Skip to content
Deploy

Deploy #60

Sign in to view logs

Deploy

Deploy #60

Workflow file for this run

.github/workflows/deploy.yml at f000605
# AUTOMATICALLY GENERATED FILE, DO NOT EDIT MANUALLY.
# Generated by AWS CDK and [cdk-pipelines-github](https://github.com/cdklabs/cdk-pipelines-github)
name: Deploy
on:
workflow_call:
inputs:
runner:
type: string
default: ubuntu-latest
description: Runner to use.
required: false
environments:
type: string
description: Environments to deploy.
default: development,staging
required: false
workflow_dispatch:
inputs:
runner:
type: choice
description: Runner to use.
options:
- ubuntu-latest
- self-hosted
default: ubuntu-latest
environments:
type: choice
description: Environments to deploy.
options:
- development
- staging
- production
- development,staging
- development,staging,production
default: development,staging
jobs:
build-crisiscleanup-infra-pipeline-synth:
name: Synthesize
permissions:
contents: read
id-token: write
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
needs: []
env:
CI: "true"
NX_NON_NATIVE_HASHER: "true"
NX_BRANCH: ${{github.event.number}}
NX_RUN_GROUP: ${{github.run_id}}
NX_CLOUD_ACCESS_TOKEN: ${{secrets.NX_CLOUD_ACCESS_TOKEN}}
GIGET_AUTH: ${{secrets.GH_CONFIGS_RO_PAT}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Checkout
uses: actions/checkout@v3
with:
repository: CrisisCleanup/infrastructure
ref: main
- name: Setup PNPM
uses: pnpm/[email protected]
- name: Setup Node
uses: actions/setup-node@v3
with:
node-version: "18"
cache: pnpm
- name: Install SOPs
uses: CrisisCleanup/mozilla-sops-action@main
with:
version: 3.7.3
- name: Install AWS CLI
uses: unfor19/install-aws-cli-action@v1
if: runner.arch == 'ARM64' && (inputs.runner && !contains(inputs.runner,
'ubuntu'))
with:
arch: arm64
version: 2.13.11
- name: Install Helm
uses: azure/setup-helm@v3
with:
version: 3.12.2
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Pull cdk.context.json
continue-on-error: true
env:
S3_SOURCE: s3://crisiscleanup-pipeline-assets/cdk-assets/deploy/cdk.context.json
S3_DESTINATION: packages/stacks/api/cdk.context.json
run: aws s3 cp ${{env.S3_SOURCE}} ${{env.S3_DESTINATION}}
- name: Install
run: pnpm install
- name: Build
run: |-
pnpm build
pnpm -F 'stacks.api' run synth:silent
cp -r packages/stacks/api/cdk.out ./cdk.out
- name: Push cdk.context.json
continue-on-error: true
env:
S3_SOURCE: packages/stacks/api/cdk.context.json
S3_DESTINATION: s3://crisiscleanup-pipeline-assets/cdk-assets/deploy/cdk.context.json
run: aws s3 cp ${{env.S3_SOURCE}} ${{env.S3_DESTINATION}}
- name: Push cdk.out
env:
S3_SOURCE: cdk.out
S3_DESTINATION: s3://crisiscleanup-pipeline-assets/cdk-assets/deploy/${{github.run_id}}-${{github.run_attempt}}/cdk.out
run: aws s3 sync ${{env.S3_SOURCE}} ${{env.S3_DESTINATION}}
publish:
name: Publish Assets
permissions:
contents: read
id-token: write
outputs:
asset-hash1: ${{steps.publish.outputs.asset-hash1}}
asset-hash10: ${{steps.publish.outputs.asset-hash10}}
asset-hash11: ${{steps.publish.outputs.asset-hash11}}
asset-hash12: ${{steps.publish.outputs.asset-hash12}}
asset-hash13: ${{steps.publish.outputs.asset-hash13}}
asset-hash14: ${{steps.publish.outputs.asset-hash14}}
asset-hash15: ${{steps.publish.outputs.asset-hash15}}
asset-hash16: ${{steps.publish.outputs.asset-hash16}}
asset-hash17: ${{steps.publish.outputs.asset-hash17}}
asset-hash18: ${{steps.publish.outputs.asset-hash18}}
asset-hash19: ${{steps.publish.outputs.asset-hash19}}
asset-hash2: ${{steps.publish.outputs.asset-hash2}}
asset-hash20: ${{steps.publish.outputs.asset-hash20}}
asset-hash21: ${{steps.publish.outputs.asset-hash21}}
asset-hash22: ${{steps.publish.outputs.asset-hash22}}
asset-hash23: ${{steps.publish.outputs.asset-hash23}}
asset-hash24: ${{steps.publish.outputs.asset-hash24}}
asset-hash25: ${{steps.publish.outputs.asset-hash25}}
asset-hash26: ${{steps.publish.outputs.asset-hash26}}
asset-hash27: ${{steps.publish.outputs.asset-hash27}}
asset-hash28: ${{steps.publish.outputs.asset-hash28}}
asset-hash29: ${{steps.publish.outputs.asset-hash29}}
asset-hash3: ${{steps.publish.outputs.asset-hash3}}
asset-hash30: ${{steps.publish.outputs.asset-hash30}}
asset-hash31: ${{steps.publish.outputs.asset-hash31}}
asset-hash32: ${{steps.publish.outputs.asset-hash32}}
asset-hash4: ${{steps.publish.outputs.asset-hash4}}
asset-hash5: ${{steps.publish.outputs.asset-hash5}}
asset-hash6: ${{steps.publish.outputs.asset-hash6}}
asset-hash7: ${{steps.publish.outputs.asset-hash7}}
asset-hash8: ${{steps.publish.outputs.asset-hash8}}
asset-hash9: ${{steps.publish.outputs.asset-hash9}}
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
needs:
- Build-crisiscleanup-infra-pipeline-synth
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Setup Node
uses: actions/setup-node@v3
with:
node-version: "18"
if: inputs.runner && !contains(inputs.runner, 'ubuntu')
- name: Install AWS CLI
uses: unfor19/install-aws-cli-action@v1
if: runner.arch == 'ARM64' && (inputs.runner && !contains(inputs.runner,
'ubuntu'))
with:
arch: arm64
version: 2.13.11
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Pull cdk.out
env:
S3_SOURCE: s3://crisiscleanup-pipeline-assets/cdk-assets/deploy/${{github.run_id}}-${{github.run_attempt}}/cdk.out
S3_DESTINATION: cdk.out
run: aws s3 sync ${{env.S3_SOURCE}} ${{env.S3_DESTINATION}}
- name: Install cdk-assets
run: npm install --no-save cdk-assets
- name: Publish
id: publish
run: >-
targets="./cdk.out/publish-Assets-FileAsset1-step.sh,./cdk.out/publish-Assets-FileAsset10-step.sh,./cdk.out/publish-Assets-FileAsset11-step.sh,./cdk.out/publish-Assets-FileAsset12-step.sh,./cdk.out/publish-Assets-FileAsset13-step.sh,./cdk.out/publish-Assets-FileAsset14-step.sh,./cdk.out/publish-Assets-FileAsset15-step.sh,./cdk.out/publish-Assets-FileAsset16-step.sh,./cdk.out/publish-Assets-FileAsset17-step.sh,./cdk.out/publish-Assets-FileAsset18-step.sh,./cdk.out/publish-Assets-FileAsset19-step.sh,./cdk.out/publish-Assets-FileAsset2-step.sh,./cdk.out/publish-Assets-FileAsset20-step.sh,./cdk.out/publish-Assets-FileAsset21-step.sh,./cdk.out/publish-Assets-FileAsset22-step.sh,./cdk.out/publish-Assets-FileAsset23-step.sh,./cdk.out/publish-Assets-FileAsset24-step.sh,./cdk.out/publish-Assets-FileAsset25-step.sh,./cdk.out/publish-Assets-FileAsset26-step.sh,./cdk.out/publish-Assets-FileAsset27-step.sh,./cdk.out/publish-Assets-FileAsset28-step.sh,./cdk.out/publish-Assets-FileAsset29-step.sh,./cdk.out/publish-Assets-FileAsset3-step.sh,./cdk.out/publish-Assets-FileAsset30-step.sh,./cdk.out/publish-Assets-FileAsset31-step.sh,./cdk.out/publish-Assets-FileAsset32-step.sh,./cdk.out/publish-Assets-FileAsset4-step.sh,./cdk.out/publish-Assets-FileAsset5-step.sh,./cdk.out/publish-Assets-FileAsset6-step.sh,./cdk.out/publish-Assets-FileAsset7-step.sh,./cdk.out/publish-Assets-FileAsset8-step.sh,./cdk.out/publish-Assets-FileAsset9-step.sh"
echo -n "$targets" | xargs -r -d',' -t -n1 -P2 /bin/bash
deploy-development-development-network-deploy:
name: Deploy crisiscleanupinfrapipelinestackdevelopmentdevelopmentnetwork9BE60577
if: contains((github.event.inputs.environments || inputs.environments),
'development')
permissions:
contents: read
id-token: write
environment:
name: development
url: https://app.dev.crisiscleanup.io
needs:
- Build-crisiscleanup-infra-pipeline-synth
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: development-development-network
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash1 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1
deploy-staging-staging-network-deploy:
name: Deploy crisiscleanupinfrapipelinestackstagingstagingnetworkF6BE5B3F
if: contains((github.event.inputs.environments || inputs.environments),
'staging')
permissions:
contents: read
id-token: write
environment:
name: staging
url: https://app.staging.crisiscleanup.io
needs:
- Build-crisiscleanup-infra-pipeline-synth
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_STAGING}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: staging-staging-network
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash19 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_STAGING}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1
deploy-production-production-network-deploy:
name: Deploy crisiscleanupinfrapipelinestackproductionproductionnetworkACD050B9
if: contains((github.event.inputs.environments || inputs.environments),
'production')
permissions:
contents: read
id-token: write
environment:
name: production
url: https://crisiscleanup.org
needs:
- Build-crisiscleanup-infra-pipeline-synth
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: production-production-network
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash25 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
deploy-development-development-data-deploy:
name: Deploy crisiscleanupinfrapipelinestackdevelopmentdevelopmentdataE98C910D
if: contains((github.event.inputs.environments || inputs.environments),
'development')
permissions:
contents: read
id-token: write
environment:
name: development
url: https://app.dev.crisiscleanup.io
needs:
- Build-crisiscleanup-infra-pipeline-synth
- deploy-development-development-network-Deploy
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: development-development-data
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash2 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1
deploy-staging-staging-data-deploy:
name: Deploy crisiscleanupinfrapipelinestackstagingstagingdataE88954EF
if: contains((github.event.inputs.environments || inputs.environments),
'staging')
permissions:
contents: read
id-token: write
environment:
name: staging
url: https://app.staging.crisiscleanup.io
needs:
- Build-crisiscleanup-infra-pipeline-synth
- deploy-staging-staging-network-Deploy
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_STAGING}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: staging-staging-data
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash20 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_STAGING}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1
deploy-production-production-cache-deploy:
name: Deploy crisiscleanupinfrapipelinestackproductionproductioncacheE7EE3824
if: contains((github.event.inputs.environments || inputs.environments),
'production')
permissions:
contents: read
id-token: write
environment:
name: production
url: https://crisiscleanup.org
needs:
- Build-crisiscleanup-infra-pipeline-synth
- deploy-production-production-network-Deploy
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: production-production-cache
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash26 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
deploy-production-production-data-deploy:
name: Deploy crisiscleanupinfrapipelinestackproductionproductiondataFD607C3D
if: contains((github.event.inputs.environments || inputs.environments),
'production')
permissions:
contents: read
id-token: write
environment:
name: production
url: https://crisiscleanup.org
needs:
- Build-crisiscleanup-infra-pipeline-synth
- deploy-production-production-network-Deploy
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: production-production-data
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash27 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
deploy-development-development-blueprint-deploy:
name: Deploy
crisiscleanupinfrapipelinestackdevelopmentdevelopmentblueprint44D37614
if: contains((github.event.inputs.environments || inputs.environments),
'development')
permissions:
contents: read
id-token: write
environment:
name: development
url: https://app.dev.crisiscleanup.io
needs:
- Build-crisiscleanup-infra-pipeline-synth
- deploy-development-development-network-Deploy
- deploy-development-development-data-Deploy
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: development-development-blueprint
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash5 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}-us-east-1
deploy-staging-staging-blueprint-deploy:
name: Deploy crisiscleanupinfrapipelinestackstagingstagingblueprint5D1F778A
if: contains((github.event.inputs.environments || inputs.environments),
'staging')
permissions:
contents: read
id-token: write
environment:
name: staging
url: https://app.staging.crisiscleanup.io
needs:
- Build-crisiscleanup-infra-pipeline-synth
- deploy-staging-staging-network-Deploy
- deploy-staging-staging-data-Deploy
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_STAGING}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: staging-staging-blueprint
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash21 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_STAGING}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_STAGING}}-us-east-1
deploy-production-production-blueprint-deploy:
name: Deploy crisiscleanupinfrapipelinestackproductionproductionblueprint6F97D85D
if: contains((github.event.inputs.environments || inputs.environments),
'production')
permissions:
contents: read
id-token: write
environment:
name: production
url: https://crisiscleanup.org
needs:
- Build-crisiscleanup-infra-pipeline-synth
- deploy-production-production-network-Deploy
- deploy-production-production-data-Deploy
- publish
runs-on: ${{inputs.runner || 'ubuntu-latest'}}
steps:
- name: Mask values
run: |-
echo ::add-mask::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PIPELINE}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_DEVELOPMENT}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_STAGING}}
echo ::add-mask::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}
- name: Authenticate Via OIDC Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
role-to-assume: arn:aws:iam::${{secrets.AWS_PIPELINE_ACCOUNT_ID}}:role/GitHubActionRole
role-session-name: deploy
- name: Assume CDK Deploy Role
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-region: us-east-1
role-duration-seconds: 1800
role-skip-session-tagging: true
aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
role-to-assume: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-deploy-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
role-external-id: Pipeline
- id: Deploy
uses: aws-actions/[email protected]
with:
name: production-production-blueprint
template: https://cdk-hnb659fds-assets-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1.s3.us-east-1.amazonaws.com/${{
needs.publish.outputs.asset-hash28 }}.json
no-fail-on-empty-changeset: "1"
capabilities: CAPABILITY_IAM,CAPABILITY_NAMED_IAM
role-arn: arn:aws:iam::${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}:role/cdk-hnb659fds-cfn-exec-role-${{secrets.AWS_ACCOUNT_ID_PRODUCTION}}-us-east-1
concurrency:
group: deploy-infra
cancel-in-progress: false