cloudformation.yml

name: Cloudformation Actions

on:
  workflow_call:
    inputs:
      stack_name:
        required: true
        type: string
      template:
        required: true
        type: string
      capabilities:
        required: true
        type: string
      execute_change_set:
        required: true
        type: boolean
      env:
        required: true
        type: string
      target_environment:
        required: true
        type: string
      version:
        required: true
        type: string
      change_set_version:
        required: true
        type: string
      dynamic_vars:
        required: false
        type: string
        default: "{}"
      pinned_image:
        type: string
        required: true
    secrets:
      cf_deploy_role:
        required: false
      parameter_secrets:
        required: false
      cf_create_changeset_role:
        required: true
permissions: {}

jobs:
  create_change_set:
    name: Create ${{ inputs.stack_name }} change set
    runs-on: ubuntu-22.04
    container:
      image: ${{ inputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    permissions:
      id-token: write
      contents: read
    env:
      CAPABILITIES: ${{ inputs.capabilities }}
      CHANGE_SET_VERSION: ${{ inputs.change_set_version }}
      STACK_NAME: ${{ inputs.stack_name }}
      TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
      TEMPLATE: ${{ inputs.template }}
      VERSION: ${{ inputs.version }}
    outputs:
      parameters_file_name: ${{ steps.parse_parameters.outputs.PARAMETERS_FILE_NAME }}
    steps:
    - name: copy .tool-versions
      run: |
        cp /home/vscode/.tool-versions "$HOME/.tool-versions"
    - name: checkout code
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
      with:
        persist-credentials: false
        fetch-depth: 0

    - name: Assume create changeset role
      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
      with:
        aws-region: eu-west-2
        role-to-assume: ${{ secrets.cf_create_changeset_role}}
        role-session-name: account-resources-create-changeset

    - name: check stack exists
      id: check_stack_exists
      shell: bash
      working-directory: .github/scripts
      run: ./check_stack_exists.sh

    # ***************************************************
    # This does not work for int and prod as this job does not specify an environment 
    # if we do specify an environment, it will ask for confirmation before creating a changeset
    # which is not what we want
    # ***************************************************

    - name: Assume create deploy stack role
      if: ${{ steps.check_stack_exists.outputs.STACK_EXISTS == 'false' }} 
      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
      with:
        aws-region: eu-west-2
        role-to-assume: ${{ secrets.cf_deploy_role}}
        role-session-name: account-resources-create-empty-stack

    - name: create stack
      if: ${{ steps.check_stack_exists.outputs.STACK_EXISTS == 'false' }} 
      shell: bash
      run: |
        aws cloudformation create-stack --stack-name "${STACK_NAME}" \
        --template-body file://./cloudformation/empty_stack.yml
      env:
        STACK_NAME: ${{ inputs.stack_name }}

    - name: Assume create changeset role
      if: ${{ steps.check_stack_exists.outputs.STACK_EXISTS == 'false' }} 
      uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
      with:
        aws-region: eu-west-2
        role-to-assume: ${{ secrets.cf_create_changeset_role}}
        role-session-name: account-resources-create-changeset
        
    - name: Parse Parameters
      env:
        parameter_secrets: ${{ secrets.parameter_secrets }}
        dynamic_vars: ${{ inputs.dynamic_vars }}
        TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
        STACK_NAME: ${{ inputs.stack_name }}
      id: parse_parameters
      shell: bash
      run: |
        PARAMETERS_FILE_NAME=$(python scripts/parse_parameters.py ${{ env.TARGET_ENVIRONMENT }} ${{ env.STACK_NAME }})
        cat "$PARAMETERS_FILE_NAME"
        echo "PARAMETERS_FILE_NAME=${PARAMETERS_FILE_NAME}" >> "$GITHUB_OUTPUT"

    - name: Create Change Set with new tags
      shell: bash
      working-directory: .github/scripts
      env:
        PARAMETERS: ${{ steps.parse_parameters.outputs.PARAMETERS_FILE_NAME }}
      run: ./create_changeset_new_tags.sh

    - name: Create Change Set with existing tags
      shell: bash
      working-directory: .github/scripts
      env:
        PARAMETERS: ${{ steps.parse_parameters.outputs.PARAMETERS_FILE_NAME }}
      run: ./create_changeset_existing_tags.sh

    - name: Header output
      shell: bash
      working-directory: .github/scripts
      run: ./header_output.sh

    - name: Describe Full Change Set
      shell: bash
      working-directory: .github/scripts
      env:
        CHANGESET_NAME: ${{ inputs.stack_name }}-${{ inputs.change_set_version }}
        SUMMARY: "[${{ inputs.target_environment }}] FULL Change Set for ${{ inputs.stack_name }}"
      run: ./describe_changeset.sh

    - name: Describe Change Set for existing tag
      shell: bash
      working-directory: .github/scripts
      env:
        CHANGESET_NAME: ${{ inputs.stack_name }}-${{ inputs.change_set_version }}-current-tag
        SUMMARY: "[${{ inputs.target_environment }}] Change Set for ${{ inputs.stack_name }} with existing tag"
      run: ./describe_changeset.sh

    - name: Delete Change Set for new tag
      if: ${{ inputs.execute_change_set == false }}
      shell: bash
      run: |
        aws cloudformation delete-change-set \
        --stack-name "${STACK_NAME}" \
        --change-set-name "${STACK_NAME}-${CHANGE_SET_VERSION}"
      env:
        STACK_NAME: ${{ inputs.stack_name }}
        CHANGE_SET_VERSION: ${{ inputs.change_set_version }}

    - name: Delete Change Set for existing tag
      shell: bash
      run: |
        aws cloudformation delete-change-set \
        --stack-name "${STACK_NAME}" \
        --change-set-name "${STACK_NAME}-${CHANGE_SET_VERSION}-current-tag"
      env:
        STACK_NAME: ${{ inputs.stack_name }}
        CHANGE_SET_VERSION: ${{ inputs.change_set_version }}
  
  execute_change_set:
    name: Execute ${{ inputs.stack_name }} change Set
    if: ${{ inputs.execute_change_set == true }}
    needs: [create_change_set]
    runs-on: ubuntu-22.04
    container:
      image: ${{ inputs.pinned_image }}
      options: --user 1001:1001 --group-add 128
    defaults:
      run:
        shell: bash
    environment: ${{ inputs.target_environment }}
    permissions:
      id-token: write
      contents: write
    env:
      CHANGE_SET_VERSION: ${{ inputs.change_set_version }}
      STACK_NAME: ${{ inputs.stack_name }}
    steps:
      - name: copy .tool-versions
        run: |
          cp /home/vscode/.tool-versions "$HOME/.tool-versions"
      - name: Checkout scripts
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/scripts

      - name: Assume deploy changeset role
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          aws-region: eu-west-2
          role-to-assume: ${{ secrets.cf_deploy_role }}
          role-session-name: account-resources-deploy-changeset

      - name: Execute Change Set
        shell: bash
        working-directory: .github/scripts
        run: ./execute_changeset.sh

      - name: Checkout gh-pages
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: true
          ref: gh-pages
          path: gh-pages

      - name: Update release tag in github pages
        run: |
          cd gh-pages
          NOW=$(date +'%Y-%m-%dT%H:%M:%S')
          echo "tag,release_datetime" > "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_latest.csv"
          echo "${VERSION},${NOW}" >> "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_latest.csv"
          echo "${VERSION},${NOW}" >> "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_deployments.csv"
          git config user.name github-actions
          git config user.email github-actions@github.com
          git add "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_latest.csv"
          git add "_data/${TARGET_ENVIRONMENT}_${STACK_NAME}_deployments.csv"
          git commit -m "update releases for ${TARGET_ENVIRONMENT} and stack ${STACK_NAME}"
          parallel --retries 10 --delay 3 ::: "git pull --rebase && git push"
        env:
          TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
          STACK_NAME: ${{ inputs.stack_name }}
          VERSION: ${{ inputs.version }}