mirror of
https://github.com/Sea-Haven-Industries/meal-order-manager.git
synced 2026-09-30 18:13:13 +00:00
f632020b20
* ci: convert onto org HCP reusables Switch Fargate CD and CI to the v1.0.13 org workflows, emit ci-complete, and retarget githubdeploy OIDC to the reusable plus the thin caller. * chore(security): retarget githubdeploy Checkov suppression The OIDC dual-claim edit shifted CKV_AWS_111 from line 40 to 49. Permissions are unchanged. * style: apply formatter * ci: pin org reusables to v1.0.14 Drop collect-only and requirements from the python lint caller now that ci-python-app is lint-only. * test(ci): probe autofix with a ruff format violation * style: apply formatter --------- Co-authored-by: sea-haven-auto-fix[bot] <5037331+sea-haven-auto-fix[bot]@users.noreply.github.com>
71 lines
2.3 KiB
YAML
71 lines
2.3 KiB
YAML
name: Deploy API
|
|
|
|
# Fargate image CD. GitHub Actions builds the Flask image, pushes to ECR,
|
|
# and registers a new task definition. Terraform owns the cluster, service,
|
|
# ALB, and ignores container_definitions / task_definition.
|
|
#
|
|
# push to main -> dev, at github.sha
|
|
# release: published -> prod, at the release tag
|
|
# workflow_dispatch -> chosen environment at a chosen ref
|
|
#
|
|
# Releases are cut by a human with `gh release create vX.Y.Z --target main`.
|
|
# Nothing here creates an HCP run.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- "terraform/**"
|
|
- "docs/**"
|
|
- "*.md"
|
|
- ".github/workflows/weekly-menu.yml"
|
|
- ".github/workflows/ci.yml"
|
|
release:
|
|
types: [published]
|
|
workflow_dispatch:
|
|
inputs:
|
|
environment:
|
|
description: "Target Environment"
|
|
required: true
|
|
type: choice
|
|
options: [dev, prod]
|
|
ref:
|
|
description: "Git ref to build and deploy (tag, branch, or SHA). Empty means the workflow ref."
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
deploy-dev:
|
|
name: Deploy API to dev
|
|
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'dev')
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@fd4113241058d4709f80d5c29f7d5c43030ae6fa # v1.0.14
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
environment: dev
|
|
ref: ${{ inputs.ref }}
|
|
ssm-prefix: /meal-order-manager/deploy
|
|
docker-platform: linux/amd64
|
|
extra-task-env: '{"SENTRY_DSN_PARAM":"/meal-order-manager/sentry-dsn"}'
|
|
|
|
deploy-prod:
|
|
name: Deploy API to prod
|
|
if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && inputs.environment == 'prod')
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/cd-hcp-fargate.yaml@fd4113241058d4709f80d5c29f7d5c43030ae6fa # v1.0.14
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
secrets: inherit
|
|
with:
|
|
environment: prod
|
|
ref: ${{ github.event.release.tag_name || inputs.ref }}
|
|
ssm-prefix: /meal-order-manager/deploy
|
|
docker-platform: linux/amd64
|
|
ship-gate: true
|
|
extra-task-env: '{"SENTRY_DSN_PARAM":"/meal-order-manager/sentry-dsn"}'
|