data-hub/.github/workflows/deploy-lambda.yml at staging · Arcadia-Science/data-hub · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: Deploy Lambda function

on:
  push:
    branches:
      - staging
      - production
    paths:
      - .github/workflows/deploy-lambda.yml
      - lambda/**
      - packages/shared/**
      - infra/**
      - uv.lock

permissions:
  id-token: write
  contents: read

# Serialize deploys per environment so two merges can't update the same
# CloudFormation stack at once. Don't cancel a running deploy: CloudFormation
# keeps updating the stack after the job stops, so a cancelled run would still
# block the next one.
concurrency:
  group: deploy-lambda-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  deploy-lambda:
    runs-on: ubuntu-latest
    environment: ${{ github.ref_name }}
    steps:
      - uses: actions/checkout@v6

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: us-west-1

      - name: Login to Amazon ECR
        id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push Docker image
        env:
          ECR_REGISTRY: ${{ steps.ecr-login.outputs.registry }}
        run: |
          # Short SHA matches the tag format used by `make docker-push-lambda`.
          IMAGE_TAG="${GITHUB_REF_NAME}-$(git rev-parse --short "$GITHUB_SHA")"
          IMAGE_URI="${ECR_REGISTRY}/data-hub-${{ github.ref_name }}:${IMAGE_TAG}"
          docker build \
            --provenance=false \
            --platform linux/amd64 \
            -f lambda/Dockerfile \
            -t "${IMAGE_URI}" \
            .
          docker push "${IMAGE_URI}"
          echo "IMAGE_URI=${IMAGE_URI}" >> "$GITHUB_ENV"

      - uses: aws-actions/setup-sam@v3

      - name: Deploy SAM stack
        working-directory: infra
        # AlarmEmail is quoted because SAM CLI rejects an empty `Key=` override.
        run: |
          sam deploy \
            --config-env "${{ github.ref_name }}" \
            --no-confirm-changeset \
            --no-fail-on-empty-changeset \
            --s3-bucket "${{ secrets.SAM_S3_BUCKET }}" \
            --s3-prefix "data-hub-${{ github.ref_name }}" \
            --no-resolve-s3 \
            --image-repository "${{ steps.ecr-login.outputs.registry }}/data-hub-${{ github.ref_name }}" \
            --parameter-overrides \
              "EcrImageUri=${IMAGE_URI}" \
              "DataHubApiUrl=${{ secrets.DATA_HUB_API_URL }}" \
              "DataHubApiKey=${{ secrets.DATA_HUB_API_KEY }}" \
              "Environment=${{ github.ref_name }}" \
              "GitHubOidcProviderArn=${{ secrets.GH_OIDC_PROVIDER_ARN }}" \
              "VercelOidcProviderArn=${{ secrets.VERCEL_OIDC_PROVIDER_ARN }}" \
              "AdminDeployPrincipalArn=${{ vars.ADMIN_DEPLOY_PRINCIPAL_ARN }}" \
              "EnableS3Files=${{ vars.ENABLE_S3_FILES }}" \
              'AlarmEmail="${{ vars.ALARM_EMAIL }}"'