Skip to content

Commit 87248ce

Browse files
TheOneFromNorwayTheOneFromNorway
committed
Completely move infrastructure deployment out of deploy.yml
- This is a final step before moving infrastructure code to a separate repository
1 parent ec87870 commit 87248ce

2 files changed

Lines changed: 85 additions & 75 deletions

File tree

‎.github/workflows/deploy-infrastructure.yml‎

Lines changed: 84 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,6 @@ name: Deploy infrastructure
22
run-name: Deploy infrastructure for ${{ inputs.environment }}
33

44
on:
5-
workflow_call:
6-
inputs:
7-
environment:
8-
description: Deployment environment
9-
required: true
10-
type: string
11-
git_ref_to_deploy:
12-
required: true
13-
type: string
145
workflow_dispatch:
156
inputs:
167
environment:
@@ -26,7 +17,6 @@ permissions: {}
2617

2718
env:
2819
environment: ${{ inputs.environment }}
29-
image_tag: ${{ inputs.image_tag || github.sha }}
3020
git_ref_to_deploy: ${{ inputs.git_ref_to_deploy || github.ref_name }}
3121
aws_role: ${{ inputs.environment == 'production'
3222
&& 'arn:aws:iam::820242920762:role/GithubDeployMavisAndInfrastructure'
@@ -42,9 +32,92 @@ defaults:
4232
working-directory: terraform/app
4333

4434
jobs:
35+
36+
validate-inputs:
37+
runs-on: ubuntu-latest
38+
permissions: {}
39+
steps:
40+
- name: Validate inputs
41+
run: |
42+
if [[ "$environment" == "preview" || "$environment" == "production" ]]; then
43+
if [[ -z "$git_ref_to_deploy" ]]; then
44+
echo "Error: git_ref_to_deploy is required for preview and production environments."
45+
exit 1
46+
fi
47+
fi
48+
determine-git-sha:
49+
runs-on: ubuntu-latest
50+
permissions: {}
51+
needs: validate-inputs
52+
outputs:
53+
git-sha: ${{ steps.get-git-sha.outputs.git-sha }}
54+
steps:
55+
- name: Checkout code
56+
uses: actions/checkout@v6
57+
with:
58+
ref: ${{ inputs.git_ref_to_deploy || github.sha }}
59+
- name: Get git sha
60+
id: get-git-sha
61+
run: echo "git-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
62+
validate-permissions:
63+
needs: validate-inputs
64+
runs-on: ubuntu-latest
65+
defaults:
66+
run:
67+
working-directory: ./terraform
68+
permissions:
69+
id-token: write
70+
steps:
71+
- name: Checkout code
72+
uses: actions/checkout@v6
73+
with:
74+
ref: ${{ github.ref_name }}
75+
- name: Configure AWS Credentials
76+
uses: aws-actions/configure-aws-credentials@v5
77+
with:
78+
role-to-assume: arn:aws:iam::${{ env.account_id }}:role/GithubDeployMavisAndInfrastructure
79+
aws-region: eu-west-2
80+
- name: Compare permissions
81+
id: compare-permissions
82+
run: |
83+
source ./scripts/validate-github-actions-policy.sh
84+
validate_policies "arn:aws:iam::$account_id:policy/DeployMavisResources" ./account/resources/iam_policy_DeployMavisResources.json
85+
exit $?
86+
update-permissions:
87+
runs-on: ubuntu-latest
88+
needs: validate-permissions
89+
if: ${{ !cancelled() && (inputs.environment == 'production' || inputs.environment == 'preview') && needs.validate-permissions.result == 'failure' }}
90+
environment: ${{ inputs.environment }}
91+
defaults:
92+
run:
93+
working-directory: ./terraform
94+
permissions:
95+
id-token: write
96+
steps:
97+
- name: Checkout code
98+
uses: actions/checkout@v6
99+
with:
100+
ref: ${{ github.ref_name }}
101+
- name: Configure AWS Credentials
102+
uses: aws-actions/configure-aws-credentials@v5
103+
with:
104+
role-to-assume: arn:aws:iam::${{ env.account_id }}:role/GithubDeployMavisAndInfrastructure
105+
aws-region: eu-west-2
106+
- name: Update IAM policy
107+
run: ./scripts/update-github-actions-policy.sh "arn:aws:iam::$account_id:policy/DeployMavisResources" ./account/resources/iam_policy_DeployMavisResources.json
108+
45109
plan:
46110
name: Terraform plan
47111
runs-on: ubuntu-latest
112+
needs:
113+
[
114+
determine-git-sha,
115+
validate-permissions,
116+
update-permissions,
117+
]
118+
if: ${{ !cancelled() &&
119+
((inputs.environment != 'production' && inputs.environment != 'preview') ||
120+
needs.validate-permissions.result == 'success' || needs.update-permissions.result == 'success') }}
48121
permissions:
49122
id-token: write
50123
steps:
@@ -85,6 +158,7 @@ jobs:
85158
name: Terraform apply
86159
runs-on: ubuntu-latest
87160
needs: plan
161+
if: ${{ !cancelled() && needs.plan.result == 'success' }}
88162
environment: ${{ inputs.environment }}
89163
permissions:
90164
id-token: write

‎.github/workflows/deploy.yml‎

Lines changed: 1 addition & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ on:
4444
- web
4545
- sidekiq
4646
- ops
47-
- none
4847
default: all
4948

5049
env:
@@ -80,73 +79,10 @@ jobs:
8079
- name: Get git sha
8180
id: get-git-sha
8281
run: echo "git-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
83-
validate-permissions:
84-
needs: validate-inputs
85-
runs-on: ubuntu-latest
86-
defaults:
87-
run:
88-
working-directory: ./terraform
89-
permissions:
90-
id-token: write
91-
steps:
92-
- name: Checkout code
93-
uses: actions/checkout@v6
94-
with:
95-
ref: ${{ github.ref_name }}
96-
- name: Configure AWS Credentials
97-
uses: aws-actions/configure-aws-credentials@v5
98-
with:
99-
role-to-assume: arn:aws:iam::${{ env.account_id }}:role/GithubDeployMavisAndInfrastructure
100-
aws-region: eu-west-2
101-
- name: Compare permissions
102-
id: compare-permissions
103-
run: |
104-
source ./scripts/validate-github-actions-policy.sh
105-
validate_policies "arn:aws:iam::$account_id:policy/DeployMavisResources" ./account/resources/iam_policy_DeployMavisResources.json
106-
exit $?
107-
update-permissions:
108-
runs-on: ubuntu-latest
109-
needs: validate-permissions
110-
if: ${{ !cancelled() && (inputs.environment == 'production' || inputs.environment == 'preview') && needs.validate-permissions.result == 'failure' }}
111-
environment: ${{ inputs.environment }}
112-
defaults:
113-
run:
114-
working-directory: ./terraform
115-
permissions:
116-
id-token: write
117-
steps:
118-
- name: Checkout code
119-
uses: actions/checkout@v6
120-
with:
121-
ref: ${{ github.ref_name }}
122-
- name: Configure AWS Credentials
123-
uses: aws-actions/configure-aws-credentials@v5
124-
with:
125-
role-to-assume: arn:aws:iam::${{ env.account_id }}:role/GithubDeployMavisAndInfrastructure
126-
aws-region: eu-west-2
127-
- name: Update IAM policy
128-
run: ./scripts/update-github-actions-policy.sh "arn:aws:iam::$account_id:policy/DeployMavisResources" ./account/resources/iam_policy_DeployMavisResources.json
129-
deploy-infrastructure:
130-
permissions:
131-
id-token: write
132-
needs:
133-
[
134-
determine-git-sha,
135-
validate-permissions,
136-
update-permissions,
137-
]
138-
if: ${{ !cancelled() &&
139-
((inputs.environment != 'production' && inputs.environment != 'preview') ||
140-
needs.validate-permissions.result == 'success' || needs.update-permissions.result == 'success') }}
141-
uses: ./.github/workflows/deploy-infrastructure.yml
142-
with:
143-
environment: ${{ inputs.environment }}
144-
git_ref_to_deploy: ${{ needs.determine-git-sha.outputs.git-sha }}
14582
deploy-application:
14683
permissions:
14784
id-token: write
148-
needs: [deploy-infrastructure, determine-git-sha]
149-
if: ${{ !cancelled() && inputs.server_types != 'none' && needs.deploy-infrastructure.result == 'success' }}
85+
needs: determine-git-sha
15086
uses: ./.github/workflows/deploy-application.yml
15187
with:
15288
environment: ${{ inputs.environment }}

0 commit comments

Comments
 (0)