@v2
with:
name: packaged-prod.yaml
- name: Assume the pipeline user role
uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ env.PIPELINE_USER_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.PIPELINE_USER_SECRET_ACCESS_KEY }}
aws-region: ${{ env.REGION }}
role-to-assume: ${{ env.PIPELINE_EXECUTION_ROLE }}
role-session-name: testing-deployment
role-duration-seconds: 3600
role-skip-session-tagging: true
- name: Deploy to testing account
run: |
sam deploy --stack-name ${STACK_NAME} \
--template packaged-prod.yaml \
--capabilities CAPABILITY_IAM \
--region ${REGION} \
--s3-bucket ${ARTIFACTS_BUCKET} \
--no-fail-on-empty-changeset \
--parameter-overrides "S3Bucket=${ARTIFACTS_BUCKET} CognitoDomain=${COGNITO_DOMAIN}" \
--role-arn ${CLOUDFORMATION_EXECUTION_ROLE}
- name: Download NPM static resources
uses: actions/download-artifact@v2
with:
name: static-build
path: build/static
- name: Deploy NPM static resources
run: |
aws s3 cp \
build/static \
s3://${ARTIFACTS_BUCKET}/static/ \
--recursive