adam/seahaven-ap
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/seahaven-ap.git synced 2026-10-05 09:31:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(ci): run deploy scripts from the trusted workflow commit

Browse source
This commit is contained in:
Adam Moussa 2026-09-25 17:03:05 -04:00
parent cb9b9fc9d3
commit c770c59a40
No known key found for this signature in database
2 changed files with 28 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
.github/workflows/deploy-api.yaml vendored
View file

@ -5,7 +5,9 @@ name: Deploy API
# and ignores container_definitions / task_definition.
#
# push to main -> GitHub Environment dev, at github.sha
# workflow_dispatch -> GitHub Environment dev at a chosen ref
# workflow_dispatch -> GitHub Environment dev. The workflow file must be main.
# inputs.ref is only the image source. Deploy scripts stay
# on github.sha, which is the trusted workflow commit.
#
# Cluster, service, ECR, and task env come from SSM after assuming the
# Environment's DEPLOY_ROLE_ARN. Terraform owns /seahaven-ap/deploy/task-environment;
@ -68,6 +70,10 @@ jobs:
ref="${GITHUB_SHA_IN}"
;;
workflow_dispatch)
if [ "${GITHUB_REF_NAME_IN}" != "refs/heads/main" ]; then
echo "workflow_dispatch deploys only run from main" >&2
exit 1
fi
environment="${INPUT_ENVIRONMENT:-dev}"
if [ "${environment}" != "dev" ]; then
echo "only GitHub Environment dev is allowed" >&2
@ -102,13 +108,23 @@ jobs:
AWS_REGION: us-east-1
DEPLOY_ROLE_ARN: ${{ vars.DEPLOY_ROLE_ARN }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Checkout trusted workflow
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.sha }}
persist-credentials: false
path: ci
- name: Checkout image source
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ needs.target.outputs.ref }}
persist-credentials: false
path: src
- name: Resolve commit
id: commit
working-directory: src
run: |
set -euo pipefail
sha="$(git rev-parse HEAD)"
@ -153,6 +169,7 @@ jobs:
ECR: ${{ steps.deploy.outputs.ecr }}
GIT_SHA: ${{ steps.commit.outputs.sha }}
ENVIRONMENT: ${{ needs.target.outputs.environment }}
working-directory: src
run: |
set -euo pipefail
docker build \
@ -192,7 +209,7 @@ jobs:
--task-definition "${FAMILY}" \
--query taskDefinition \
--output json \
| python3 scripts/patch-ecs-task-def.py > /tmp/task-def.json
| python3 "${GITHUB_WORKSPACE}/ci/scripts/patch-ecs-task-def.py" > /tmp/task-def.json
REV="$(aws ecs register-task-definition --cli-input-json file:///tmp/task-def.json --query taskDefinition.revision --output text)"
NET="$(aws ecs describe-services --cluster "${CLUSTER}" --services "${SERVICE}" \
--query 'services[0].networkConfiguration.awsvpcConfiguration' --output json)"
@ -225,4 +242,4 @@ jobs:
env:
SITE_URL: ${{ steps.deploy.outputs.site_url }}
EXPECTED_SHA: ${{ steps.commit.outputs.sha }}
run: bash scripts/verify-api-health.sh
run: bash "${GITHUB_WORKSPACE}/ci/scripts/verify-api-health.sh"

8
.github/workflows/deploy-web.yaml vendored
View file

@ -5,7 +5,9 @@ name: Deploy Web
# distribution and never touches content. Do not run a SPA production build.
#
# push to main -> GitHub Environment dev, at github.sha
# workflow_dispatch -> GitHub Environment dev at a chosen ref
# workflow_dispatch -> GitHub Environment dev. The workflow file must be main.
# inputs.ref selects the placeholder tree to publish.
# Job steps are the workflow file, not scripts from that ref.
#
# Nothing here creates an HCP run. Prod is AP-12.
@ -70,6 +72,10 @@ jobs:
ref="${GITHUB_SHA_IN}"
;;
workflow_dispatch)
if [ "${GITHUB_REF_NAME_IN}" != "refs/heads/main" ]; then
echo "workflow_dispatch deploys only run from main" >&2
exit 1
fi
environment="${INPUT_ENVIRONMENT:-dev}"
if [ "${environment}" != "dev" ]; then
echo "only GitHub Environment dev is allowed" >&2