build-deploy.yml

# Build and Deploy aws-python-post-stack-outputs
name: build-deploy-ci

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the "main" branch
  push:
    branches: ["main", "dev"]
  pull_request:
    branches: ["main", "dev"]

  # For a workflow to be reusable by other repositories
  workflow_call:

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# These permissions are needed to interact with GitHub's OIDC Token endpoint.
permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout
  pull-requests: read

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  build:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest
    outputs:
      requires-deploy: ${{ steps.changed-files.outputs.any_changed }}
      repo-name: ${{ steps.repo-name.outputs.GIT_REPO_NAME }}

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - name: Git Checkout
        uses: actions/checkout@v4.1.7

      - name: Get changed files
        id: changed-files
        uses: tj-actions/changed-files@v44.5.7
        with:
          files_ignore: |
            .github/**
            .git*
            LICENSE
            **.md

      - name: List all changed files
        env:
          ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
        run: |
          for file in ${ALL_CHANGED_FILES}; do
            echo "$file was changed"
          done

      - name: Get GitHub Repository Name
        id: repo-name
        run: |
          echo GIT_REPO_NAME=`echo $GITHUB_REPOSITORY | cut -d "/" -f 2` >> $GITHUB_OUTPUT

  deploy:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ (needs.build.outputs.requires-deploy == 'true') && (contains('refs/heads/main, refs/heads/dev', github.ref)) }}
    env:
      LAMBDA_ZIP_NAME: lambda-${{ needs.build.outputs.repo-name }}.zip

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - name: Git Checkout
        uses: actions/checkout@v4.1.7

      - name: Install Python requirements
        run: |
          pip3 install -r requirements.txt -t .

      - name: Package Lambda
        run: |
          zip -r ${{ env.LAMBDA_ZIP_NAME }} . -x .git\*/\* -x *.yml -x .DS_Store -x .gitignore

      - name: Upload Lambda Package Zip
        uses: actions/upload-artifact@v4.3.6
        with:
          name: ${{ env.LAMBDA_ZIP_NAME }}
          path: ${{ env.LAMBDA_ZIP_NAME }}
          retention-days: 30

      - name: Configure AWS Credentials Action for GitHub Actions
        uses: aws-actions/configure-aws-credentials@v4.0.2
        with:
          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/github-wafr-ftr-onboarding-role
          aws-region: ${{ vars.AWS_REGION }}

      - name: Extract branch name
        shell: bash
        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
        id: extract_branch

      # Upload files to Amazon S3
      - name: Copy files to s3
        run: |
          aws s3 sync . s3://${{ vars.BUCKET_BASE_URL }}/${{ vars.S3_KEY_PREFIX }}${{ steps.extract_branch.outputs.branch }}/ --exclude '*' --include ${{ env.LAMBDA_ZIP_NAME }}

      # Copy to us-east-1
      - name: Copy files across S3 buckets, primarily AWS Lambda zip files
        uses: GeorgeDavis-Ibexlabs/aws-lambda-s3-copy-zips@v0.0.5
        with:
          SRC_REGION: ${{ vars.AWS_REGION }}
          SRC_BUCKET: ${{ vars.BUCKET_BASE_URL }}
          SRC_KEY_PREFIX: ${{ vars.S3_KEY_PREFIX }}${{ steps.extract_branch.outputs.branch }}/
          SRC_KEY: ${{ env.LAMBDA_ZIP_NAME }}
          DST_REGION: us-east-1
          DST_BUCKET: us-east-1.${{ vars.BUCKET_BASE_URL }}

      # Copy to us-east-2
      - name: Copy files across S3 buckets, primarily AWS Lambda zip files
        uses: GeorgeDavis-Ibexlabs/aws-lambda-s3-copy-zips@v0.0.5
        with:
          SRC_REGION: ${{ vars.AWS_REGION }}
          SRC_BUCKET: ${{ vars.BUCKET_BASE_URL }}
          SRC_KEY_PREFIX: ${{ vars.S3_KEY_PREFIX }}${{ steps.extract_branch.outputs.branch }}/
          SRC_KEY: ${{ env.LAMBDA_ZIP_NAME }}
          DST_REGION: us-east-2
          DST_BUCKET: us-east-2.${{ vars.BUCKET_BASE_URL }}

      # Copy to us-west-1
      - name: Copy files across S3 buckets, primarily AWS Lambda zip files
        uses: GeorgeDavis-Ibexlabs/aws-lambda-s3-copy-zips@v0.0.5
        with:
          SRC_REGION: ${{ vars.AWS_REGION }}
          SRC_BUCKET: ${{ vars.BUCKET_BASE_URL }}
          SRC_KEY_PREFIX: ${{ vars.S3_KEY_PREFIX }}${{ steps.extract_branch.outputs.branch }}/
          SRC_KEY: ${{ env.LAMBDA_ZIP_NAME }}
          DST_REGION: us-west-1
          DST_BUCKET: us-west-1.${{ vars.BUCKET_BASE_URL }}

      # Copy to ca-central-1
      - name: Copy files across S3 buckets, primarily AWS Lambda zip files
        uses: GeorgeDavis-Ibexlabs/aws-lambda-s3-copy-zips@v0.0.5
        with:
          SRC_REGION: ${{ vars.AWS_REGION }}
          SRC_BUCKET: ${{ vars.BUCKET_BASE_URL }}
          SRC_KEY_PREFIX: ${{ vars.S3_KEY_PREFIX }}${{ steps.extract_branch.outputs.branch }}/
          SRC_KEY: ${{ env.LAMBDA_ZIP_NAME }}
          DST_REGION: ca-central-1
          DST_BUCKET: ca-central-1.${{ vars.BUCKET_BASE_URL }}