Skip to content
Main

try this approach for passing env and secrets context to ServerlessOp… #100

Sign in to view logs

try this approach for passing env and secrets context to ServerlessOp…

try this approach for passing env and secrets context to ServerlessOp… #100

Workflow file for this run

.github/workflows/main.yaml at e9c3076
name: Main
on:
workflow_dispatch:
push:
branches:
- 'main'
jobs:
build:
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- name: Setup job workspace
uses: ServerlessOpsIO/gha-setup-workspace@v1
- name: Setup Python environment
uses: ServerlessOpsIO/gha-setup-python@v1
with:
python_version: 3.12
- name: Assume AWS Credentials
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
with:
build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
gha_build_role_name: ${{ secrets.AWS_CICD_BUILD_ROLE_NAME }}
- name: Install AWS SAM
uses: aws-actions/setup-sam@v2
# FIXME: We're only validating the top-level template and not the rest.
- name: Validate artifact
run: sam validate --lint
- name: Synethsize StackSet templates
run: |
for _f in $(find . -type f -name 'stackset.yaml'); do
_dir="$(dirname $_f)/" \
yq \
-i \
'(.. | select(has("localTemplateFile")) | .localTemplateFile) |= load_str(strenv(_dir) + .)' \
$_f;
done
- name: Upload SAM artifact
id: upload-sam-template
shell: bash
run: |
sam package \
--template template.yaml \
--s3-bucket aws-sam-cli-sourcebucket-346402060170-us-east-1 \
--s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
--region us-east-1 \
--output-template-file packaged-template.yaml
- name: Upload SAM artifact
id: upload-sam-stackset-template
shell: bash
run: |
sam package \
--template delegate-template.yaml \
--s3-bucket aws-sam-cli-sourcebucket-346402060170-us-east-1 \
--s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
--region us-east-1 \
--output-template-file packaged-delegate-template.yaml
- name: Store Artifacts
uses: ServerlessOpsIO/gha-store-artifacts@v1
deploy_management:
needs:
- build
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- name: Setup job workspace
uses: ServerlessOpsIO/gha-setup-workspace@v1
with:
checkout_artifact: true
- name: Setup Python enviornment
uses: ServerlessOpsIO/gha-setup-python@v1
with:
python_version: 3.12
- name: Assume AWS Credentials
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
with:
build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
gha_build_role_name: ${{ secrets.AWS_CICD_BUILD_ROLE_NAME }}
deploy_aws_account_id: ${{ secrets.AWS_MANAGEMENT_ACCOUNT_ID }}
gha_deploy_role_name: ${{ secrets.AWS_CICD_DEPLOY_ROLE_NAME }}
- name: Deploy via AWS SAM
uses: ServerlessOpsIO/gha-deploy-aws-sam@v1
with:
aws_account_id: ${{ secrets.AWS_MANAGEMENT_ACCOUNT_ID }}
env_json: ${{ toJson(env) }}
secrets_json: ${{ toJson(secrets) }}
deploy_delegate:
needs:
- build
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- name: Setup job workspace
uses: ServerlessOpsIO/gha-setup-workspace@v1
with:
checkout_artifact: true
- name: Setup Python enviornment
uses: ServerlessOpsIO/gha-setup-python@v1
with:
python_version: 3.12
- name: Assume AWS Credentials
uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
with:
build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
gha_build_role_name: ${{ secrets.AWS_CICD_BUILD_ROLE_NAME }}
deploy_aws_account_id: ${{ secrets.AWS_STACKSETS_ACCOUNT_ID }}
gha_deploy_role_name: ${{ secrets.AWS_CICD_DEPLOY_ROLE_NAME }}
- name: Deploy via AWS SAM
uses: ServerlessOpsIO/gha-deploy-aws-sam@v1
with:
aws_account_id: ${{ secrets.AWS_STACKSETS_ACCOUNT_ID }}
template_file: packaged-delegate-template.yaml
env_json: ${{ toJson(env) }}
secrets_json: ${{ toJson(secrets) }}