Skip to content

Commit 65b3600

Browse files
author
Jonathan Alvarez Delgado
committed
feat: deploy ATN stage infra on ECS Fargate with VPC peering and smoke test
1 parent 19acf0d commit 65b3600

File tree

13 files changed

+2752
-1
lines changed

13 files changed

+2752
-1
lines changed

‎.github/workflows/build-and-push.yml‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
# Build and Push to ECR
2+
# This workflow builds the Docker image and pushes it to AWS ECR
3+
# Triggered on pushes to stage branch (tag-based releases can be enabled later)
4+
#
5+
# On pull_request: build-only (validates Dockerfile, no AWS auth required)
6+
# On push to stage: build + push to ECR (requires OIDC role below)
7+
#
8+
# Authentication: GitHub OIDC
9+
# Prerequisites:
10+
# 1. AWS OIDC provider for token.actions.githubusercontent.com (already exists)
11+
# 2. IAM role with trust policy condition:
12+
# "StringEquals": { "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" }
13+
# "StringLike": { "token.actions.githubusercontent.com:sub": "repo:thunderbird/addons-server:ref:refs/heads/stage" }
14+
# 3. Repository variable: AWS_ROLE_ARN (role ARN from step 2)
15+
# Note: Can later be moved to an environment for stricter controls
16+
# See: https://tinyurl.com/ghAwsOidc
17+
#
18+
# Publishing is gated on BOTH:
19+
# - Event type (push, not pull_request)
20+
# - vars.AWS_ROLE_ARN is set
21+
# If either condition fails, then build succeeds but publish is skipped
22+
#
23+
# Required IAM permissions for the OIDC role:
24+
# - ecr:GetAuthorizationToken
25+
# - ecr:BatchCheckLayerAvailability
26+
# - ecr:BatchGetImage
27+
# - ecr:CompleteLayerUpload
28+
# - ecr:DescribeImages
29+
# - ecr:InitiateLayerUpload
30+
# - ecr:GetDownloadUrlForLayer
31+
# - ecr:ListImages
32+
# - ecr:UploadLayerPart
33+
# - ecr:PutImage
34+
35+
name: Build and Push to ECR
36+
37+
on:
38+
push:
39+
branches:
40+
- stage
41+
# tags:
42+
# - 'v*' # Uncomment when tag-based releases are defined
43+
pull_request:
44+
branches:
45+
- stage
46+
- master
47+
48+
env:
49+
AWS_REGION: us-west-2
50+
ECR_REPOSITORY: atn-stage-addons-server
51+
AWS_ACCOUNT_ID: "768512802988"
52+
53+
jobs:
54+
# Build job: always runs, validates Dockerfile, no AWS permissions needed
55+
build:
56+
name: Build
57+
runs-on: ubuntu-latest
58+
permissions:
59+
contents: read
60+
# Note: no id-token here - minimum privilege for PR/build-only scenarios
61+
62+
steps:
63+
- name: Checkout repository
64+
uses: actions/checkout@v4
65+
66+
- name: Set up Docker Buildx
67+
uses: docker/setup-buildx-action@v3
68+
69+
- name: Extract metadata for Docker
70+
id: meta
71+
uses: docker/metadata-action@v5
72+
with:
73+
images: ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}
74+
tags: |
75+
type=ref,event=branch
76+
type=ref,event=pr
77+
type=sha,prefix=
78+
# type=semver,pattern={{version}} # Enable when tag triggers are added
79+
# type=semver,pattern={{major}}.{{minor}}
80+
81+
- name: Build Docker image
82+
uses: docker/build-push-action@v5
83+
with:
84+
context: .
85+
file: ./Dockerfile.ecs
86+
push: false
87+
tags: ${{ steps.meta.outputs.tags }}
88+
labels: ${{ steps.meta.outputs.labels }}
89+
cache-from: type=gha
90+
cache-to: type=gha,mode=max
91+
build-args: |
92+
OLYMPIA_UID=9500
93+
OLYMPIA_GID=9500
94+
95+
# Informational job: shows why publishing skipped when not configured role
96+
publish-disabled:
97+
name: Publish (skipped - AWS_ROLE_ARN not set)
98+
needs: build
99+
runs-on: ubuntu-latest
100+
if: github.event_name == 'push' && github.ref == 'refs/heads/stage' && vars.AWS_ROLE_ARN == ''
101+
steps:
102+
- name: Publishing not configured
103+
run: |
104+
echo "::notice::Publish skipped: AWS_ROLE_ARN repo variable not set (OIDC role not configured yet)"
105+
echo "See workflow header comments for IAM role setup instructions"
106+
107+
# Publish job: only runs on push to stage when OIDC role is configured
108+
publish:
109+
name: Publish to ECR
110+
needs: build
111+
runs-on: ubuntu-latest
112+
if: github.event_name == 'push' && github.ref == 'refs/heads/stage' && vars.AWS_ROLE_ARN != ''
113+
concurrency:
114+
group: ecr-stage-publish
115+
cancel-in-progress: true
116+
permissions:
117+
contents: read
118+
id-token: write # Required for OIDC authn - only granted when actually publishing
119+
120+
steps:
121+
- name: Checkout repository
122+
uses: actions/checkout@v4
123+
124+
- name: Set up Docker Buildx
125+
uses: docker/setup-buildx-action@v3
126+
127+
- name: Configure AWS credentials (OIDC)
128+
uses: aws-actions/configure-aws-credentials@v4
129+
with:
130+
role-to-assume: ${{ vars.AWS_ROLE_ARN }}
131+
aws-region: ${{ env.AWS_REGION }}
132+
133+
- name: Login to Amazon ECR
134+
id: login-ecr
135+
uses: aws-actions/amazon-ecr-login@v2
136+
137+
- name: Extract metadata for Docker
138+
id: meta
139+
uses: docker/metadata-action@v5
140+
with:
141+
images: ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}
142+
tags: |
143+
type=ref,event=branch
144+
type=sha,prefix=
145+
type=raw,value=stage-latest
146+
147+
- name: Build and push Docker image
148+
id: build-image
149+
uses: docker/build-push-action@v5
150+
with:
151+
context: .
152+
file: ./Dockerfile.ecs
153+
push: true
154+
tags: ${{ steps.meta.outputs.tags }}
155+
labels: ${{ steps.meta.outputs.labels }}
156+
cache-from: type=gha
157+
cache-to: type=gha,mode=max
158+
build-args: |
159+
OLYMPIA_UID=9500
160+
OLYMPIA_GID=9500
161+
162+
# Generate build metadata (future: bake into image or upload to S3 for traceability)
163+
- name: Generate version.json
164+
run: |
165+
echo '{
166+
"commit": "${{ github.sha }}",
167+
"version": "${{ github.ref_name }}",
168+
"source": "https://github.com/${{ github.repository }}",
169+
"build": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
170+
}' > version.json
171+
cat version.json
172+
173+
- name: Image digest
174+
run: echo "Image pushed with digest ${{ steps.build-image.outputs.digest }}"
175+
176+
# Deploy to ECS (optional - we would uncomment this when ready, or move to separate deploy.yml)
177+
# deploy:
178+
# name: Deploy to ECS
179+
# needs: publish
180+
# runs-on: ubuntu-latest
181+
# permissions:
182+
# contents: read
183+
# id-token: write
184+
#
185+
# steps:
186+
# - name: Configure AWS credentials (OIDC)
187+
# uses: aws-actions/configure-aws-credentials@v4
188+
# with:
189+
# role-to-assume: ${{ vars.AWS_ROLE_ARN }}
190+
# aws-region: ${{ env.AWS_REGION }}
191+
#
192+
# - name: Update ECS services
193+
# run: |
194+
# for service in web worker versioncheck; do
195+
# aws ecs update-service \
196+
# --cluster thunderbird-addons-stage-${service}-cluster \
197+
# --service thunderbird-addons-stage-${service}-service \
198+
# --force-new-deployment
199+
# done

‎.gitignore‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,4 +46,10 @@ storage/guarded-addons/*
4646
storage/shared_storage/*
4747
supervisord.pid
4848
tmp/*
49-
venv*
49+
venv*
50+
51+
# Pulumi local artefacts (outputs, notes, analysis)
52+
infra/pulumi/pulumi-*.txt
53+
infra/pulumi/preview-output-*.txt
54+
infra/pulumi/analysis.md
55+
infra/pulumi/infrastructure-inventory.md

0 commit comments

Comments
 (0)