Skip to content

Commit 32fd8a2

Browse files
Neiland85Neiland85
authored
Merge branch 'main' into develop
2 parents c763247 + ef9825c commit 32fd8a2

13 files changed

+669
-16
lines changed

‎.dockerignore‎

Whitespace-only changes.

‎.github/workflows/ci-cd-fixed.yml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
# Workflow alternativo para casos de emergencia o testing
2+
name: CI/CD Pipeline - Fixed
3+
4+
on:
5+
workflow_dispatch:
6+
inputs:
7+
skip_tests:
8+
description: '¿Saltar tests? (solo para emergencias)'
9+
required: true
10+
default: 'false'
11+
type: choice
12+
options:
13+
- 'true'
14+
- 'false'
15+
force_deploy:
16+
description: '¿Forzar deployment?'
17+
required: true
18+
default: 'false'
19+
type: choice
20+
options:
21+
- 'true'
22+
- 'false'
23+
24+
# Permisos necesarios para AWS OIDC
25+
permissions:
26+
id-token: write # Para AWS OIDC authentication
27+
contents: read # Para hacer checkout del código
28+
29+
env:
30+
AWS_REGION: eu-west-1
31+
ECR_REPOSITORY: neurobank-fastapi
32+
AWS_ACCOUNT_ID: 120242956739
33+
AWS_ROLE_ARN: arn:aws:iam::120242956739:role/GitHubActionsOIDCRole
34+
35+
jobs:
36+
test:
37+
runs-on: ubuntu-latest
38+
if: github.event.inputs.skip_tests != 'true'
39+
steps:
40+
- uses: actions/checkout@v4
41+
42+
- name: Set up Python
43+
uses: actions/setup-python@v5
44+
with:
45+
python-version: '3.11'
46+
47+
- name: Install dependencies
48+
run: |
49+
python -m pip install --upgrade pip
50+
pip install -r requirements.txt
51+
52+
- name: Run tests with coverage
53+
run: |
54+
python -m pytest --cov=app --cov-report=xml --cov-report=html
55+
56+
- name: Upload coverage reports
57+
uses: actions/upload-artifact@v4
58+
if: always()
59+
with:
60+
name: coverage-reports
61+
path: |
62+
coverage.xml
63+
htmlcov/
64+
65+
security:
66+
runs-on: ubuntu-latest
67+
if: github.event.inputs.skip_tests != 'true'
68+
steps:
69+
- uses: actions/checkout@v4
70+
71+
- name: Set up Python
72+
uses: actions/setup-python@v5
73+
with:
74+
python-version: '3.11'
75+
76+
- name: Install dependencies
77+
run: |
78+
python -m pip install --upgrade pip
79+
pip install -r requirements.txt
80+
pip install bandit safety
81+
82+
- name: Run Bandit security scan
83+
run: |
84+
bandit -r app/ -f json -o bandit-report.json --skip B101 || true
85+
86+
- name: Run Safety vulnerability scan
87+
run: |
88+
pip freeze > current-requirements.txt
89+
safety scan --json --output safety-report.json --continue-on-error || true
90+
91+
- name: Upload security reports
92+
uses: actions/upload-artifact@v4
93+
if: always()
94+
with:
95+
name: security-reports-fixed
96+
path: |
97+
bandit-report.json
98+
safety-report.json
99+
100+
build-and-deploy:
101+
needs: [test, security]
102+
runs-on: ubuntu-latest
103+
if: |
104+
always() &&
105+
github.event.inputs.force_deploy == 'true' &&
106+
(github.event.inputs.skip_tests == 'true' ||
107+
(needs.test.result == 'success' && needs.security.result == 'success'))
108+
109+
steps:
110+
- name: Checkout
111+
uses: actions/checkout@v4
112+
113+
- name: Emergency deployment warning
114+
if: github.event.inputs.skip_tests == 'true'
115+
run: |
116+
echo "⚠️ WARNING: EMERGENCY DEPLOYMENT MODE"
117+
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
118+
echo "🚨 Tests have been SKIPPED!"
119+
echo "🚨 This should only be used in emergency situations!"
120+
echo "🚨 Make sure to run full testing after deployment!"
121+
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
122+
123+
- name: Set up Python
124+
uses: actions/setup-python@v5
125+
with:
126+
python-version: '3.11'
127+
128+
- name: Configure AWS credentials via OIDC
129+
uses: aws-actions/configure-aws-credentials@v4
130+
with:
131+
role-to-assume: ${{ env.AWS_ROLE_ARN }}
132+
aws-region: ${{ env.AWS_REGION }}
133+
role-session-name: GitHubActions-Fixed-${{ github.run_id }}
134+
135+
- name: Verify AWS connection
136+
run: |
137+
echo "🔍 Verifying AWS OIDC connection..."
138+
aws sts get-caller-identity
139+
echo "✅ AWS connection verified!"
140+
141+
- name: Setup SAM CLI
142+
uses: aws-actions/setup-sam@v2
143+
with:
144+
use-installer: true
145+
146+
- name: Create ECR repository if not exists
147+
run: |
148+
aws ecr describe-repositories --repository-names ${{ env.ECR_REPOSITORY }} --region ${{ env.AWS_REGION }} || \
149+
aws ecr create-repository --repository-name ${{ env.ECR_REPOSITORY }} --region ${{ env.AWS_REGION }}
150+
151+
- name: Login to Amazon ECR
152+
id: login-ecr
153+
uses: aws-actions/amazon-ecr-login@v2
154+
155+
- name: Build and push Docker image
156+
env:
157+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
158+
IMAGE_TAG: fixed-${{ github.sha }}
159+
run: |
160+
docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
161+
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
162+
docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:latest
163+
docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
164+
165+
- name: Deploy to AWS Lambda
166+
run: |
167+
sam build --region ${{ env.AWS_REGION }}
168+
sam deploy --no-confirm-changeset --no-fail-on-empty-changeset \
169+
--stack-name neurobank-api-fixed \
170+
--capabilities CAPABILITY_IAM \
171+
--region ${{ env.AWS_REGION }} \
172+
--parameter-overrides ApiKey=${{ secrets.API_KEY || 'emergency-deploy-key' }}
173+
echo "🎉 Emergency deployment completed!"

‎.github/workflows/ci-cd.yml‎

Lines changed: 79 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,36 @@ on:
55
branches: [ main, develop ]
66
pull_request:
77
branches: [ main ]
8+
# Deployment solo cuando el usuario lo solicite manualmente
9+
workflow_dispatch:
10+
inputs:
11+
deploy_to_aws:
12+
description: '¿Desplegar a AWS?'
13+
required: true
14+
default: 'false'
15+
type: choice
16+
options:
17+
- 'true'
18+
- 'false'
19+
environment:
20+
description: 'Entorno de deployment'
21+
required: true
22+
default: 'staging'
23+
type: choice
24+
options:
25+
- 'staging'
26+
- 'production'
27+
28+
# Permisos necesarios para AWS OIDC
29+
permissions:
30+
id-token: write # Para AWS OIDC authentication
31+
contents: read # Para hacer checkout del código
832

933
env:
1034
AWS_REGION: eu-west-1
1135
ECR_REPOSITORY: neurobank-fastapi
36+
AWS_ACCOUNT_ID: 120242956739
37+
AWS_ROLE_ARN: arn:aws:iam::120242956739:role/GitHubActionsOIDCRole
1238

1339
jobs:
1440
test:
@@ -83,44 +109,54 @@ jobs:
83109
- name: Check deployment readiness
84110
run: |
85111
echo "🔍 Checking deployment readiness..."
86-
if [ -z "${{ secrets.AWS_ACCESS_KEY_ID }}" ] || [ -z "${{ secrets.AWS_SECRET_ACCESS_KEY }}" ]; then
112+
if [ -z "${{ secrets.AWS_ACCOUNT_ID }}" ]; then
87113
echo ""
88-
echo "⚠️ AWS CREDENTIALS NOT CONFIGURED"
114+
echo "⚠️ AWS OIDC NOT CONFIGURED"
89115
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
90116
echo "To enable automatic deployment, please configure:"
91117
echo ""
92118
echo "1. Go to: https://github.com/${{ github.repository }}/settings/secrets/actions"
93-
echo "2. Add these Repository Secrets:"
94-
echo " • AWS_ACCESS_KEY_ID"
95-
echo " • AWS_SECRET_ACCESS_KEY"
96-
echo " • API_KEY (for your application)"
119+
echo "2. Add this Repository Secret:"
120+
echo " • AWS_ACCOUNT_ID (your 12-digit AWS account number)"
121+
echo " • API_KEY (for your application - optional)"
122+
echo ""
123+
echo "3. Ensure AWS OIDC role exists:"
124+
echo " • Role name: GitHubActionsOIDCRole"
125+
echo " • Trust policy allows: ${{ github.repository }}"
97126
echo ""
98-
echo "3. Also create an ECR repository named: ${{ env.ECR_REPOSITORY }}"
127+
echo "4. Also create an ECR repository named: ${{ env.ECR_REPOSITORY }}"
99128
echo ""
100129
echo "✅ Tests and Security scans completed successfully!"
101-
echo "🚀 Deployment will run automatically once credentials are configured"
130+
echo "🚀 Deployment will run automatically once OIDC is configured"
102131
echo ""
103132
else
104-
echo "✅ AWS credentials are configured - deployment will proceed"
133+
echo "✅ AWS OIDC is configured - deployment will proceed"
105134
echo "🚀 Ready for production deployment to AWS Lambda!"
106135
echo "📍 Region: ${{ env.AWS_REGION }}"
107136
echo "📦 ECR Repository: ${{ env.ECR_REPOSITORY }}"
137+
echo "🔐 AWS Role: ${{ env.AWS_ROLE_ARN }}"
138+
echo "🏗️ Using secure OIDC authentication (no long-term keys) ✨"
108139
fi
109140
110141
build-and-deploy:
111142
needs: [test, security]
112143
runs-on: ubuntu-latest
113-
if: github.ref == 'refs/heads/main'
144+
# Solo deployar cuando el usuario lo active manualmente con workflow_dispatch
145+
if: |
146+
(github.event_name == 'workflow_dispatch' &&
147+
github.event.inputs.deploy_to_aws == 'true' &&
148+
github.ref == 'refs/heads/main')
114149
115150
steps:
116151
- name: Checkout
117152
uses: actions/checkout@v4
118153

119-
- name: Verify deployment prerequisites
154+
- name: Verify OIDC prerequisites
120155
run: |
121-
echo "🚀 Starting deployment process..."
156+
echo "🚀 Starting OIDC-secured deployment process..."
122157
echo "📍 AWS Region: ${{ env.AWS_REGION }}"
123158
echo "📦 ECR Repository: ${{ env.ECR_REPOSITORY }}"
159+
develop
124160
echo "🔑 Checking AWS Credentials..."
125161
126162
# Verify secrets are available (without exposing them)
@@ -136,25 +172,47 @@ jobs:
136172
exit 1
137173
else
138174
echo "✅ AWS_SECRET_ACCESS_KEY is available"
175+
176+
echo "� AWS Role ARN: ${{ env.AWS_ROLE_ARN }}"
177+
echo "🏗️ Using secure OIDC authentication ✨"
178+
179+
# Verify AWS Account ID is available
180+
if [ -z "${{ secrets.AWS_ACCOUNT_ID }}" ]; then
181+
echo "❌ AWS_ACCOUNT_ID secret is missing"
182+
echo "💡 Add it in: https://github.com/${{ github.repository }}/settings/secrets/actions"
183+
exit 1
184+
else
185+
echo "✅ AWS_ACCOUNT_ID is configured"
186+
main
139187
fi
140188
141189
if [ -z "${{ secrets.API_KEY }}" ]; then
142190
echo "⚠️ API_KEY is missing - using default"
143191
else
192+
develop
144193
echo "✅ API_KEY is available"
194+
195+
echo "✅ API_KEY is configured"
196+
main
145197
fi
146198
147199
- name: Set up Python
148200
uses: actions/setup-python@v5
149201
with:
150202
python-version: '3.11'
151203

152-
- name: Configure AWS credentials
204+
- name: Configure AWS credentials via OIDC
153205
uses: aws-actions/configure-aws-credentials@v4
154206
with:
155-
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
156-
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
207+
role-to-assume: ${{ env.AWS_ROLE_ARN }}
157208
aws-region: ${{ env.AWS_REGION }}
209+
role-session-name: GitHubActions-${{ github.run_id }}
210+
211+
- name: Debug AWS identity
212+
run: |
213+
echo "🧪 Testing AWS OIDC connection..."
214+
aws sts get-caller-identity
215+
echo "✅ AWS OIDC connection successful!"
158216
159217
- name: Test AWS connection
160218
run: |
@@ -201,3 +259,9 @@ jobs:
201259
--region ${{ env.AWS_REGION }} \
202260
--parameter-overrides ApiKey=${{ secrets.API_KEY || 'default-api-key' }}
203261
echo "🎉 Deployment completed successfully!"
262+
develop
263+
264+
echo "📋 Stack: neurobank-api"
265+
echo "📍 Region: ${{ env.AWS_REGION }}"
266+
echo "🔗 Check AWS Lambda console for endpoint URL"
267+
main

0 commit comments

Comments
 (0)