feat(pipeline): add preDeploySteps to run steps at the start of every deploy job

src/pipeline.ts

@@ -105,6 +105,14 @@ export interface GitHubWorkflowProps extends PipelineBaseProps, AwsCredsCommonPr
    */
   readonly postBuildSteps?: github.JobStep[];
 
+  /**
+   * GitHub workflow steps to execute at the start of every deploy job, before
+   * AWS credentials are configured.
+   *
+   * @default []
+   */
+  readonly preDeploySteps?: github.JobStep[];
+
   /**
    * What approval level is required for deployments? By default this is
    * `never` to ensure that all automated deployments succeed.
@@ -158,6 +166,7 @@ export class GitHubWorkflow extends PipelineBase {
   private readonly buildRunner: github.Runner;
   private readonly preBuildSteps: github.JobStep[];
   private readonly postBuildSteps: github.JobStep[];
+  private readonly preDeploySteps: github.JobStep[];
   private readonly deployArgs: string[];
   private readonly diffFirst: boolean;
   private readonly jobOutputs: Record<string, github.JobStepOutput[]> = {};
@@ -185,6 +194,7 @@ export class GitHubWorkflow extends PipelineBase {
     this.buildContainer = props.buildContainer;
     this.preBuildSteps = props.preBuildSteps ?? [];
     this.postBuildSteps = props.postBuildSteps ?? [];
+    this.preDeploySteps = props.preDeploySteps ?? [];
     this.jobSettings = props.jobSettings;
     this.diffFirst = props.diffFirst ?? false;
     this.deployArgs = props.deployArgs ?? [];
@@ -484,6 +494,7 @@ export class GitHubWorkflow extends PipelineBase {
         needs: this.renderDependencies(node),
         runsOn: this.runner.runsOn,
         steps: [
+          ...this.preDeploySteps,
           ...this.stepsToUnpackageAssembly,
           ...awsCredentials.credentialSteps(region),
           ...this.stepsToDeploy(stack),

test/github.test.ts

@@ -315,6 +315,34 @@ test('single wave/stage/stack', () => {
     expect(readFileSync(pipeline.workflowPath, 'utf-8')).toMatchSnapshot();
   });
 });
+test('single wave/stage/stack - with pre-deploy steps', () => {
+  withTemporaryDirectory((dir) => {
+    const pipeline = new GitHubWorkflow(app, 'Pipeline', {
+      workflowPath: `${dir}/.github/workflows/deploy.yml`,
+      synth: new ShellStep('Build', {
+        commands: [],
+      }),
+      preDeploySteps: [{ name: 'Pre Deploy', run: 'echo pre-deploy' }],
+    });
+
+    const stage = new Stage(app, 'MyStack', {
+      env: { account: '111111111111', region: 'us-east-1' },
+    });
+
+    new Stack(stage, 'MyStack');
+
+    pipeline.addStage(stage);
+
+    app.synth();
+
+    const workflow = readFileSync(pipeline.workflowPath, 'utf-8');
+    const deployJob = workflow.slice(workflow.indexOf('name: Deploy MyStack/MyStack'));
+    expect(deployJob.indexOf('name: Pre Deploy')).toBeGreaterThan(-1);
+    expect(deployJob.indexOf('name: Pre Deploy')).toBeLessThan(deployJob.indexOf('name: Download cdk.out'));
+    expect(workflow.split('name: Pre Deploy').length - 1).toBe(1);
+    expect(workflow).toMatchSnapshot();
+  });
+});
 test('single wave/stage/stack - with diff enabled', () => {
   withTemporaryDirectory((dir) => {
     const pipeline = new GitHubWorkflow(app, 'Pipeline', {