.github/.github/workflows/cd-sam.yaml

name: CD — SAM Deploy

on:
  workflow_call:
    inputs:
      python-version:
        description: "Python version to use"
        type: string
        default: "3.12"
      stack-name:
        description: "CloudFormation stack name"
        type: string
        required: true
      sam-template:
        description: "Path to SAM template file"
        type: string
        default: "template.yaml"
      region:
        description: "AWS region"
        type: string
        default: "us-east-1"
      cfn-role-arn:
        description: "CloudFormation execution role ARN"
        type: string
        required: true
    secrets:
      deploy-role-arn:
        description: "OIDC deploy role ARN"
        required: true
      parameter-overrides:
        description: "SAM parameter overrides (e.g. 'Key1=Value1 Key2=Value2')"
        required: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ inputs.python-version }}

      - uses: aws-actions/setup-sam@v2

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.deploy-role-arn }}
          aws-region: ${{ inputs.region }}

      - name: SAM build
        run: sam build --template ${{ inputs.sam-template }}

      - name: SAM deploy
        run: |
          PARAMS=""
          if [ -n "${{ secrets.parameter-overrides }}" ]; then
            PARAMS="--parameter-overrides ${{ secrets.parameter-overrides }}"
          fi
          sam deploy \
            --stack-name ${{ inputs.stack-name }} \
            --template-file .aws-sam/build/template.yaml \
            --resolve-s3 \
            --capabilities CAPABILITY_IAM \
            --no-confirm-changeset \
            --no-fail-on-empty-changeset \
            --role-arn ${{ inputs.cfn-role-arn }} \
            $PARAMS