Skip to content

Commit b046352

Browse files
leandrodamascenaleandrodamascena
authored
chore(ci): enable SAR deployment (#6104)
* Enabling SAR deployment * Enabling SAR deployment * Making SAR version works as expected * Making SAR version works as expected * Making SAR version works as expected * Making SAR version works as expected * Modify arch name
1 parent 3b7f297 commit b046352

File tree

3 files changed

+58
-45
lines changed

3 files changed

+58
-45
lines changed

‎.github/workflows/publish_v3_layer.yml‎

Lines changed: 41 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ on:
4949
default: false
5050
type: boolean
5151
required: false
52+
skip_lambda_layer:
53+
description: "Skip publishing Lambda Layers as it can publish duplicated versions of the same layer. Useful for semi-failed releases"
54+
type: boolean
55+
required: false
56+
5257
workflow_call:
5358
inputs:
5459
latest_published_version:
@@ -72,6 +77,11 @@ on:
7277
description: "Sealed source code integrity hash"
7378
type: string
7479
required: true
80+
skip_lambda_layer:
81+
description: "Skip publishing Lambda Layers as it can publish duplicated versions of the same layer. Useful for semi-failed releases"
82+
default: false
83+
type: boolean
84+
required: false
7585

7686
permissions:
7787
contents: read
@@ -180,6 +190,7 @@ jobs:
180190
source_code_integrity_hash: ${{ inputs.source_code_integrity_hash }}
181191

182192
prod:
193+
if: ${{ !inputs.skip_lambda_layer }}
183194
needs: beta
184195
# lower privilege propagated from parent workflow (release-v3.yml)
185196
permissions:
@@ -195,41 +206,39 @@ jobs:
195206
source_code_artifact_name: ${{ inputs.source_code_artifact_name }}
196207
source_code_integrity_hash: ${{ inputs.source_code_integrity_hash }}
197208

198-
# UNCOMMENT sar-beta JOB
199-
#sar-beta:
200-
# needs: beta # canaries run on Layer Beta env
201-
# permissions:
209+
sar-beta:
210+
needs: beta # canaries run on Layer Beta env
211+
permissions:
202212
# lower privilege propagated from parent workflow (release.yml)
203-
# id-token: write
204-
# contents: read
205-
# pull-requests: none
206-
# pages: none
207-
# uses: ./.github/workflows/reusable_deploy_v3_sar.yml
208-
# secrets: inherit
209-
# with:
210-
# stage: "BETA"
211-
# environment: "layer-beta"
212-
# package-version: ${{ inputs.latest_published_version }}
213-
# source_code_artifact_name: ${{ inputs.source_code_artifact_name }}
214-
# source_code_integrity_hash: ${{ inputs.source_code_integrity_hash }}
213+
id-token: write
214+
contents: read
215+
pull-requests: none
216+
pages: none
217+
uses: ./.github/workflows/reusable_deploy_v3_sar.yml
218+
secrets: inherit
219+
with:
220+
stage: "BETA"
221+
environment: "layer-beta"
222+
package-version: ${{ inputs.latest_published_version }}
223+
source_code_artifact_name: ${{ inputs.source_code_artifact_name }}
224+
source_code_integrity_hash: ${{ inputs.source_code_integrity_hash }}
215225

216-
# UNCOMMENT sar-prod JOB
217-
#sar-prod:
218-
# needs: sar-beta
219-
# permissions:
226+
sar-prod:
227+
needs: sar-beta
228+
permissions:
220229
# lower privilege propagated from parent workflow (release.yml)
221-
# id-token: write
222-
# contents: read
223-
# pull-requests: none
224-
# pages: none
225-
# uses: ./.github/workflows/reusable_deploy_v3_sar.yml
226-
# secrets: inherit
227-
# with:
228-
# stage: "PROD"
229-
# environment: "layer-prod"
230-
# package-version: ${{ inputs.latest_published_version }}
231-
# source_code_artifact_name: ${{ inputs.source_code_artifact_name }}
232-
# source_code_integrity_hash: ${{ inputs.source_code_integrity_hash }}
230+
id-token: write
231+
contents: read
232+
pull-requests: none
233+
pages: none
234+
uses: ./.github/workflows/reusable_deploy_v3_sar.yml
235+
secrets: inherit
236+
with:
237+
stage: "PROD"
238+
environment: "layer-prod"
239+
package-version: ${{ inputs.latest_published_version }}
240+
source_code_artifact_name: ${{ inputs.source_code_artifact_name }}
241+
source_code_integrity_hash: ${{ inputs.source_code_integrity_hash }}
233242

234243

235244
# Updating the documentation with the latest Layer ARNs is a two-phase process

‎.github/workflows/release-v3.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ on:
4848
default: false
4949
type: boolean
5050
required: false
51+
skip_lambda_layer:
52+
description: "Skip publishing Lambda Layers as it can publish duplicated versions of the same layer. Useful for semi-failed releases"
53+
default: false
54+
type: boolean
55+
required: false
5156
skip_code_quality:
5257
description: "Skip tests, linting, and baseline. Only use if release fail for reasons beyond our control and you need a quick release."
5358
default: false
@@ -350,6 +355,7 @@ jobs:
350355
pre_release: ${{ inputs.pre_release }}
351356
source_code_artifact_name: ${{ needs.seal.outputs.artifact_name }}
352357
source_code_integrity_hash: ${{ needs.seal.outputs.integrity_hash }}
358+
skip_lambda_layer: ${{ inputs.skip_lambda_layer }}
353359

354360
post_release:
355361
needs: [seal, release, publish_layer]

‎.github/workflows/reusable_deploy_v3_sar.yml‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ jobs:
106106
aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
107107
role-duration-seconds: 1200
108108
aws-region: ${{ env.AWS_REGION }}
109-
role-to-assume: ${{ secrets.AWS_SAR_V2_ROLE_ARN }}
109+
role-to-assume: ${{ secrets.AWS_SAR_V3_ROLE_ARN }}
110110
mask-aws-account-id: true
111111
- name: Setup Node.js
112112
uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
@@ -127,25 +127,22 @@ jobs:
127127
if [[ "${{ inputs.stage }}" == "BETA" ]]; then
128128
SAR_NAME="test-${SAR_NAME}"
129129
fi
130-
ARCH_NAME=$(echo ${{ matrix.architecture }} | tr -d '_')
130+
ARCH_NAME=$(echo ${{ matrix.architecture }} | tr '_' '-')
131131
SAR_NAME="${SAR_NAME}-python${{env.PYTHON_VERSION}}-${ARCH_NAME}"
132132
echo SAR_NAME="${SAR_NAME}" >> "$GITHUB_ENV"
133-
- name: Normalize semantic version
134-
id: semantic-version # v2.0.0a0 -> v2.0.0-a0
135-
env:
136-
VERSION: ${{ inputs.package-version }}
137-
run: |
138-
# VERSION="${VERSION/a/-a}"
139-
VERSION="3.0.0"
140-
echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
141133
- name: Prepare SAR App
142-
env:
143-
VERSION: ${{ steps.semantic-version.outputs.VERSION }}
144134
run: |
145135
# From the generated LayerStack cdk.out artifact, find the layer asset path for the correct architecture.
146136
# We'll use this as the source directory of our SAR. This way we are re-using the same layer asset for our SAR.
147137
PYTHON_VERSION=$(echo ${{ matrix.python-version }} | tr -d '.')
148-
asset=$(jq -jc '.Resources[] | select(.Properties.CompatibleArchitectures == ["${{ matrix.architecture }}"]) | .Metadata."aws:asset:path"' "cdk.out/LayerV3Stack-python${PYTHON_VERSION}.template.json")
138+
asset_cdk=$(jq -jc '.Resources[] | select(.Properties.CompatibleArchitectures == ["${{ matrix.architecture }}"]) | .Metadata."aws:asset:path"' "cdk.out/LayerV3Stack-python${PYTHON_VERSION}.template.json")
139+
140+
echo "Normalizing the asset variable"
141+
asset=$(echo $asset_cdk | sed -E 's/^(asset\.[^.]+).*\1/\1/')
142+
143+
VERSION=$(echo ${{ inputs.package-version }} | sed 's/^v//')
144+
echo $asset
145+
echo $VERSION
149146
150147
# fill in the SAR SAM template
151148
sed \
@@ -165,6 +162,7 @@ jobs:
165162
166163
# Package the SAR to our SAR S3 bucket, and publish it
167164
sam package --template-file template.yml --output-template-file packaged.yml --s3-bucket ${{ secrets.AWS_SAR_S3_BUCKET_V3 }}
165+
cat packaged.yml
168166
sam publish --template packaged.yml --region "$AWS_REGION"
169167
- name: Deploy BETA canary
170168
if: ${{ inputs.stage == 'BETA' }}

0 commit comments

Comments
 (0)