|
1 | 1 | name: Deploy V2 SAR |
2 | 2 |
|
| 3 | +# SAR deployment process |
| 4 | +# |
| 5 | +# 1. This workflow starts after the layer artifact is produced on `publish_v2_layer` |
| 6 | +# 2. We use the same layer artifact to ensure the SAR app is consistent with the published Lambda Layer |
| 7 | +# 3. We publish the SAR for both x86_64 and arm64 (see `matrix` section) |
| 8 | +# 4. We use `sam package` and `sam publish` to publish the SAR app |
| 9 | +# 5. We remove the previous Canary stack (if present) and deploy a new one to test the SAR App. We retain the Canary in the account for debugging purposes |
| 10 | +# 6. Finally the published SAR app is made public on the PROD environment |
| 11 | + |
| 12 | +permissions: |
| 13 | + id-token: write |
| 14 | + contents: read |
| 15 | + |
| 16 | +env: |
| 17 | + NODE_VERSION: 16.12 |
| 18 | + AWS_REGION: eu-west-1 |
| 19 | + SAR_NAME: aws-lambda-powertools-python-layer-v2 |
| 20 | + TEST_STACK_NAME: serverlessrepo-v2-powertools-layer-test-stack |
| 21 | + |
3 | 22 | on: |
4 | 23 | workflow_call: |
5 | 24 | inputs: |
|
21 | 40 | type: string |
22 | 41 |
|
23 | 42 | jobs: |
24 | | - dummy: |
| 43 | + deploy-sar-app: |
25 | 44 | runs-on: ubuntu-latest |
| 45 | + environment: ${{ inputs.environment }} |
| 46 | + strategy: |
| 47 | + matrix: |
| 48 | + architecture: ["x86_64", "arm64"] |
26 | 49 | steps: |
27 | | - - name: Hello world |
28 | | - run: echo "hello world" |
| 50 | + - name: Checkout |
| 51 | + uses: actions/checkout@v3 |
| 52 | + - name: AWS credentials |
| 53 | + uses: aws-actions/configure-aws-credentials@v1 |
| 54 | + with: |
| 55 | + aws-region: ${{ env.AWS_REGION }} |
| 56 | + role-to-assume: ${{ secrets.AWS_LAYERS_ROLE_ARN }} |
| 57 | + - name: AWS credentials SAR role |
| 58 | + uses: aws-actions/configure-aws-credentials@v1 |
| 59 | + id: aws-credentials-sar-role |
| 60 | + with: |
| 61 | + aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }} |
| 62 | + aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }} |
| 63 | + aws-session-token: ${{ env.AWS_SESSION_TOKEN }} |
| 64 | + role-duration-seconds: 1200 |
| 65 | + aws-region: ${{ env.AWS_REGION }} |
| 66 | + role-to-assume: ${{ secrets.AWS_SAR_V2_ROLE_ARN }} |
| 67 | + - name: Setup Node.js |
| 68 | + uses: actions/setup-node@v3 |
| 69 | + with: |
| 70 | + node-version: ${{ env.NODE_VERSION }} |
| 71 | + - name: Download artifact |
| 72 | + uses: actions/download-artifact@v3 |
| 73 | + with: |
| 74 | + name: ${{ inputs.artefact-name }} |
| 75 | + - name: Unzip artefact |
| 76 | + run: unzip cdk.out.zip |
| 77 | + - name: Configure SAR name |
| 78 | + run: | |
| 79 | + if [[ "${{ inputs.stage }}" == "BETA" ]]; then |
| 80 | + SAR_NAME="test-${SAR_NAME}" |
| 81 | + fi |
| 82 | + echo SAR_NAME="${SAR_NAME}" >> "$GITHUB_ENV" |
| 83 | + - name: Adds arm64 suffix to SAR name |
| 84 | + if: ${{ matrix.architecture == 'arm64' }} |
| 85 | + run: echo SAR_NAME="${SAR_NAME}-arm64" >> "$GITHUB_ENV" |
| 86 | + - name: Deploy SAR |
| 87 | + run: | |
| 88 | + # From the generated LayerStack cdk.out artifact, find the layer asset path for the correct architecture. |
| 89 | + # We'll use this as the source directory of our SAR. This way we are re-using the same layer asset for our SAR. |
| 90 | + asset=$(jq -jc '.Resources[] | select(.Properties.CompatibleArchitectures == ["${{ matrix.architecture }}"]) | .Metadata."aws:asset:path"' cdk.out/LayerV2Stack.template.json) |
| 91 | +
|
| 92 | + # fill in the SAR SAM template |
| 93 | + sed -e "s|<VERSION>|${{ inputs.package-version }}|g" -e "s/<SAR_APP_NAME>/${{ env.SAR_NAME }}/g" -e "s|<LAYER_CONTENT_PATH>|./cdk.out/$asset|g" layer/sar/template.txt > template.yml |
| 94 | +
|
| 95 | + # SAR needs a README and a LICENSE, so just copy the ones from the repo |
| 96 | + cp README.md LICENSE "./cdk.out/$asset/" |
| 97 | +
|
| 98 | + # Package the SAR to our SAR S3 bucket, and publish it |
| 99 | + sam package --template-file template.yml --output-template-file packaged.yml --s3-bucket ${{ secrets.AWS_SAR_S3_BUCKET }} |
| 100 | + sam publish --template packaged.yml --region "$AWS_REGION" |
| 101 | + - name: Deploy BETA canary |
| 102 | + if: ${{ inputs.stage == 'BETA' }} |
| 103 | + run: | |
| 104 | + if [[ "${{ matrix.architecture }}" == "arm64" ]]; then |
| 105 | + TEST_STACK_NAME="${TEST_STACK_NAME}-arm64" |
| 106 | + fi |
| 107 | +
|
| 108 | + echo "Check if stack does not exist" |
| 109 | + stack_exists=$(aws cloudformation list-stacks --query "StackSummaries[?(StackName == '$TEST_STACK_NAME' && StackStatus == 'CREATE_COMPLETE')].{StackId:StackId, StackName:StackName, CreationTime:CreationTime, StackStatus:StackStatus}" --output text) |
| 110 | +
|
| 111 | + if [[ -n "$stack_exists" ]] ; then |
| 112 | + echo "Found test deployment stack, removing..." |
| 113 | + aws cloudformation delete-stack --stack-name "$TEST_STACK_NAME" |
| 114 | + aws cloudformation wait stack-delete-complete --stack-name "$TEST_STACK_NAME" |
| 115 | + fi |
| 116 | +
|
| 117 | + echo "Creating canary stack" |
| 118 | + echo "Stack name: $TEST_STACK_NAME" |
| 119 | + aws serverlessrepo create-cloud-formation-change-set --application-id arn:aws:serverlessrepo:${{ env.AWS_REGION }}:${{ steps.aws-credentials-sar-role.outputs.aws-account-id }}:applications/${{ env.SAR_NAME }} --stack-name "${TEST_STACK_NAME/serverlessrepo-/}" --capabilities CAPABILITY_NAMED_IAM |
| 120 | + CHANGE_SET_ID=$(aws cloudformation list-change-sets --stack-name "$TEST_STACK_NAME" --query 'Summaries[*].ChangeSetId' --output text) |
| 121 | + aws cloudformation wait change-set-create-complete --change-set-name "$CHANGE_SET_ID" |
| 122 | + aws cloudformation execute-change-set --change-set-name "$CHANGE_SET_ID" |
| 123 | + aws cloudformation wait stack-create-complete --stack-name "$TEST_STACK_NAME" |
| 124 | + echo "Waiting until stack deployment completes..." |
| 125 | +
|
| 126 | + echo "Exit with error if stack is not in CREATE_COMPLETE" |
| 127 | + stack_exists=$(aws cloudformation list-stacks --query "StackSummaries[?(StackName == '$TEST_STACK_NAME' && StackStatus == 'CREATE_COMPLETE')].{StackId:StackId, StackName:StackName, CreationTime:CreationTime, StackStatus:StackStatus}") |
| 128 | + if [[ -z "$stack_exists" ]] ; then |
| 129 | + echo "Could find successful deployment, exit error..." |
| 130 | + exit 1 |
| 131 | + fi |
| 132 | + echo "Deployment successful" |
| 133 | + - name: Publish SAR |
| 134 | + if: ${{ inputs.stage == 'PROD' }} |
| 135 | + run: | |
| 136 | + # wait until SAR registers the app, otherwise it fails to make it public |
| 137 | + sleep 15 |
| 138 | + echo "Make SAR app public" |
| 139 | + aws serverlessrepo put-application-policy --application-id arn:aws:serverlessrepo:${{ env.AWS_REGION }}:${{ steps.aws-credentials-sar-role.outputs.aws-account-id }}:applications/${{ env.SAR_NAME }} --statements Principals='*',Actions=Deploy |
0 commit comments