mirror of
https://github.com/Sea-Haven-Industries/proposal-system.git
synced 2026-09-30 19:23:15 +00:00
fcdc46c136
INF-M5: Add enforceSSL: true to all S3 buckets (uploads, generated, library, web site) to require HTTPS-only access via bucket policy. INF-M8: Pin all reusable GitHub Actions workflow references from @main to commit SHA c040bfaa for supply chain security.
29 lines
722 B
YAML
29 lines
722 B
YAML
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- "mobile/**"
|
|
|
|
concurrency:
|
|
group: deploy-backend
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy to AWS
|
|
# Fix: INF-M8 — pin to SHA for supply chain security (cd-cdk.yaml@main)
|
|
uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
|
|
with:
|
|
cdk-dir: infra
|
|
dotnet-version: "8.0.x"
|
|
dotnet-publish-project: api/src/ProposalSystem.Api/ProposalSystem.Api.csproj
|
|
python-version: "3.12"
|
|
post-deploy-script: scripts/post-deploy.sh
|
|
secrets:
|
|
deploy-role-arn: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
|