Skip to content

Commit 22282b5

Browse files
GeoWillGeoWill
committed
WIP
1 parent 6808f17 commit 22282b5

File tree

9 files changed

+199
-24
lines changed

9 files changed

+199
-24
lines changed

‎.github/actions/cdk-deploy/action.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: 'CDK Synth'
2+
description: 'Check CDK output is valid'
3+
inputs:
4+
dc-environment:
5+
description: 'Environment to deploy to (development, staging, production)'
6+
required: true
7+
aws-role-arn:
8+
description: 'ARN of AWS account to assume'
9+
required: true
10+
11+
runs:
12+
using: composite
13+
steps:
14+
15+
- name: Python setup
16+
uses: ./.github/actions/install
17+
18+
- name: Configure AWS Credentials
19+
uses: aws-actions/configure-aws-credentials@v4
20+
with:
21+
aws-region: eu-west-2
22+
role-to-assume: ${{ inputs.aws-role-arn }}
23+
24+
- name: CDK Deploy
25+
run: scripts/cdk-deploy --all --concurrency 3 --require-approval never --asset-parallelism true
26+
shell: bash
27+
env:
28+
DC_ENVIRONMENT: ${{ inputs.dc-environment }}

‎.github/actions/cdk-synth/action.yml‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,28 +4,33 @@ inputs:
44
dc-environment:
55
description: 'Environment to deploy to (development, staging, production)'
66
required: true
7-
aws-role-arn:
8-
description: 'ARN of AWS account to assume'
9-
required: true
7+
# aws-role-arn:
8+
# description: 'ARN of AWS account to assume'
9+
# required: true
1010

1111
runs:
1212
using: composite
1313
steps:
1414

1515
- name: Python setup
16-
uses: ./.github/actions/python-setup
17-
18-
- name: Node setup
19-
uses: ./.github/actions/node-setup
16+
uses: ./.github/actions/install
2017

21-
- name: Configure AWS Credentials
22-
uses: aws-actions/configure-aws-credentials@v4
23-
with:
24-
aws-region: eu-west-2
25-
role-to-assume: ${{ inputs.aws-role-arn }}
18+
# - name: Configure AWS Credentials
19+
# uses: aws-actions/configure-aws-credentials@v4
20+
# with:
21+
# aws-region: eu-west-2
22+
# role-to-assume: ${{ inputs.aws-role-arn }}
2623

2724
- name: CDK Synth
2825
run: scripts/cdk-synth --all
2926
shell: bash
3027
env:
3128
DC_ENVIRONMENT: ${{ inputs.dc-environment }}
29+
30+
# ToDo: This produces changes on CI, but not when run locally.
31+
# - name: Check Diagram
32+
# shell: bash
33+
# run: |
34+
# sudo apt install -y graphviz
35+
# uv run make_graph.py
36+
# git diff --exit-code || (echo "Please update graph and commit changes." && exit 1)

‎.github/actions/install/action.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
runs:
2+
using: composite
3+
steps:
4+
- name: Check out repository
5+
uses: actions/checkout@v4
6+
7+
- name: Python setup
8+
uses: ./.github/actions/python-setup
9+
10+
- name: Node setup
11+
uses: ./.github/actions/node-setup

‎.github/actions/test/action.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
runs:
2+
using: composite
3+
steps:
4+
- name: Check Workflows
5+
shell: bash
6+
run: uvx zizmor --format sarif . > zizmor-results.sarif
7+
# ToDo: set up a github_token to do further analysis. See: https://woodruffw.github.io/zizmor/usage/#use-in-github-actions)
8+
9+
# ToDo: Reenable this when I understand what it does.
10+
# - name: Upload SARIF file
11+
# shell: bash
12+
# uses: github/codeql-action/upload-sarif@v3
13+
# with:
14+
# sarif_file: zizmor-results.sarif
15+
# category: zizmor
16+
17+
- name: Pre-test checks
18+
shell: bash
19+
run: uv run scripts/code-check

‎.github/workflows/build-and-test.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
name: Build and Test
22

3-
on:
4-
push:
5-
branches: [github-actions-deploy]
6-
3+
on: push
74

85
jobs:
96
build-and-test:
@@ -32,8 +29,3 @@ jobs:
3229

3330
- name: Pre-test checks
3431
run: uv run scripts/code-check
35-
36-
# ToDo a check for whether the graph needs to be updated.
37-
# Install graphviz
38-
# uv run make_graph.py
39-
# git diff --exit-code || (echo "Please update graph and commit changes." && exit 1)

‎.github/workflows/cdk-deploy.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: CDK Deploy
2+
3+
on:
4+
# workflow_run:
5+
# workflows: ["Build and Test"]
6+
# types: [completed]
7+
push:
8+
branches: [github-actions-deploy]
9+
10+
permissions:
11+
id-token: write
12+
13+
jobs:
14+
cdk-deploy-development:
15+
name: CDK Deploy (Development)
16+
runs-on: ubuntu-22.04
17+
environment: development
18+
steps:
19+
- name: Check out repository
20+
uses: actions/checkout@v4
21+
22+
- name: CDK Deploy Development
23+
uses: ./.github/actions/cdk-deploy
24+
with:
25+
dc-environment: ${{ vars.DC_ENVIRONMENT }}
26+
aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
27+
28+
cdk-deploy-staging:
29+
name: CDK Deploy (Staging)
30+
if: ${{ github.ref == 'refs/heads/github-actions-deploy' }} # ToDo: Change to main
31+
needs: cdk-deploy-development
32+
runs-on: ubuntu-22.04
33+
environment: staging
34+
steps:
35+
- name: Check out repository
36+
uses: actions/checkout@v4
37+
38+
- name: CDK Deploy Staging
39+
uses: ./.github/actions/cdk-deploy
40+
with:
41+
dc-environment: ${{ vars.DC_ENVIRONMENT }}
42+
aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
43+
44+
cdk-deploy-production:
45+
name: CDK Deploy (Production)
46+
if: ${{ github.ref == 'refs/heads/main' }}
47+
needs: cdk-deploy-staging
48+
runs-on: ubuntu-22.04
49+
environment: production
50+
steps:
51+
- name: Check out repository
52+
uses: actions/checkout@v4
53+
54+
- name: CDK Deploy Production
55+
uses: ./.github/actions/cdk-deploy
56+
with:
57+
dc-environment: ${{ vars.DC_ENVIRONMENT }}
58+
aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}

‎.github/workflows/development.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Development
2+
3+
on: push
4+
5+
jobs:
6+
build-and-test:
7+
runs-on: ubuntu-22.04
8+
steps:
9+
- name: Check out repository
10+
uses: actions/checkout@v4
11+
12+
- name: Install
13+
uses: ./.github/actions/install
14+
15+
- name: Test
16+
uses: ./.github/actions/test
17+
18+
cdk-synth:
19+
environment: development
20+
runs-on: ubuntu-22.04
21+
needs: build-and-test
22+
steps:
23+
- name: Check out repository
24+
uses: actions/checkout@v4
25+
26+
- name: CDK Synth
27+
uses: ./.github/actions/cdk-synth
28+
with:
29+
dc-environment: ${{ vars.DC_ENVIRONMENT }}
30+
31+
cdk-deploy:
32+
permissions:
33+
id-token: write
34+
environment: development
35+
runs-on: ubuntu-22.04
36+
needs: cdk-synth
37+
steps:
38+
- name: Check out repository
39+
uses: actions/checkout@v4
40+
41+
- name: CDK Deploy Production
42+
uses: ./.github/actions/cdk-deploy
43+
with:
44+
dc-environment: ${{ vars.DC_ENVIRONMENT }}
45+
aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}

‎scripts/cdk-deploy‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
set -euxo pipefail
3+
4+
# Echo environment information
5+
echo "Running CDK synth with DC_ENVIRONMENT=$DC_ENVIRONMENT"
6+
7+
# If AWS_PROFILE exists (+x) then see if it's set.
8+
# Useful if calling script locally.
9+
if [ -n "${AWS_PROFILE+x}" ]; then
10+
echo "Using AWS_PROFILE=$AWS_PROFILE"
11+
fi
12+
13+
# Check if CDK is available in node_modules
14+
if [ -f "./node_modules/.bin/cdk" ]; then
15+
echo "Using CDK from node_modules"
16+
uv run ./node_modules/.bin/cdk deploy "$@"
17+
else
18+
echo "Error: CDK not found in node_modules. Make sure it's installed with 'npm ci'"
19+
exit 1
20+
fi

‎scripts/cdk-synth‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,6 @@ set -euxo pipefail
33

44
# Echo environment information
55
echo "Running CDK synth with DC_ENVIRONMENT=$DC_ENVIRONMENT"
6-
if [ -n "${AWS_PROFILE+x}" ]; then
7-
echo "Using AWS_PROFILE=$AWS_PROFILE"
8-
fi
96

107
# Check if CDK is available in node_modules
118
if [ -f "./node_modules/.bin/cdk" ]; then

0 commit comments

Comments
 (0)