feat: automate ecs backend deployments #282
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD | |
| # First runs linter and tests all affected projects | |
| # Then, for each project that requires deployment, deploy-<project>-<service-type> is added | |
| # Environment variables are labelled <project-name>_SHORT_DESCRIPTION | |
| on: | |
| push: | |
| branches: ['main'] | |
| pull_request: | |
| branches: ['main'] | |
| workflow_dispatch: | |
| inputs: | |
| manual-deploy: | |
| description: 'App to Deploy' | |
| required: false | |
| default: '' | |
| concurrency: | |
| # Never have two deployments happening at the same time (potential race condition) | |
| group: '{{ github.head_ref || github.ref }}' | |
| jobs: | |
| pre-deploy: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| affected: ${{ steps.should-deploy.outputs.affected }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| with: | |
| # We need to fetch all branches and commits so that Nx affected has a base to compare against. | |
| fetch-depth: 0 | |
| - name: Use Node.js 20 | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 20.x | |
| cache: 'yarn' | |
| - name: Install Dependencies | |
| run: yarn install | |
| # In any subsequent steps within this job (myjob) we can reference the resolved SHAs | |
| # using either the step outputs or environment variables: | |
| - name: Derive appropriate SHAs for base and head for `nx affected` commands | |
| uses: nrwl/nx-set-shas@v3 | |
| - run: | | |
| echo "BASE: ${{ env.NX_BASE }}" | |
| echo "HEAD: ${{ env.NX_HEAD }}" | |
| - name: Nx Affected Lint | |
| run: npx nx affected -t lint | |
| # - name: Nx Affected Test | |
| # run: npx nx affected -t test | |
| - name: Nx Affected Build | |
| run: npx nx affected -t build | |
| - name: Determine who needs to be deployed | |
| id: should-deploy | |
| run: | | |
| AFFECTED=$(npx nx show projects --affected --target=build | tr '\n' ' ') | |
| echo "The following projects have been affected: [$AFFECTED]"; | |
| echo "affected=$AFFECTED" >> "$GITHUB_OUTPUT" | |
| deploy-debug: | |
| needs: pre-deploy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Debug logs | |
| run: | | |
| echo "Manual Deploy: ${{github.event.inputs.manual-deploy}}"; | |
| echo "Affected Names: ${{needs.pre-deploy.outputs.affected}}"; | |
| echo "Event: ${{github.event_name}}"; | |
| echo "Ref: ${{github.ref}}"; | |
| echo "Will deploy?: ${{(github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'}}"; | |
| deploy-frontend: | |
| needs: pre-deploy | |
| if: (contains(github.event.inputs.manual-deploy, 'frontend') || contains(needs.pre-deploy.outputs.affected, 'frontend')) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| # For "simplicity", deployment settings are configured in the AWS Amplify Console | |
| # This just posts to a webhook telling Amplify to redeploy the main branch | |
| steps: | |
| - name: Tell Amplify to rebuild | |
| run: curl -X POST -d {} ${C4C_OPS_WEBHOOK_DEPLOY} -H "Content-Type:application/json" | |
| env: | |
| C4C_OPS_WEBHOOK_DEPLOY: ${{ secrets.C4C_OPS_WEBHOOK_DEPLOY }} | |
| deploy-backend: | |
| needs: pre-deploy | |
| if: (contains(github.event.inputs.manual-deploy, 'backend') || contains(needs.pre-deploy.outputs.affected, 'backend')) && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v2 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-east-2 | |
| - name: Login to Amazon ECR | |
| id: login-ecr | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| - name: Build, tag, and push image to Amazon ECR | |
| env: | |
| ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }} | |
| ECR_REPOSITORY: fcc-backend | |
| IMAGE_TAG: latest | |
| run: | | |
| docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG -f apps/backend/Dockerfile . | |
| docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG | |
| - name: Force ECS deployment | |
| run: | | |
| aws ecs update-service --cluster fcc-ecs --service fcc-backend --force-new-deployment |