apm-wo-analysis/.github/workflows/deploy.yaml

name: Deploy

# Terraform owns Lambda skeletons and Grafana infra. This workflow ships zips
# to prod, calls update-function-code, and syncs grafana-config/. It never
# creates an HCP run. No GitHub Releases and no tagging in this workflow.

on:
  push:
    branches: [main]
    paths-ignore:
      - "terraform/**"
      - "docs/**"
      - "README.md"
      - "AGENTS.md"
      - "CLAUDE.md"
  workflow_dispatch:
    inputs:
      ref:
        description: "Git ref to build and deploy (tag, branch, or SHA). Empty means the workflow ref."
        required: false
        type: string
        default: ""

permissions:
  contents: read

jobs:
  deploy:
    name: Deploy to prod
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: prod
    concurrency:
      group: deploy-apm-wo-analysis-prod
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write
    env:
      AWS_REGION: us-east-1
      DEPLOY_ROLE_ARN: ${{ vars.DEPLOY_ROLE_ARN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}
          persist-credentials: false

      - name: Resolve commit
        id: commit
        run: |
          set -euo pipefail
          sha="$(git rev-parse HEAD)"
          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
          echo "Building ${sha}"

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Build function zips
        env:
          GIT_SHA: ${{ steps.commit.outputs.sha }}
        run: |
          set -euo pipefail
          python scripts/package_lambdas.py --git-sha "${GIT_SHA}" --out-dir build/packages
          python - <<'PY'
          import os, zipfile
          from pathlib import Path
          sha = os.environ["GIT_SHA"]
          names = ["classifier", "slack_post", "slack_interactions"]
          for name in names:
              path = Path("build/packages") / f"{name}.zip"
              if not path.is_file():
                  raise SystemExit(f"missing {path}")
              with zipfile.ZipFile(path) as zf:
                  info = zf.read("build_info.py").decode()
                  if sha not in info:
                      raise SystemExit(f"{path} missing GIT_SHA {sha}")
          print("zips ok")
          PY

      - name: Configure AWS credentials using OIDC
        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
        with:
          role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
          audience: sts.amazonaws.com

      - name: Get deploy parameters
        id: deploy
        run: |
          set -euo pipefail
          prefix=/apm-wo-analysis/deploy
          {
            echo "artifacts_bucket=$(aws ssm get-parameter --name "${prefix}/artifacts-bucket" --query Parameter.Value --output text)"
            echo "exports_bucket=$(aws ssm get-parameter --name "${prefix}/exports-bucket" --query Parameter.Value --output text)"
            echo "classifier=$(aws ssm get-parameter --name "${prefix}/classifier-function-name" --query Parameter.Value --output text)"
            echo "slack_post=$(aws ssm get-parameter --name "${prefix}/slack_post-function-name" --query Parameter.Value --output text)"
            echo "slack_interactions=$(aws ssm get-parameter --name "${prefix}/slack_interactions-function-name" --query Parameter.Value --output text)"
          } >> "${GITHUB_OUTPUT}"

      - name: Upload zips and update function code
        env:
          ARTIFACTS_BUCKET: ${{ steps.deploy.outputs.artifacts_bucket }}
          GIT_SHA: ${{ steps.commit.outputs.sha }}
          CLASSIFIER: ${{ steps.deploy.outputs.classifier }}
          SLACK_POST: ${{ steps.deploy.outputs.slack_post }}
          SLACK_INTERACTIONS: ${{ steps.deploy.outputs.slack_interactions }}
        run: |
          set -euo pipefail
          keys=(
            classifier:"${CLASSIFIER}"
            slack_post:"${SLACK_POST}"
            slack_interactions:"${SLACK_INTERACTIONS}"
          )
          for pair in "${keys[@]}"; do
            name="${pair%%:*}"
            fn="${pair#*:}"
            key="functions/${name}/${GIT_SHA}.zip"
            aws s3 cp "build/packages/${name}.zip" "s3://${ARTIFACTS_BUCKET}/${key}"
            aws lambda update-function-code \
              --function-name "${fn}" \
              --s3-bucket "${ARTIFACTS_BUCKET}" \
              --s3-key "${key}" \
              --query '{Function:FunctionName,Sha256:CodeSha256,Updated:LastModified}' \
              --output table
            aws lambda wait function-updated-v2 --function-name "${fn}"
          done

      - name: Sync Grafana dashboards-as-code
        env:
          EXPORTS_BUCKET: ${{ steps.deploy.outputs.exports_bucket }}
        run: |
          set -euo pipefail
          aws s3 sync grafana/ "s3://${EXPORTS_BUCKET}/grafana-config/" --delete --exact-timestamps