main.yaml

name: Main

on:
  workflow_dispatch:
  push:
    branches:
      - 'main'

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1

      - name: Setup Python environment
        uses: ServerlessOpsIO/gha-setup-python@v1
        with:
          python_version: 3.12

      - name: Assume AWS Credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
          gha_build_role_name: ${{ secrets.AWS_CICD_BUILD_ROLE_NAME }}

      - name: Install AWS SAM
        uses: aws-actions/setup-sam@v2

      # FIXME: We're only validating the top-level template and not the rest.
      - name: Validate artifact
        run: sam validate --lint

      - name: Synethsize StackSet templates
        run: |
          for _f in $(find . -type f -name 'stackset.yaml'); do
            _dir="$(dirname $_f)/" \
            yq \
              -i \
              '(.. | select(has("localTemplateFile")) | .localTemplateFile) |= load_str(strenv(_dir) + .)' \
              $_f;
          done

      - name: Upload SAM artifact
        id: upload-sam-template
        shell: bash
        run: |
          sam package \
            --template template.yaml \
            --s3-bucket aws-sam-cli-sourcebucket-346402060170-us-east-1  \
            --s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
            --region us-east-1 \
            --output-template-file packaged-template.yaml

      - name: Upload SAM artifact
        id: upload-sam-stackset-template
        shell: bash
        run: |
          sam package \
            --template stacksets-template.yaml \
            --s3-bucket aws-sam-cli-sourcebucket-346402060170-us-east-1  \
            --s3-prefix ${{ env.GITHUB_REPOSITORY_OWNER_PART_SLUG_URL }}/${{ env.GITHUB_REPOSITORY_NAME_PART_SLUG_URL }}/${{ env.GITHUB_REF_SLUG_URL }} \
            --region us-east-1 \
            --output-template-file packaged-stacksets-template.yaml

      - name: Store Artifacts
        uses: ServerlessOpsIO/gha-store-artifacts@v1

  deploy_management:
    needs:
      - build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1
        with:
          checkout_artifact: true

      - name: Setup Python enviornment
        uses: ServerlessOpsIO/gha-setup-python@v1
        with:
          python_version: 3.12

      - name: Assume AWS Credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
          gha_build_role_name: ${{ secrets.AWS_CICD_BUILD_ROLE_NAME }}
          deploy_aws_account_id: ${{ secrets.AWS_MANAGEMENT_ACCOUNT_ID }}
          gha_deploy_role_name: ${{ secrets.AWS_CICD_DEPLOY_ROLE_NAME }}

      - name: Deploy via AWS SAM
        uses: ServerlessOpsIO/gha-deploy-aws-sam@v1
        with:
          aws_account_id: ${{ secrets.AWS_MANAGEMENT_ACCOUNT_ID }}
          env_json: ${{ toJson(env) }}
          secrets_json: ${{ toJson(secrets) }}

  deploy_stacksets:
    needs:
      - build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Setup job workspace
        uses: ServerlessOpsIO/gha-setup-workspace@v1
        with:
          checkout_artifact: true

      - name: Setup Python environment
        uses: ServerlessOpsIO/gha-setup-python@v1
        with:
          python_version: 3.12

      - name: Assume AWS Credentials
        uses: ServerlessOpsIO/gha-assume-aws-credentials@v1
        with:
          build_aws_account_id: ${{ secrets.AWS_CICD_ACCOUNT_ID }}
          gha_build_role_name: ${{ secrets.AWS_CICD_BUILD_ROLE_NAME }}
          deploy_aws_account_id: ${{ secrets.AWS_STACKSETS_ACCOUNT_ID }}
          gha_deploy_role_name: ${{ secrets.AWS_CICD_DEPLOY_ROLE_NAME }}

      - name: Deploy via AWS SAM
        uses: ServerlessOpsIO/gha-deploy-aws-sam@v1
        with:
          aws_account_id: ${{ secrets.AWS_STACKSETS_ACCOUNT_ID }}
          template_file: packaged-stacksets-template.yaml
          cfn_capabilities: CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND
          env_json: ${{ toJson(env) }}
          secrets_json: ${{ toJson(secrets) }}